@omnitron-dev/omnitron 0.2.0 → 0.3.1

package/dist/services/auth.service.js

@@ -8,23 +8,52 @@
  * Password hashing via Node's native crypto.scrypt (zero external deps).
  * JWT via jose (HS256), already a Titan dependency.
  */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { randomBytes, randomUUID, scrypt, timingSafeEqual } from 'node:crypto';
+import { computeLockout } from './lockout.js';
 import { promisify } from 'node:util';
 import { SignJWT, jwtVerify } from 'jose';
+import { Injectable, Inject } from '@omnitron-dev/titan/decorators';
+import { OMNITRON_DB_TOKEN, JWT_SECRET_TOKEN } from '../shared/tokens.js';
 const scryptAsync = promisify(scrypt);
 // =============================================================================
 // Constants
 // =============================================================================
 const SALT_LENGTH = 32;
 const KEY_LENGTH = 64;
+/**
+ * What migration 001 seeds. Named here so the check below cannot drift from
+ * the migration silently — if the seed changes, this is the other half.
+ */
+const SEEDED_ADMIN_USERNAME = 'admin';
+const SEEDED_ADMIN_PASSWORD = 'admin';
 const SESSION_DURATION_MS = 24 * 60 * 60 * 1000; // 24 hours
 const JWT_EXPIRY = '1h';
 // =============================================================================
 // Auth Service
 // =============================================================================
-export class AuthService {
+let AuthService = class AuthService {
     db;
     jwtSecret;
+    /** Lazily-computed decoy hash — see `decoyHash()`. */
+    decoyHashPromise = null;
+    // T-2 part 2 — @Inject + useClass replaces the prior useFactory.
+    // The jwtSecret string used to ride a non-DI ctor param; it now
+    // flows through JWT_SECRET_TOKEN registered as useValue in the
+    // module, so the framework reads the dependency contract from the
+    // decorator metadata. The DI guard catches both length AND
+    // order-swap drift in one path.
     constructor(db, jwtSecret) {
         this.db = db;
         // Derive JWT signing key from secret. The default string MUST
@@ -35,29 +64,48 @@ export class AuthService {
         // for callers to always pass the resolved secret; the default
         // here exists only as a fail-safe for unit tests that construct
         // AuthService directly.
-        const secret = jwtSecret ?? 'omnitron-dev-jwt-secret';
-        this.jwtSecret = new TextEncoder().encode(secret);
+        this.jwtSecret = new TextEncoder().encode(jwtSecret || 'omnitron-dev-jwt-secret');
     }
     // ===========================================================================
     // Sign In
     // ===========================================================================
-    async signIn(request) {
-        const { username, password, ipAddress, userAgent } = request;
+    /**
+     * @param request - the client's payload (username, password, claimed UA)
+     * @param origin  - facts the SERVER established about the call. Kept as a
+     *                  separate argument rather than folded into `request` so
+     *                  the wire DTO cannot grow a field a client could set:
+     *                  `ipAddress` was exactly that before, and the operator's
+     *                  session list repeated whatever the client claimed.
+     */
+    async signIn(request, origin = {}) {
+        const { username, password, userAgent } = request;
         // 1. Find user
         const user = await this.db
             .selectFrom('omnitron_users')
             .selectAll()
             .where('username', '=', username)
             .executeTakeFirst();
-        if (!user) {
-            throw new Error('Invalid credentials');
+        // 2. Reject while locked out, before spending a scrypt on it.
+        if (user?.lockedUntil && new Date(user.lockedUntil) > new Date()) {
+            const seconds = Math.ceil((new Date(user.lockedUntil).getTime() - Date.now()) / 1000);
+            throw new Error(`Account temporarily locked — try again in ${seconds}s`);
         }
-        // 2. Verify password
-        const valid = await this.verifyPassword(password, user.passwordHash);
-        if (!valid) {
+        // 3. Verify password.
+        //
+        // An unknown username still costs a full scrypt against a throwaway hash.
+        // Returning early on "no such user" made sign-in measurably faster for
+        // absent accounts than for present ones, which is a username oracle on
+        // the infrastructure control plane: scrypt here takes ~100ms, so the
+        // difference was trivially observable over the network.
+        const valid = user
+            ? await this.verifyPassword(password, user.passwordHash)
+            : await this.verifyPassword(password, await this.decoyHash());
+        if (!user || !valid) {
+            if (user)
+                await this.registerFailedAttempt(user.id, user.failedLoginAttempts);
             throw new Error('Invalid credentials');
         }
-        // 3. Create session (include role in JWT for RBAC enforcement)
+        // 4. Create session (include role in JWT for RBAC enforcement)
         const sessionId = randomUUID();
         const expiresAt = new Date(Date.now() + SESSION_DURATION_MS);
         const accessToken = await this.issueToken(user.id, sessionId, user.role);
@@ -68,14 +116,14 @@ export class AuthService {
             userId: user.id,
             token: accessToken,
             expiresAt,
-            ipAddress: ipAddress ?? null,
+            ipAddress: origin.ipAddress ?? null,
             userAgent: userAgent ?? null,
         })
             .execute();
-        // 4. Update last login
+        // 5. Update last login and clear the failure streak
         await this.db
             .updateTable('omnitron_users')
-            .set({ lastLoginAt: new Date() })
+            .set({ lastLoginAt: new Date(), failedLoginAttempts: 0, lockedUntil: null })
             .where('id', '=', user.id)
             .execute();
         return {
@@ -92,6 +140,36 @@ export class AuthService {
         };
     }
     // ===========================================================================
+    // Brute-force throttling
+    // ===========================================================================
+    /**
+     * Record a failed sign-in and lock the account once the streak crosses the
+     * threshold. The lockout grows exponentially with each additional failure
+     * past the threshold, capped at LOCKOUT_MAX_MS.
+     *
+     * State is persisted rather than held in memory: a daemon restart — which
+     * an attacker may be able to provoke — must not hand back a clean slate.
+     */
+    async registerFailedAttempt(userId, currentAttempts) {
+        const attempts = currentAttempts + 1;
+        const lockedUntil = computeLockout(attempts);
+        await this.db
+            .updateTable('omnitron_users')
+            .set({ failedLoginAttempts: attempts, lockedUntil })
+            .where('id', '=', userId)
+            .execute();
+    }
+    /**
+     * A scrypt hash of a random secret, computed once per process.
+     *
+     * Used to spend the same CPU on an unknown username as on a known one, so
+     * response time cannot distinguish the two.
+     */
+    async decoyHash() {
+        this.decoyHashPromise ??= this.hashPassword(randomBytes(32).toString('hex'));
+        return this.decoyHashPromise;
+    }
+    // ===========================================================================
     // Sign Out
     // ===========================================================================
     async signOut(sessionId) {
@@ -162,20 +240,43 @@ export class AuthService {
             const sessionId = payload['sid'];
             if (!userId || !sessionId)
                 return null;
-            // Verify session still exists and is not expired
-            const session = await this.db
-                .selectFrom('omnitron_sessions')
-                .select(['id', 'expiresAt'])
-                .where('id', '=', sessionId)
-                .where('userId', '=', userId)
-                .executeTakeFirst();
+            // The session lookup gets its own catch, because a database that cannot
+            // answer is not a revoked session.
+            //
+            // Both used to return null from the outer catch, and the daemon turns
+            // null into `Session has been revoked or expired` with a 401. So every
+            // operator, during a database outage, was told their session had been
+            // revoked — an affirmative claim about their account, made at the one
+            // moment the platform could not check, and the kind of message that
+            // sends someone looking for a security incident. Signing in again does
+            // not help either: that path needs the same database.
+            let session;
+            try {
+                session = await this.db
+                    .selectFrom('omnitron_sessions')
+                    .select(['id', 'expiresAt'])
+                    .where('id', '=', sessionId)
+                    .where('userId', '=', userId)
+                    .executeTakeFirst();
+            }
+            catch (err) {
+                throw Object.assign(new Error('Session store is unavailable'), {
+                    code: 'SESSION_STORE_UNAVAILABLE',
+                    statusCode: 503,
+                    cause: err,
+                });
+            }
             if (!session)
                 return null;
             if (new Date(session.expiresAt) < new Date())
                 return null;
             return { userId, sessionId };
         }
-        catch {
+        catch (err) {
+            // A token that does not verify is the normal answer here. The lookup
+            // failure above is rethrown so it does not land in this branch.
+            if (err?.code === 'SESSION_STORE_UNAVAILABLE')
+                throw err;
             return null;
         }
     }
@@ -281,6 +382,30 @@ export class AuthService {
         const derived = (await scryptAsync(password, salt, KEY_LENGTH));
         return `scrypt:${salt.toString('hex')}:${derived.toString('hex')}`;
     }
+    /**
+     * Is the seeded `admin` account still using the password it shipped with?
+     *
+     * Migration 001 seeds `admin` / `admin` and its comment says the password
+     * "MUST be changed on first login". Nothing enforced that — no flag, no
+     * gate, no check anywhere in this daemon. A comment is not a control.
+     *
+     * The daemon binds loopback by default and the console does too, so this
+     * only matters where an operator has deliberately published one of them.
+     * That is exactly the moment to ask, which is what the caller does.
+     *
+     * Answers false when the account is gone or renamed: the question is about
+     * a shipped credential, not about weak passwords in general.
+     */
+    async isUsingSeededAdminPassword() {
+        const user = await this.db
+            .selectFrom('omnitron_users')
+            .select(['passwordHash'])
+            .where('username', '=', SEEDED_ADMIN_USERNAME)
+            .executeTakeFirst();
+        if (!user)
+            return false;
+        return this.verifyPassword(SEEDED_ADMIN_PASSWORD, user.passwordHash);
+    }
     async verifyPassword(password, hash) {
         const parts = hash.split(':');
         if (parts[0] !== 'scrypt' || parts.length !== 3)
@@ -313,5 +438,12 @@ export class AuthService {
             .executeTakeFirst();
         return Number(result.numDeletedRows ?? 0);
     }
-}
+};
+AuthService = __decorate([
+    Injectable(),
+    __param(0, Inject(OMNITRON_DB_TOKEN)),
+    __param(1, Inject(JWT_SECRET_TOKEN)),
+    __metadata("design:paramtypes", [Function, String])
+], AuthService);
+export { AuthService };
 //# sourceMappingURL=auth.service.js.map

package/dist/services/auth.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../src/services/auth.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAI1C,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;AA0CtC,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW;AAC5D,MAAM,UAAU,GAAG,IAAI,CAAC;AAExB,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,MAAM,OAAO,WAAW;IAIH;IAHF,SAAS,CAAa;IAEvC,YACmB,EAA4B,EAC7C,SAAkB;QADD,OAAE,GAAF,EAAE,CAA0B;QAG7C,8DAA8D;QAC9D,iEAAiE;QACjE,8DAA8D;QAC9D,4DAA4D;QAC5D,iEAAiE;QACjE,8DAA8D;QAC9D,gEAAgE;QAChE,wBAAwB;QACxB,MAAM,MAAM,GAAG,SAAS,IAAI,yBAAyB,CAAC;QACtD,IAAI,CAAC,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,8EAA8E;IAC9E,UAAU;IACV,8EAA8E;IAE9E,KAAK,CAAC,MAAM,CAAC,OAA8B;QACzC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QAE7D,eAAe;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,gBAAgB,CAAC;aAC5B,SAAS,EAAE;aACX,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC;aAChC,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,qBAAqB;QACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,+DAA+D;QAC/D,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEzE,MAAM,IAAI,CAAC,EAAE;aACV,UAAU,CAAC,mBAAmB,CAAC;aAC/B,MAAM,CAAC;YACN,EAAE,EAAE,SAAS;YACb,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,WAAW;YAClB,SAAS;YACT,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,SAAS,EAAE,SAAS,IAAI,IAAI;SAC7B,CAAC;aACD,OAAO,EAAE,CAAC;QAEb,uBAAuB;QACvB,MAAM,IAAI,CAAC,EAAE;aACV,WAAW,CAAC,gBAAgB,CAAC;aAC7B,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAChC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;aACzB,OAAO,EAAE,CAAC;QAEb,OAAO;YACL,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B;YACD,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE;YACrC,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,WAAW;IACX,8EAA8E;IAE9E,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,IAAI,CAAC,EAAE;aACV,UAAU,CAAC,mBAAmB,CAAC;aAC/B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,OAAO,EAAE,CAAC;IACf,CAAC;IAED,8EAA8E;IAC9E,mBAAmB;IACnB,8EAA8E;IAE9E,KAAK,CAAC,eAAe,CAAC,SAAiB;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;aAC1B,UAAU,CAAC,mBAAmB,CAAC;aAC/B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,eAAe;QACf,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC7C,qBAAqB;YACrB,MAAM,IAAI,CAAC,EAAE;iBACV,UAAU,CAAC,mBAAmB,CAAC;iBAC/B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;iBAC3B,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,gBAAgB,CAAC;aAC5B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC;aAChC,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;aAC1B,UAAU,CAAC,mBAAmB,CAAC;aAC/B,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC;aACrB,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;IACpD,CAAC;IAED,8EAA8E;IAC9E,uBAAuB;IACvB,8EAA8E;IAE9E,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;gBACzD,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;YAC3B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAuB,CAAC;YAEvD,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAEvC,iDAAiD;YACjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC1B,UAAU,CAAC,mBAAmB,CAAC;iBAC/B,MAAM,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;iBAC3B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;iBAC3B,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,gBAAgB,EAAE,CAAC;YAEtB,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;gBAAE,OAAO,IAAI,CAAC;YAE1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,sBAAsB;IACtB,8EAA8E;IAE9E,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,gBAAyB;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE;aAC3B,UAAU,CAAC,mBAAmB,CAAC;aAC/B,SAAS,EAAE;aACX,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;aAC5B,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;aACnC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;aAC5B,OAAO,EAAE,CAAC;QAEb,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1B,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAChC,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAChC,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,gBAAgB;SACnC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;aAC1B,UAAU,CAAC,mBAAmB,CAAC;aAC/B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,iFAAiF;QACjF,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACrE,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YACpF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,gBAAgB,CAAC;aAC5B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC;aAChC,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,6DAA6D;QAC7D,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtE,MAAM,IAAI,CAAC,EAAE;aACV,WAAW,CAAC,mBAAmB,CAAC;aAChC,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;aACjD,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,OAAO,EAAE,CAAC;QAEb,OAAO;YACL,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B;YACD,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE;YACnD,WAAW,EAAE,QAAQ;SACtB,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,WAAmB,EAAE,WAAmB,EAAE,gBAAyB;QACtG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,gBAAgB,CAAC;aAC5B,MAAM,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;aAC9B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;aACxB,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAErD,MAAM,IAAI,CAAC,EAAE;aACV,WAAW,CAAC,gBAAgB,CAAC;aAC7B,GAAG,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACrD,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;aACxB,OAAO,EAAE,CAAC;QAEb,0DAA0D;QAC1D,IAAI,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACjF,IAAI,gBAAgB,EAAE,CAAC;YACrB,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,8EAA8E;IAC9E,sDAAsD;IACtD,8EAA8E;IAE9E,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAW,CAAC;QAC1E,OAAO,UAAU,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,IAAY;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAE9D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAW,CAAC;QAE1E,OAAO,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,8EAA8E;IAC9E,MAAM;IACN,8EAA8E;IAEtE,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,SAAiB,EAAE,IAAI,GAAG,QAAQ;QACzE,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;aACzC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;aACpC,UAAU,CAAC,MAAM,CAAC;aAClB,SAAS,CAAC,UAAU,CAAC;aACrB,WAAW,EAAE;aACb,iBAAiB,CAAC,UAAU,CAAC;aAC7B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED,8EAA8E;IAC9E,UAAU;IACV,8EAA8E;IAE9E,sDAAsD;IACtD,KAAK,CAAC,sBAAsB;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,UAAU,CAAC,mBAAmB,CAAC;aAC/B,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;aACnC,gBAAgB,EAAE,CAAC;QAEtB,OAAO,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC;CACF"}
+{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../src/services/auth.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;;;;;;;;;;;;;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAG1C,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAQ1E,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;AActC,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB;;;GAGG;AACH,MAAM,qBAAqB,GAAG,OAAO,CAAC;AACtC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AACtC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW;AAC5D,MAAM,UAAU,GAAG,IAAI,CAAC;AAGxB,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAGzE,IAAM,WAAW,GAAjB,MAAM,WAAW;IAYwB,EAAE;IAX/B,SAAS,CAAa;IACvC,sDAAsD;IAC9C,gBAAgB,GAA2B,IAAI,CAAC;IAExD,iEAAiE;IACjE,gEAAgE;IAChE,+DAA+D;IAC/D,kEAAkE;IAClE,2DAA2D;IAC3D,gCAAgC;IAChC,YAC8C,EAA4B,EAC9C,SAAiB;kBADC,EAAE;QAG9C,8DAA8D;QAC9D,iEAAiE;QACjE,8DAA8D;QAC9D,4DAA4D;QAC5D,iEAAiE;QACjE,8DAA8D;QAC9D,gEAAgE;QAChE,wBAAwB;QACxB,IAAI,CAAC,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,IAAI,yBAAyB,CAAC,CAAC;IACpF,CAAC;IAED,8EAA8E;IAC9E,UAAU;IACV,8EAA8E;IAE9E;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CACV,OAA8B,EAC9B,MAAM,GAA2B,EAAE;QAEnC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QAElD,eAAe;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,gBAAgB,CAAC;aAC5B,SAAS,EAAE;aACX,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC;aAChC,gBAAgB,EAAE,CAAC;QAEtB,8DAA8D;QAC9D,IAAI,IAAI,EAAE,WAAW,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,6CAA6C,OAAO,GAAG,CAAC,CAAC;QAC3E,CAAC;QAED,sBAAsB;QACtB,EAAE;QACF,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,wDAAwD;QACxD,MAAM,KAAK,GAAG,IAAI;YAChB,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC;YACxD,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAEhE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,IAAI;gBAAE,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,+DAA+D;QAC/D,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEzE,MAAM,IAAI,CAAC,EAAE;aACV,UAAU,CAAC,mBAAmB,CAAC;aAC/B,MAAM,CAAC;YACN,EAAE,EAAE,SAAS;YACb,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,WAAW;YAClB,SAAS;YACT,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;YACnC,SAAS,EAAE,SAAS,IAAI,IAAI;SAC7B,CAAC;aACD,OAAO,EAAE,CAAC;QAEb,oDAAoD;QACpD,MAAM,IAAI,CAAC,EAAE;aACV,WAAW,CAAC,gBAAgB,CAAC;aAC7B,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;aAC3E,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;aACzB,OAAO,EAAE,CAAC;QAEb,OAAO;YACL,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B;YACD,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE;YACrC,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,yBAAyB;IACzB,8EAA8E;IAE9E;;;;;;;OAOG;IACK,KAAK,CAAC,qBAAqB,CAAC,MAAc,EAAE,eAAuB;QACzE,MAAM,QAAQ,GAAG,eAAe,GAAG,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QAE7C,MAAM,IAAI,CAAC,EAAE;aACV,WAAW,CAAC,gBAAgB,CAAC;aAC7B,GAAG,CAAC,EAAE,mBAAmB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;aACnD,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;aACxB,OAAO,EAAE,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC,gBAAgB,KAAK,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED,8EAA8E;IAC9E,WAAW;IACX,8EAA8E;IAE9E,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,IAAI,CAAC,EAAE;aACV,UAAU,CAAC,mBAAmB,CAAC;aAC/B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,OAAO,EAAE,CAAC;IACf,CAAC;IAED,8EAA8E;IAC9E,mBAAmB;IACnB,8EAA8E;IAE9E,KAAK,CAAC,eAAe,CAAC,SAAiB;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;aAC1B,UAAU,CAAC,mBAAmB,CAAC;aAC/B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,eAAe;QACf,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC7C,qBAAqB;YACrB,MAAM,IAAI,CAAC,EAAE;iBACV,UAAU,CAAC,mBAAmB,CAAC;iBAC/B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;iBAC3B,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,gBAAgB,CAAC;aAC5B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC;aAChC,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;aAC1B,UAAU,CAAC,mBAAmB,CAAC;aAC/B,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC;aACrB,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;IACpD,CAAC;IAED,8EAA8E;IAC9E,uBAAuB;IACvB,8EAA8E;IAE9E,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;gBACzD,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;YAC3B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAuB,CAAC;YAEvD,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAEvC,wEAAwE;YACxE,mCAAmC;YACnC,EAAE;YACF,sEAAsE;YACtE,uEAAuE;YACvE,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,uEAAuE;YACvE,sDAAsD;YACtD,IAAI,OAAO,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;qBACpB,UAAU,CAAC,mBAAmB,CAAC;qBAC/B,MAAM,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;qBAC3B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;qBAC3B,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;qBAC5B,gBAAgB,EAAE,CAAC;YACxB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,EAAE;oBAC7D,IAAI,EAAE,2BAA2B;oBACjC,UAAU,EAAE,GAAG;oBACf,KAAK,EAAE,GAAG;iBACX,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;gBAAE,OAAO,IAAI,CAAC;YAE1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,gEAAgE;YAChE,IAAK,GAAyB,EAAE,IAAI,KAAK,2BAA2B;gBAAE,MAAM,GAAG,CAAC;YAChF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,sBAAsB;IACtB,8EAA8E;IAE9E,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,gBAAyB;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE;aAC3B,UAAU,CAAC,mBAAmB,CAAC;aAC/B,SAAS,EAAE;aACX,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;aAC5B,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;aACnC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;aAC5B,OAAO,EAAE,CAAC;QAEb,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1B,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAChC,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAChC,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,gBAAgB;SACnC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;aAC1B,UAAU,CAAC,mBAAmB,CAAC;aAC/B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,iFAAiF;QACjF,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACrE,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YACpF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,gBAAgB,CAAC;aAC5B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC;aAChC,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,6DAA6D;QAC7D,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtE,MAAM,IAAI,CAAC,EAAE;aACV,WAAW,CAAC,mBAAmB,CAAC;aAChC,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;aACjD,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,OAAO,EAAE,CAAC;QAEb,OAAO;YACL,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B;YACD,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE;YACnD,WAAW,EAAE,QAAQ;SACtB,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,WAAmB,EAAE,WAAmB,EAAE,gBAAyB;QACtG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,gBAAgB,CAAC;aAC5B,MAAM,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;aAC9B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;aACxB,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAErD,MAAM,IAAI,CAAC,EAAE;aACV,WAAW,CAAC,gBAAgB,CAAC;aAC7B,GAAG,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACrD,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;aACxB,OAAO,EAAE,CAAC;QAEb,0DAA0D;QAC1D,IAAI,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACjF,IAAI,gBAAgB,EAAE,CAAC;YACrB,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,8EAA8E;IAC9E,sDAAsD;IACtD,8EAA8E;IAE9E,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAW,CAAC;QAC1E,OAAO,UAAU,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,0BAA0B;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,gBAAgB,CAAC;aAC5B,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;aACxB,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,qBAAqB,CAAC;aAC7C,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,IAAI,CAAC,cAAc,CAAC,qBAAqB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,IAAY;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAE9D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAW,CAAC;QAE1E,OAAO,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,8EAA8E;IAC9E,MAAM;IACN,8EAA8E;IAEtE,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,SAAiB,EAAE,IAAI,GAAG,QAAQ;QACzE,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;aACzC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;aACpC,UAAU,CAAC,MAAM,CAAC;aAClB,SAAS,CAAC,UAAU,CAAC;aACrB,WAAW,EAAE;aACb,iBAAiB,CAAC,UAAU,CAAC;aAC7B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED,8EAA8E;IAC9E,UAAU;IACV,8EAA8E;IAE9E,sDAAsD;IACtD,KAAK,CAAC,sBAAsB;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,UAAU,CAAC,mBAAmB,CAAC;aAC/B,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;aACnC,gBAAgB,EAAE,CAAC;QAEtB,OAAO,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC;CACF,CAAA;AAjcY,WAAW;IADvB,UAAU,EAAE;IAaR,WAAA,MAAM,CAAC,iBAAiB,CAAC,CAAA;IACzB,WAAA,MAAM,CAAC,gBAAgB,CAAC,CAAA;;GAbhB,WAAW,CAicvB"}

package/dist/services/backup-pipeline.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Running a dump or restore without a shell.
+ *
+ * Every one of these was `execFile('/bin/sh', ['-c', "pg_dump … | gzip > file"])`,
+ * which has three faults and the first is the serious one:
+ *
+ *   1. **A shell pipeline reports only the LAST command's exit status.**
+ *      `pg_dump … | gzip > file` exits 0 when pg_dump fails, because gzip
+ *      succeeded in writing its (empty) output. Verified: a pipeline whose
+ *      first command does not exist exits 0 and leaves a 20-byte file. So a
+ *      backup that dumped nothing was recorded as a backup — with a row in
+ *      the store, a size, and a timestamp — and the operator found out when
+ *      they tried to restore it.
+ *   2. Names and paths were interpolated into a command string. A container,
+ *      user or database name containing a space or a quote breaks the
+ *      command; the values come from a project's own config, so this is a
+ *      correctness problem before it is anything else.
+ *   3. The uncompressed local path buffered the entire dump in memory with a
+ *      100 MB ceiling, which an ordinary database exceeds.
+ *
+ * Streaming through `spawn` fixes all three: both ends of the pipe are real
+ * processes whose exit codes are observed, arguments are passed as an array
+ * so nothing is parsed, and nothing is held in memory.
+ *
+ * ## …and the file only takes its name once it is whole
+ *
+ * All of that catches a dump that FAILS. None of it catches a dump that is
+ * never allowed to finish: the process killed, the host disk full, the VM
+ * stopped mid-write. There no catch of ours runs, and the stream has been
+ * writing under the FINAL name since its first byte.
+ *
+ * Measured in `~/.omnitron/backups` after this host filled on 2026-09-14 —
+ * `main_…07-51….sql.gz` at 98 304 bytes and `quotes_…sql.gz` at 1.5 MB,
+ * both a gzip header with the body cut off, both sitting under their final
+ * names where a restore would have taken them. So the write goes to
+ * `<name>.partial` and is renamed once the exit code has been checked.
+ */
+/**
+ * Render a byte count so a small backup cannot be mistaken for an empty one.
+ *
+ * `backup list` printed `(size / 1024 / 1024).toFixed(2) + ' MB'`, which shows
+ * every backup under ten kilobytes as `0.00 MB`. On this host that is 261 of
+ * 391 files — mostly legitimate dumps of small databases, rendered
+ * indistinguishable from a dump that captured nothing.
+ */
+export declare function formatBackupSize(bytes: number): string;
+/**
+ * A moment as UTC, to the second, with the zone written on it.
+ *
+ * `backup list` printed `new Date(createdAt).toLocaleString()` — the daemon
+ * host's local time with no zone at all — beside filenames that carry UTC.
+ * Measured on the master: `geo_2026-09-23T08-19-04-…` listed as
+ * `9/23/2026, 11:19:04 AM`, three hours apart and nothing saying which of the
+ * two was right. Lives here, beside `formatBackupSize`, because this is the
+ * one module both the daemon and the CLI load without the service's graph.
+ */
+export declare function formatUtc(moment: string | number | Date): string;
+/** Shortest id prefix of at least `min` characters that still tells every id apart. */
+export declare function uniqueIdPrefixLength(ids: string[], min?: number): number;
+/** Below this, a prefix names a handful of backups at random rather than one on purpose. */
+export declare const MIN_BACKUP_ID_PREFIX = 4;
+/**
+ * The one backup an id — or an unambiguous prefix of one — names.
+ *
+ * `restoreBackup` compared the argument with `===` against a full UUID, and
+ * nothing the CLI printed carried one: `backup list` showed Database,
+ * Filename cut to 24 characters (`geo_2026-09-23T08-19-04-`, the id is after
+ * the cut) and Size; `backup create` printed `[a63dbcf4]`, eight characters
+ * that restore then refused as "not found". Shared by the daemon and the CLI,
+ * so both sides read a prefix the same way.
+ *
+ * @throws naming every candidate when the prefix matches more than one, and
+ *         saying so when it matches none — never a guess.
+ */
+export declare function resolveBackupId<T extends {
+    id: string;
+}>(rows: T[], idOrPrefix: string, describe?: (row: T) => string): T;
+export interface PipelineOptions {
+    /** Milliseconds before both processes are killed. */
+    timeoutMs?: number;
+    /** Extra environment for the spawned command (e.g. PGPASSWORD). */
+    env?: NodeJS.ProcessEnv;
+}
+/**
+ * Run `command args…`, sending stdout to `outputPath`, optionally gzipped.
+ *
+ * @throws when the command exits non-zero, carrying its stderr — which the
+ *         shell version discarded along with the exit status.
+ */
+export declare function dumpToFile(command: string, args: string[], outputPath: string, compress: boolean, options?: PipelineOptions): Promise<void>;
+/**
+ * Feed `inputPath` into `command args…` on stdin, optionally gunzipping.
+ *
+ * @throws when the command exits non-zero, carrying its stderr.
+ */
+export declare function restoreFromFile(command: string, args: string[], inputPath: string, compressed: boolean, options?: PipelineOptions): Promise<void>;
+//# sourceMappingURL=backup-pipeline.d.ts.map

package/dist/services/backup-pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-pipeline.d.ts","sourceRoot":"","sources":["../../src/services/backup-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAOH;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOtD;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,CAIhE;AAED,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,GAAG,SAAI,GAAG,MAAM,CAMnE;AAED,4FAA4F;AAC5F,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EACtD,IAAI,EAAE,CAAC,EAAE,EACT,UAAU,EAAE,MAAM,EAClB,QAAQ,GAAE,CAAC,GAAG,EAAE,CAAC,KAAK,MAAwB,GAC7C,CAAC,CAgBH;AAED,MAAM,WAAW,eAAe;IAC9B,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAkBD;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,OAAO,EACjB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAuFf;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,OAAO,EACnB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,IAAI,CAAC,CA4Df"}