@omnitron-dev/omnitron 0.2.0 → 0.3.0

package/dist/services/audit.service.js

@@ -0,0 +1,242 @@
+/**
+ * Who changed this control plane, and what they changed.
+ *
+ * `omnitron_audit_log` has been in the schema since the first migration —
+ * `action`, `actorId`, `actorType`, `resourceType`, `resourceId`, `details`,
+ * `ipAddress`, four indexes — and nothing has ever written a row to it. So a
+ * console with accounts, roles and sessions could not answer who stopped a
+ * stack, who added a node, or who read a secret out of the vault, and the
+ * only account of any of it was a log line that rotates.
+ *
+ * The actor is the identity the call was ADMITTED with: the auth context the
+ * RPC guard enforced, carried into an AsyncLocalStorage by the transport's
+ * invocation wrapper — so a row cannot claim an identity the request did not
+ * carry, and never invents one.
+ *
+ *   user     a console session's account — or `omnitron-local`, the context
+ *            the daemon grants every connection on its owner-only unix
+ *            socket, which is where the CLI (and an MCP tool) arrives. The
+ *            trust there is the socket's permissions rather than a session,
+ *            and the id says so.
+ *   service  another omnitron acting as the control plane: `service_role`,
+ *            no account behind it.
+ *   system   nothing asked. The daemon acting on its own — a boot autostart,
+ *            the enabled-stacks reconciler.
+ *
+ * This said a CLI call was `system`, and for a reason that was no design: the
+ * unix transport was registered without the invocation wrapper the HTTP and
+ * WebSocket ones have, so the store was empty on every CLI call while the
+ * guard, one layer down, was admitting it as `omnitron-local`. Measured on
+ * the master 2026-09-23: 171 of 178 rows `system`, `omnitron audit --actor
+ * system` answering «nothing recorded», and a deployment the operator typed
+ * indistinguishable from one the daemon started at boot.
+ *
+ * Not only what was asked of this daemon, either — this also said a boot
+ * autostart was in the log and not here, and 44 of the master's 79
+ * `stack.start` rows were exactly that. A stack start is recorded for every
+ * caller, with `details.source` naming which (`operator`, `boot`,
+ * `auto-resume`). What is in the log only: a supervisor restarting a crashed
+ * app, and a remote stack a restart re-attaches, which deploys nothing.
+ *
+ * How it ended. Most writers record after their action succeeded and write no
+ * outcome — the row IS the action. A writer that records both endings passes
+ * `outcome`, and a failure keeps the first line of its error (see
+ * `describeFailure`). `outcomeOf` (`shared/audit-outcome.ts`, which the
+ * console reads too) reads either convention, including the older one of
+ * naming the failure in the action (`node.upgrade.failed`).
+ *
+ * Best-effort by design: the action has already happened — or already failed
+ * — when this is called, and failing it afterwards would turn an unrecorded
+ * change into a broken one. A write that fails is reported at error with the
+ * action it could not record, which is the state an operator needs to know
+ * about.
+ */
+import { redactTokens } from '../release/publish.js';
+import { getCurrentAuth, getRequestContext } from './auth-context.js';
+/**
+ * Who an actor can be, as `currentActor` answers it — and the words `omnitron
+ * audit --actor` takes as a KIND of actor rather than an id.
+ */
+export const ACTOR_TYPES = ['user', 'service', 'system'];
+/**
+ * The most rows one call may ask for.
+ *
+ * A page size is the cost of the request, and the server is the only side
+ * that knows what it can afford — see `node-manager.rpc-service`, which
+ * learned this the same way.
+ */
+export const MAX_AUDIT_PAGE = 500;
+/** Keys whose VALUE is a credential, whatever the caller meant by them. */
+const SECRET_KEY = /password|passphrase|secret|token|credential|privatekey|apikey/i;
+/** `details`, with anything that looks like a credential removed. */
+export function scrubDetails(details) {
+    if (!details)
+        return null;
+    const out = {};
+    for (const [key, value] of Object.entries(details)) {
+        if (SECRET_KEY.test(key)) {
+            out[key] = '[redacted]';
+            continue;
+        }
+        // One level. A nested object is a payload, and this table takes facts.
+        out[key] = value && typeof value === 'object' && !Array.isArray(value) ? '[object]' : value;
+    }
+    return out;
+}
+/** The longest failure a row keeps. The whole error is in the daemon log. */
+const MAX_FAILURE_TEXT = 300;
+/**
+ * A failure as a row keeps it: the first line of what the error said, with a
+ * credential a connection string carried taken out, and bounded.
+ *
+ * The first line because the rest is for a terminal — the dirty-tree refusal
+ * goes on to list ten file names. Redacted because an error is not a detail
+ * a caller chose: it is whatever the failing layer wrote, and a
+ * `redis://user:pass@host` has reached the daemon log that way before (see
+ * `redactTokens`).
+ */
+export function describeFailure(err) {
+    // An error that crossed a transport arrives as a plain `{ message }`.
+    const message = err instanceof Error
+        ? err.message
+        : err && typeof err === 'object' && typeof err.message === 'string'
+            ? err.message
+            : String(err);
+    const first = message
+        .split('\n')
+        .map((line) => line.trim())
+        .find((line) => line.length > 0) ?? '(the error said nothing)';
+    const clean = redactTokens(first);
+    return clean.length > MAX_FAILURE_TEXT ? `${clean.slice(0, MAX_FAILURE_TEXT - 1)}…` : clean;
+}
+/** Who is calling, as the request proved rather than as it claimed. */
+export function currentActor() {
+    const auth = getCurrentAuth();
+    if (!auth)
+        return { actorId: null, actorType: 'system' };
+    const roles = auth.roles ?? [];
+    // A master reaching a node carries `service_role` and no human behind it.
+    if (roles.includes('service_role') && !auth.userId) {
+        return { actorId: null, actorType: 'service' };
+    }
+    return { actorId: auth.userId ?? null, actorType: auth.userId ? 'user' : 'system' };
+}
+export class AuditService {
+    logger;
+    db;
+    constructor(logger, 
+    /** `null` on a daemon with no omnitron database — a slave, or a boot that failed. */
+    db) {
+        this.logger = logger;
+        this.db = db;
+    }
+    /** Whether anything written here can be read back. */
+    get available() {
+        return this.db !== null;
+    }
+    async record(entry) {
+        if (!this.db)
+            return;
+        const { actorId, actorType } = currentActor();
+        const ipAddress = getRequestContext()?.ipAddress ?? null;
+        // After the scrub, so neither can be mistaken for something to redact;
+        // the error is made safe by `describeFailure` instead.
+        const scrubbed = scrubDetails(entry.details);
+        const details = entry.outcome
+            ? {
+                ...(scrubbed ?? {}),
+                outcome: entry.outcome,
+                ...(entry.outcome === 'failed' && entry.error !== undefined ? { error: describeFailure(entry.error) } : {}),
+            }
+            : scrubbed;
+        try {
+            await this.db
+                .insertInto('omnitron_audit_log')
+                .values({
+                action: entry.action,
+                actorId,
+                actorType,
+                resourceType: entry.resourceType,
+                resourceId: entry.resourceId ?? null,
+                details: details,
+                ipAddress,
+            })
+                .execute();
+        }
+        catch (err) {
+            this.logger.error({ action: entry.action, resource: `${entry.resourceType}:${entry.resourceId ?? '-'}`, error: err.message }, 'Could not record this action in the audit log — it happened and nothing recorded it');
+        }
+    }
+    async list(query = {}) {
+        if (!this.db)
+            return [];
+        // Refused by name before the database sees it. `Math.floor(NaN)` is NaN,
+        // which `min`/`max` pass straight through, so `omnitron audit -n abc`
+        // reached Postgres as `LIMIT NaN` and came back as «invalid input syntax
+        // for type bigint: "NaN"» — an error about SQL, for a typo in a flag.
+        const asked = query.limit == null ? 100 : Number(query.limit);
+        if (Number.isNaN(asked)) {
+            throw new Error(`limit is a number of entries, 1 to ${MAX_AUDIT_PAGE} — not "${String(query.limit)}"`);
+        }
+        const limit = Math.min(MAX_AUDIT_PAGE, Math.max(1, Math.floor(asked)));
+        const before = query.before ? new Date(query.before) : null;
+        if (before && Number.isNaN(before.getTime())) {
+            throw new Error(`before is an ISO timestamp such as 2026-09-22T21:20:37Z — not "${String(query.before)}"`);
+        }
+        let q = this.db
+            .selectFrom('omnitron_audit_log')
+            .selectAll()
+            .orderBy('createdAt', 'desc')
+            .limit(limit);
+        if (query.action)
+            q = q.where('action', '=', query.action);
+        if (query.resourceType)
+            q = q.where('resourceType', '=', query.resourceType);
+        if (query.actorId)
+            q = q.where('actorId', '=', query.actorId);
+        if (query.actorType)
+            q = q.where('actorType', '=', query.actorType);
+        if (before)
+            q = q.where('createdAt', '<', before);
+        const rows = await q.execute();
+        return rows.map(toAuditRow);
+    }
+    /**
+     * The newest row for each resource, for one action — «what each stack last
+     * did», over the whole trail.
+     *
+     * `OmnitronRelease.deployments()` read the newest 200 `stack.start` rows and
+     * took the first per stack. Measured on the master: 80 such rows in three
+     * days, 57 of them on one day — every daemon start writes one for the local
+     * stack — so the window was about 3.5 days. A stack left running longer read
+     * as never deployed, and `prune` did not protect the release it runs.
+     */
+    async latestPerResource(action) {
+        if (!this.db)
+            return [];
+        const rows = await this.db
+            .selectFrom('omnitron_audit_log')
+            .distinctOn('resourceId')
+            .selectAll()
+            .where('action', '=', action)
+            .where('resourceId', 'is not', null)
+            .orderBy('resourceId')
+            .orderBy('createdAt', 'desc')
+            .execute();
+        return rows.map(toAuditRow);
+    }
+}
+function toAuditRow(r) {
+    return {
+        id: String(r.id),
+        action: r.action,
+        actorId: r.actorId ?? null,
+        actorType: r.actorType,
+        resourceType: r.resourceType,
+        resourceId: r.resourceId ?? null,
+        details: r.details ?? null,
+        ipAddress: r.ipAddress ?? null,
+        createdAt: r.createdAt instanceof Date ? r.createdAt.toISOString() : String(r.createdAt),
+    };
+}
+//# sourceMappingURL=audit.service.js.map

package/dist/services/audit.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.service.js","sourceRoot":"","sources":["../../src/services/audit.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAMH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AA4BtE;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAC;AAgClE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAElC,2EAA2E;AAC3E,MAAM,UAAU,GAAG,gEAAgE,CAAC;AAEpF,qEAAqE;AACrE,MAAM,UAAU,YAAY,CAC1B,OAAmD;IAEnD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;YACxB,SAAS;QACX,CAAC;QACD,uEAAuE;QACvE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,sEAAsE;IACtE,MAAM,OAAO,GACX,GAAG,YAAY,KAAK;QAClB,CAAC,CAAC,GAAG,CAAC,OAAO;QACb,CAAC,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAQ,GAA6B,CAAC,OAAO,KAAK,QAAQ;YAC5F,CAAC,CAAE,GAA2B,CAAC,OAAO;YACtC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpB,MAAM,KAAK,GACT,OAAO;SACJ,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,0BAA0B,CAAC;IACnE,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9F,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY;IAC1B,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAEzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,0EAA0E;IAC1E,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtF,CAAC;AAED,MAAM,OAAO,YAAY;IAEJ,MAAM;IAEN,EAAE;IAHrB,YACmB,MAAe;IAChC,qFAAqF;IACpE,EAAmC;sBAFnC,MAAM;kBAEN,EAAE;IAClB,CAAC;IAEJ,sDAAsD;IACtD,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAiB;QAC5B,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO;QACrB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,iBAAiB,EAAE,EAAE,SAAS,IAAI,IAAI,CAAC;QAEzD,uEAAuE;QACvE,uDAAuD;QACvD,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO;YAC3B,CAAC,CAAC;gBACE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACnB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5G;YACH,CAAC,CAAC,QAAQ,CAAC;QAEb,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE;iBACV,UAAU,CAAC,oBAAoB,CAAC;iBAChC,MAAM,CAAC;gBACN,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO;gBACP,SAAS;gBACT,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;gBACpC,OAAO,EAAE,OAAgB;gBACzB,SAAS;aACD,CAAC;iBACV,OAAO,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EACrH,qFAAqF,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAK,GAAe,EAAE;QAC/B,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACxB,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,cAAc,WAAW,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,kEAAkE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7G,CAAC;QAED,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE;aACZ,UAAU,CAAC,oBAAoB,CAAC;aAChC,SAAS,EAAE;aACX,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;aAC5B,KAAK,CAAC,KAAK,CAAC,CAAC;QAEhB,IAAI,KAAK,CAAC,MAAM;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,YAAY;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7E,IAAI,KAAK,CAAC,OAAO;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,KAAK,CAAC,SAAS;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,MAAM;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,MAAe,CAAC,CAAC;QAE3D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,oBAAoB,CAAC;aAChC,UAAU,CAAC,YAAY,CAAC;aACxB,SAAS,EAAE;aACX,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;aAC5B,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC;aACnC,OAAO,CAAC,YAAY,CAAC;aACrB,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;aAC5B,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;CACF;AAED,SAAS,UAAU,CAAC,CAUnB;IACC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;QAChC,OAAO,EAAG,CAAC,CAAC,OAA0C,IAAI,IAAI;QAC9D,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC9B,SAAS,EAAE,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;KACzF,CAAC;AACJ,CAAC"}

package/dist/services/auth-context.d.ts

@@ -9,6 +9,24 @@
  * but simplified — daemon doesn't need full RLS, just auth identity.
  */
 import type { AuthContext } from '@omnitron-dev/titan/netron/auth';
+/**
+ * Per-request facts the transport knows and the service layer cannot ask for.
+ *
+ * Kept separate from `AuthContext`: that describes WHO is calling (from a
+ * verified token), this describes HOW the call arrived. Mixing them would
+ * invite treating a header as an identity claim.
+ */
+export interface RequestContext {
+    /** Peer address as seen by the server, or undefined when unavailable. */
+    ipAddress?: string;
+    /**
+     * The Netron peer the call arrived from — for a service that answers that
+     * peer later (`OmnitronEvents` pushes events to the connection that asked).
+     */
+    peerId?: string;
+}
+/** The current request's transport facts, or null outside a request. */
+export declare function getRequestContext(): RequestContext | null;
 /**
  * Get the current auth context from AsyncLocalStorage.
  * Returns null if no auth context is set (anonymous request).
@@ -35,5 +53,7 @@ export declare function runWithAuth<T>(authContext: AuthContext, fn: () => T | P
  *
  * This is the standard Titan pattern — same as apps/main bootstrap.
  */
-export declare function createAuthContextWrapper(): (metadata: Map<string, unknown>, fn: () => Promise<unknown>) => Promise<unknown>;
+export declare function createAuthContextWrapper(options?: {
+    trustProxy?: boolean;
+}): (metadata: Map<string, unknown>, fn: () => Promise<unknown>) => Promise<unknown>;
 //# sourceMappingURL=auth-context.d.ts.map

package/dist/services/auth-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-context.d.ts","sourceRoot":"","sources":["../../src/services/auth-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAYnE;;;GAGG;AACH,wBAAgB,cAAc,IAAI,WAAW,GAAG,IAAI,CAEnD;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,WAAW,CAMzC;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAEjG;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,KACxB,UAAU,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,MAAM,OAAO,CAAC,OAAO,CAAC,KAAG,OAAO,CAAC,OAAO,CAAC,CAO5F"}
+{"version":3,"file":"auth-context.d.ts","sourceRoot":"","sources":["../../src/services/auth-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID,wEAAwE;AACxE,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAEzD;AAYD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,WAAW,GAAG,IAAI,CAEnD;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,WAAW,CAMzC;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAEjG;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAO,cACrD,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,MAAM,OAAO,CAAC,OAAO,CAAC,KAAG,OAAO,CAAC,OAAO,CAAC,CAY5F"}

package/dist/services/auth-context.js

@@ -9,6 +9,11 @@
  * but simplified — daemon doesn't need full RLS, just auth identity.
  */
 import { AsyncLocalStorage } from 'node:async_hooks';
+const requestContextStorage = new AsyncLocalStorage();
+/** The current request's transport facts, or null outside a request. */
+export function getRequestContext() {
+    return requestContextStorage.getStore() ?? null;
+}
 // ---------------------------------------------------------------------------
 // AsyncLocalStorage instance (singleton)
 // ---------------------------------------------------------------------------
@@ -54,13 +59,54 @@ export function runWithAuth(authContext, fn) {
  *
  * This is the standard Titan pattern — same as apps/main bootstrap.
  */
-export function createAuthContextWrapper() {
+export function createAuthContextWrapper(options = {}) {
     return async (metadata, fn) => {
         const authCtx = metadata.get('authContext');
-        if (authCtx) {
-            return runWithAuth(authCtx, fn);
-        }
-        return fn();
+        const requestCtx = {};
+        const ip = resolveClientIp(metadata, options.trustProxy === true);
+        if (ip)
+            requestCtx.ipAddress = ip;
+        const peerId = metadata.get('peerId');
+        if (typeof peerId === 'string' && peerId.length > 0)
+            requestCtx.peerId = peerId;
+        const run = () => (authCtx ? runWithAuth(authCtx, fn) : fn());
+        return requestContextStorage.run(requestCtx, run);
     };
 }
+/**
+ * Determine the caller's address from transport metadata.
+ *
+ * ## Why this is header-only
+ *
+ * Netron's HTTP server is built on the fetch `Request` API, which carries no
+ * peer address — Node exposes the socket, the Request does not. So the only
+ * address available at this layer is one a proxy wrote into a header.
+ *
+ * That makes `trustProxy` load-bearing rather than a nicety. A header is
+ * written by whoever is talking to us: believed unconditionally, a client
+ * could choose the address recorded against its own session, and the
+ * operator's session list would repeat that choice as fact. (That is exactly
+ * why `ipAddress` was removed from the sign-in payload — see
+ * auth.rpc-service.ts. Re-introducing it via an untrusted header would undo
+ * the fix in a different costume.)
+ *
+ * So: with no declared proxy the address stays UNKNOWN and the session list
+ * shows "--". An honest blank beats a forgeable value.
+ *
+ * Header names arrive lower-cased. The middleware adapter also strips a
+ * leading `x-`, while the RPC path does not, so both spellings are accepted.
+ */
+function resolveClientIp(metadata, trustProxy) {
+    if (!trustProxy)
+        return undefined;
+    const forwarded = metadata.get('x-forwarded-for') ?? metadata.get('forwarded-for');
+    if (typeof forwarded === 'string' && forwarded.length > 0) {
+        // Left-most entry is the original client; the rest are proxies.
+        const first = forwarded.split(',')[0]?.trim();
+        if (first)
+            return first;
+    }
+    const realIp = metadata.get('x-real-ip') ?? metadata.get('real-ip');
+    return typeof realIp === 'string' && realIp.length > 0 ? realIp : undefined;
+}
 //# sourceMappingURL=auth-context.js.map

package/dist/services/auth-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-context.js","sourceRoot":"","sources":["../../src/services/auth-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,8EAA8E;AAC9E,yCAAyC;AACzC,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,IAAI,iBAAiB,EAAe,CAAC;AAEhE,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,kBAAkB,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,WAAW,EAAE,CAAC,MAAM,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAI,WAAwB,EAAE,EAAwB;IAC/E,OAAO,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,KAAK,EAAE,QAA8B,EAAE,EAA0B,EAAoB,EAAE;QAC5F,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,CAA4B,CAAC;QACvE,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,EAAE,EAAE,CAAC;IACd,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth-context.js","sourceRoot":"","sources":["../../src/services/auth-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAoBrD,MAAM,qBAAqB,GAAG,IAAI,iBAAiB,EAAkB,CAAC;AAEtE,wEAAwE;AACxE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,qBAAqB,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,yCAAyC;AACzC,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,IAAI,iBAAiB,EAAe,CAAC;AAEhE,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,kBAAkB,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,WAAW,EAAE,CAAC,MAAM,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAI,WAAwB,EAAE,EAAwB;IAC/E,OAAO,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAO,GAA6B,EAAE;IAC7E,OAAO,KAAK,EAAE,QAA8B,EAAE,EAA0B,EAAoB,EAAE;QAC5F,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,CAA4B,CAAC;QACvE,MAAM,UAAU,GAAmB,EAAE,CAAC;QAEtC,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;QAClE,IAAI,EAAE;YAAE,UAAU,CAAC,SAAS,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC;QAEhF,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9D,OAAO,qBAAqB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,eAAe,CAAC,QAA8B,EAAE,UAAmB;IAC1E,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAElC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACnF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,gEAAgE;QAChE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC9C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACpE,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC"}

package/dist/services/auth.rpc-service.d.ts

@@ -20,7 +20,6 @@ export declare class AuthRpcService {
     signIn(data: {
         username: string;
         password: string;
-        ipAddress?: string;
         userAgent?: string;
     }): Promise<OmnitronSignInResult>;
     validateToken(data: {

package/dist/services/auth.rpc-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.rpc-service.d.ts","sourceRoot":"","sources":["../../src/services/auth.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,KAAK,EACV,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,mBAAmB,CAAC;AAE3B,qBACa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,WAAW;IAO/C,MAAM,CAAC,IAAI,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAK3B,aAAa,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACpD,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IAOI,eAAe,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAC1D,KAAK,EAAE,OAAO,CAAC;QACf,IAAI,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;QACpC,OAAO,CAAC,EAAE;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC;KAC7C,CAAC;IAQI,cAAc,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACzD,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,oBAAoB,CAAC;KAC/B,CAAC;IAOI,OAAO,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAkBnE,iBAAiB,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAOrD,cAAc,CAAC,IAAI,EAAE;QACzB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CAMlC"}
+{"version":3,"file":"auth.rpc-service.d.ts","sourceRoot":"","sources":["../../src/services/auth.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,OAAO,KAAK,EACV,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,mBAAmB,CAAC;AAE3B,qBACa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,WAAW;IAAxC,YAA6B,WAAW,EAAE,WAAW,EAAI;IAOnD,MAAM,CAAC,IAAI,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAWhC;IAGK,aAAa,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACpD,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CAKD;IAGK,eAAe,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAC1D,KAAK,EAAE,OAAO,CAAC;QACf,IAAI,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;QACpC,OAAO,CAAC,EAAE;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC;KAC7C,CAAC,CAMD;IAGK,cAAc,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACzD,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,oBAAoB,CAAC;KAC/B,CAAC,CAKD;IAGK,OAAO,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAaxE;IAOK,iBAAiB,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAI1D;IAGK,cAAc,CAAC,IAAI,EAAE;QACzB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAKhC;CACF"}

package/dist/services/auth.rpc-service.js

@@ -23,7 +23,9 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 import { Service, Public } from '@omnitron-dev/titan/decorators';
-import { getCurrentAuth, requireAuth } from './auth-context.js';
+import { Errors } from '@omnitron-dev/titan/errors';
+import { requirePayload, requireString } from './anonymous-input.js';
+import { getCurrentAuth, requireAuth, getRequestContext } from './auth-context.js';
 let AuthRpcService = class AuthRpcService {
     authService;
     constructor(authService) {
@@ -33,37 +35,49 @@ let AuthRpcService = class AuthRpcService {
     // Public (anonymous) endpoints — no token required
     // ===========================================================================
     async signIn(data) {
-        return this.authService.signIn(data);
+        // The address is taken from the TRANSPORT, never from the payload. It
+        // used to be a client-supplied field written to omnitron_sessions
+        // verbatim, so a client could stamp any address onto its own session and
+        // the operator's session list would repeat it as fact.
+        const payload = requirePayload(data, 'signIn');
+        requireString(payload, 'username', 'signIn');
+        requireString(payload, 'password', 'signIn');
+        const ipAddress = getRequestContext()?.ipAddress;
+        return this.authService.signIn(data, ipAddress ? { ipAddress } : {});
     }
     async validateToken(data) {
-        const result = await this.authService.validateToken(data.token);
+        const token = requireString(requirePayload(data, 'validateToken'), 'token', 'validateToken');
+        const result = await this.authService.validateToken(token);
         if (!result)
             return { valid: false };
         return { valid: true, userId: result.userId, sessionId: result.sessionId };
     }
     async validateSession(data) {
-        const user = await this.authService.validateSession(data.sessionId);
+        const sessionId = requireString(requirePayload(data, 'validateSession'), 'sessionId', 'validateSession');
+        const user = await this.authService.validateSession(sessionId);
         if (!user)
             return { valid: false };
-        const session = await this.authService.getSessionInfo(data.sessionId);
+        const session = await this.authService.getSessionInfo(sessionId);
         return { valid: true, user, session: session ? { expiresAt: session.expiresAt.toISOString() } : undefined };
     }
     async refreshSession(data) {
-        const result = await this.authService.refreshSession(data.sessionId);
+        const sessionId = requireString(requirePayload(data, 'refreshSession'), 'sessionId', 'refreshSession');
+        const result = await this.authService.refreshSession(sessionId);
         if (!result)
             return { success: false };
         return { success: true, result };
     }
     async signOut(data) {
+        const sessionId = requireString(requirePayload(data, 'signOut'), 'sessionId', 'signOut');
         // If authenticated, verify session ownership
         const auth = getCurrentAuth();
         if (auth) {
-            const sessionOwner = await this.authService.validateSession(data.sessionId);
+            const sessionOwner = await this.authService.validateSession(sessionId);
             if (sessionOwner && sessionOwner.id !== auth.userId) {
-                throw new Error('Forbidden: cannot revoke another user\'s session');
+                throw Errors.forbidden('Cannot revoke another user\'s session');
             }
         }
-        await this.authService.signOut(data.sessionId);
+        await this.authService.signOut(sessionId);
         return { success: true };
     }
     // ===========================================================================

package/dist/services/auth.rpc-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.rpc-service.js","sourceRoot":"","sources":["../../src/services/auth.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AASzD,IAAM,cAAc,GAApB,MAAM,cAAc;IACI;IAA7B,YAA6B,WAAwB;QAAxB,gBAAW,GAAX,WAAW,CAAa;IAAG,CAAC;IAEzD,8EAA8E;IAC9E,mDAAmD;IACnD,8EAA8E;IAGxE,AAAN,KAAK,CAAC,MAAM,CAAC,IAKZ;QACC,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAGK,AAAN,KAAK,CAAC,aAAa,CAAC,IAAuB;QAKzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IAC7E,CAAC;IAGK,AAAN,KAAK,CAAC,eAAe,CAAC,IAA2B;QAK/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC9G,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc,CAAC,IAA2B;QAI9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAC,IAA2B;QACvC,6CAA6C;QAC7C,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC5E,IAAI,YAAY,IAAI,YAAY,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,8EAA8E;IAC9E,+DAA+D;IAC/D,8EAA8E;IAGxE,AAAN,KAAK,CAAC,iBAAiB;QACrB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAI,IAAI,CAAC,QAAgB,EAAE,SAAS,CAAC;QACpD,OAAO,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpE,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc,CAAC,IAGpB;QACC,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAI,IAAI,CAAC,QAAgB,EAAE,SAAS,CAAC;QACpD,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAClG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AA7EO;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;4CAQ1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;mDAS1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;qDAU1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;oDAQ1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;6CAY1C;AAOK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;;;uDAKtB;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;;;oDAStB;AApFU,cAAc;IAD1B,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;;GACrB,cAAc,CAqF1B"}
+{"version":3,"file":"auth.rpc-service.js","sourceRoot":"","sources":["../../src/services/auth.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAS5E,IAAM,cAAc,GAApB,MAAM,cAAc;IACI,WAAW;IAAxC,YAA6B,WAAwB;2BAAxB,WAAW;IAAgB,CAAC;IAEzD,8EAA8E;IAC9E,mDAAmD;IACnD,8EAA8E;IAGxE,AAAN,KAAK,CAAC,MAAM,CAAC,IAIZ;QACC,sEAAsE;QACtE,kEAAkE;QAClE,yEAAyE;QACzE,uDAAuD;QACvD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/C,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC7C,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAE7C,MAAM,SAAS,GAAG,iBAAiB,EAAE,EAAE,SAAS,CAAC;QACjD,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAGK,AAAN,KAAK,CAAC,aAAa,CAAC,IAAuB;QAKzC,MAAM,KAAK,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IAC7E,CAAC;IAGK,AAAN,KAAK,CAAC,eAAe,CAAC,IAA2B;QAK/C,MAAM,SAAS,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;QACzG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC9G,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc,CAAC,IAA2B;QAI9C,MAAM,SAAS,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAC,IAA2B;QACvC,MAAM,SAAS,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAEzF,6CAA6C;QAC7C,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YACvE,IAAI,YAAY,IAAI,YAAY,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;gBACpD,MAAM,MAAM,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,8EAA8E;IAC9E,+DAA+D;IAC/D,8EAA8E;IAGxE,AAAN,KAAK,CAAC,iBAAiB;QACrB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAI,IAAI,CAAC,QAAgB,EAAE,SAAS,CAAC;QACpD,OAAO,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpE,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc,CAAC,IAGpB;QACC,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAI,IAAI,CAAC,QAAgB,EAAE,SAAS,CAAC;QACpD,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAClG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AA1FO;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;4CAgB1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;mDAU1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;qDAW1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;oDAS1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;6CAc1C;AAOK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;;;uDAKtB;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;;;oDAStB;AAjGU,cAAc;IAD1B,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;;GACrB,cAAc,CAkG1B"}

package/dist/services/auth.service.d.ts

@@ -10,42 +10,41 @@
  */
 import type { Kysely } from 'kysely';
 import type { OmnitronDatabase } from '../database/schema.js';
-export interface OmnitronSignInRequest {
-    username: string;
-    password: string;
-    ipAddress?: string;
-    userAgent?: string;
-}
-export interface OmnitronSignInResult {
-    user: OmnitronAuthUser;
-    session: OmnitronSessionInfo;
-    accessToken: string;
-}
-export interface OmnitronAuthUser {
-    id: string;
-    username: string;
-    displayName: string | null;
-    role: string;
-    totpEnabled: boolean;
-    pgpEnabled: boolean;
-}
-export interface OmnitronSessionInfo {
-    id: string;
-    expiresAt: Date;
-}
-export interface OmnitronActiveSession {
-    id: string;
-    ipAddress: string | null;
-    userAgent: string | null;
-    createdAt: Date;
-    expiresAt: Date;
-    current: boolean;
-}
+import type { OmnitronSignInRequest, OmnitronSignInResult, OmnitronAuthUser, OmnitronActiveSession } from '../shared/dto/auth.js';
+export type { OmnitronSignInRequest, OmnitronSignInResult, OmnitronAuthUser, OmnitronSessionInfo, OmnitronActiveSession, } from '../shared/dto/auth.js';
 export declare class AuthService {
     private readonly db;
     private readonly jwtSecret;
-    constructor(db: Kysely<OmnitronDatabase>, jwtSecret?: string);
-    signIn(request: OmnitronSignInRequest): Promise<OmnitronSignInResult>;
+    /** Lazily-computed decoy hash — see `decoyHash()`. */
+    private decoyHashPromise;
+    constructor(db: Kysely<OmnitronDatabase>, jwtSecret: string);
+    /**
+     * @param request - the client's payload (username, password, claimed UA)
+     * @param origin  - facts the SERVER established about the call. Kept as a
+     *                  separate argument rather than folded into `request` so
+     *                  the wire DTO cannot grow a field a client could set:
+     *                  `ipAddress` was exactly that before, and the operator's
+     *                  session list repeated whatever the client claimed.
+     */
+    signIn(request: OmnitronSignInRequest, origin?: {
+        ipAddress?: string;
+    }): Promise<OmnitronSignInResult>;
+    /**
+     * Record a failed sign-in and lock the account once the streak crosses the
+     * threshold. The lockout grows exponentially with each additional failure
+     * past the threshold, capped at LOCKOUT_MAX_MS.
+     *
+     * State is persisted rather than held in memory: a daemon restart — which
+     * an attacker may be able to provoke — must not hand back a clean slate.
+     */
+    private registerFailedAttempt;
+    /**
+     * A scrypt hash of a random secret, computed once per process.
+     *
+     * Used to spend the same CPU on an unknown username as on a known one, so
+     * response time cannot distinguish the two.
+     */
+    private decoyHash;
     signOut(sessionId: string): Promise<void>;
     validateSession(sessionId: string): Promise<OmnitronAuthUser | null>;
     /**
@@ -62,6 +61,21 @@ export declare class AuthService {
     refreshSession(sessionId: string): Promise<OmnitronSignInResult | null>;
     changePassword(userId: string, oldPassword: string, newPassword: string, currentSessionId?: string): Promise<void>;
     hashPassword(password: string): Promise<string>;
+    /**
+     * Is the seeded `admin` account still using the password it shipped with?
+     *
+     * Migration 001 seeds `admin` / `admin` and its comment says the password
+     * "MUST be changed on first login". Nothing enforced that — no flag, no
+     * gate, no check anywhere in this daemon. A comment is not a control.
+     *
+     * The daemon binds loopback by default and the console does too, so this
+     * only matters where an operator has deliberately published one of them.
+     * That is exactly the moment to ask, which is what the caller does.
+     *
+     * Answers false when the account is gone or renamed: the question is about
+     * a shipped credential, not about weak passwords in general.
+     */
+    isUsingSeededAdminPassword(): Promise<boolean>;
     verifyPassword(password: string, hash: string): Promise<boolean>;
     private issueToken;
     /** Remove all expired sessions — call periodically */

package/dist/services/auth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../src/services/auth.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAQ9D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAeD,qBAAa,WAAW;IAIpB,OAAO,CAAC,QAAQ,CAAC,EAAE;IAHrB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAa;gBAGpB,EAAE,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAC7C,SAAS,CAAC,EAAE,MAAM;IAkBd,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA8DrE,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWzC,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAqC1E;;OAEG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAetE,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAiCnF,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAuB9F,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAoDvE,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoClH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAM/C,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;YAexD,UAAU;IAcxB,sDAAsD;IAChD,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC;CAQhD"}
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../src/services/auth.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,uBAAuB,CAAC;AAQ/B,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAuB/B,qBACa,WAAW;IAYO,OAAO,CAAC,QAAQ,CAAC,EAAE;IAXhD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAa;IACvC,sDAAsD;IACtD,OAAO,CAAC,gBAAgB,CAAgC;IAQxD,YAC8C,EAAE,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAC9C,SAAS,EAAE,MAAM,EAW5C;IAMD;;;;;;;OAOG;IACG,MAAM,CACV,OAAO,EAAE,qBAAqB,EAC9B,MAAM,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAoE/B;IAMD;;;;;;;OAOG;YACW,qBAAqB;IAWnC;;;;;OAKG;YACW,SAAS;IASjB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9C;IAMK,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAmCzE;IAED;;OAEG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAS3E;IAMK,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAgDxF;IAMK,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAiBnG;IAMK,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CA8C5E;IAMK,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BvH;IAMK,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIpD;IAED;;;;;;;;;;;;;OAaG;IACG,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,CASnD;IAEK,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASrE;YAMa,UAAU;IAcxB,sDAAsD;IAChD,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC,CAO9C;CACF"}