@omnitron-dev/omnitron 0.2.0 → 0.3.0

package/dist/project/operator-account.js

@@ -0,0 +1,373 @@
+/**
+ * An operator account on a stack's node — the transport's pure half.
+ *
+ * A stand needs a named account with the platform's highest role that
+ * somebody can sign in with, and a fresh one has only the seed's: on
+ * daos/test, `admin` from a migration, whose password is in the project's
+ * repository and whose role is not the highest. The project knows how to make
+ * an account properly (`scripts/operator-account.mjs`: a captcha from the
+ * stand, its answer from the stack's redis, the application's own signup
+ * hashing the password, the role through its postgres). What it cannot do
+ * from a laptop is reach the node's containers. The master can — SSH with the
+ * node's own credentials, under the node's deploy lease, the transport the
+ * on-node attestation already uses.
+ *
+ * The password is generated ON the node and comes back SEALED — RSA-OAEP to a
+ * key this daemon makes for the one run and never writes down (`sealingKey`)
+ * — and is opened only to go into the vault. `omnitron secret get <key>`
+ * reads it, in the operator's own terminal.
+ *
+ * Sealed because the transport rewrites what looks like a secret. Every
+ * stdout the SSH layer returns passes through its masker, and
+ * `"password":"…"` comes back as `"password": [REDACTED]` — measured on
+ * daos/test, 2026-09-23: the first account made this way was made, the tool
+ * said so with exit 0, and the line carrying its password arrived as a line
+ * that was no longer JSON. It was refused, rightly — a masker that had kept
+ * the JSON valid would have put the string `[REDACTED]` in the vault — and
+ * the account stayed on the stand with a password nobody could ever read.
+ * A sealed password is nothing a masker recognises, and nothing any log that
+ * kept the line could use.
+ *
+ * Even so, a make's stdout is never quoted here: an answer this side cannot
+ * read is described by its shape, not its content.
+ */
+import { execFile } from 'node:child_process';
+import { constants, generateKeyPair, privateDecrypt } from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { promisify } from 'node:util';
+import { shellEscape } from '../shared/shell-escape.js';
+import { standContainerAssignments } from './stand-containers.js';
+const exec = promisify(execFile);
+/** The project's tool, relative to its root. */
+export const OPERATOR_ACCOUNT_TOOL = 'scripts/operator-account.mjs';
+/**
+ * The project's tool for what the probes left on a stand. Without flags it
+ * is a census — SELECTs and nothing else; its removal modes are not asked for
+ * from here.
+ */
+export const PROBE_LEFTOVERS_TOOL = 'scripts/probe-leftovers.mjs';
+/** Where the password is kept when the operator names no key. */
+export function accountVaultKey(project, stack, username) {
+    return `${project}.${stack}.account.${username}.password`;
+}
+export async function sealingKey() {
+    const { publicKey, privateKey } = await promisify(generateKeyPair)('rsa', { modulusLength: 3072 });
+    return {
+        spki: publicKey.export({ format: 'der', type: 'spki' }).toString('base64'),
+        open: (sealed) => privateDecrypt({ key: privateKey, padding: constants.RSA_PKCS1_OAEP_PADDING, oaepHash: 'sha256' }, Buffer.from(sealed, 'base64')).toString('utf8'),
+    };
+}
+/** The command the tool runs as on the node, the stand's containers named as they are there. */
+export function toolCommand(remoteDir, containerPrefix, flags, tool = OPERATOR_ACCOUNT_TOOL) {
+    return (`cd ${shellEscape(remoteDir)} && ${standContainerAssignments(containerPrefix)} ` +
+        `node ${tool}${flags.length > 0 ? ` ${flags.map((f) => shellEscape(f)).join(' ')}` : ''}`);
+}
+/**
+ * The make. `--role` and `--display-name` only when the operator gave them:
+ * which roles exist, and which one is the default, are the project's to say.
+ * `--seal-to` always.
+ */
+export function operatorAccountCommand(input) {
+    return toolCommand(input.remoteDir, input.containerPrefix, [
+        `--username=${input.username}`,
+        ...(input.role !== undefined ? [`--role=${input.role}`] : []),
+        ...(input.displayName !== undefined ? [`--display-name=${input.displayName}`] : []),
+        `--seal-to=${input.sealTo}`,
+    ]);
+}
+/** What the stand holds under a name — read, never a secret. */
+export function operatorAccountShowCommand(input) {
+    return toolCommand(input.remoteDir, input.containerPrefix, [`--show=${input.username}`]);
+}
+/** What the stand holds in aggregate — counts, never a value. */
+export function operatorCensusCommand(input) {
+    return toolCommand(input.remoteDir, input.containerPrefix, ['--census']);
+}
+/** The tool on the node in one of this door's modes; `also` names accounts no template matches, after the census. */
+export function probeLeftoversCommand(input) {
+    const also = input.also && input.also.length > 0 ? [`--also=${input.also.join(',')}`] : [];
+    const flags = input.mode === 'census' ? also : [`--${input.mode}`, ...also];
+    return toolCommand(input.remoteDir, input.containerPrefix, flags, PROBE_LEFTOVERS_TOOL);
+}
+/** What the probes left on the stand, counted and named — the tool without a flag, which is its census. */
+export function probeLeftoversCensusCommand(input) {
+    return probeLeftoversCommand({ ...input, mode: 'census' });
+}
+/** The row with this name AND this id, or nothing. */
+export function operatorAccountRemoveCommand(input) {
+    return toolCommand(input.remoteDir, input.containerPrefix, [`--remove=${input.username}`, `--id=${input.id}`]);
+}
+/** The last lines of what the tool said on stderr. */
+function wordsOf(stderr) {
+    return stderr.trim().split('\n').slice(-4).join(' | ');
+}
+/**
+ * The last line of stdout that is a JSON object with this key, searched from
+ * the end — as `parseAttestation` reads a producer: the answer is one object
+ * on one line, and a line after it (a transport's, a runtime's warning) does
+ * not hide it.
+ */
+function answerLine(stdout, key) {
+    const lines = stdout.split('\n').map((l) => l.trim()).filter(Boolean);
+    for (let i = lines.length - 1; i >= 0; i--) {
+        if (!lines[i].startsWith('{'))
+            continue;
+        try {
+            const parsed = JSON.parse(lines[i]);
+            if (parsed && typeof parsed === 'object' && key in parsed)
+                return parsed;
+        }
+        catch {
+            // Not this line.
+        }
+    }
+    return undefined;
+}
+/**
+ * What stdout looked like, without what it said: how many lines, and of the
+ * last whether it is JSON. A make's stdout is never quoted — see the head of
+ * this file.
+ */
+export function describeStdout(stdout) {
+    const lines = stdout.split('\n').map((l) => l.trim()).filter(Boolean);
+    if (lines.length === 0)
+        return 'stdout was empty';
+    const last = lines[lines.length - 1];
+    let what;
+    try {
+        const parsed = JSON.parse(last);
+        what = parsed && typeof parsed === 'object' ? `is a JSON object with ${Object.keys(parsed).join(', ') || 'no keys'}` : 'is JSON, not an object';
+    }
+    catch {
+        what = last.startsWith('{') ? 'starts like JSON and does not parse' : 'is not JSON';
+    }
+    return `stdout had ${lines.length} line(s); the last, ${last.length} characters, ${what}`;
+}
+/**
+ * A run of `probe-leftovers.mjs`, read. Only a report in the mode that was
+ * asked for is an answer: anything else means the tool did something this
+ * run never asked of it, and that is refused rather than shown as counts.
+ */
+export function readLeftoversRun(run, asked = 'census') {
+    if (run.code !== 0)
+        return { ok: false, because: `exit ${run.code}: ${wordsOf(run.stderr) || '(no words)'}` };
+    const report = answerLine(run.stdout, 'probeLeftovers')?.['probeLeftovers'];
+    if (!report || typeof report !== 'object') {
+        return { ok: false, because: `the tool exited 0 without a report (${describeStdout(run.stdout)})` };
+    }
+    if (report['mode'] !== asked) {
+        return { ok: false, because: `the tool answered in mode '${String(report['mode'])}', and this run asked for '${asked}'` };
+    }
+    const lines = run.stderr.split('\n').map((l) => l.trimEnd()).filter((l) => l.trim() !== '');
+    return { ok: true, census: { report, lines } };
+}
+/**
+ * A run of the make, read as the tool defines it.
+ *
+ *   0 — made: the answer line is `{"operatorAccount": {username, id, role,
+ *       sealed}}`, and `sealed` opens with this run's key.
+ *   1 — refused, with the reason on stderr (the name is taken, the stand
+ *       would not sign it up, the role did not stick).
+ *   2 — the tool refused its arguments — among them a tool too old to know
+ *       `--seal-to`, which refuses before it makes anything.
+ *
+ * Anything else is the transport — a signal, ssh's own 255 — and says
+ * nothing about whether the account was made. A `password` on the line is
+ * never read: through this transport it is `[REDACTED]` at best.
+ */
+export function readAccountRun(run, username, open) {
+    if (run.code === 0) {
+        const account = answerLine(run.stdout, 'operatorAccount')?.['operatorAccount'];
+        const unknownOutcome = (why) => ({
+            made: false,
+            uncertain: true,
+            because: `the tool exited 0, but ${why} — ${username} may be on the stand with a password nobody holds`,
+        });
+        if (!account || typeof account !== 'object')
+            return unknownOutcome(`no account line could be read (${describeStdout(run.stdout)})`);
+        if (account.username !== username)
+            return unknownOutcome('its account line names another account');
+        if (typeof account.id !== 'string' || typeof account.role !== 'string')
+            return unknownOutcome('its account line has no id or role');
+        if (typeof account.sealed !== 'string' || account.sealed.length === 0) {
+            return unknownOutcome('its account line carries no sealed password');
+        }
+        let password;
+        try {
+            password = open(account.sealed);
+        }
+        catch {
+            return unknownOutcome("the sealed password does not open with this run's key");
+        }
+        if (password.length === 0)
+            return unknownOutcome('the sealed password opened to nothing');
+        return { made: true, account: { username, password, id: account.id, role: account.role } };
+    }
+    if (run.code === 1) {
+        return { made: false, uncertain: false, because: `the stand refused: ${wordsOf(run.stderr) || '(the tool said nothing)'}` };
+    }
+    if (run.code === 2) {
+        return {
+            made: false,
+            uncertain: false,
+            because: `the tool refused its arguments (exit 2): ${wordsOf(run.stderr) || '(it said nothing)'}`,
+        };
+    }
+    return {
+        made: false,
+        uncertain: true,
+        because: `exit ${run.code} is the transport, not the tool — whether ${username} was made is not known: ` +
+            `${wordsOf(run.stderr) || '(no words)'}`,
+    };
+}
+/**
+ * A run of `--show`. Its stdout carries no secret, so an answer this side
+ * cannot read is quoted — the one place here that does.
+ */
+export function readShowRun(run) {
+    if (run.code === 0) {
+        const answer = answerLine(run.stdout, 'operatorAccountShown');
+        if (answer) {
+            const shown = answer['operatorAccountShown'];
+            if (shown === null)
+                return { ok: true, account: null };
+            if (shown && typeof shown.id === 'string' && typeof shown.username === 'string') {
+                const text = (v) => (typeof v === 'string' ? v : null);
+                return {
+                    ok: true,
+                    account: {
+                        username: shown.username,
+                        id: shown.id,
+                        role: text(shown.role) ?? '(none)',
+                        status: text(shown.status),
+                        createdAt: text(shown.createdAt),
+                        lastActiveAt: text(shown.lastActiveAt),
+                    },
+                };
+            }
+        }
+        return { ok: false, because: `the tool exited 0 with nothing this side can read: ${run.stdout.trim().slice(-300) || '(empty)'}` };
+    }
+    return { ok: false, because: `exit ${run.code}: ${wordsOf(run.stderr) || '(no words)'}` };
+}
+const isCount = (v) => typeof v === 'number' && Number.isInteger(v) && v >= 0;
+const isCounts = (v) => !!v && typeof v === 'object' && Object.values(v).every(isCount);
+/**
+ * A run of `--census`. Its stdout carries counts only, so an answer this side
+ * cannot read is quoted, as `--show`'s is.
+ */
+export function readCensusRun(run) {
+    if (run.code !== 0)
+        return { ok: false, because: `exit ${run.code}: ${wordsOf(run.stderr) || '(no words)'}` };
+    const c = answerLine(run.stdout, 'operatorCensus')?.['operatorCensus'];
+    const m = c?.mfa;
+    const a = c?.seededAdmin;
+    const p = c?.privileged;
+    const k = c?.keyedOnJwtSecret;
+    // Absent is a tool that predates the block; present and malformed is not an answer.
+    const privilegedWhole = p === undefined ||
+        (isCount(p.accounts) &&
+            isCounts(p.byCreatedDay) &&
+            (p.openWithPublishedPassword === null || isCount(p.openWithPublishedPassword)) &&
+            isCount(p.signedIn));
+    const keyedWhole = k === undefined || isCounts(k.pickupCodesLive);
+    const named = c?.counts;
+    const countsWhole = named === undefined || isCounts(named);
+    const whole = c &&
+        isCount(c.users) &&
+        isCounts(c.byRole) &&
+        isCounts(c.byStatus) &&
+        m &&
+        isCount(m.totpEnabled) &&
+        isCount(m.totpSecretEncrypted) &&
+        isCount(m.totpSecretPlain) &&
+        isCount(m.backupCodes) &&
+        a &&
+        typeof a.present === 'boolean' &&
+        (a.publishedPassword === null || typeof a.publishedPassword === 'boolean') &&
+        privilegedWhole &&
+        keyedWhole &&
+        countsWhole;
+    if (!whole) {
+        return { ok: false, because: `the tool exited 0 with nothing this side can read: ${run.stdout.trim().slice(-300) || '(empty)'}` };
+    }
+    return {
+        ok: true,
+        census: {
+            users: c.users,
+            byRole: c.byRole,
+            byStatus: c.byStatus,
+            mfa: {
+                totpEnabled: m.totpEnabled,
+                totpSecretEncrypted: m.totpSecretEncrypted,
+                totpSecretPlain: m.totpSecretPlain,
+                backupCodes: m.backupCodes,
+            },
+            seededAdmin: {
+                present: a.present,
+                status: typeof a.status === 'string' ? a.status : null,
+                role: typeof a.role === 'string' ? a.role : null,
+                publishedPassword: a.publishedPassword ?? null,
+            },
+            ...(p
+                ? {
+                    privileged: {
+                        accounts: p.accounts,
+                        byCreatedDay: p.byCreatedDay,
+                        openWithPublishedPassword: p.openWithPublishedPassword ?? null,
+                        signedIn: p.signedIn,
+                    },
+                }
+                : {}),
+            ...(k ? { keyedOnJwtSecret: { pickupCodesLive: k.pickupCodesLive } } : {}),
+            ...(named !== undefined ? { counts: named } : {}),
+        },
+    };
+}
+/** A run of `--remove`: removed, or why not. */
+export function readRemoveRun(run, username, id) {
+    if (run.code === 0) {
+        const answer = answerLine(run.stdout, 'operatorAccountRemoved')?.['operatorAccountRemoved'];
+        if (answer?.username === username && answer.id === id)
+            return { removed: true };
+        return { removed: false, because: `the tool exited 0 without saying it removed ${username} (${describeStdout(run.stdout)})` };
+    }
+    return { removed: false, because: `exit ${run.code}: ${wordsOf(run.stderr) || '(no words)'}` };
+}
+/**
+ * The project's `scripts/` at its HEAD commit, in a directory of its own.
+ *
+ * The commit, not the working tree: what runs on a stand with the power to
+ * hand out its highest role is code somebody committed, and the answer names
+ * which. Refused when that commit has no tool.
+ */
+export async function stageOperatorTool(projectPath, 
+/** The tool the run needs — refused when the commit has none. */
+tool = OPERATOR_ACCOUNT_TOOL) {
+    const { stdout: head } = await exec('git', ['rev-parse', 'HEAD'], { cwd: projectPath });
+    const commit = head.trim();
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'omnitron-operator-'));
+    try {
+        const archive = path.join(dir, 'scripts.tar');
+        await exec('git', ['archive', '--format=tar', `--output=${archive}`, commit, 'scripts'], {
+            cwd: projectPath,
+            maxBuffer: 64 * 1024 * 1024,
+        });
+        await exec('tar', ['-xf', archive, '-C', dir]);
+        fs.rmSync(archive);
+    }
+    catch (err) {
+        fs.rmSync(dir, { recursive: true, force: true });
+        throw new Error(`Could not take scripts/ from the project's commit ${commit.slice(0, 8)}: ${err.message}`, {
+            cause: err,
+        });
+    }
+    if (!fs.existsSync(path.join(dir, tool))) {
+        fs.rmSync(dir, { recursive: true, force: true });
+        throw new Error(`The project's commit ${commit.slice(0, 8)} has no ${tool} — there is no tool to run`);
+    }
+    return { dir, commit };
+}
+//# sourceMappingURL=operator-account.js.map

package/dist/project/operator-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator-account.js","sourceRoot":"","sources":["../../src/project/operator-account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAElE,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,8BAA8B,CAAC;AAEpE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAElE,iEAAiE;AACjE,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,KAAa,EAAE,QAAgB;IAC9E,OAAO,GAAG,OAAO,IAAI,KAAK,YAAY,QAAQ,WAAW,CAAC;AAC5D,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACnG,OAAO;QACL,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC1E,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CACf,cAAc,CACZ,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,sBAAsB,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAClF,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC9B,CAAC,QAAQ,CAAC,MAAM,CAAC;KACrB,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,WAAW,CACzB,SAAiB,EACjB,eAAuB,EACvB,KAAwB,EACxB,IAAI,GAAW,qBAAqB;IAEpC,OAAO,CACL,MAAM,WAAW,CAAC,SAAS,CAAC,OAAO,yBAAyB,CAAC,eAAe,CAAC,GAAG;QAChF,QAAQ,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1F,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAOtC;IACC,OAAO,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,eAAe,EAAE;QACzD,cAAc,KAAK,CAAC,QAAQ,EAAE;QAC9B,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,kBAAkB,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,aAAa,KAAK,CAAC,MAAM,EAAE;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,0BAA0B,CAAC,KAAuE;IAChH,OAAO,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,UAAU,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,qBAAqB,CAAC,KAAqD;IACzF,OAAO,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;AAC3E,CAAC;AAYD,qHAAqH;AACrH,MAAM,UAAU,qBAAqB,CAAC,KAKrC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;IAC5E,OAAO,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC;AAC1F,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,2BAA2B,CAAC,KAAqD;IAC/F,OAAO,qBAAqB,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,4BAA4B,CAAC,KAK5C;IACC,OAAO,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,YAAY,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACjH,CAAC;AAwBD,sDAAsD;AACtD,SAAS,OAAO,CAAC,MAAc;IAC7B,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,MAAc,EAAE,GAAW;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtE,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACzC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAE,CAA4B,CAAC;YAChE,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,GAAG,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC;IAClD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IACtC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,IAAI,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,yBAAyB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC;IAClJ,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,aAAa,CAAC;IACtF,CAAC;IACD,OAAO,cAAc,KAAK,CAAC,MAAM,uBAAuB,IAAI,CAAC,MAAM,gBAAgB,IAAI,EAAE,CAAC;AAC5F,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAqD,EACrD,KAAK,GAAkB,QAAQ;IAE/B,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,YAAY,EAAE,EAAE,CAAC;IAC9G,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,CAAC,gBAAgB,CAAwC,CAAC;IACnH,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,uCAAuC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IACtG,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,8BAA8B,KAAK,GAAG,EAAE,CAAC;IAC5H,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAqD,EACrD,QAAgB,EAChB,IAAgC;IAEhC,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC,iBAAiB,CAEhE,CAAC;QACd,MAAM,cAAc,GAAG,CAAC,GAAW,EAAc,EAAE,CAAC,CAAC;YACnD,IAAI,EAAE,KAAK;YACX,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,0BAA0B,GAAG,MAAM,QAAQ,mDAAmD;SACxG,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,cAAc,CAAC,kCAAkC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpI,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,cAAc,CAAC,wCAAwC,CAAC,CAAC;QACnG,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,cAAc,CAAC,oCAAoC,CAAC,CAAC;QACpI,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtE,OAAO,cAAc,CAAC,6CAA6C,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,cAAc,CAAC,uDAAuD,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,cAAc,CAAC,uCAAuC,CAAC,CAAC;QAC1F,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,sBAAsB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,yBAAyB,EAAE,EAAE,CAAC;IAC9H,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO;YACL,IAAI,EAAE,KAAK;YACX,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,4CAA4C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,mBAAmB,EAAE;SAClG,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,IAAI;QACf,OAAO,EACL,QAAQ,GAAG,CAAC,IAAI,6CAA6C,QAAQ,0BAA0B;YAC/F,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,YAAY,EAAE;KAC3C,CAAC;AACJ,CAAC;AAaD;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,GAAqD;IAErD,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;QAC9D,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,MAAM,CAAC,sBAAsB,CAOnC,CAAC;YACT,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACvD,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAChF,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAChE,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE;wBACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;wBACxB,EAAE,EAAE,KAAK,CAAC,EAAE;wBACZ,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,QAAQ;wBAClC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;wBAC1B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;wBAChC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;qBACvC;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,sDAAsD,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,SAAS,EAAE,EAAE,CAAC;IACpI,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,YAAY,EAAE,EAAE,CAAC;AAC5F,CAAC;AA+CD,MAAM,OAAO,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpG,MAAM,QAAQ,GAAG,CAAC,CAAU,EAA+B,EAAE,CAC3D,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,CAA4B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAE7F;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAqD;IAErD,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,YAAY,EAAE,EAAE,CAAC;IAC9G,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,CAAC,gBAAgB,CAAqC,CAAC;IAC3G,MAAM,CAAC,GAAG,CAAC,EAAE,GAA8C,CAAC;IAC5D,MAAM,CAAC,GAAG,CAAC,EAAE,WAA8D,CAAC;IAC5E,MAAM,CAAC,GAAG,CAAC,EAAE,UAAyE,CAAC;IACvF,MAAM,CAAC,GAAG,CAAC,EAAE,gBAAqF,CAAC;IACnG,oFAAoF;IACpF,MAAM,eAAe,GACnB,CAAC,KAAK,SAAS;QACf,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;YAClB,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC;YACxB,CAAC,CAAC,CAAC,yBAAyB,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC;YAC9E,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzB,MAAM,UAAU,GAAG,CAAC,KAAK,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,CAAC,EAAE,MAAiB,CAAC;IACnC,MAAM,WAAW,GAAG,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,KAAK,GACT,CAAC;QACD,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QAChB,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAClB,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QACpB,CAAC;QACD,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;QACtB,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC;QAC9B,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QAC1B,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;QACtB,CAAC;QACD,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS;QAC9B,CAAC,CAAC,CAAC,iBAAiB,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,iBAAiB,KAAK,SAAS,CAAC;QAC1E,eAAe;QACf,UAAU;QACV,WAAW,CAAC;IACd,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,sDAAsD,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,SAAS,EAAE,EAAE,CAAC;IACpI,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,KAAK,EAAE,CAAC,CAAC,KAAM;YACf,MAAM,EAAE,CAAC,CAAC,MAAO;YACjB,QAAQ,EAAE,CAAC,CAAC,QAAS;YACrB,GAAG,EAAE;gBACH,WAAW,EAAE,CAAC,CAAC,WAAY;gBAC3B,mBAAmB,EAAE,CAAC,CAAC,mBAAoB;gBAC3C,eAAe,EAAE,CAAC,CAAC,eAAgB;gBACnC,WAAW,EAAE,CAAC,CAAC,WAAY;aAC5B;YACD,WAAW,EAAE;gBACX,OAAO,EAAE,CAAC,CAAC,OAAQ;gBACnB,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;gBACtD,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;gBAChD,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,IAAI,IAAI;aAC/C;YACD,GAAG,CAAC,CAAC;gBACH,CAAC,CAAC;oBACE,UAAU,EAAE;wBACV,QAAQ,EAAE,CAAC,CAAC,QAAS;wBACrB,YAAY,EAAE,CAAC,CAAC,YAAa;wBAC7B,yBAAyB,EAAE,CAAC,CAAC,yBAAyB,IAAI,IAAI;wBAC9D,QAAQ,EAAE,CAAC,CAAC,QAAS;qBACtB;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,eAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAA+B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5E;KACF,CAAC;AACJ,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,aAAa,CAC3B,GAAqD,EACrD,QAAgB,EAChB,EAAU;IAEV,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,EAAE,CAAC,wBAAwB,CAE7E,CAAC;QACd,IAAI,MAAM,EAAE,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAChF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,+CAA+C,QAAQ,KAAK,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IAChI,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,YAAY,EAAE,EAAE,CAAC;AACjG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAmB;AACnB,iEAAiE;AACjE,IAAI,GAAW,qBAAqB;IAEpC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,YAAY,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE;YACvF,GAAG,EAAE,WAAW;YAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC5B,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/C,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,qDAAqD,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE;YACpH,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QACzC,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,IAAI,4BAA4B,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC"}

package/dist/project/registry.d.ts

@@ -1,15 +1,44 @@
 /**
- * Project Registry — Manages seed projects registered with omnitron
+ * Project Registry — Manages seed projects registered with omnitron.
  *
  * A seed project is a monorepo with `omnitron.config.ts` at the root.
  * Omnitron can manage multiple projects simultaneously.
  *
- * Registry stored in ~/.omnitron/projects/registry.json
+ * T-7 migration (this file): persistence moved from
+ * `~/.omnitron/projects/registry.json` (single fs.writeFileSync per
+ * mutation) onto the SQLite-backed `projects` table in
+ * DaemonStateStore. Same crash-safe + transactional guarantees as
+ * the unified daemon state, no torn-write risk on kill -9
+ * mid-flush. One-shot migration: if the legacy JSON file exists on
+ * first construction, its rows are imported into the table and
+ * the file is unlinked.
+ *
+ * API is unchanged — synchronous CRUD via better-sqlite3 prepared
+ * statements (the `..Sync` helpers on DaemonStateStore). Callers
+ * that did `new ProjectRegistry()` keep working; the only contract
+ * change is the constructor now requires the store handle.
  */
 import type { ISeedProject } from '../config/types.js';
+import type { DaemonStateStore } from '../daemon/daemon-state-store.service.js';
 export declare class ProjectRegistry {
-    private registry;
-    constructor();
+    private readonly store;
+    /**
+     * In-memory cache mirroring the persisted state. Reads (list/get)
+     * serve from here so legacy callers don't pay an SQLite round-
+     * trip per call; mutations write through to SQLite synchronously
+     * and update the cache on success.
+     */
+    private projects;
+    constructor(store: DaemonStateStore);
+    /**
+     * Stand-alone factory for CLI commands that don't have a running
+     * daemon's DI container (e.g. `omnitron project add` invoked
+     * before `omnitron up`). Constructs a DaemonStateStore inline
+     * with a no-op logger and opens the registry against it. The
+     * SQLite file is shared with the daemon — both writers use
+     * WAL-mode locking so concurrent access is safe.
+     */
+    static open(): ProjectRegistry;
     add(name: string, projectPath: string): ISeedProject;
     remove(name: string): void;
     updatePath(name: string, newPath: string): ISeedProject;
@@ -18,12 +47,20 @@ export declare class ProjectRegistry {
     getConfigPath(name: string): string | null;
     getWorkspaceDir(name: string): string;
     /**
-     * Persist current in-memory state to disk.
-     * Called by ProjectService when updating enabledStacks etc.
+     * Persist the cache to SQLite. Pre-fix this serialised the entire
+     * registry to JSON and overwrote the file; now it's a no-op
+     * because each mutation already writes through. Kept on the API
+     * so external callers (ProjectService.updateProject) compile
+     * unchanged.
      */
     persist(): void;
     autoDetect(cwd?: string): ISeedProject | null;
-    private load;
-    private save;
+    private loadFromStore;
+    /**
+     * One-shot migration: if the legacy JSON registry exists, import
+     * it into the SQLite store and unlink. Idempotent — running the
+     * new code against an already-migrated host is a no-op.
+     */
+    private migrateLegacyJsonIfPresent;
 }
 //# sourceMappingURL=registry.d.ts.map

package/dist/project/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/project/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAoB,MAAM,oBAAoB,CAAC;AAMzE,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAmB;;IAWnC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,YAAY;IA2BpD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAO1B,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY;IAiCvD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAItC,IAAI,IAAI,YAAY,EAAE;IAItB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAM1C,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAIrC;;;OAGG;IACH,OAAO,IAAI,IAAI;IAQf,UAAU,CAAC,GAAG,GAAE,MAAsB,GAAG,YAAY,GAAG,IAAI;IAmB5D,OAAO,CAAC,IAAI;IAoBZ,OAAO,CAAC,IAAI;CAGb"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/project/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAoB,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAmChF,qBAAa,eAAe;IASd,OAAO,CAAC,QAAQ,CAAC,KAAK;IARlC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAmC;IAEnD,YAA6B,KAAK,EAAE,gBAAgB,EAInD;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,IAAI,IAAI,eAAe,CAsB7B;IAMD,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,YAAY,CA6BnD;IAED,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAKzB;IAED,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,CA0CtD;IAED,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAErC;IAED,IAAI,IAAI,YAAY,EAAE,CAErB;IAED,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIzC;IAED,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpC;IAED;;;;;;OAMG;IACH,OAAO,IAAI,IAAI,CAyBd;IAMD,UAAU,CAAC,GAAG,GAAE,MAAsB,GAAG,YAAY,GAAG,IAAI,CAa3D;IAMD,OAAO,CAAC,aAAa;IAqBrB;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;CAwCnC"}