@omnitron-dev/omnitron 0.1.3 → 0.3.0

package/dist/shared/events.js.map

@@ -1 +1 @@
-{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/shared/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,OAAO,EAAE,aAAa;IACtB,OAAO,EAAE,aAAa;IACtB,OAAO,EAAE,aAAa;IACtB,UAAU,EAAE,gBAAgB;IAC5B,MAAM,EAAE,YAAY;IACpB,cAAc,EAAE,oBAAoB;CAC5B,CAAC;AAsCX,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,KAAK,EAAE,aAAa;IACpB,QAAQ,EAAE,gBAAgB;IAC1B,MAAM,EAAE,cAAc;IACtB,UAAU,EAAE,kBAAkB;IAC9B,YAAY,EAAE,oBAAoB;IAClC,iBAAiB,EAAE,yBAAyB;CACpC,CAAC;AAsBX,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,KAAK,EAAE,aAAa;IACpB,QAAQ,EAAE,gBAAgB;IAC1B,YAAY,EAAE,oBAAoB;CAC1B,CAAC;AAgBX,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,mBAAmB;CACtB,CAAC;AASX,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,KAAK,EAAE,eAAe;IACtB,OAAO,EAAE,iBAAiB;IAC1B,eAAe,EAAE,yBAAyB;CAClC,CAAC;AAeX,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,QAAQ,EAAE,gBAAgB;IAC1B,OAAO,EAAE,eAAe;IACxB,QAAQ,EAAE,gBAAgB;IAC1B,OAAO,EAAE,eAAe;IACxB,KAAK,EAAE,aAAa;IACpB,WAAW,EAAE,mBAAmB;IAChC,cAAc,EAAE,sBAAsB;IACtC,WAAW,EAAE,mBAAmB;IAChC,eAAe,EAAE,uBAAuB;IACxC,cAAc,EAAE,sBAAsB;IACtC,iBAAiB,EAAE,yBAAyB;CACpC,CAAC;AAqEX,gFAAgF;AAChF,cAAc;AACd,gFAAgF;AAEhF,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,cAAc,EAAE,qBAAqB;IACrC,WAAW,EAAE,kBAAkB;IAC/B,YAAY,EAAE,mBAAmB;IACjC,aAAa,EAAE,oBAAoB;IACnC,eAAe,EAAE,sBAAsB;CAC/B,CAAC;AAeX,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,gBAAgB;IACzB,QAAQ,EAAE,iBAAiB;IAC3B,eAAe,EAAE,wBAAwB;CACjC,CAAC;AAEX,gFAAgF;AAChF,8DAA8D;AAC9D,gFAAgF;AAEhF,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;IAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;IAC9B,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;IAC9B,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;IAChC,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;IAChC,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;IAC9B,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;IAC7B,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;CACvB,CAAC"}
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/shared/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,OAAO,EAAE,aAAa;IACtB,OAAO,EAAE,aAAa;IACtB,OAAO,EAAE,aAAa;IACtB,UAAU,EAAE,gBAAgB;IAC5B,MAAM,EAAE,YAAY;IACpB,cAAc,EAAE,oBAAoB;CAC5B,CAAC;AAsCX,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,KAAK,EAAE,aAAa;IACpB,QAAQ,EAAE,gBAAgB;IAC1B,MAAM,EAAE,cAAc;IACtB,UAAU,EAAE,kBAAkB;IAC9B,YAAY,EAAE,oBAAoB;IAClC,iBAAiB,EAAE,yBAAyB;CACpC,CAAC;AAsBX,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,KAAK,EAAE,aAAa;IACpB,QAAQ,EAAE,gBAAgB;IAC1B,YAAY,EAAE,oBAAoB;CAC1B,CAAC;AAgBX,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,mBAAmB;CACtB,CAAC;AASX,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,KAAK,EAAE,eAAe;IACtB,OAAO,EAAE,iBAAiB;IAC1B,eAAe,EAAE,yBAAyB;CAClC,CAAC;AAeX,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,QAAQ,EAAE,gBAAgB;IAC1B,OAAO,EAAE,eAAe;IACxB,QAAQ,EAAE,gBAAgB;IAC1B,OAAO,EAAE,eAAe;IACxB,KAAK,EAAE,aAAa;IACpB,WAAW,EAAE,mBAAmB;IAChC,cAAc,EAAE,sBAAsB;IACtC,WAAW,EAAE,mBAAmB;IAChC,eAAe,EAAE,uBAAuB;IACxC,cAAc,EAAE,sBAAsB;IACtC,iBAAiB,EAAE,yBAAyB;CACpC,CAAC;AAqEX,gFAAgF;AAChF,cAAc;AACd,gFAAgF;AAEhF,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,cAAc,EAAE,qBAAqB;IACrC,WAAW,EAAE,kBAAkB;IAC/B,YAAY,EAAE,mBAAmB;IACjC,aAAa,EAAE,oBAAoB;IACnC,eAAe,EAAE,sBAAsB;CAC/B,CAAC;AAeX,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,gBAAgB;IACzB,QAAQ,EAAE,iBAAiB;IAC3B,eAAe,EAAE,wBAAwB;CACjC,CAAC;AAEX,gFAAgF;AAChF,8DAA8D;AAC9D,gFAAgF;AAEhF,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;IAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;IAC9B,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;IAC9B,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;IAChC,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;IAChC,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;IAC9B,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;IAC7B,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;CACvB,CAAC;AAIX;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC"}

package/dist/shared/format.d.ts

@@ -10,7 +10,7 @@ export declare function formatCpu(cpu: number): string;
 /** Color-coded memory with threshold highlighting */
 export declare function formatMemoryColored(bytes: number): string;
 /** Format restart count — highlight if restarts > 0 */
-export declare function formatRestarts(count: number): string;
+export declare function formatRestarts(count: number | null): string;
 /** Format port number or dash */
 export declare function formatPort(port: number | null): string;
 /** Critical badge */

package/dist/shared/format.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../src/shared/format.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAW/C;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKlD;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMjD;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAmBnD;AAED,6DAA6D;AAC7D,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAK7C;AAED,qDAAqD;AACrD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMzD;AAED,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIpD;AAED,iCAAiC;AACjC,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAEtD;AAED,qBAAqB;AACrB,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAExD"}
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../src/shared/format.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAW/C;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKlD;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMjD;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAmBnD;AAED,6DAA6D;AAC7D,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAK7C;AAED,qDAAqD;AACrD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMzD;AAED,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAO3D;AAED,iCAAiC;AACjC,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAEtD;AAED,qBAAqB;AACrB,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAExD"}

package/dist/shared/format.js

@@ -76,6 +76,10 @@ export function formatMemoryColored(bytes) {
 }
 /** Format restart count — highlight if restarts > 0 */
 export function formatRestarts(count) {
+    // `null` is "nothing counts this", which is not the same claim as zero and
+    // must not render as one.
+    if (count == null)
+        return '-';
     if (count === 0)
         return '0';
     if (count >= 5)

package/dist/shared/format.js.map

@@ -1 +1 @@
-{"version":3,"file":"format.js","sourceRoot":"","sources":["../../src/shared/format.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IAEpC,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,GAAG,CAAC;IAC/C,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,GAAG,KAAK,KAAK,OAAO,GAAG,EAAE,GAAG,CAAC;IACnD,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,GAAG,OAAO,KAAK,OAAO,GAAG,EAAE,GAAG,CAAC;IACvD,OAAO,GAAG,OAAO,GAAG,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAC5B,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,GAAG,IAAI;QAAE,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,OAAO,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC;IAC/B,IAAI,EAAE,GAAG,GAAG;QAAE,OAAO,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,IAAI,EAAE,GAAG,IAAI;QAAE,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,OAAO,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/B,KAAK,UAAU;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAClC,KAAK,UAAU;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAClC,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B;YACE,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;IAClC,IAAI,GAAG,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,GAAG,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,EAAE,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,UAAU,CAAC,IAAmB;IAC5C,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACnC,CAAC;AAED,qBAAqB;AACrB,MAAM,UAAU,cAAc,CAAC,QAAiB;IAC9C,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACzC,CAAC"}
+{"version":3,"file":"format.js","sourceRoot":"","sources":["../../src/shared/format.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IAEpC,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,GAAG,CAAC;IAC/C,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,GAAG,KAAK,KAAK,OAAO,GAAG,EAAE,GAAG,CAAC;IACnD,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,GAAG,OAAO,KAAK,OAAO,GAAG,EAAE,GAAG,CAAC;IACvD,OAAO,GAAG,OAAO,GAAG,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAC5B,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,GAAG,IAAI;QAAE,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,OAAO,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC;IAC/B,IAAI,EAAE,GAAG,GAAG;QAAE,OAAO,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,IAAI,EAAE,GAAG,IAAI;QAAE,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,OAAO,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/B,KAAK,UAAU;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAClC,KAAK,UAAU;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAClC,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B;YACE,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;IAClC,IAAI,GAAG,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,GAAG,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,EAAE,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,2EAA2E;IAC3E,0BAA0B;IAC1B,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,GAAG,CAAC;IAC9B,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,UAAU,CAAC,IAAmB;IAC5C,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACnC,CAAC;AAED,qBAAqB;AACrB,MAAM,UAAU,cAAc,CAAC,QAAiB;IAC9C,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACzC,CAAC"}

package/dist/shared/local-infra-host.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The address of infrastructure this daemon provisioned on this machine.
+ *
+ * Not `localhost`. That name resolves to two addresses — `::1` and
+ * `127.0.0.1` — and Node tries them in the order the resolver returns, which
+ * is IPv6 first here. Docker publishes a container's port on IPv4 only:
+ *
+ *     daos-dev-redis      127.0.0.1:6379->6379/tcp
+ *     daos-dev-postgres   127.0.0.1:5432->5432/tcp
+ *
+ * so the first attempt of every new connection is refused and the client
+ * reaches the service on the second. Measured, five connects each:
+ *
+ *     redis     localhost   0.91–3.76 ms      postgres  localhost   0.74–1.79 ms
+ *     redis     127.0.0.1   0.35–0.75 ms      postgres  127.0.0.1   0.24–0.70 ms
+ *     redis     ::1         ECONNREFUSED      postgres  ::1         ECONNREFUSED
+ *
+ * The milliseconds do not matter. The log does: about 3 500 ERROR records on
+ * the dev stand, each an `AggregateError [ECONNREFUSED]` with an empty
+ * `message` and `connect ECONNREFUSED ::1:6379` inside `aggregateErrors`,
+ * every one of them followed by «connected successfully». A refusal that is
+ * always followed by a success teaches an operator to read past refusals.
+ *
+ * A NODE's address is a different thing and stays a name: whatever the
+ * operator wrote in `stackConfig.nodes[].host` is resolved as written.
+ */
+export declare const LOCAL_INFRA_HOST = "127.0.0.1";
+//# sourceMappingURL=local-infra-host.d.ts.map

package/dist/shared/local-infra-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-infra-host.d.ts","sourceRoot":"","sources":["../../src/shared/local-infra-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,gBAAgB,cAAc,CAAC"}

package/dist/shared/local-infra-host.js

@@ -0,0 +1,28 @@
+/**
+ * The address of infrastructure this daemon provisioned on this machine.
+ *
+ * Not `localhost`. That name resolves to two addresses — `::1` and
+ * `127.0.0.1` — and Node tries them in the order the resolver returns, which
+ * is IPv6 first here. Docker publishes a container's port on IPv4 only:
+ *
+ *     daos-dev-redis      127.0.0.1:6379->6379/tcp
+ *     daos-dev-postgres   127.0.0.1:5432->5432/tcp
+ *
+ * so the first attempt of every new connection is refused and the client
+ * reaches the service on the second. Measured, five connects each:
+ *
+ *     redis     localhost   0.91–3.76 ms      postgres  localhost   0.74–1.79 ms
+ *     redis     127.0.0.1   0.35–0.75 ms      postgres  127.0.0.1   0.24–0.70 ms
+ *     redis     ::1         ECONNREFUSED      postgres  ::1         ECONNREFUSED
+ *
+ * The milliseconds do not matter. The log does: about 3 500 ERROR records on
+ * the dev stand, each an `AggregateError [ECONNREFUSED]` with an empty
+ * `message` and `connect ECONNREFUSED ::1:6379` inside `aggregateErrors`,
+ * every one of them followed by «connected successfully». A refusal that is
+ * always followed by a success teaches an operator to read past refusals.
+ *
+ * A NODE's address is a different thing and stays a name: whatever the
+ * operator wrote in `stackConfig.nodes[].host` is resolved as written.
+ */
+export const LOCAL_INFRA_HOST = '127.0.0.1';
+//# sourceMappingURL=local-infra-host.js.map

package/dist/shared/local-infra-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-infra-host.js","sourceRoot":"","sources":["../../src/shared/local-infra-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC"}

package/dist/shared/node-check.d.ts

@@ -0,0 +1,37 @@
+/**
+ * What one check of a node's omnitron found — one reading for the uptime
+ * strip's aggregate (`NodeHealthRepository.getUptimeBar`, in SQL) and the
+ * console's status dot, and the words the checker writes for it to read.
+ *
+ * A check MEASURED omnitron only when it answered the question: omnitron
+ * was running, or the node said it was not. Everything else measured
+ * nothing, and says why:
+ *
+ *   - `not-installed` — the node has no omnitron; nothing there to be down;
+ *   - `unreachable`   — no SSH session, so nothing was asked;
+ *   - `unread`        — a session, and an answer that could not be read: a
+ *                       timeout, output that was not JSON, an exec that
+ *                       failed, or the old reader's NULL (migration 009).
+ *
+ * Both readers counted every error with SSH up as «not running», and matched
+ * «not installed» anywhere in the text — so a timeout, whose message echoes
+ * the command and the command contains «omnitron: command not found», read
+ * as not installed: 19 such rows on the master, 2026-09-15 → 09-22, and the
+ * console's dot said «Not installed on this node» after one.
+ *
+ * Imported by the console through `@omnitron-dev/omnitron/node-check`, so
+ * nothing here may need Node.
+ */
+/** The checker's answer when omnitron's status said no daemon runs. */
+export declare const NOT_RUNNING = "omnitron status reported no running daemon";
+/** The checker's answer, first on the line, when the node has no omnitron. */
+export declare const NOT_INSTALLED = "omnitron: command not found";
+export type OmnitronFinding = 'running' | 'not-running' | 'not-installed' | 'unreachable' | 'unread';
+/** The fields of a check this is read from — a history row or a live status. */
+export interface OmnitronCheck {
+    readonly sshConnected: boolean | null;
+    readonly omnitronConnected: boolean | null;
+    readonly omnitronError?: string | null;
+}
+export declare function omnitronFinding(check: OmnitronCheck): OmnitronFinding;
+//# sourceMappingURL=node-check.d.ts.map

package/dist/shared/node-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-check.d.ts","sourceRoot":"","sources":["../../src/shared/node-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,uEAAuE;AACvE,eAAO,MAAM,WAAW,+CAA+C,CAAC;AAExE,8EAA8E;AAC9E,eAAO,MAAM,aAAa,gCAAgC,CAAC;AAE3D,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,aAAa,GAAG,eAAe,GAAG,aAAa,GAAG,QAAQ,CAAC;AAErG,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,GAAG,eAAe,CAOrE"}

package/dist/shared/node-check.js

@@ -0,0 +1,41 @@
+/**
+ * What one check of a node's omnitron found — one reading for the uptime
+ * strip's aggregate (`NodeHealthRepository.getUptimeBar`, in SQL) and the
+ * console's status dot, and the words the checker writes for it to read.
+ *
+ * A check MEASURED omnitron only when it answered the question: omnitron
+ * was running, or the node said it was not. Everything else measured
+ * nothing, and says why:
+ *
+ *   - `not-installed` — the node has no omnitron; nothing there to be down;
+ *   - `unreachable`   — no SSH session, so nothing was asked;
+ *   - `unread`        — a session, and an answer that could not be read: a
+ *                       timeout, output that was not JSON, an exec that
+ *                       failed, or the old reader's NULL (migration 009).
+ *
+ * Both readers counted every error with SSH up as «not running», and matched
+ * «not installed» anywhere in the text — so a timeout, whose message echoes
+ * the command and the command contains «omnitron: command not found», read
+ * as not installed: 19 such rows on the master, 2026-09-15 → 09-22, and the
+ * console's dot said «Not installed on this node» after one.
+ *
+ * Imported by the console through `@omnitron-dev/omnitron/node-check`, so
+ * nothing here may need Node.
+ */
+/** The checker's answer when omnitron's status said no daemon runs. */
+export const NOT_RUNNING = 'omnitron status reported no running daemon';
+/** The checker's answer, first on the line, when the node has no omnitron. */
+export const NOT_INSTALLED = 'omnitron: command not found';
+export function omnitronFinding(check) {
+    if (check.omnitronConnected === true)
+        return 'running';
+    const error = check.omnitronError ?? '';
+    if (error.startsWith(NOT_INSTALLED))
+        return 'not-installed';
+    if (check.sshConnected === false)
+        return 'unreachable';
+    if (check.omnitronConnected === false && error === NOT_RUNNING)
+        return 'not-running';
+    return 'unread';
+}
+//# sourceMappingURL=node-check.js.map

package/dist/shared/node-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-check.js","sourceRoot":"","sources":["../../src/shared/node-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,uEAAuE;AACvE,MAAM,CAAC,MAAM,WAAW,GAAG,4CAA4C,CAAC;AAExE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,aAAa,GAAG,6BAA6B,CAAC;AAW3D,MAAM,UAAU,eAAe,CAAC,KAAoB;IAClD,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACvD,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC;IACxC,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,eAAe,CAAC;IAC5D,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK;QAAE,OAAO,aAAa,CAAC;IACvD,IAAI,KAAK,CAAC,iBAAiB,KAAK,KAAK,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,aAAa,CAAC;IACrF,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/shared/paths.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Path helpers — single source of truth for `~`-expansion.
+ *
+ * Pre-fix 31 distinct call sites inlined the same one-liner
+ * `path.replace('~', process.env['HOME'] ?? '')`. That pattern had
+ * three quiet bugs:
+ *   - `''` for HOME on weird environments produced literal paths
+ *     like `'/.omnitron/state.json'` (root-anchored, owner = root)
+ *     rather than failing fast.
+ *   - It only replaced the FIRST `~`, so a config that contained
+ *     `~/foo/~/bar` (rare but possible) silently mis-resolved.
+ *   - It didn't handle `~/` vs `~user/` correctly (we don't need
+ *     the latter, but the inline pattern wouldn't reject it either).
+ *
+ * Centralising the expansion gives us one place to add validation
+ * (refuse empty HOME, prefer `os.homedir()` over raw env), and a
+ * later ConfigService migration can substitute in without touching
+ * 31 call sites again.
+ */
+/**
+ * Expand a leading `~` or `~/` to the current user's home directory.
+ * No-op for paths that don't start with `~`.
+ *
+ * Throws if `~` is at the start but no home directory is resolvable
+ * — better to fail fast than to silently fall through to a root-
+ * anchored path that the caller almost certainly doesn't intend.
+ */
+export declare function expandPath(p: string): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/shared/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/shared/paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAS5C"}

package/dist/shared/paths.js

@@ -0,0 +1,54 @@
+/**
+ * Path helpers — single source of truth for `~`-expansion.
+ *
+ * Pre-fix 31 distinct call sites inlined the same one-liner
+ * `path.replace('~', process.env['HOME'] ?? '')`. That pattern had
+ * three quiet bugs:
+ *   - `''` for HOME on weird environments produced literal paths
+ *     like `'/.omnitron/state.json'` (root-anchored, owner = root)
+ *     rather than failing fast.
+ *   - It only replaced the FIRST `~`, so a config that contained
+ *     `~/foo/~/bar` (rare but possible) silently mis-resolved.
+ *   - It didn't handle `~/` vs `~user/` correctly (we don't need
+ *     the latter, but the inline pattern wouldn't reject it either).
+ *
+ * Centralising the expansion gives us one place to add validation
+ * (refuse empty HOME, prefer `os.homedir()` over raw env), and a
+ * later ConfigService migration can substitute in without touching
+ * 31 call sites again.
+ */
+import os from 'node:os';
+/**
+ * Expand a leading `~` or `~/` to the current user's home directory.
+ * No-op for paths that don't start with `~`.
+ *
+ * Throws if `~` is at the start but no home directory is resolvable
+ * — better to fail fast than to silently fall through to a root-
+ * anchored path that the caller almost certainly doesn't intend.
+ */
+export function expandPath(p) {
+    if (!p)
+        return p;
+    if (p === '~') {
+        return getHomeDir();
+    }
+    if (p.startsWith('~/')) {
+        return getHomeDir() + p.slice(1);
+    }
+    return p;
+}
+/**
+ * Resolve the home directory. Prefers `os.homedir()` (which respects
+ * platform conventions on Windows + handles missing HOME) over the
+ * raw env var. Throws when no home dir is resolvable so the failure
+ * is visible at boot rather than producing a root-anchored path.
+ */
+function getHomeDir() {
+    const home = os.homedir() || process.env['HOME'] || process.env['USERPROFILE'];
+    if (!home) {
+        throw new Error('Cannot resolve home directory: neither os.homedir() nor $HOME/$USERPROFILE is set. ' +
+            'Set HOME explicitly when launching omnitron in a minimal environment.');
+    }
+    return home;
+}
+//# sourceMappingURL=paths.js.map

package/dist/shared/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/shared/paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QACd,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU;IACjB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC/E,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,qFAAqF;YACnF,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/shared/pnpm.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Where `pnpm` is, for a process that did not inherit a shell's PATH.
+ *
+ * The daemon is started by launchd, whose PATH is
+ *
+ *     /Users/…/.nvm/versions/node/v24.13.0/bin:/usr/local/bin:
+ *     /opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin
+ *
+ * — measured off the running process — and pnpm's own installer puts the
+ * binary in `~/Library/pnpm`, which is on none of those. A bare `'pnpm'` in
+ * an `execFile` is therefore an ENOENT every time the daemon runs it, and
+ * never when a developer runs the same code from a terminal.
+ *
+ * This lived as a private function in `artifact-builder.ts`, written for
+ * exactly that failure. `bundle-builder.ts` had the same bare `'pnpm'` call
+ * six lines into the loop that packs every workspace package, and fixing one
+ * copy left the other — so the artifact builder found pnpm and the bundle
+ * builder it delegates to did not. It is one question and now has one answer.
+ *
+ * Resolved once per process and remembered: the answer cannot change while
+ * the daemon runs, and the search is a handful of `stat` calls.
+ *
+ * Returns `pnpm` unchanged when nothing is found, so the failure is an ENOENT
+ * naming the command rather than a path this invented.
+ */
+export declare function resolvePnpm(): string;
+/** The resolver, for a test that must run on the machine it is about. */
+export declare function resolvePnpmForTests(): string;
+//# sourceMappingURL=pnpm.d.ts.map

package/dist/shared/pnpm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pnpm.d.ts","sourceRoot":"","sources":["../../src/shared/pnpm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAMH,wBAAgB,WAAW,IAAI,MAAM,CAuBpC;AAED,yEAAyE;AACzE,wBAAgB,mBAAmB,IAAI,MAAM,CAG5C"}

package/dist/shared/pnpm.js

@@ -0,0 +1,57 @@
+/**
+ * Where `pnpm` is, for a process that did not inherit a shell's PATH.
+ *
+ * The daemon is started by launchd, whose PATH is
+ *
+ *     /Users/…/.nvm/versions/node/v24.13.0/bin:/usr/local/bin:
+ *     /opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin
+ *
+ * — measured off the running process — and pnpm's own installer puts the
+ * binary in `~/Library/pnpm`, which is on none of those. A bare `'pnpm'` in
+ * an `execFile` is therefore an ENOENT every time the daemon runs it, and
+ * never when a developer runs the same code from a terminal.
+ *
+ * This lived as a private function in `artifact-builder.ts`, written for
+ * exactly that failure. `bundle-builder.ts` had the same bare `'pnpm'` call
+ * six lines into the loop that packs every workspace package, and fixing one
+ * copy left the other — so the artifact builder found pnpm and the bundle
+ * builder it delegates to did not. It is one question and now has one answer.
+ *
+ * Resolved once per process and remembered: the answer cannot change while
+ * the daemon runs, and the search is a handful of `stat` calls.
+ *
+ * Returns `pnpm` unchanged when nothing is found, so the failure is an ENOENT
+ * naming the command rather than a path this invented.
+ */
+import fs from 'node:fs';
+let pnpmPath = null;
+export function resolvePnpm() {
+    if (pnpmPath)
+        return pnpmPath;
+    const home = process.env['HOME'] ?? '';
+    const candidates = [
+        // The two pnpm installs itself into, in the order it prefers.
+        process.env['PNPM_HOME'] ? `${process.env['PNPM_HOME']}/pnpm` : null,
+        home ? `${home}/Library/pnpm/pnpm` : null,
+        home ? `${home}/.local/share/pnpm/pnpm` : null,
+        '/opt/homebrew/bin/pnpm',
+        '/usr/local/bin/pnpm',
+    ].filter((c) => c !== null);
+    for (const candidate of candidates) {
+        try {
+            fs.accessSync(candidate, fs.constants.X_OK);
+            pnpmPath = candidate;
+            return candidate;
+        }
+        catch {
+            // Not here; try the next.
+        }
+    }
+    return 'pnpm';
+}
+/** The resolver, for a test that must run on the machine it is about. */
+export function resolvePnpmForTests() {
+    pnpmPath = null;
+    return resolvePnpm();
+}
+//# sourceMappingURL=pnpm.js.map

package/dist/shared/pnpm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pnpm.js","sourceRoot":"","sources":["../../src/shared/pnpm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,IAAI,QAAQ,GAAkB,IAAI,CAAC;AAEnC,MAAM,UAAU,WAAW;IACzB,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG;QACjB,8DAA8D;QAC9D,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QACpE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC,CAAC,IAAI;QACzC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,yBAAyB,CAAC,CAAC,CAAC,IAAI;QAC9C,wBAAwB;QACxB,qBAAqB;KACtB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAEzC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC5C,QAAQ,GAAG,SAAS,CAAC;YACrB,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB;IACjC,QAAQ,GAAG,IAAI,CAAC;IAChB,OAAO,WAAW,EAAE,CAAC;AACvB,CAAC"}

package/dist/shared/private-files.d.ts

@@ -0,0 +1,29 @@
+/** `rwx------` — the owner, and nobody else. */
+export declare const PRIVATE_DIR_MODE = 448;
+/** `rw-------`. */
+export declare const PRIVATE_FILE_MODE = 384;
+/**
+ * Create `dir` if missing, and make sure it is 0700 either way.
+ *
+ * `mkdirSync(dir, { mode })` applies the mode only to directories it actually
+ * creates, so on every host where the directory already exists — which is
+ * every host that has run the daemon before — passing a mode alone changes
+ * nothing. That is why the chmod is unconditional.
+ */
+export declare function ensurePrivateDir(dir: string): void;
+/**
+ * Make one file owner-only, along with any SQLite sidecar beside it.
+ *
+ * Best-effort: a backup that exists and is readable by its owner beats one
+ * that threw on the way to being tightened.
+ */
+export declare function sealFile(filepath: string): void;
+/**
+ * Tighten everything already in `dir`, and report how much was loose.
+ *
+ * The fix has to reach backwards: files written before it landed are the ones
+ * that have been sitting there longest. Returns the number of entries whose
+ * mode this actually changed, so a boot can say so once and then stay quiet.
+ */
+export declare function sealDirContents(dir: string): number;
+//# sourceMappingURL=private-files.d.ts.map

package/dist/shared/private-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-files.d.ts","sourceRoot":"","sources":["../../src/shared/private-files.ts"],"names":[],"mappings":"AA4BA,gDAAgD;AAChD,eAAO,MAAM,gBAAgB,MAAQ,CAAC;AAEtC,mBAAmB;AACnB,eAAO,MAAM,iBAAiB,MAAQ,CAAC;AAQvC;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAQlD;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAS/C;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAuBnD"}

package/dist/shared/private-files.js

@@ -0,0 +1,109 @@
+/**
+ * Files only the daemon's own user may read.
+ *
+ * Measured on a working host, 2026-09-12: `~/.omnitron/backups` was 0755 and
+ * every one of its 493 files was 0644 — world-readable. Among them 40
+ * `tor-keys` archives (the hidden service's ed25519 secret key: whoever holds
+ * one can BE the .onion), 48 `main` dumps (every user row, password hash,
+ * TOTP secret and PGP key), 48 `payments` dumps, and the live
+ * `~/.omnitron/data/daemon-state.db`. Anyone with a shell account on that
+ * machine could read all of it.
+ *
+ * The rule was already in the codebase a directory away: `config.json` is
+ * written 0600 and `daemon.sock` is bound 0600. What was missing was applying
+ * it to the files that matter most, and the reason is ordinary — those two are
+ * written by `fs.writeFileSync`, which takes a mode, while a backup is
+ * produced by `pg_dump > file`, `tar czf` or `sqlite3 .backup`, where the mode
+ * comes from the process umask and nobody chose it.
+ *
+ * So the mode is applied AFTER creation, at the one place each kind of file is
+ * finished, rather than hoped for from a umask the daemon does not control.
+ *
+ * Not encryption. A backup on this disk is still plaintext, and that is a
+ * separate decision with a key-management question attached. This only stops
+ * the other accounts on the host from reading it.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+/** `rwx------` — the owner, and nobody else. */
+export const PRIVATE_DIR_MODE = 0o700;
+/** `rw-------`. */
+export const PRIVATE_FILE_MODE = 0o600;
+/** SQLite leaves these beside the database it opens; they hold the same data. */
+const SIDECAR_SUFFIXES = ['-shm', '-wal', '-journal'];
+/** POSIX modes mean nothing on Windows, and `chmod` there is a partial lie. */
+const CAN_CHMOD = process.platform !== 'win32';
+/**
+ * Create `dir` if missing, and make sure it is 0700 either way.
+ *
+ * `mkdirSync(dir, { mode })` applies the mode only to directories it actually
+ * creates, so on every host where the directory already exists — which is
+ * every host that has run the daemon before — passing a mode alone changes
+ * nothing. That is why the chmod is unconditional.
+ */
+export function ensurePrivateDir(dir) {
+    fs.mkdirSync(dir, { recursive: true, mode: PRIVATE_DIR_MODE });
+    if (!CAN_CHMOD)
+        return;
+    try {
+        fs.chmodSync(dir, PRIVATE_DIR_MODE);
+    }
+    catch {
+        /* not ours to chmod — the caller still gets a usable directory */
+    }
+}
+/**
+ * Make one file owner-only, along with any SQLite sidecar beside it.
+ *
+ * Best-effort: a backup that exists and is readable by its owner beats one
+ * that threw on the way to being tightened.
+ */
+export function sealFile(filepath) {
+    if (!CAN_CHMOD)
+        return;
+    for (const suffix of ['', ...SIDECAR_SUFFIXES]) {
+        try {
+            fs.chmodSync(filepath + suffix, PRIVATE_FILE_MODE);
+        }
+        catch {
+            /* missing sidecar, or not ours */
+        }
+    }
+}
+/**
+ * Tighten everything already in `dir`, and report how much was loose.
+ *
+ * The fix has to reach backwards: files written before it landed are the ones
+ * that have been sitting there longest. Returns the number of entries whose
+ * mode this actually changed, so a boot can say so once and then stay quiet.
+ */
+export function sealDirContents(dir) {
+    if (!CAN_CHMOD)
+        return 0;
+    let tightened = 0;
+    let entries;
+    try {
+        entries = fs.readdirSync(dir);
+    }
+    catch {
+        return 0;
+    }
+    for (const entry of entries) {
+        const full = path.join(dir, entry);
+        try {
+            const stat = fs.lstatSync(full);
+            if (!stat.isFile())
+                continue;
+            // Only the group/other bits matter here; leave the owner's alone.
+            if ((stat.mode & 0o077) === 0)
+                continue;
+            fs.chmodSync(full, PRIVATE_FILE_MODE);
+            tightened++;
+        }
+        catch {
+            /* raced with a delete, or not ours */
+        }
+    }
+    return tightened;
+}
+//# sourceMappingURL=private-files.js.map

package/dist/shared/private-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-files.js","sourceRoot":"","sources":["../../src/shared/private-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,gDAAgD;AAChD,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAEtC,mBAAmB;AACnB,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEvC,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AAEtD,+EAA+E;AAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;IACpE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACvC,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,KAAK,MAAM,MAAM,IAAI,CAAC,EAAE,EAAE,GAAG,gBAAgB,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC;IACzB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC7B,kEAAkE;YAClE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;gBAAE,SAAS;YACxC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;YACtC,SAAS,EAAE,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/shared/redact-env.d.ts

@@ -0,0 +1,24 @@
+/**
+ * An app's environment as it may be shown: secrets replaced, everything else
+ * as it is.
+ *
+ * `omnitron env main` printed all twelve values in clear — JWT_SECRET (64
+ * characters) and DATABASE_URL with its password among them — and `inspect`
+ * masked by KEY NAME only, so the password inside `DATABASE_URL`
+ * (`postgres://postgres:<password>@…`) was printed by the command that
+ * claimed to mask. The daemon answered both with the raw values, to anyone
+ * with the operator role.
+ *
+ * One function now decides, and the daemon applies it before the values
+ * leave (`getEnv`); the clear values are a separate, admin-only, audited
+ * call (`revealEnv`).
+ */
+export declare const REDACTED = "***";
+/**
+ * The value with every credential it carries replaced: the password part of
+ * `scheme://user:password@host`, and a `password=` / `token=` / `secret=` /
+ * `key=` query parameter.
+ */
+export declare function redactValue(value: string): string;
+export declare function redactEnv(env: Readonly<Record<string, string>>): Record<string, string>;
+//# sourceMappingURL=redact-env.d.ts.map

package/dist/shared/redact-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-env.d.ts","sourceRoot":"","sources":["../../src/shared/redact-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAE9B;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIjD;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMvF"}

package/dist/shared/redact-env.js

@@ -0,0 +1,36 @@
+/**
+ * An app's environment as it may be shown: secrets replaced, everything else
+ * as it is.
+ *
+ * `omnitron env main` printed all twelve values in clear — JWT_SECRET (64
+ * characters) and DATABASE_URL with its password among them — and `inspect`
+ * masked by KEY NAME only, so the password inside `DATABASE_URL`
+ * (`postgres://postgres:<password>@…`) was printed by the command that
+ * claimed to mask. The daemon answered both with the raw values, to anyone
+ * with the operator role.
+ *
+ * One function now decides, and the daemon applies it before the values
+ * leave (`getEnv`); the clear values are a separate, admin-only, audited
+ * call (`revealEnv`).
+ */
+/** Names that hold a secret whatever their value looks like. */
+const SECRET_KEY = /secret|passw(or)?d|token|key|credential|private|mnemonic|seed|salt/i;
+export const REDACTED = '***';
+/**
+ * The value with every credential it carries replaced: the password part of
+ * `scheme://user:password@host`, and a `password=` / `token=` / `secret=` /
+ * `key=` query parameter.
+ */
+export function redactValue(value) {
+    return value
+        .replace(/(\/\/[^/@\s:]*:)[^/@\s]*@/g, `$1${REDACTED}@`)
+        .replace(/([?&](?:[a-z_]*password|[a-z_]*token|[a-z_]*secret|[a-z_]*key)=)[^&#\s]*/gi, `$1${REDACTED}`);
+}
+export function redactEnv(env) {
+    const out = {};
+    for (const [key, value] of Object.entries(env)) {
+        out[key] = SECRET_KEY.test(key) ? REDACTED : redactValue(value);
+    }
+    return out;
+}
+//# sourceMappingURL=redact-env.js.map

package/dist/shared/redact-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-env.js","sourceRoot":"","sources":["../../src/shared/redact-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,gEAAgE;AAChE,MAAM,UAAU,GAAG,qEAAqE,CAAC;AAEzF,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,CAAC;AAE9B;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,KAAK;SACT,OAAO,CAAC,4BAA4B,EAAE,KAAK,QAAQ,GAAG,CAAC;SACvD,OAAO,CAAC,4EAA4E,EAAE,KAAK,QAAQ,EAAE,CAAC,CAAC;AAC5G,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAqC;IAC7D,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}