@omnitron-dev/omnitron 0.1.3 → 0.3.0

package/dist/shared/dto/health.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Health DTOs — wire shapes shared with the Omnitron Console.
+ *
+ * Declared away from the service implementation for the reason set out in
+ * `./auth.ts`: a DTO that imports from an implementation drags decorators and
+ * the server's dependency graph into the console's build.
+ */
+export interface HealthCheckResult {
+    name: string;
+    status: 'pass' | 'fail' | 'warn';
+    message?: string | undefined;
+    duration?: number | undefined;
+}
+export interface HealthReport {
+    overall: 'healthy' | 'degraded' | 'unhealthy';
+    checks: HealthCheckResult[];
+    timestamp: string;
+    duration: number;
+}
+export interface PlatformHealthReport {
+    apps: HealthReport;
+    infra: HealthReport;
+    overall: 'healthy' | 'degraded' | 'unhealthy';
+    timestamp: string;
+}
+//# sourceMappingURL=health.d.ts.map

package/dist/shared/dto/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../../src/shared/dto/health.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC;IAC9C,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/shared/dto/health.js

@@ -0,0 +1,9 @@
+/**
+ * Health DTOs — wire shapes shared with the Omnitron Console.
+ *
+ * Declared away from the service implementation for the reason set out in
+ * `./auth.ts`: a DTO that imports from an implementation drags decorators and
+ * the server's dependency graph into the console's build.
+ */
+export {};
+//# sourceMappingURL=health.js.map

package/dist/shared/dto/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../../src/shared/dto/health.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/shared/dto/kubernetes.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Kubernetes DTOs — wire shapes shared with the Omnitron Console.
+ *
+ * Declared away from the service implementation for the reason set out in
+ * `./auth.ts`: a DTO that imports from an implementation drags decorators and
+ * the server's dependency graph into the console's build.
+ */
+export interface K8sPod {
+    name: string;
+    namespace: string;
+    status: string;
+    ready: boolean;
+    restarts: number;
+    age: string;
+    node: string;
+    labels: Record<string, string>;
+}
+export interface K8sDeployment {
+    name: string;
+    namespace: string;
+    replicas: number;
+    available: number;
+    ready: number;
+    age: string;
+}
+export interface K8sService {
+    name: string;
+    namespace: string;
+    type: string;
+    clusterIP: string;
+    ports: Array<{
+        port: number;
+        targetPort: number;
+        protocol: string;
+    }>;
+}
+export interface PortForwardHandle {
+    localPort: number;
+    remotePort: number;
+    pod: string;
+    namespace: string;
+    close: () => void;
+}
+//# sourceMappingURL=kubernetes.d.ts.map

package/dist/shared/dto/kubernetes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubernetes.d.ts","sourceRoot":"","sources":["../../../src/shared/dto/kubernetes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB"}

package/dist/shared/dto/kubernetes.js

@@ -0,0 +1,9 @@
+/**
+ * Kubernetes DTOs — wire shapes shared with the Omnitron Console.
+ *
+ * Declared away from the service implementation for the reason set out in
+ * `./auth.ts`: a DTO that imports from an implementation drags decorators and
+ * the server's dependency graph into the console's build.
+ */
+export {};
+//# sourceMappingURL=kubernetes.js.map

package/dist/shared/dto/kubernetes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubernetes.js","sourceRoot":"","sources":["../../../src/shared/dto/kubernetes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/shared/dto/logs.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Log DTOs — the wire shapes of the OmnitronLogs service.
+ *
+ * Declared here rather than in `services/log-collector.service.ts` for the
+ * same reason as the auth DTOs: the console consumes them, and a DTO that
+ * imports from a service implementation drags the server's type graph
+ * (decorators, Kysely, pino) into the browser build. See `./auth.ts`.
+ */
+export interface LogEntry {
+    app: string;
+    level: string;
+    message: string;
+    timestamp?: Date | string;
+    nodeId?: string;
+    labels?: Record<string, unknown>;
+    traceId?: string;
+    spanId?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface LogQueryFilter {
+    app?: string | undefined;
+    /**
+     * Restrict to one cluster node.
+     *
+     * `logs.nodeId` is populated by `SyncService.ingestLog` for everything a
+     * slave sends up; locally collected entries leave it null, so filtering by
+     * a node correctly excludes the master's own output.
+     */
+    nodeId?: string | undefined;
+    level?: string | string[] | undefined;
+    search?: string | undefined;
+    labels?: Record<string, string> | undefined;
+    traceId?: string | undefined;
+    from?: Date | string | undefined;
+    to?: Date | string | undefined;
+    limit?: number | undefined;
+    offset?: number | undefined;
+}
+export interface LogEntryRow {
+    id: string;
+    timestamp: Date;
+    nodeId: string | null;
+    app: string;
+    level: string;
+    message: string;
+    labels: Record<string, unknown> | null;
+    traceId: string | null;
+    spanId: string | null;
+    metadata: Record<string, unknown> | null;
+}
+/** How many rows hold one level. */
+export interface LevelCount {
+    level: string;
+    count: number;
+}
+export interface LogQueryResult {
+    entries: LogEntryRow[];
+    /** The rows the filter matches: the sum of `byLevel`. */
+    total: number;
+    /**
+     * The same rows by level, from the query that counts `total` — so a
+     * breakdown shown beside the total adds up to it.
+     */
+    byLevel: LevelCount[];
+    hasMore: boolean;
+}
+export interface LogStats {
+    byApp: Array<{
+        app: string;
+        count: number;
+    }>;
+    byLevel: LevelCount[];
+    totalCount: number;
+    oldestEntry: Date | null;
+    newestEntry: Date | null;
+}
+//# sourceMappingURL=logs.d.ts.map

package/dist/shared/dto/logs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logs.d.ts","sourceRoot":"","sources":["../../../src/shared/dto/logs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5C,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,IAAI,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,CAAC;IACjC,EAAE,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC1C;AAED,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;CAC1B"}

package/dist/shared/dto/logs.js

@@ -0,0 +1,10 @@
+/**
+ * Log DTOs — the wire shapes of the OmnitronLogs service.
+ *
+ * Declared here rather than in `services/log-collector.service.ts` for the
+ * same reason as the auth DTOs: the console consumes them, and a DTO that
+ * imports from a service implementation drags the server's type graph
+ * (decorators, Kysely, pino) into the browser build. See `./auth.ts`.
+ */
+export {};
+//# sourceMappingURL=logs.js.map

package/dist/shared/dto/logs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logs.js","sourceRoot":"","sources":["../../../src/shared/dto/logs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/shared/dto/metrics.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Metrics DTOs — wire shapes of the OmnitronMetrics service.
+ *
+ * The service itself is implemented by `MetricsRpcService` in
+ * `@omnitron-dev/titan-metrics`, but these shapes are declared here rather
+ * than imported from it. That package's `exports.types` points at its SOURCE
+ * (`./src/index.ts`), so importing a type from it pulls the implementation —
+ * decorators and all — into whatever program does the importing. In the
+ * console's build that is an immediate `TS1241` on every `@Public()`.
+ *
+ * Structural duplication is the lesser cost: a DTO's job is to describe the
+ * wire, and the wire is what both sides agree on regardless of which package
+ * happens to implement the server half. If titan-metrics ever points its
+ * `types` at `dist`, these can become re-exports.
+ */
+export interface MetricsQueryFilter {
+    /** Filter by metric name(s) */
+    names?: string[];
+    /** Filter by app name(s) */
+    apps?: string[];
+    /** Start time (ISO string or ms) */
+    from?: string | number;
+    /** End time (ISO string or ms) */
+    to?: string | number;
+    /** Label filters */
+    labels?: Record<string, string>;
+    /** Time bucket interval for aggregation (e.g., '1m', '5m', '1h') */
+    interval?: string;
+    /** Max data points to return */
+    limit?: number;
+}
+export interface MetricsTimeSeries {
+    name: string;
+    app: string;
+    labels: Record<string, string>;
+    points: Array<{
+        timestamp: number;
+        value: number;
+    }>;
+}
+export interface MetricsAppSnapshot {
+    cpu: number;
+    memory: number;
+    requests: number;
+    errors: number;
+    instances: number;
+    status: string;
+    latency?: {
+        p50: number;
+        p95: number;
+        p99: number;
+        mean: number;
+    };
+}
+export interface MetricsSnapshot {
+    timestamp: number;
+    apps: Record<string, MetricsAppSnapshot>;
+    totals: {
+        cpu: number;
+        memory: number;
+        apps: number;
+        onlineApps: number;
+    };
+}
+//# sourceMappingURL=metrics.d.ts.map

package/dist/shared/dto/metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../../src/shared/dto/metrics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,oCAAoC;IACpC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,kCAAkC;IAClC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,oBAAoB;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,MAAM,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACnE;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACzC,MAAM,EAAE;QACN,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH"}

package/dist/shared/dto/metrics.js

@@ -0,0 +1,17 @@
+/**
+ * Metrics DTOs — wire shapes of the OmnitronMetrics service.
+ *
+ * The service itself is implemented by `MetricsRpcService` in
+ * `@omnitron-dev/titan-metrics`, but these shapes are declared here rather
+ * than imported from it. That package's `exports.types` points at its SOURCE
+ * (`./src/index.ts`), so importing a type from it pulls the implementation —
+ * decorators and all — into whatever program does the importing. In the
+ * console's build that is an immediate `TS1241` on every `@Public()`.
+ *
+ * Structural duplication is the lesser cost: a DTO's job is to describe the
+ * wire, and the wire is what both sides agree on regardless of which package
+ * happens to implement the server half. If titan-metrics ever points its
+ * `types` at `dist`, these can become re-exports.
+ */
+export {};
+//# sourceMappingURL=metrics.js.map

package/dist/shared/dto/metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../../../src/shared/dto/metrics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/shared/dto/nodes.d.ts

@@ -0,0 +1,347 @@
+/**
+ * Node DTOs — wire shapes shared with the Omnitron Console.
+ *
+ * Declared away from the service implementation for the reason set out in
+ * `./auth.ts`.
+ */
+export interface INode {
+    id: string;
+    name: string;
+    host: string;
+    sshPort: number;
+    sshUser: string;
+    sshAuthMethod: 'password' | 'key';
+    sshPrivateKey?: string;
+    /** Whether an encrypted passphrase is stored in secrets.enc */
+    hasPassphrase?: boolean;
+    /** Whether an SSH password is stored in secrets.enc */
+    hasPassword?: boolean;
+    /** Runtime to install/use on remote nodes */
+    runtime: 'node' | 'bun';
+    /** Omnitron daemon port on this node */
+    daemonPort: number;
+    /** Tags for filtering/grouping */
+    tags: string[];
+    /** Whether this is the local machine (cannot be deleted) */
+    isLocal: boolean;
+    /** When the node was added */
+    createdAt: string;
+    /** Last modification */
+    updatedAt: string;
+    /** Per-node offline timeout in ms (null = use global default) */
+    offlineTimeout?: number | null;
+}
+export interface INodeStatus {
+    nodeId: string;
+    pingReachable: boolean;
+    pingLatencyMs: number | null;
+    pingError?: string;
+    /**
+     * Whether an SSH connection was established — `null` when none was tried.
+     *
+     * The distinction is load-bearing. Two producers fill this in: the
+     * health-monitor worker, which opens an SSH session on every round, and the
+     * daemon's own fallback check, which does not — it pings and probes the
+     * Netron port, because a node running omnitron is reached over Netron and
+     * SSH is for provisioning it. The fallback used to write `false` here, and
+     * `false` means "SSH was refused" to every reader: the console showed
+     * "Waiting for SSH connection" for a node whose SSH works, and never showed
+     * `omnitronError`, which held the actual reason.
+     */
+    sshConnected: boolean | null;
+    sshLatencyMs: number | null;
+    sshError?: string;
+    /**
+     * Whether the node's daemon answered — `null` when no path reached it.
+     *
+     * The same three states as `sshConnected`, for the same reason. The
+     * daemon's own check asks over the mesh and then dials the daemon port;
+     * when neither gets through, that is not evidence the daemon is down — the
+     * port of a hardened node is closed to the master by design — and `false`
+     * printed «offline» about a node serving six apps. `omnitronError` says
+     * which paths were tried and why each failed.
+     */
+    omnitronConnected: boolean | null;
+    omnitronVersion?: string;
+    omnitronPid?: number;
+    omnitronUptime?: number;
+    omnitronRole?: 'master' | 'slave';
+    omnitronError?: string;
+    /** OS info from remote node */
+    os?: {
+        platform: string;
+        arch: string;
+        hostname: string;
+        release: string;
+    };
+    checkedAt: string;
+}
+export interface INodeWithStatus extends INode {
+    status: INodeStatus | null;
+}
+export interface AddNodeInput {
+    name: string;
+    host: string;
+    sshPort?: number;
+    sshUser?: string;
+    sshAuthMethod?: 'password' | 'key';
+    sshPrivateKey?: string;
+    /** Passphrase for encrypted SSH key (will be encrypted in secrets.enc) */
+    sshPassphrase?: string;
+    /** SSH password auth (will be encrypted in secrets.enc) */
+    sshPassword?: string;
+    runtime?: 'node' | 'bun';
+    daemonPort?: number;
+    tags?: string[];
+    offlineTimeout?: number | null;
+}
+export interface UpdateNodeInput {
+    name?: string;
+    host?: string;
+    sshPort?: number;
+    sshUser?: string;
+    sshAuthMethod?: 'password' | 'key';
+    sshPrivateKey?: string;
+    /** Passphrase for encrypted SSH key (will be encrypted in secrets.enc) */
+    sshPassphrase?: string;
+    /** SSH password auth (will be encrypted in secrets.enc) */
+    sshPassword?: string;
+    runtime?: 'node' | 'bun';
+    daemonPort?: number;
+    tags?: string[];
+    offlineTimeout?: number | null;
+}
+export interface SshKeyInfo {
+    name: string;
+    path: string;
+    type: string;
+}
+/**
+ * How the fleet is checked — the operator-tunable half.
+ *
+ * Declared here rather than beside the checker for the reason in the header:
+ * the console reads and writes this shape over RPC, and a console type that
+ * had to import the checker would drag `node:child_process` with it.
+ */
+export interface NodeCheckConfig {
+    /** Whether ICMP ping is attempted at all. */
+    pingEnabled: boolean;
+    /** Ping timeout, ms. */
+    pingTimeout: number;
+    /** SSH connect+command timeout, ms. */
+    sshTimeout: number;
+    /** Remote omnitron probe timeout, ms. */
+    omnitronCheckTimeout: number;
+    /** Max nodes checked at once. */
+    concurrency: number;
+}
+/**
+ * How much history there is, and how the console should slice it.
+ *
+ * `uptimeIntervalMs` and `retentionDays` are daemon configuration the console
+ * needs in order to ask a question that can be answered: it hard-coded a
+ * 24-hour bucket and asked for 200 of them against a daemon that keeps 90
+ * days, so three of every four segments were "no data" by construction and
+ * every poll asked the database for a window that cannot exist.
+ */
+export interface FleetHistoryConfig {
+    /** Width of one uptime-bar segment, ms. */
+    uptimeIntervalMs: number;
+    /** How long check history is kept, days. */
+    retentionDays: number;
+}
+/**
+ * A node's membership of the mesh, as the console shows it.
+ *
+ * Distinct from `INodeStatus`, which answers "can this master reach it" —
+ * SSH, ping, a daemon that answers. A node can pass all of that and
+ * replicate nothing, which is what every registered node did until the
+ * master started dialling the ones no stack had been deployed onto.
+ */
+export interface IMeshNodeStatus {
+    nodeId: string;
+    /** False means the master is not connected to it at all. */
+    inMesh: boolean;
+    status: 'disconnected' | 'connecting' | 'connected' | 'error';
+    /** `ssh-tunnel` means the node's daemon port is closed to this master. */
+    via: 'direct' | 'ssh-tunnel' | null;
+    /** False on a live connection means pings work and no data can be pulled. */
+    authenticated: boolean;
+    lastHeartbeat: number | null;
+    lastError: string | null;
+}
+/**
+ * What a node's own titan-health reports about it.
+ *
+ * `reachable` is about the QUESTION, not the answer: false means the node was
+ * not asked — it is outside the mesh, or the call failed — and carries the
+ * reason. A node that could not be asked has reported nothing, and nothing is
+ * not a verdict. Rendering it as `unhealthy` is the same mistake as reading an
+ * unmeasured SSH layer as a refusal, which this console has made once already.
+ */
+export interface INodeIndicators {
+    nodeId: string;
+    /** Whether the node answered at all. */
+    reachable: boolean;
+    /** Why it did not, when it did not. */
+    error: string | null;
+    /** The node's overall verdict — `null` when it was not asked. */
+    status: string | null;
+    /** Indicator name → its result, as titan-health reports it. */
+    indicators: Record<string, unknown>;
+}
+/**
+ * One question put to a node's own daemon, over the mesh.
+ *
+ * The fleet commands dial `host:9700` and ask `OmnitronDaemon` directly. A
+ * node whose daemon port is not open to this master — which is the normal
+ * state of a hardened server, and the reason the mesh tunnels over SSH —
+ * answers nothing, so `fleet status` listed a machine running six apps as
+ * `offline  0 apps`, and `fleet health` and `fleet metrics` had nothing to
+ * print either.
+ *
+ * `reachable: false` carries the reason and never a verdict: a node that
+ * could not be asked has not reported anything, and rendering silence as
+ * `offline` sends an operator to look at the wrong machine.
+ */
+export interface INodeDaemonAnswer<T> {
+    nodeId: string;
+    /** Whether the node's daemon answered at all. */
+    reachable: boolean;
+    /** Why it did not, when it did not. */
+    error: string | null;
+    /** What it said — `null` when it was not asked or did not answer. */
+    answer: T | null;
+}
+/**
+ * Whether a node's data is reaching this master.
+ *
+ * Reachability and membership are different questions, and so are membership
+ * and MOVEMENT. A node can answer every ping, sit in the mesh authenticated,
+ * and still have delivered nothing — `pendingItems` climbing while
+ * `lastSyncAt` stands still is the whole diagnosis.
+ *
+ * `reachable: false` means the node was not asked, and carries why. It is not
+ * "not replicating".
+ */
+export interface INodeSyncStatus {
+    nodeId: string;
+    reachable: boolean;
+    error: string | null;
+    sync: import('./project.js').ISyncStatus | null;
+}
+/**
+ * A node's telemetry relay, as it reports itself.
+ *
+ * The companion to `INodeSyncStatus`: that one is the log/metric replication,
+ * this one the telemetry relay. It carries the only counter in the fleet that
+ * reports LOSS — `relay.buffer.totalDropped`, entries the buffer threw away
+ * because it was full. A gap in a chart is otherwise discovered from the chart.
+ *
+ * `reachable: false` means the node was not asked, and carries why.
+ */
+export interface INodeRelayStats {
+    nodeId: string;
+    reachable: boolean;
+    error: string | null;
+    /** As `TelemetryRelayService.stats()` returns it; shape owned by that package. */
+    relay: Record<string, unknown> | null;
+}
+/**
+ * Which node a node believes is the leader.
+ *
+ * Only meaningful ACROSS nodes: one node's answer is unremarkable, and two
+ * nodes naming different leaders — or sitting in different terms — is a split
+ * brain, the state in which every node is individually healthy and the fleet
+ * is not.
+ */
+export interface INodeClusterState {
+    nodeId: string;
+    reachable: boolean;
+    error: string | null;
+    /** As `LeaderElection.getClusterState()` returns it. */
+    cluster: Record<string, unknown> | null;
+}
+/**
+ * What a rollout will do to one node, decided BEFORE anything is shipped.
+ *
+ * The console shows these rows behind a «Plan» button so an operator sees the
+ * outcome before the outcome happens: how many will move, how many are
+ * already there, who cannot be reached and why. `planUpgrade` in
+ * `services/node-upgrade.ts` is the pure function that produces the decision;
+ * this is that decision projected onto the wire, with the two fields a table
+ * needs added — the node's label and the machine behind it.
+ *
+ * `host` is `host:sshPort`, the MACHINE, and it is here because two registry
+ * entries can name one box. Measured: `daos-test` and `acme-deploy-test`,
+ * both `37.27.130.185:22`, listed as two targets — one host would have
+ * received the bundle twice, the second install running while the first was
+ * still switching `current` underneath it. The plan collapses them and says
+ * so in `because`; showing the address is how an operator can see that the
+ * collapse was right.
+ */
+export interface INodeUpgradePlanRow {
+    nodeId: string;
+    /** What the node is called in the console — `UpgradeCandidate.name`. */
+    label: string;
+    /** `host:sshPort`. Null when the registry entry has no usable address. */
+    host: string | null;
+    /** What it runs now; null means it could not be asked. */
+    currentVersion: string | null;
+    /**
+     * What the rollout would install. NULL in a plan asked for without a
+     * build: nothing has been compiled, so there is no version to compare
+     * against, and a made-up string here would be compared anyway.
+     */
+    targetVersion: string | null;
+    action: 'upgrade' | 'skip' | 'refuse';
+    /**
+     * Why, in the words the operator should read — «already on 0.2.0+…»,
+     * «unreachable: …», «the same machine as 'daos-test'».
+     *
+     * Empty for an `upgrade` row: there is no reason to give for doing the
+     * thing that was asked for.
+     */
+    because: string;
+}
+/** The whole plan, as `planUpgrade` decided it. */
+export interface INodeUpgradePlan {
+    /**
+     * The version this rollout would install everywhere, or null when the plan
+     * was asked for without building one.
+     *
+     * A plan without it still says which nodes are local, which refused SSH
+     * and which would be attempted — everything except «already on it», which
+     * is the one decision that needs something to compare against.
+     */
+    targetVersion: string | null;
+    /**
+     * False when no bundle was built, so the console can say that rather than
+     * letting an operator read «12 to upgrade» as a comparison that happened.
+     */
+    compared: boolean;
+    rows: INodeUpgradePlanRow[];
+    /**
+     * Set when the run must not start at all — a daemon with nothing to build
+     * from, for instance. Distinct from every row refusing: this is about the
+     * rollout, not about the nodes.
+     */
+    refusal: string | null;
+}
+/** What a rollout accepted, and what it would not take. */
+export interface INodeRolloutStart {
+    /** Node ids the daemon has queued. Order is the order they will run in. */
+    accepted: string[];
+    /**
+     * Nodes the daemon declined to queue, each with its reason — already
+     * running, unknown to the registry, held by another deployment.
+     *
+     * Refused rather than silently dropped: a rollout that quietly shrinks is
+     * how an operator comes to believe a node was upgraded when it was not.
+     */
+    refused: Array<{
+        nodeId: string;
+        because: string;
+    }>;
+}
+//# sourceMappingURL=nodes.d.ts.map

package/dist/shared/dto/nodes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodes.d.ts","sourceRoot":"","sources":["../../../src/shared/dto/nodes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,UAAU,GAAG,KAAK,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,uDAAuD;IACvD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,6CAA6C;IAC7C,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;IACxB,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,4DAA4D;IAC5D,OAAO,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;OAWG;IACH,YAAY,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,EAAE,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAgB,SAAQ,KAAK;IAC5C,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,6CAA6C;IAC7C,WAAW,EAAE,OAAO,CAAC;IACrB,wBAAwB;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,2CAA2C;IAC3C,gBAAgB,EAAE,MAAM,CAAC;IACzB,4CAA4C;IAC5C,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,cAAc,GAAG,YAAY,GAAG,WAAW,GAAG,OAAO,CAAC;IAC9D,0EAA0E;IAC1E,GAAG,EAAE,QAAQ,GAAG,YAAY,GAAG,IAAI,CAAC;IACpC,6EAA6E;IAC7E,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,SAAS,EAAE,OAAO,CAAC;IACnB,uCAAuC;IACvC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,iEAAiE;IACjE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,iBAAiB,CAAC,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,SAAS,EAAE,OAAO,CAAC;IACnB,uCAAuC;IACvC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qEAAqE;IACrE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC;CAClB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,OAAO,cAAc,EAAE,WAAW,GAAG,IAAI,CAAC;CACjD;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACzC;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,0DAA0D;IAC1D,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;;OAIG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;IACtC;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mDAAmD;AACnD,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;OAOG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,mBAAmB,EAAE,CAAC;IAC5B;;;;OAIG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,2DAA2D;AAC3D,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;OAMG;IACH,OAAO,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD"}

package/dist/shared/dto/nodes.js

@@ -0,0 +1,8 @@
+/**
+ * Node DTOs — wire shapes shared with the Omnitron Console.
+ *
+ * Declared away from the service implementation for the reason set out in
+ * `./auth.ts`.
+ */
+export {};
+//# sourceMappingURL=nodes.js.map

package/dist/shared/dto/nodes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodes.js","sourceRoot":"","sources":["../../../src/shared/dto/nodes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}