@omnitron-dev/omnitron 0.2.0 → 0.3.1

package/dist/shared/release-reading.d.ts

@@ -0,0 +1,85 @@
+/**
+ * How a release reads — its gates, and which stacks run it: one reading for
+ * the CLI and the console.
+ *
+ * They read releases apart, and came apart:
+ *
+ *   - A build with `--skip-gates` records one outcome, `gates: not-run`, and
+ *     as `passed/total` that is «0/1» — what one failed gate reads as too.
+ *     The CLI learnt to say «skipped» (70b988a6); the console still drew
+ *     «0/1».
+ *   - A gate that timed out or was killed counted in `notRun` until 70b988a6
+ *     gave each its own count. The console coloured by `failed` and `notRun`
+ *     alone, so sample-202609230557, whose one gate that did not pass timed
+ *     out, would have read a green «20/21».
+ *   - A daemon whose database did not come up runs with no audit trail and
+ *     serves `deployments()` as `[]` — the shape of «no stack has taken a
+ *     release». The CLI learnt that in 70b988a6 and will not prune on it; the
+ *     console read `[]` as it came, protected nothing, and a stack's card
+ *     said «No recorded deployment of this stack yet» about a stack it could
+ *     not ask about.
+ *
+ * Imported by the console through `@omnitron-dev/omnitron/release-reading`,
+ * so nothing here may need Node.
+ */
+import type { GateOutcome } from '../release/manifest.js';
+import type { ReleaseDeploymentDto } from './dto/services.js';
+/**
+ * The part of a release summary its gates are read from. Not the per-outcome
+ * counts beyond `failed`: what did not pass and did not fail is unfinished,
+ * whatever a daemon of any age calls it — one that predates `timedOut` and
+ * `killed` counted both in `notRun`.
+ */
+export interface ReleaseGates {
+    readonly complete: boolean;
+    readonly gates: {
+        readonly total: number;
+        readonly passed: number;
+        readonly failed: number;
+    };
+    readonly gateList: readonly GateOutcome[];
+}
+/**
+ * The words, and what they say about deploying it: `passed` all of them,
+ * `failed` at least one, `unfinished` none failed and not all passed —
+ * skipped, not run, timed out, killed — and `none` nothing to read.
+ */
+export interface GatesReading {
+    readonly text: string;
+    readonly tone: 'passed' | 'failed' | 'unfinished' | 'none';
+}
+/** The single outcome a build records when it ran no gate at all, or null. */
+export declare function noGateRan(gates: readonly GateOutcome[]): GateOutcome | null;
+export declare function readGates(release: ReleaseGates): GatesReading;
+/**
+ * Which release each stack runs, or why that cannot be said. `known: false`
+ * is not «nothing is deployed», and nothing may read it as that.
+ */
+export type DeploymentsAnswer = {
+    readonly known: true;
+    readonly deployments: readonly ReleaseDeploymentDto[];
+} | {
+    readonly known: false;
+    readonly why: string;
+};
+/** Why a daemon without its audit trail cannot say which release a stack runs. */
+export declare const NO_AUDIT_TRAIL = "the daemon has no audit trail, and its `stack.start` rows are what say which release a stack runs";
+/**
+ * The daemon's `deployments()` rows as an answer: known only when its audit
+ * trail is there to have written them.
+ */
+export declare function deploymentsAnswer(trailAvailable: boolean, rows: readonly ReleaseDeploymentDto[]): DeploymentsAnswer;
+/** Release id → every stack whose last start took it. */
+export declare function stacksByRelease(deployments: readonly ReleaseDeploymentDto[]): Map<string, ReleaseDeploymentDto[]>;
+/**
+ * Stacks whose last start recorded a release and not its name (rows from
+ * before the trail flattened the field). No release can be marked as theirs,
+ * and none can be protected for them.
+ */
+export declare function unnamedStacks(deployments: readonly ReleaseDeploymentDto[]): string[];
+/**
+ * Why a prune cannot tell which releases the stacks run, or `null` when it
+ * can. A prune that goes ahead regardless may remove the one a stack runs.
+ */
+export declare function pruneBlindness(answer: DeploymentsAnswer): string | null;
+//# sourceMappingURL=release-reading.d.ts.map

package/dist/shared/release-reading.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-reading.d.ts","sourceRoot":"","sources":["../../src/shared/release-reading.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7F,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;CAC3C;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,YAAY,GAAG,MAAM,CAAC;CAC5D;AAED,8EAA8E;AAC9E,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,WAAW,GAAG,IAAI,CAG3E;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,CAU7D;AAMD;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,kFAAkF;AAClF,eAAO,MAAM,cAAc,sGAC0E,CAAC;AAEtG;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,oBAAoB,EAAE,GAAG,iBAAiB,CAEnH;AAED,yDAAyD;AACzD,wBAAgB,eAAe,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAOjH;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,MAAM,EAAE,CAEpF;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,CAIvE"}

package/dist/shared/release-reading.js

@@ -0,0 +1,81 @@
+/**
+ * How a release reads — its gates, and which stacks run it: one reading for
+ * the CLI and the console.
+ *
+ * They read releases apart, and came apart:
+ *
+ *   - A build with `--skip-gates` records one outcome, `gates: not-run`, and
+ *     as `passed/total` that is «0/1» — what one failed gate reads as too.
+ *     The CLI learnt to say «skipped» (70b988a6); the console still drew
+ *     «0/1».
+ *   - A gate that timed out or was killed counted in `notRun` until 70b988a6
+ *     gave each its own count. The console coloured by `failed` and `notRun`
+ *     alone, so sample-202609230557, whose one gate that did not pass timed
+ *     out, would have read a green «20/21».
+ *   - A daemon whose database did not come up runs with no audit trail and
+ *     serves `deployments()` as `[]` — the shape of «no stack has taken a
+ *     release». The CLI learnt that in 70b988a6 and will not prune on it; the
+ *     console read `[]` as it came, protected nothing, and a stack's card
+ *     said «No recorded deployment of this stack yet» about a stack it could
+ *     not ask about.
+ *
+ * Imported by the console through `@omnitron-dev/omnitron/release-reading`,
+ * so nothing here may need Node.
+ */
+/** The single outcome a build records when it ran no gate at all, or null. */
+export function noGateRan(gates) {
+    const only = gates.length === 1 ? gates[0] : null;
+    return only && only.name === 'gates' && only.status === 'not-run' ? only : null;
+}
+export function readGates(release) {
+    if (!release.complete)
+        return { text: 'no manifest', tone: 'none' };
+    const none = noGateRan(release.gateList);
+    // The builder records `--skip-gates` only as that outcome's reason, so the
+    // reason is what is read; any other — no gates script at the commit, a
+    // script that printed nothing — is «not run», which is true of all of them.
+    if (none)
+        return { text: /--skip-gates/.test(none.detail ?? '') ? 'skipped' : 'not run', tone: 'unfinished' };
+    const { total, passed, failed } = release.gates;
+    if (total === 0)
+        return { text: '—', tone: 'none' };
+    return { text: `${passed}/${total}`, tone: failed > 0 ? 'failed' : passed < total ? 'unfinished' : 'passed' };
+}
+/** Why a daemon without its audit trail cannot say which release a stack runs. */
+export const NO_AUDIT_TRAIL = 'the daemon has no audit trail, and its `stack.start` rows are what say which release a stack runs';
+/**
+ * The daemon's `deployments()` rows as an answer: known only when its audit
+ * trail is there to have written them.
+ */
+export function deploymentsAnswer(trailAvailable, rows) {
+    return trailAvailable ? { known: true, deployments: rows } : { known: false, why: NO_AUDIT_TRAIL };
+}
+/** Release id → every stack whose last start took it. */
+export function stacksByRelease(deployments) {
+    const out = new Map();
+    for (const d of deployments) {
+        if (!d.release)
+            continue;
+        out.set(d.release, [...(out.get(d.release) ?? []), d]);
+    }
+    return out;
+}
+/**
+ * Stacks whose last start recorded a release and not its name (rows from
+ * before the trail flattened the field). No release can be marked as theirs,
+ * and none can be protected for them.
+ */
+export function unnamedStacks(deployments) {
+    return deployments.filter((d) => d.releaseUnnamed).map((d) => `${d.project}/${d.stack}`);
+}
+/**
+ * Why a prune cannot tell which releases the stacks run, or `null` when it
+ * can. A prune that goes ahead regardless may remove the one a stack runs.
+ */
+export function pruneBlindness(answer) {
+    if (!answer.known)
+        return answer.why;
+    const unnamed = unnamedStacks(answer.deployments);
+    return unnamed.length > 0 ? `${unnamed.join(', ')} last took a release whose name the trail did not record` : null;
+}
+//# sourceMappingURL=release-reading.js.map

package/dist/shared/release-reading.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-reading.js","sourceRoot":"","sources":["../../src/shared/release-reading.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AA2BH,8EAA8E;AAC9E,MAAM,UAAU,SAAS,CAAC,KAA6B;IACrD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,OAAO,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAqB;IAC7C,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpE,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,2EAA2E;IAC3E,uEAAuE;IACvE,4EAA4E;IAC5E,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC9G,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpD,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChH,CAAC;AAcD,kFAAkF;AAClF,MAAM,CAAC,MAAM,cAAc,GACzB,mGAAmG,CAAC;AAEtG;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,cAAuB,EAAE,IAAqC;IAC9F,OAAO,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;AACrG,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,eAAe,CAAC,WAA4C;IAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkC,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,SAAS;QACzB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,WAA4C;IACxE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAyB;IACtD,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC;IACrC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC,CAAC,IAAI,CAAC;AACrH,CAAC"}

package/dist/shared/roles.d.ts

@@ -12,20 +12,75 @@
  */
 /** All valid daemon roles, ordered by privilege level (highest first). */
 export declare const ROLES: {
-    readonly ADMIN: "admin";
-    readonly OPERATOR: "operator";
-    readonly VIEWER: "viewer";
+    readonly ADMIN: 'admin';
+    readonly OPERATOR: 'operator';
+    readonly VIEWER: 'viewer';
 };
 export type OmnitronRole = (typeof ROLES)[keyof typeof ROLES];
 /**
  * Check if a user's roles satisfy the minimum required role.
  * Uses hierarchical comparison: admin satisfies operator, operator satisfies viewer, etc.
  */
+/**
+ * Whether any of `userRoles` ranks at or above `minimumRole`.
+ *
+ * NOT on the request path, and deliberately kept: `@Public({ auth: { roles }})`
+ * takes an explicit list, and the three lists below are what every method
+ * declares. This function is the only place the rank order is written down,
+ * which makes it useful for reading — and a trap for anyone who assumes the
+ * wire enforces a minimum. It does not: it enforces membership of a list.
+ *
+ * The difference shows when a role is added. `service_role` — named on
+ * `OmnitronSync`'s methods — has no entry in ROLE_HIERARCHY, so it ranks 0
+ * here, and it is absent from all three lists, so it is permitted nowhere.
+ * Both answers happen to be safe; neither is a decision anyone made.
+ */
 export declare function hasMinimumRole(userRoles: string[], minimumRole: OmnitronRole): boolean;
 /** Roles that can view (read-only) — admin + operator + viewer */
 export declare const VIEWER_ROLES: OmnitronRole[];
 /** Roles that can operate (start/stop/deploy) — admin + operator */
 export declare const OPERATOR_ROLES: OmnitronRole[];
+/**
+ * An operator, or another omnitron acting on its own behalf.
+ *
+ * A master reaches its nodes with a `service_role` token minted from the
+ * node's own signing secret — no session, no human. The replication
+ * endpoints have always listed the role explicitly; anything else the
+ * control plane asks a node to do needs it too, and spelling it out three
+ * times is how one of them ends up without it.
+ *
+ * Measured: `provisionStack` was declared OPERATOR_ROLES, so the master's
+ * own credential could not call the method that exists for the master to
+ * call — `Missing required role`, from a node that had just authenticated
+ * that very credential.
+ *
+ * Not `OmnitronRole[]`, deliberately. That type is the human hierarchy —
+ * admin > operator > viewer — and `service_role` has no place in an
+ * ordering: it is not more than an operator or less than one, it is a
+ * different kind of principal. Typing it into the hierarchy would make
+ * `hasRole('service_role', 'viewer')` a question with an answer.
+ */
+export declare const CONTROL_PLANE_ROLES: string[];
+/**
+ * A read a master may make about a node it drives.
+ *
+ * `VIEWER_ROLES` is the human hierarchy, and `service_role` is not in it —
+ * so a master could TELL a node to provision its infrastructure and could
+ * not ASK what it had provisioned. `provisionStack` answered; the read-only
+ * `getConnectionInfo` beside it answered `Missing required role`, from a
+ * node that had just authenticated the same credential for the strictly more
+ * powerful call.
+ *
+ * The docblock above predicted this exactly — "anything else the control
+ * plane asks a node to do needs it too, and spelling it out three times is
+ * how one of them ends up without it" — and it happened again on the reading
+ * half, which is why the reads now have a name of their own rather than a
+ * third hand-written list.
+ *
+ * Reads that hand out CREDENTIALS are not in here. They belong to
+ * `CONTROL_PLANE_ROLES`, where the human tier starts at operator.
+ */
+export declare const CONTROL_PLANE_READ_ROLES: string[];
 /** Roles that can administer (shutdown, secrets, backup) — admin only */
 export declare const ADMIN_ROLES: OmnitronRole[];
 //# sourceMappingURL=roles.d.ts.map

package/dist/shared/roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/shared/roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,0EAA0E;AAC1E,eAAO,MAAM,KAAK;;;;CAIR,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,OAAO,KAAK,CAAC,CAAC;AAS9D;;;GAGG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,YAAY,GAAG,OAAO,CAGtF;AAED,kEAAkE;AAClE,eAAO,MAAM,YAAY,EAAE,YAAY,EAAoC,CAAC;AAC5E,oEAAoE;AACpE,eAAO,MAAM,cAAc,EAAE,YAAY,EAA0B,CAAC;AACpE,yEAAyE;AACzE,eAAO,MAAM,WAAW,EAAE,YAAY,EAAc,CAAC"}
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/shared/roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,0EAA0E;AAC1E,eAAO,MAAM,KAAK;aAChB,KAAK,EAAE,OAAO;aACd,QAAQ,EAAE,UAAU;aACpB,MAAM,EAAE,QAAQ;CACR,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,OAAO,KAAK,CAAC,CAAC;AAS9D;;;GAGG;AACH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,YAAY,GAAG,OAAO,CAGtF;AAED,kEAAkE;AAClE,eAAO,MAAM,YAAY,EAAE,YAAY,EAAoC,CAAC;AAC5E,oEAAoE;AACpE,eAAO,MAAM,cAAc,EAAE,YAAY,EAA0B,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,EAA0C,CAAC;AAEnF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,EAAoD,CAAC;AAClG,yEAAyE;AACzE,eAAO,MAAM,WAAW,EAAE,YAAY,EAAc,CAAC"}

package/dist/shared/roles.js

@@ -26,6 +26,20 @@ const ROLE_HIERARCHY = {
  * Check if a user's roles satisfy the minimum required role.
  * Uses hierarchical comparison: admin satisfies operator, operator satisfies viewer, etc.
  */
+/**
+ * Whether any of `userRoles` ranks at or above `minimumRole`.
+ *
+ * NOT on the request path, and deliberately kept: `@Public({ auth: { roles }})`
+ * takes an explicit list, and the three lists below are what every method
+ * declares. This function is the only place the rank order is written down,
+ * which makes it useful for reading — and a trap for anyone who assumes the
+ * wire enforces a minimum. It does not: it enforces membership of a list.
+ *
+ * The difference shows when a role is added. `service_role` — named on
+ * `OmnitronSync`'s methods — has no entry in ROLE_HIERARCHY, so it ranks 0
+ * here, and it is absent from all three lists, so it is permitted nowhere.
+ * Both answers happen to be safe; neither is a decision anyone made.
+ */
 export function hasMinimumRole(userRoles, minimumRole) {
     const requiredLevel = ROLE_HIERARCHY[minimumRole] ?? 0;
     return userRoles.some((role) => (ROLE_HIERARCHY[role] ?? 0) >= requiredLevel);
@@ -34,6 +48,47 @@ export function hasMinimumRole(userRoles, minimumRole) {
 export const VIEWER_ROLES = ['admin', 'operator', 'viewer'];
 /** Roles that can operate (start/stop/deploy) — admin + operator */
 export const OPERATOR_ROLES = ['admin', 'operator'];
+/**
+ * An operator, or another omnitron acting on its own behalf.
+ *
+ * A master reaches its nodes with a `service_role` token minted from the
+ * node's own signing secret — no session, no human. The replication
+ * endpoints have always listed the role explicitly; anything else the
+ * control plane asks a node to do needs it too, and spelling it out three
+ * times is how one of them ends up without it.
+ *
+ * Measured: `provisionStack` was declared OPERATOR_ROLES, so the master's
+ * own credential could not call the method that exists for the master to
+ * call — `Missing required role`, from a node that had just authenticated
+ * that very credential.
+ *
+ * Not `OmnitronRole[]`, deliberately. That type is the human hierarchy —
+ * admin > operator > viewer — and `service_role` has no place in an
+ * ordering: it is not more than an operator or less than one, it is a
+ * different kind of principal. Typing it into the hierarchy would make
+ * `hasRole('service_role', 'viewer')` a question with an answer.
+ */
+export const CONTROL_PLANE_ROLES = ['admin', 'operator', 'service_role'];
+/**
+ * A read a master may make about a node it drives.
+ *
+ * `VIEWER_ROLES` is the human hierarchy, and `service_role` is not in it —
+ * so a master could TELL a node to provision its infrastructure and could
+ * not ASK what it had provisioned. `provisionStack` answered; the read-only
+ * `getConnectionInfo` beside it answered `Missing required role`, from a
+ * node that had just authenticated the same credential for the strictly more
+ * powerful call.
+ *
+ * The docblock above predicted this exactly — "anything else the control
+ * plane asks a node to do needs it too, and spelling it out three times is
+ * how one of them ends up without it" — and it happened again on the reading
+ * half, which is why the reads now have a name of their own rather than a
+ * third hand-written list.
+ *
+ * Reads that hand out CREDENTIALS are not in here. They belong to
+ * `CONTROL_PLANE_ROLES`, where the human tier starts at operator.
+ */
+export const CONTROL_PLANE_READ_ROLES = ['admin', 'operator', 'viewer', 'service_role'];
 /** Roles that can administer (shutdown, secrets, backup) — admin only */
 export const ADMIN_ROLES = ['admin'];
 //# sourceMappingURL=roles.js.map

package/dist/shared/roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/shared/roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;CACR,CAAC;AAIX,gDAAgD;AAChD,MAAM,cAAc,GAA2B;IAC7C,KAAK,EAAE,CAAC;IACR,QAAQ,EAAE,CAAC;IACX,MAAM,EAAE,CAAC;CACV,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,SAAmB,EAAE,WAAyB;IAC3E,MAAM,aAAa,GAAG,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACvD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC;AAChF,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,MAAM,YAAY,GAAmB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAC5E,oEAAoE;AACpE,MAAM,CAAC,MAAM,cAAc,GAAmB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACpE,yEAAyE;AACzE,MAAM,CAAC,MAAM,WAAW,GAAmB,CAAC,OAAO,CAAC,CAAC"}
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/shared/roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;CACR,CAAC;AAIX,gDAAgD;AAChD,MAAM,cAAc,GAA2B;IAC7C,KAAK,EAAE,CAAC;IACR,QAAQ,EAAE,CAAC;IACX,MAAM,EAAE,CAAC;CACV,CAAC;AAEF;;;GAGG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,SAAmB,EAAE,WAAyB;IAC3E,MAAM,aAAa,GAAG,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACvD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC;AAChF,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,MAAM,YAAY,GAAmB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAC5E,oEAAoE;AACpE,MAAM,CAAC,MAAM,cAAc,GAAmB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAa,CAAC,OAAO,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;AAEnF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAa,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;AAClG,yEAAyE;AACzE,MAAM,CAAC,MAAM,WAAW,GAAmB,CAAC,OAAO,CAAC,CAAC"}

package/dist/shared/rpcauth.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Bitcoin Core's `rpcauth` value, as its own `share/rpcauth/rpcauth.py`
+ * writes it: `<user>:<salt>$<hmac>`, the salt 16 random bytes in hex and the
+ * HMAC-SHA256 keyed with that salt's text over the password.
+ *
+ * It is the form bitcoind keeps on disk in place of the password, which is
+ * why a node's bitcoin.conf can carry it while the password itself stays in
+ * the vault and in the applications' environment.
+ */
+export declare function rpcauth(user: string, password: string, salt?: string): string;
+/** Whether an `rpcauth` value lets this user in with this password — the check bitcoind makes. */
+export declare function rpcauthAccepts(value: string, user: string, password: string): boolean;
+//# sourceMappingURL=rpcauth.d.ts.map

package/dist/shared/rpcauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpcauth.d.ts","sourceRoot":"","sources":["../../src/shared/rpcauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,SAAkC,GAAG,MAAM,CAEtG;AAED,kGAAkG;AAClG,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAMrF"}

package/dist/shared/rpcauth.js

@@ -0,0 +1,23 @@
+/**
+ * Bitcoin Core's `rpcauth` value, as its own `share/rpcauth/rpcauth.py`
+ * writes it: `<user>:<salt>$<hmac>`, the salt 16 random bytes in hex and the
+ * HMAC-SHA256 keyed with that salt's text over the password.
+ *
+ * It is the form bitcoind keeps on disk in place of the password, which is
+ * why a node's bitcoin.conf can carry it while the password itself stays in
+ * the vault and in the applications' environment.
+ */
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+export function rpcauth(user, password, salt = randomBytes(16).toString('hex')) {
+    return `${user}:${salt}$${createHmac('sha256', salt).update(password).digest('hex')}`;
+}
+/** Whether an `rpcauth` value lets this user in with this password — the check bitcoind makes. */
+export function rpcauthAccepts(value, user, password) {
+    const match = /^([^:]+):([0-9a-f]+)\$([0-9a-f]{64})$/.exec(value);
+    if (!match || match[1] !== user)
+        return false;
+    const expected = Buffer.from(createHmac('sha256', match[2]).update(password).digest('hex'));
+    const given = Buffer.from(match[3]);
+    return expected.length === given.length && timingSafeEqual(expected, given);
+}
+//# sourceMappingURL=rpcauth.js.map

package/dist/shared/rpcauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpcauth.js","sourceRoot":"","sources":["../../src/shared/rpcauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,QAAgB,EAAE,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IAC5F,OAAO,GAAG,IAAI,IAAI,IAAI,IAAI,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACxF,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,IAAY,EAAE,QAAgB;IAC1E,MAAM,KAAK,GAAG,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACrC,OAAO,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/shared/shell-escape.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Quote a string as one single-quoted shell word.
+ *
+ * Remote commands are strings handed to a shell that runs as the SSH user —
+ * root, by default — so anything interpolated into one goes through here.
+ * One implementation: the deployer and the node lease both build commands.
+ */
+export declare function shellEscape(s: string): string;
+//# sourceMappingURL=shell-escape.d.ts.map

package/dist/shared/shell-escape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-escape.d.ts","sourceRoot":"","sources":["../../src/shared/shell-escape.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE7C"}

package/dist/shared/shell-escape.js

@@ -0,0 +1,11 @@
+/**
+ * Quote a string as one single-quoted shell word.
+ *
+ * Remote commands are strings handed to a shell that runs as the SSH user —
+ * root, by default — so anything interpolated into one goes through here.
+ * One implementation: the deployer and the node lease both build commands.
+ */
+export function shellEscape(s) {
+    return "'" + s.replace(/'/g, "'\\''") + "'";
+}
+//# sourceMappingURL=shell-escape.js.map

package/dist/shared/shell-escape.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-escape.js","sourceRoot":"","sources":["../../src/shared/shell-escape.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,OAAO,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC;AAC9C,CAAC"}

package/dist/shared/sync-reading.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Whether a node's replication is keeping up — one reading for `omnitron
+ * stack status` and the console's stack pages.
+ *
+ * The master PULLS: on each heartbeat sweep (15 s by default) it drains the
+ * slave's `sync_buffer`, and `ackDrained` advances `lastSyncAt`. So entries
+ * are always waiting between two pulls — 275 to 515 on the test node,
+ * sampled every 10 s on 2026-09-23 while `lastSyncAt` moved every 15 s —
+ * and a node is behind only when entries wait and no pull has come.
+ *
+ * `connected` is not read: it is the slave's PUSH channel, which no
+ * production code opens (`ISyncStatus.connected`). The stack page read it
+ * anyway, so every node there said «Buffering», in amber, for ever; the
+ * stack list counted the nodes whose daemon answered and called them
+ * «synced».
+ *
+ * Imported by the console through `@omnitron-dev/omnitron/sync-reading`, so
+ * nothing here may need Node.
+ */
+import type { ISyncStatus } from './dto/project.js';
+/** Entries waiting and no pull for this long is a node falling behind: four missed default sweeps. */
+export declare const PULL_OVERDUE_MS = 60000;
+export type SyncFinding = 
+/** Nothing waiting. */
+{
+    readonly state: 'synced';
+}
+/** Entries since the last pull, and that pull recent: keeping up. */
+ | {
+    readonly state: 'pulling';
+    readonly pending: number;
+    readonly lastPullMs: number;
+}
+/** Entries waiting, and no pull for `PULL_OVERDUE_MS` — or none ever (`lastPullMs: null`). */
+ | {
+    readonly state: 'behind';
+    readonly pending: number;
+    readonly lastPullMs: number | null;
+};
+export declare function syncFinding(status: Pick<ISyncStatus, 'pendingItems' | 'lastSyncAt'>, now?: number): SyncFinding;
+/** Keeping up: nothing waiting, or only what arrived since a recent pull. */
+export declare const inSync: (finding: SyncFinding) => boolean;
+/** The finding in words, as `stack status` and the stack pages print it. */
+export declare function syncWords(finding: SyncFinding): string;
+//# sourceMappingURL=sync-reading.d.ts.map

package/dist/shared/sync-reading.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-reading.d.ts","sourceRoot":"","sources":["../../src/shared/sync-reading.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,sGAAsG;AACtG,eAAO,MAAM,eAAe,QAAS,CAAC;AAEtC,MAAM,MAAM,WAAW;AACrB,uBAAuB;AACrB;IAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAA;CAAE;AAC9B,qEAAqE;GACnE;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AACtF,8FAA8F;GAC5F;IAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAE/F,wBAAgB,WAAW,CACzB,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,YAAY,CAAC,EACxD,GAAG,GAAE,MAAmB,GACvB,WAAW,CAMb;AAED,6EAA6E;AAC7E,eAAO,MAAM,MAAM,YAAa,WAAW,KAAG,OAAqC,CAAC;AAEpF,4EAA4E;AAC5E,wBAAgB,SAAS,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAMtD"}

package/dist/shared/sync-reading.js

@@ -0,0 +1,42 @@
+/**
+ * Whether a node's replication is keeping up — one reading for `omnitron
+ * stack status` and the console's stack pages.
+ *
+ * The master PULLS: on each heartbeat sweep (15 s by default) it drains the
+ * slave's `sync_buffer`, and `ackDrained` advances `lastSyncAt`. So entries
+ * are always waiting between two pulls — 275 to 515 on the test node,
+ * sampled every 10 s on 2026-09-23 while `lastSyncAt` moved every 15 s —
+ * and a node is behind only when entries wait and no pull has come.
+ *
+ * `connected` is not read: it is the slave's PUSH channel, which no
+ * production code opens (`ISyncStatus.connected`). The stack page read it
+ * anyway, so every node there said «Buffering», in amber, for ever; the
+ * stack list counted the nodes whose daemon answered and called them
+ * «synced».
+ *
+ * Imported by the console through `@omnitron-dev/omnitron/sync-reading`, so
+ * nothing here may need Node.
+ */
+/** Entries waiting and no pull for this long is a node falling behind: four missed default sweeps. */
+export const PULL_OVERDUE_MS = 60_000;
+export function syncFinding(status, now = Date.now()) {
+    if (status.pendingItems === 0)
+        return { state: 'synced' };
+    const lastPullMs = status.lastSyncAt === null ? null : Math.max(0, now - status.lastSyncAt);
+    return lastPullMs !== null && lastPullMs < PULL_OVERDUE_MS
+        ? { state: 'pulling', pending: status.pendingItems, lastPullMs }
+        : { state: 'behind', pending: status.pendingItems, lastPullMs };
+}
+/** Keeping up: nothing waiting, or only what arrived since a recent pull. */
+export const inSync = (finding) => finding.state !== 'behind';
+/** The finding in words, as `stack status` and the stack pages print it. */
+export function syncWords(finding) {
+    if (finding.state === 'synced')
+        return 'in sync';
+    if (finding.state === 'pulling')
+        return `in sync · ${finding.pending} since the last pull`;
+    return finding.lastPullMs === null
+        ? `behind · ${finding.pending} waiting, never pulled`
+        : `behind · ${finding.pending} waiting, last pull ${Math.round(finding.lastPullMs / 1000)} s ago`;
+}
+//# sourceMappingURL=sync-reading.js.map

package/dist/shared/sync-reading.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-reading.js","sourceRoot":"","sources":["../../src/shared/sync-reading.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,sGAAsG;AACtG,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AAUtC,MAAM,UAAU,WAAW,CACzB,MAAwD,EACxD,GAAG,GAAW,IAAI,CAAC,GAAG,EAAE;IAExB,IAAI,MAAM,CAAC,YAAY,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC5F,OAAO,UAAU,KAAK,IAAI,IAAI,UAAU,GAAG,eAAe;QACxD,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE;QAChE,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC;AACpE,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAoB,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC;AAEpF,4EAA4E;AAC5E,MAAM,UAAU,SAAS,CAAC,OAAoB;IAC5C,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,aAAa,OAAO,CAAC,OAAO,sBAAsB,CAAC;IAC3F,OAAO,OAAO,CAAC,UAAU,KAAK,IAAI;QAChC,CAAC,CAAC,YAAY,OAAO,CAAC,OAAO,wBAAwB;QACrD,CAAC,CAAC,YAAY,OAAO,CAAC,OAAO,uBAAuB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC;AACtG,CAAC"}

package/dist/shared/tokens.d.ts

@@ -6,6 +6,7 @@ import type { Kysely } from 'kysely';
 import type { OrchestratorService } from '../orchestrator/orchestrator.service.js';
 import type { LogManager } from '../monitoring/log-manager.js';
 import type { StateStore } from '../daemon/state-store.js';
+import type { DaemonStateStore } from '../daemon/daemon-state-store.service.js';
 import type { IEcosystemConfig } from '../config/types.js';
 import type { OmnitronDatabase } from '../database/schema.js';
 import type { AuthService } from '../services/auth.service.js';
@@ -28,6 +29,12 @@ type Token<T> = ReturnType<typeof createToken<T>>;
 export declare const ORCHESTRATOR_TOKEN: Token<OrchestratorService>;
 export declare const LOG_MANAGER_TOKEN: Token<LogManager>;
 export declare const STATE_STORE_TOKEN: Token<StateStore>;
+/**
+ * Unified SQLite-backed daemon state. Backs StateStore, pid-lock,
+ * project / node / backup registries — anything that must survive
+ * a daemon restart WITHOUT requiring PostgreSQL to be up first.
+ */
+export declare const DAEMON_STATE_STORE_TOKEN: Token<DaemonStateStore>;
 export declare const ECOSYSTEM_CONFIG_TOKEN: Token<IEcosystemConfig>;
 /** Kysely connection to omnitron-pg (port 5480) */
 export declare const OMNITRON_DB_TOKEN: Token<Kysely<OmnitronDatabase>>;
@@ -55,6 +62,11 @@ export declare const TRACE_COLLECTOR_TOKEN: Token<TraceCollectorService>;
 export declare const BACKUP_SERVICE_TOKEN: Token<BackupService>;
 /** Encrypted secrets storage */
 export declare const SECRETS_SERVICE_TOKEN: Token<SecretsService>;
+/**
+ * The audit trail. Master-only: it writes to `omnitron_audit_log`, which is
+ * in the omnitron database, which a slave does not have.
+ */
+export declare const AUDIT_SERVICE_TOKEN: Token<import('../services/audit.service.js').AuditService>;
 /** Telemetry relay (store-and-forward pipeline) */
 export declare const TELEMETRY_RELAY_TOKEN: Token<TelemetryRelayService>;
 /** Infrastructure readiness gate */
@@ -63,6 +75,13 @@ export declare const INFRASTRUCTURE_GATE_TOKEN: Token<InfrastructureGate>;
 export declare const INFRASTRUCTURE_SERVICE_TOKEN: Token<InfrastructureService>;
 /** Project + Stack management service */
 export declare const PROJECT_SERVICE_TOKEN: Token<ProjectService>;
+/** JWT signing secret used by the daemon's portal AuthService. */
+export declare const JWT_SECRET_TOKEN: Token<string>;
+/** Self-identifying node ID stamped on every fleet heartbeat. */
+export declare const FLEET_SELF_NODE_ID_TOKEN: Token<string | undefined>;
+/** Passphrase + legacy file path for the encrypted secrets store. */
+export declare const SECRETS_PASSPHRASE_TOKEN: Token<string>;
+export declare const SECRETS_LEGACY_PATH_TOKEN: Token<string | undefined>;
 /** SQLite storage for slave daemons (replaces OMNITRON_DB_TOKEN on slaves) */
 export { SlaveStorageService } from '../services/slave-storage.service.js';
 import type { SlaveStorageService } from '../services/slave-storage.service.js';

package/dist/shared/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/shared/tokens.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,KAAK,KAAK,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;AAElD,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,mBAAmB,CAAoD,CAAC;AAC/G,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,UAAU,CAAyC,CAAC;AAC1F,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,UAAU,CAAyC,CAAC;AAC1F,eAAO,MAAM,sBAAsB,EAAE,KAAK,CAAC,gBAAgB,CAAoD,CAAC;AAEhH,mDAAmD;AACnD,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAuD,CAAC;AACtH,oCAAoC;AACpC,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,WAAW,CAA2C,CAAC;AAC9F,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,CAAoD,CAAC;AAEhH,4CAA4C;AAC5C,eAAO,MAAM,mBAAmB,EAAE,KAAK,CAAC,YAAY,CAA6C,CAAC;AAClG,yCAAyC;AACzC,eAAO,MAAM,mBAAmB,EAAE,KAAK,CAAC,YAAY,CAAqD,CAAC;AAC1G,6CAA6C;AAC7C,eAAO,MAAM,oBAAoB,EAAE,KAAK,CAAC,aAAa,CAA+C,CAAC;AACtG,8CAA8C;AAC9C,eAAO,MAAM,0BAA0B,EAAE,KAAK,CAAC,kBAAkB,CAAyD,CAAC;AAC3H,oCAAoC;AACpC,eAAO,MAAM,uBAAuB,EAAE,KAAK,CAAC,gBAAgB,CAAqD,CAAC;AAClH,oCAAoC;AACpC,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,iBAAiB,CAAuD,CAAC;AACtH,+BAA+B;AAC/B,eAAO,MAAM,sBAAsB,EAAE,KAAK,CAAC,eAAe,CAAmD,CAAC;AAC9G,kCAAkC;AAClC,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,CAA+D,CAAC;AAC/H,yCAAyC;AACzC,eAAO,MAAM,oBAAoB,EAAE,KAAK,CAAC,aAAa,CAA+C,CAAC;AACtG,gCAAgC;AAChC,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,cAAc,CAAiD,CAAC;AAC1G,mDAAmD;AACnD,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,CAA+D,CAAC;AAE/H,oCAAoC;AACpC,eAAO,MAAM,yBAAyB,EAAE,KAAK,CAAC,kBAAkB,CAAyD,CAAC;AAC1H,yDAAyD;AACzD,eAAO,MAAM,4BAA4B,EAAE,KAAK,CAAC,qBAAqB,CAA+D,CAAC;AAEtI,yCAAyC;AACzC,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,cAAc,CAAiD,CAAC;AAE1G,8EAA8E;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAChF,eAAO,MAAM,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,CAAoD,CAAC"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/shared/tokens.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,KAAK,KAAK,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;AAElD,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,mBAAmB,CAAoD,CAAC;AAC/G,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,UAAU,CAAyC,CAAC;AAC1F,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,UAAU,CAAyC,CAAC;AAC1F;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,gBAAgB,CAAqD,CAAC;AACnH,eAAO,MAAM,sBAAsB,EAAE,KAAK,CAAC,gBAAgB,CAAoD,CAAC;AAEhH,mDAAmD;AACnD,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAuD,CAAC;AACtH,oCAAoC;AACpC,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,WAAW,CAA2C,CAAC;AAC9F,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,CAAoD,CAAC;AAEhH,4CAA4C;AAC5C,eAAO,MAAM,mBAAmB,EAAE,KAAK,CAAC,YAAY,CAA6C,CAAC;AAClG,yCAAyC;AACzC,eAAO,MAAM,mBAAmB,EAAE,KAAK,CAAC,YAAY,CAAqD,CAAC;AAC1G,6CAA6C;AAC7C,eAAO,MAAM,oBAAoB,EAAE,KAAK,CAAC,aAAa,CAA+C,CAAC;AACtG,8CAA8C;AAC9C,eAAO,MAAM,0BAA0B,EAAE,KAAK,CAAC,kBAAkB,CAAyD,CAAC;AAC3H,oCAAoC;AACpC,eAAO,MAAM,uBAAuB,EAAE,KAAK,CAAC,gBAAgB,CAAqD,CAAC;AAClH,oCAAoC;AACpC,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,iBAAiB,CAAuD,CAAC;AACtH,+BAA+B;AAC/B,eAAO,MAAM,sBAAsB,EAAE,KAAK,CAAC,eAAe,CAAmD,CAAC;AAC9G,kCAAkC;AAClC,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,CAA+D,CAAC;AAC/H,yCAAyC;AACzC,eAAO,MAAM,oBAAoB,EAAE,KAAK,CAAC,aAAa,CAA+C,CAAC;AACtG,gCAAgC;AAChC,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,cAAc,CAAiD,CAAC;AAE1G;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,KAAK,CAAC,OAAO,8BAA8B,EAAE,YAAY,CACT,CAAC;AACnF,mDAAmD;AACnD,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,CAA+D,CAAC;AAE/H,oCAAoC;AACpC,eAAO,MAAM,yBAAyB,EAAE,KAAK,CAAC,kBAAkB,CAAyD,CAAC;AAC1H,yDAAyD;AACzD,eAAO,MAAM,4BAA4B,EAAE,KAAK,CAAC,qBAAqB,CAA+D,CAAC;AAEtI,yCAAyC;AACzC,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,cAAc,CAAiD,CAAC;AAa1G,kEAAkE;AAClE,eAAO,MAAM,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAoC,CAAC;AAChF,iEAAiE;AACjE,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CACX,CAAC;AACrD,qEAAqE;AACrE,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,MAAM,CAA4C,CAAC;AAChG,eAAO,MAAM,yBAAyB,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CACV,CAAC;AAEvD,8EAA8E;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAChF,eAAO,MAAM,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,CAAoD,CAAC"}

package/dist/shared/tokens.js

@@ -5,6 +5,12 @@ import { createToken } from '@omnitron-dev/titan/nexus';
 export const ORCHESTRATOR_TOKEN = createToken('Orchestrator');
 export const LOG_MANAGER_TOKEN = createToken('LogManager');
 export const STATE_STORE_TOKEN = createToken('StateStore');
+/**
+ * Unified SQLite-backed daemon state. Backs StateStore, pid-lock,
+ * project / node / backup registries — anything that must survive
+ * a daemon restart WITHOUT requiring PostgreSQL to be up first.
+ */
+export const DAEMON_STATE_STORE_TOKEN = createToken('DaemonStateStore');
 export const ECOSYSTEM_CONFIG_TOKEN = createToken('EcosystemConfig');
 /** Kysely connection to omnitron-pg (port 5480) */
 export const OMNITRON_DB_TOKEN = createToken('OmnitronDb');
@@ -32,6 +38,11 @@ export const TRACE_COLLECTOR_TOKEN = createToken('TraceCollectorService');
 export const BACKUP_SERVICE_TOKEN = createToken('BackupService');
 /** Encrypted secrets storage */
 export const SECRETS_SERVICE_TOKEN = createToken('SecretsService');
+/**
+ * The audit trail. Master-only: it writes to `omnitron_audit_log`, which is
+ * in the omnitron database, which a slave does not have.
+ */
+export const AUDIT_SERVICE_TOKEN = createToken('AuditService');
 /** Telemetry relay (store-and-forward pipeline) */
 export const TELEMETRY_RELAY_TOKEN = createToken('TelemetryRelayService');
 /** Infrastructure readiness gate */
@@ -40,6 +51,23 @@ export const INFRASTRUCTURE_GATE_TOKEN = createToken('InfrastructureGate');
 export const INFRASTRUCTURE_SERVICE_TOKEN = createToken('InfrastructureService');
 /** Project + Stack management service */
 export const PROJECT_SERVICE_TOKEN = createToken('ProjectService');
+// =============================================================================
+// Config-value tokens (T-2 part 2)
+// =============================================================================
+//
+// Services that historically needed `useFactory` because their
+// constructors took config strings/numbers/lambdas alongside their
+// DI deps now consume those values via dedicated `useValue` tokens.
+// This unlocks the @Injectable + @Inject + useClass migration —
+// the framework reads ctor metadata directly, eliminating the
+// parallel inject:[] array drift surface.
+/** JWT signing secret used by the daemon's portal AuthService. */
+export const JWT_SECRET_TOKEN = createToken('JwtSecret');
+/** Self-identifying node ID stamped on every fleet heartbeat. */
+export const FLEET_SELF_NODE_ID_TOKEN = createToken('FleetSelfNodeId');
+/** Passphrase + legacy file path for the encrypted secrets store. */
+export const SECRETS_PASSPHRASE_TOKEN = createToken('SecretsPassphrase');
+export const SECRETS_LEGACY_PATH_TOKEN = createToken('SecretsLegacyPath');
 /** SQLite storage for slave daemons (replaces OMNITRON_DB_TOKEN on slaves) */
 export { SlaveStorageService } from '../services/slave-storage.service.js';
 export const SLAVE_STORAGE_TOKEN = createToken('SlaveStorage');