@omnitron-dev/omnitron 0.3.0 → 0.3.2

package/dist/services/auth.service.js

@@ -24,6 +24,8 @@ import { randomBytes, randomUUID, scrypt, timingSafeEqual } from 'node:crypto';
 import { computeLockout } from './lockout.js';
 import { promisify } from 'node:util';
 import { SignJWT, jwtVerify } from 'jose';
+import { Errors } from '@omnitron-dev/titan/errors';
+import { consolePasswordError } from '../shared/dto/auth.js';
 import { Injectable, Inject } from '@omnitron-dev/titan/decorators';
 import { OMNITRON_DB_TOKEN, JWT_SECRET_TOKEN } from '../shared/tokens.js';
 const scryptAsync = promisify(scrypt);
@@ -36,10 +38,14 @@ const KEY_LENGTH = 64;
  * What migration 001 seeds. Named here so the check below cannot drift from
  * the migration silently — if the seed changes, this is the other half.
  */
-const SEEDED_ADMIN_USERNAME = 'admin';
 const SEEDED_ADMIN_PASSWORD = 'admin';
 const SESSION_DURATION_MS = 24 * 60 * 60 * 1000; // 24 hours
 const JWT_EXPIRY = '1h';
+function assertSignInUnlocked(until) {
+    const remaining = until ? until.getTime() - Date.now() : 0;
+    if (remaining > 0)
+        throw new Error(`Account temporarily locked — try again in ${Math.ceil(remaining / 1000)}s`);
+}
 // =============================================================================
 // Auth Service
 // =============================================================================
@@ -79,85 +85,72 @@ let AuthService = class AuthService {
      */
     async signIn(request, origin = {}) {
         const { username, password, userAgent } = request;
-        // 1. Find user
-        const user = await this.db
-            .selectFrom('omnitron_users')
-            .selectAll()
+        const candidate = await this.db.selectFrom('omnitron_users')
+            .select(['id', 'passwordHash', 'lockedUntil'])
             .where('username', '=', username)
             .executeTakeFirst();
-        // 2. Reject while locked out, before spending a scrypt on it.
-        if (user?.lockedUntil && new Date(user.lockedUntil) > new Date()) {
-            const seconds = Math.ceil((new Date(user.lockedUntil).getTime() - Date.now()) / 1000);
-            throw new Error(`Account temporarily locked — try again in ${seconds}s`);
-        }
-        // 3. Verify password.
-        //
-        // An unknown username still costs a full scrypt against a throwaway hash.
-        // Returning early on "no such user" made sign-in measurably faster for
-        // absent accounts than for present ones, which is a username oracle on
-        // the infrastructure control plane: scrypt here takes ~100ms, so the
-        // difference was trivially observable over the network.
-        const valid = user
-            ? await this.verifyPassword(password, user.passwordHash)
-            : await this.verifyPassword(password, await this.decoyHash());
-        if (!user || !valid) {
-            if (user)
-                await this.registerFailedAttempt(user.id, user.failedLoginAttempts);
+        assertSignInUnlocked(candidate?.lockedUntil);
+        // Hash outside the transaction so slow password checks never hold a row
+        // lock or pool connection. Unknown usernames pay the same verification cost.
+        const valid = await this.verifyPassword(password, candidate?.passwordHash ?? (await this.decoyHash()));
+        if (!candidate)
             throw new Error('Invalid credentials');
-        }
-        // 4. Create session (include role in JWT for RBAC enforcement)
-        const sessionId = randomUUID();
-        const expiresAt = new Date(Date.now() + SESSION_DURATION_MS);
-        const accessToken = await this.issueToken(user.id, sessionId, user.role);
-        await this.db
-            .insertInto('omnitron_sessions')
-            .values({
-            id: sessionId,
-            userId: user.id,
-            token: accessToken,
-            expiresAt,
-            ipAddress: origin.ipAddress ?? null,
-            userAgent: userAgent ?? null,
-        })
-            .execute();
-        // 5. Update last login and clear the failure streak
-        await this.db
-            .updateTable('omnitron_users')
-            .set({ lastLoginAt: new Date(), failedLoginAttempts: 0, lockedUntil: null })
-            .where('id', '=', user.id)
-            .execute();
-        return {
-            user: {
-                id: user.id,
-                username: user.username,
-                displayName: user.displayName,
-                role: user.role,
-                totpEnabled: user.totpEnabled,
-                pgpEnabled: user.pgpEnabled,
-            },
-            session: { id: sessionId, expiresAt },
-            accessToken,
-        };
-    }
-    // ===========================================================================
-    // Brute-force throttling
-    // ===========================================================================
-    /**
-     * Record a failed sign-in and lock the account once the streak crosses the
-     * threshold. The lockout grows exponentially with each additional failure
-     * past the threshold, capped at LOCKOUT_MAX_MS.
-     *
-     * State is persisted rather than held in memory: a daemon restart — which
-     * an attacker may be able to provoke — must not hand back a clean slate.
-     */
-    async registerFailedAttempt(userId, currentAttempts) {
-        const attempts = currentAttempts + 1;
-        const lockedUntil = computeLockout(attempts);
-        await this.db
-            .updateTable('omnitron_users')
-            .set({ failedLoginAttempts: attempts, lockedUntil })
-            .where('id', '=', userId)
-            .execute();
+        const result = await this.db.transaction().execute(async (trx) => {
+            // Serialize account transitions across every client and daemon. Re-read the
+            // credential and role in case either changed while scrypt was running.
+            const user = await trx.selectFrom('omnitron_users')
+                .select(['id', 'username', 'passwordHash', 'displayName', 'role', 'totpEnabled', 'pgpEnabled',
+                'failedLoginAttempts', 'lockedUntil'])
+                .where('id', '=', candidate.id)
+                .forUpdate()
+                .executeTakeFirst();
+            if (!user || user.passwordHash !== candidate.passwordHash || user.username !== username)
+                return null;
+            if (!valid) {
+                // Every check admitted before the lock counts once. New arrivals
+                // during the lock are refused before hashing and cannot extend it.
+                const attempts = user.failedLoginAttempts + 1;
+                await trx.updateTable('omnitron_users')
+                    .set({ failedLoginAttempts: attempts, lockedUntil: computeLockout(attempts) })
+                    .where('id', '=', user.id)
+                    .execute();
+                return null;
+            }
+            assertSignInUnlocked(user.lockedUntil);
+            const sessionId = randomUUID();
+            const expiresAt = new Date(Date.now() + SESSION_DURATION_MS);
+            const accessToken = await this.issueToken(user.id, sessionId, user.role);
+            await trx.insertInto('omnitron_sessions')
+                .values({
+                id: sessionId,
+                userId: user.id,
+                token: accessToken,
+                expiresAt,
+                ipAddress: origin.ipAddress ?? null,
+                userAgent: userAgent ?? null,
+            })
+                .execute();
+            await trx.updateTable('omnitron_users')
+                .set({ lastLoginAt: new Date(), failedLoginAttempts: 0, lockedUntil: null })
+                .where('id', '=', user.id)
+                .execute();
+            return {
+                user: {
+                    id: user.id,
+                    username: user.username,
+                    displayName: user.displayName,
+                    role: user.role,
+                    totpEnabled: user.totpEnabled,
+                    pgpEnabled: user.pgpEnabled,
+                },
+                session: { id: sessionId, expiresAt },
+                accessToken,
+            };
+        });
+        // Returning from the transaction first commits a recorded failed attempt.
+        if (!result)
+            throw new Error('Invalid credentials');
+        return result;
     }
     /**
      * A scrypt hash of a random secret, computed once per process.
@@ -240,37 +233,7 @@ let AuthService = class AuthService {
             const sessionId = payload['sid'];
             if (!userId || !sessionId)
                 return null;
-            // The session lookup gets its own catch, because a database that cannot
-            // answer is not a revoked session.
-            //
-            // Both used to return null from the outer catch, and the daemon turns
-            // null into `Session has been revoked or expired` with a 401. So every
-            // operator, during a database outage, was told their session had been
-            // revoked — an affirmative claim about their account, made at the one
-            // moment the platform could not check, and the kind of message that
-            // sends someone looking for a security incident. Signing in again does
-            // not help either: that path needs the same database.
-            let session;
-            try {
-                session = await this.db
-                    .selectFrom('omnitron_sessions')
-                    .select(['id', 'expiresAt'])
-                    .where('id', '=', sessionId)
-                    .where('userId', '=', userId)
-                    .executeTakeFirst();
-            }
-            catch (err) {
-                throw Object.assign(new Error('Session store is unavailable'), {
-                    code: 'SESSION_STORE_UNAVAILABLE',
-                    statusCode: 503,
-                    cause: err,
-                });
-            }
-            if (!session)
-                return null;
-            if (new Date(session.expiresAt) < new Date())
-                return null;
-            return { userId, sessionId };
+            return await this.validateSessionAuthority(userId, sessionId);
         }
         catch (err) {
             // A token that does not verify is the normal answer here. The lookup
@@ -280,6 +243,23 @@ let AuthService = class AuthService {
             return null;
         }
     }
+    /** One indexed join per admitted call. Store failure is unavailable, never a false revocation. */
+    async validateSessionAuthority(userId, sessionId) {
+        let session;
+        try {
+            session = await this.db.selectFrom('omnitron_sessions')
+                .innerJoin('omnitron_users', 'omnitron_users.id', 'omnitron_sessions.userId')
+                .select(['omnitron_sessions.id', 'omnitron_sessions.expiresAt', 'omnitron_users.role'])
+                .where('omnitron_sessions.id', '=', sessionId).where('omnitron_sessions.userId', '=', userId)
+                .executeTakeFirst();
+        }
+        catch (error) {
+            throw Object.assign(new Error('Session store is unavailable'), { code: 'SESSION_STORE_UNAVAILABLE', statusCode: 503, cause: error });
+        }
+        if (!session || !Number.isFinite(new Date(session.expiresAt).getTime()) || new Date(session.expiresAt).getTime() <= Date.now())
+            return null;
+        return { userId, sessionId, role: session.role };
+    }
     // ===========================================================================
     // Get Active Sessions
     // ===========================================================================
@@ -349,6 +329,9 @@ let AuthService = class AuthService {
     // Change Password
     // ===========================================================================
     async changePassword(userId, oldPassword, newPassword, currentSessionId) {
+        const passwordError = consolePasswordError(newPassword);
+        if (passwordError)
+            throw Errors.badRequest(passwordError);
         const user = await this.db
             .selectFrom('omnitron_users')
             .select(['id', 'passwordHash'])
@@ -362,17 +345,22 @@ let AuthService = class AuthService {
             throw new Error('Invalid current password');
         }
         const newHash = await this.hashPassword(newPassword);
-        await this.db
-            .updateTable('omnitron_users')
-            .set({ passwordHash: newHash, updatedAt: new Date() })
-            .where('id', '=', userId)
-            .execute();
-        // Revoke all sessions except the caller's current session
-        let query = this.db.deleteFrom('omnitron_sessions').where('userId', '=', userId);
-        if (currentSessionId) {
-            query = query.where('id', '!=', currentSessionId);
-        }
-        await query.execute();
+        await this.db.transaction().execute(async (trx) => {
+            const changed = await trx
+                .updateTable('omnitron_users')
+                .set({ passwordHash: newHash, updatedAt: new Date() })
+                .where('id', '=', userId)
+                .where('passwordHash', '=', user.passwordHash)
+                .executeTakeFirst();
+            if (!changed.numUpdatedRows)
+                throw new Error('Invalid current password');
+            // Revoke all sessions except the caller's current session
+            let query = trx.deleteFrom('omnitron_sessions').where('userId', '=', userId);
+            if (currentSessionId) {
+                query = query.where('id', '!=', currentSessionId);
+            }
+            await query.execute();
+        });
     }
     // ===========================================================================
     // Password Hashing (crypto.scrypt — no external deps)
@@ -383,28 +371,26 @@ let AuthService = class AuthService {
         return `scrypt:${salt.toString('hex')}:${derived.toString('hex')}`;
     }
     /**
-     * Is the seeded `admin` account still using the password it shipped with?
-     *
-     * Migration 001 seeds `admin` / `admin` and its comment says the password
-     * "MUST be changed on first login". Nothing enforced that — no flag, no
-     * gate, no check anywhere in this daemon. A comment is not a control.
-     *
-     * The daemon binds loopback by default and the console does too, so this
-     * only matters where an operator has deliberately published one of them.
-     * That is exactly the moment to ask, which is what the caller does.
-     *
-     * Answers false when the account is gone or renamed: the question is about
-     * a shipped credential, not about weak passwords in general.
+     * Is the shipped password still accepted by any Console account? Renaming
+     * or demoting the seeded account must not bypass publication admission.
+     * Keyset paging bounds memory; this check runs before external publication,
+     * not on every login or RPC. New credentials already require 15 characters.
      */
     async isUsingSeededAdminPassword() {
-        const user = await this.db
-            .selectFrom('omnitron_users')
-            .select(['passwordHash'])
-            .where('username', '=', SEEDED_ADMIN_USERNAME)
-            .executeTakeFirst();
-        if (!user)
-            return false;
-        return this.verifyPassword(SEEDED_ADMIN_PASSWORD, user.passwordHash);
+        let after;
+        for (;;) {
+            let query = this.db.selectFrom('omnitron_users').select(['id', 'passwordHash']).orderBy('id').limit(100);
+            if (after !== undefined)
+                query = query.where('id', '>', after);
+            const users = await query.execute();
+            for (const user of users) {
+                if (await this.verifyPassword(SEEDED_ADMIN_PASSWORD, user.passwordHash))
+                    return true;
+            }
+            if (users.length < 100)
+                return false;
+            after = users.at(-1).id;
+        }
     }
     async verifyPassword(password, hash) {
         const parts = hash.split(':');

package/dist/services/auth.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../src/services/auth.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;;;;;;;;;;;;;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAG1C,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAQ1E,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;AActC,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB;;;GAGG;AACH,MAAM,qBAAqB,GAAG,OAAO,CAAC;AACtC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AACtC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW;AAC5D,MAAM,UAAU,GAAG,IAAI,CAAC;AAGxB,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAGzE,IAAM,WAAW,GAAjB,MAAM,WAAW;IAYwB,EAAE;IAX/B,SAAS,CAAa;IACvC,sDAAsD;IAC9C,gBAAgB,GAA2B,IAAI,CAAC;IAExD,iEAAiE;IACjE,gEAAgE;IAChE,+DAA+D;IAC/D,kEAAkE;IAClE,2DAA2D;IAC3D,gCAAgC;IAChC,YAC8C,EAA4B,EAC9C,SAAiB;kBADC,EAAE;QAG9C,8DAA8D;QAC9D,iEAAiE;QACjE,8DAA8D;QAC9D,4DAA4D;QAC5D,iEAAiE;QACjE,8DAA8D;QAC9D,gEAAgE;QAChE,wBAAwB;QACxB,IAAI,CAAC,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,IAAI,yBAAyB,CAAC,CAAC;IACpF,CAAC;IAED,8EAA8E;IAC9E,UAAU;IACV,8EAA8E;IAE9E;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CACV,OAA8B,EAC9B,MAAM,GAA2B,EAAE;QAEnC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QAElD,eAAe;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,gBAAgB,CAAC;aAC5B,SAAS,EAAE;aACX,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC;aAChC,gBAAgB,EAAE,CAAC;QAEtB,8DAA8D;QAC9D,IAAI,IAAI,EAAE,WAAW,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,6CAA6C,OAAO,GAAG,CAAC,CAAC;QAC3E,CAAC;QAED,sBAAsB;QACtB,EAAE;QACF,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,wDAAwD;QACxD,MAAM,KAAK,GAAG,IAAI;YAChB,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC;YACxD,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAEhE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,IAAI;gBAAE,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,+DAA+D;QAC/D,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEzE,MAAM,IAAI,CAAC,EAAE;aACV,UAAU,CAAC,mBAAmB,CAAC;aAC/B,MAAM,CAAC;YACN,EAAE,EAAE,SAAS;YACb,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,WAAW;YAClB,SAAS;YACT,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;YACnC,SAAS,EAAE,SAAS,IAAI,IAAI;SAC7B,CAAC;aACD,OAAO,EAAE,CAAC;QAEb,oDAAoD;QACpD,MAAM,IAAI,CAAC,EAAE;aACV,WAAW,CAAC,gBAAgB,CAAC;aAC7B,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;aAC3E,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;aACzB,OAAO,EAAE,CAAC;QAEb,OAAO;YACL,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B;YACD,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE;YACrC,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,yBAAyB;IACzB,8EAA8E;IAE9E;;;;;;;OAOG;IACK,KAAK,CAAC,qBAAqB,CAAC,MAAc,EAAE,eAAuB;QACzE,MAAM,QAAQ,GAAG,eAAe,GAAG,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QAE7C,MAAM,IAAI,CAAC,EAAE;aACV,WAAW,CAAC,gBAAgB,CAAC;aAC7B,GAAG,CAAC,EAAE,mBAAmB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;aACnD,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;aACxB,OAAO,EAAE,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC,gBAAgB,KAAK,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED,8EAA8E;IAC9E,WAAW;IACX,8EAA8E;IAE9E,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,IAAI,CAAC,EAAE;aACV,UAAU,CAAC,mBAAmB,CAAC;aAC/B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,OAAO,EAAE,CAAC;IACf,CAAC;IAED,8EAA8E;IAC9E,mBAAmB;IACnB,8EAA8E;IAE9E,KAAK,CAAC,eAAe,CAAC,SAAiB;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;aAC1B,UAAU,CAAC,mBAAmB,CAAC;aAC/B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,eAAe;QACf,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC7C,qBAAqB;YACrB,MAAM,IAAI,CAAC,EAAE;iBACV,UAAU,CAAC,mBAAmB,CAAC;iBAC/B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;iBAC3B,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,gBAAgB,CAAC;aAC5B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC;aAChC,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;aAC1B,UAAU,CAAC,mBAAmB,CAAC;aAC/B,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC;aACrB,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;IACpD,CAAC;IAED,8EAA8E;IAC9E,uBAAuB;IACvB,8EAA8E;IAE9E,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;gBACzD,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;YAC3B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAuB,CAAC;YAEvD,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAEvC,wEAAwE;YACxE,mCAAmC;YACnC,EAAE;YACF,sEAAsE;YACtE,uEAAuE;YACvE,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,uEAAuE;YACvE,sDAAsD;YACtD,IAAI,OAAO,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;qBACpB,UAAU,CAAC,mBAAmB,CAAC;qBAC/B,MAAM,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;qBAC3B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;qBAC3B,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;qBAC5B,gBAAgB,EAAE,CAAC;YACxB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,EAAE;oBAC7D,IAAI,EAAE,2BAA2B;oBACjC,UAAU,EAAE,GAAG;oBACf,KAAK,EAAE,GAAG;iBACX,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;gBAAE,OAAO,IAAI,CAAC;YAE1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,gEAAgE;YAChE,IAAK,GAAyB,EAAE,IAAI,KAAK,2BAA2B;gBAAE,MAAM,GAAG,CAAC;YAChF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,sBAAsB;IACtB,8EAA8E;IAE9E,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,gBAAyB;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE;aAC3B,UAAU,CAAC,mBAAmB,CAAC;aAC/B,SAAS,EAAE;aACX,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;aAC5B,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;aACnC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;aAC5B,OAAO,EAAE,CAAC;QAEb,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1B,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAChC,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAChC,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,gBAAgB;SACnC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;aAC1B,UAAU,CAAC,mBAAmB,CAAC;aAC/B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,iFAAiF;QACjF,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACrE,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YACpF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,gBAAgB,CAAC;aAC5B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC;aAChC,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,6DAA6D;QAC7D,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtE,MAAM,IAAI,CAAC,EAAE;aACV,WAAW,CAAC,mBAAmB,CAAC;aAChC,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;aACjD,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,OAAO,EAAE,CAAC;QAEb,OAAO;YACL,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B;YACD,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE;YACnD,WAAW,EAAE,QAAQ;SACtB,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,WAAmB,EAAE,WAAmB,EAAE,gBAAyB;QACtG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,gBAAgB,CAAC;aAC5B,MAAM,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;aAC9B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;aACxB,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAErD,MAAM,IAAI,CAAC,EAAE;aACV,WAAW,CAAC,gBAAgB,CAAC;aAC7B,GAAG,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACrD,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;aACxB,OAAO,EAAE,CAAC;QAEb,0DAA0D;QAC1D,IAAI,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACjF,IAAI,gBAAgB,EAAE,CAAC;YACrB,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,8EAA8E;IAC9E,sDAAsD;IACtD,8EAA8E;IAE9E,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAW,CAAC;QAC1E,OAAO,UAAU,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,0BAA0B;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,gBAAgB,CAAC;aAC5B,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;aACxB,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,qBAAqB,CAAC;aAC7C,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,IAAI,CAAC,cAAc,CAAC,qBAAqB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,IAAY;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAE9D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAW,CAAC;QAE1E,OAAO,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,8EAA8E;IAC9E,MAAM;IACN,8EAA8E;IAEtE,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,SAAiB,EAAE,IAAI,GAAG,QAAQ;QACzE,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;aACzC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;aACpC,UAAU,CAAC,MAAM,CAAC;aAClB,SAAS,CAAC,UAAU,CAAC;aACrB,WAAW,EAAE;aACb,iBAAiB,CAAC,UAAU,CAAC;aAC7B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED,8EAA8E;IAC9E,UAAU;IACV,8EAA8E;IAE9E,sDAAsD;IACtD,KAAK,CAAC,sBAAsB;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,UAAU,CAAC,mBAAmB,CAAC;aAC/B,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;aACnC,gBAAgB,EAAE,CAAC;QAEtB,OAAO,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC;CACF,CAAA;AAjcY,WAAW;IADvB,UAAU,EAAE;IAaR,WAAA,MAAM,CAAC,iBAAiB,CAAC,CAAA;IACzB,WAAA,MAAM,CAAC,gBAAgB,CAAC,CAAA;;GAbhB,WAAW,CAicvB"}
+{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../src/services/auth.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;;;;;;;;;;;;;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAG7D,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAQ1E,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;AActC,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB;;;GAGG;AACH,MAAM,qBAAqB,GAAG,OAAO,CAAC;AACtC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW;AAC5D,MAAM,UAAU,GAAG,IAAI,CAAC;AAExB,SAAS,oBAAoB,CAAC,KAA8B;IAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,IAAI,SAAS,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;AAClH,CAAC;AAGD,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAGzE,IAAM,WAAW,GAAjB,MAAM,WAAW;IAYwB,EAAE;IAX/B,SAAS,CAAa;IACvC,sDAAsD;IAC9C,gBAAgB,GAA2B,IAAI,CAAC;IAExD,iEAAiE;IACjE,gEAAgE;IAChE,+DAA+D;IAC/D,kEAAkE;IAClE,2DAA2D;IAC3D,gCAAgC;IAChC,YAC8C,EAA4B,EAC9C,SAAiB;kBADC,EAAE;QAG9C,8DAA8D;QAC9D,iEAAiE;QACjE,8DAA8D;QAC9D,4DAA4D;QAC5D,iEAAiE;QACjE,8DAA8D;QAC9D,gEAAgE;QAChE,wBAAwB;QACxB,IAAI,CAAC,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,IAAI,yBAAyB,CAAC,CAAC;IACpF,CAAC;IAED,8EAA8E;IAC9E,UAAU;IACV,8EAA8E;IAE9E;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CACV,OAA8B,EAC9B,MAAM,GAA2B,EAAE;QAEnC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QAElD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC;aACzD,MAAM,CAAC,CAAC,IAAI,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;aAC7C,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC;aAChC,gBAAgB,EAAE,CAAC;QACtB,oBAAoB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAE7C,wEAAwE;QACxE,6EAA6E;QAC7E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACvG,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC/D,4EAA4E;YAC5E,uEAAuE;YACvE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC;iBAChD,MAAM,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY;gBAC3F,qBAAqB,EAAE,aAAa,CAAC,CAAC;iBACvC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;iBAC9B,SAAS,EAAE;iBACX,gBAAgB,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,YAAY,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAErG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,iEAAiE;gBACjE,mEAAmE;gBACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAC;gBAC9C,MAAM,GAAG,CAAC,WAAW,CAAC,gBAAgB,CAAC;qBACpC,GAAG,CAAC,EAAE,mBAAmB,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;qBAC7E,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;qBACzB,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YACD,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAEvC,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC,CAAC;YAC7D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAEzE,MAAM,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC;iBACtC,MAAM,CAAC;gBACN,EAAE,EAAE,SAAS;gBACb,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK,EAAE,WAAW;gBAClB,SAAS;gBACT,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;gBACnC,SAAS,EAAE,SAAS,IAAI,IAAI;aAC7B,CAAC;iBACD,OAAO,EAAE,CAAC;YACb,MAAM,GAAG,CAAC,WAAW,CAAC,gBAAgB,CAAC;iBACpC,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;iBAC3E,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;iBACzB,OAAO,EAAE,CAAC;YAEb,OAAO;gBACL,IAAI,EAAE;oBACJ,EAAE,EAAE,IAAI,CAAC,EAAE;oBACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B;gBACD,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE;gBACrC,WAAW;aACZ,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,0EAA0E;QAC1E,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC,gBAAgB,KAAK,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED,8EAA8E;IAC9E,WAAW;IACX,8EAA8E;IAE9E,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,IAAI,CAAC,EAAE;aACV,UAAU,CAAC,mBAAmB,CAAC;aAC/B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,OAAO,EAAE,CAAC;IACf,CAAC;IAED,8EAA8E;IAC9E,mBAAmB;IACnB,8EAA8E;IAE9E,KAAK,CAAC,eAAe,CAAC,SAAiB;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;aAC1B,UAAU,CAAC,mBAAmB,CAAC;aAC/B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,eAAe;QACf,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC7C,qBAAqB;YACrB,MAAM,IAAI,CAAC,EAAE;iBACV,UAAU,CAAC,mBAAmB,CAAC;iBAC/B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;iBAC3B,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,gBAAgB,CAAC;aAC5B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC;aAChC,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;aAC1B,UAAU,CAAC,mBAAmB,CAAC;aAC/B,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC;aACrB,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;IACpD,CAAC;IAED,8EAA8E;IAC9E,uBAAuB;IACvB,8EAA8E;IAE9E,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;gBACzD,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;YAC3B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAuB,CAAC;YAEvD,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAEvC,OAAO,MAAM,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,gEAAgE;YAChE,IAAK,GAAyB,EAAE,IAAI,KAAK,2BAA2B;gBAAE,MAAM,GAAG,CAAC;YAChF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,wBAAwB,CAAC,MAAc,EAAE,SAAiB;QAC9D,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC;iBACpD,SAAS,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,0BAA0B,CAAC;iBAC5E,MAAM,CAAC,CAAC,sBAAsB,EAAE,6BAA6B,EAAE,qBAAqB,CAAC,CAAC;iBACtF,KAAK,CAAC,sBAAsB,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5F,gBAAgB,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACvI,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAC5I,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IACnD,CAAC;IAED,8EAA8E;IAC9E,sBAAsB;IACtB,8EAA8E;IAE9E,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,gBAAyB;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE;aAC3B,UAAU,CAAC,mBAAmB,CAAC;aAC/B,SAAS,EAAE;aACX,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;aAC5B,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;aACnC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;aAC5B,OAAO,EAAE,CAAC;QAEb,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1B,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAChC,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAChC,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,gBAAgB;SACnC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;aAC1B,UAAU,CAAC,mBAAmB,CAAC;aAC/B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,iFAAiF;QACjF,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACrE,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YACpF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,gBAAgB,CAAC;aAC5B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC;aAChC,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,6DAA6D;QAC7D,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtE,MAAM,IAAI,CAAC,EAAE;aACV,WAAW,CAAC,mBAAmB,CAAC;aAChC,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;aACjD,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,OAAO,EAAE,CAAC;QAEb,OAAO;YACL,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B;YACD,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE;YACnD,WAAW,EAAE,QAAQ;SACtB,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,WAAmB,EAAE,WAAmB,EAAE,gBAAyB;QACtG,MAAM,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,aAAa;YAAE,MAAM,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,gBAAgB,CAAC;aAC5B,MAAM,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;aAC9B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;aACxB,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAErD,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAChD,MAAM,OAAO,GAAG,MAAM,GAAG;iBACtB,WAAW,CAAC,gBAAgB,CAAC;iBAC7B,GAAG,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBACrD,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;iBACxB,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC;iBAC7C,gBAAgB,EAAE,CAAC;YACtB,IAAI,CAAC,OAAO,CAAC,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAEzE,0DAA0D;YAC1D,IAAI,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC7E,IAAI,gBAAgB,EAAE,CAAC;gBACrB,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,sDAAsD;IACtD,8EAA8E;IAE9E,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAW,CAAC;QAC1E,OAAO,UAAU,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACrE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,0BAA0B;QAC9B,IAAI,KAAyB,CAAC;QAC9B,SAAS,CAAC;YACR,IAAI,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACzG,IAAI,KAAK,KAAK,SAAS;gBAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;YACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,EAAE,IAAI,CAAC,YAAY,CAAC;oBAAE,OAAO,IAAI,CAAC;YACvF,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;gBAAE,OAAO,KAAK,CAAC;YACrC,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,IAAY;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAE9D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAW,CAAC;QAE1E,OAAO,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,8EAA8E;IAC9E,MAAM;IACN,8EAA8E;IAEtE,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,SAAiB,EAAE,IAAI,GAAG,QAAQ;QACzE,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;aACzC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;aACpC,UAAU,CAAC,MAAM,CAAC;aAClB,SAAS,CAAC,UAAU,CAAC;aACrB,WAAW,EAAE;aACb,iBAAiB,CAAC,UAAU,CAAC;aAC7B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED,8EAA8E;IAC9E,UAAU;IACV,8EAA8E;IAE9E,sDAAsD;IACtD,KAAK,CAAC,sBAAsB;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,UAAU,CAAC,mBAAmB,CAAC;aAC/B,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;aACnC,gBAAgB,EAAE,CAAC;QAEtB,OAAO,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC;CACF,CAAA;AAnaY,WAAW;IADvB,UAAU,EAAE;IAaR,WAAA,MAAM,CAAC,iBAAiB,CAAC,CAAA;IACzB,WAAA,MAAM,CAAC,gBAAgB,CAAC,CAAA;;GAbhB,WAAW,CAmavB"}

package/dist/services/backup-pipeline.d.ts

@@ -30,7 +30,7 @@
  * writing under the FINAL name since its first byte.
  *
  * Measured in `~/.omnitron/backups` after this host filled on 2026-09-14 —
- * `main_…07-51….sql.gz` at 98 304 bytes and `priceverse_…sql.gz` at 1.5 MB,
+ * `main_…07-51….sql.gz` at 98 304 bytes and `quotes_…sql.gz` at 1.5 MB,
  * both a gzip header with the body cut off, both sitting under their final
  * names where a restore would have taken them. So the write goes to
  * `<name>.partial` and is renamed once the exit code has been checked.

package/dist/services/backup-pipeline.js

@@ -30,7 +30,7 @@
  * writing under the FINAL name since its first byte.
  *
  * Measured in `~/.omnitron/backups` after this host filled on 2026-09-14 —
- * `main_…07-51….sql.gz` at 98 304 bytes and `priceverse_…sql.gz` at 1.5 MB,
+ * `main_…07-51….sql.gz` at 98 304 bytes and `quotes_…sql.gz` at 1.5 MB,
  * both a gzip header with the body cut off, both sitting under their final
  * names where a restore would have taken them. So the write goes to
  * `<name>.partial` and is renamed once the exit code has been checked.

package/dist/services/backup-storage.d.ts

@@ -0,0 +1,14 @@
+export interface StorageBackupTarget {
+    /** An inspected immutable container ID, never a name that can be reassigned. */
+    container: string;
+    accessKey: string;
+    secretKey: string;
+    bucket: string;
+}
+export declare function validateStorageBucket(bucket: unknown): asserts bucket is string;
+/** Validate every entry before extracting: object backups contain only regular files and directories. */
+export declare function validateStorageArchive(file: string): Promise<void>;
+/** Current object contents only; this is not a versioned-volume or cross-service transaction snapshot. */
+export declare function backupStorageObjects(target: StorageBackupTarget, destination: string): Promise<void>;
+export declare function restoreStorageObjects(target: StorageBackupTarget, file: string): Promise<void>;
+//# sourceMappingURL=backup-storage.d.ts.map

package/dist/services/backup-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-storage.d.ts","sourceRoot":"","sources":["../../src/services/backup-storage.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,mBAAmB;IAClC,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAI/E;AAqFD,yGAAyG;AACzG,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAaxE;AAsBD,0GAA0G;AAC1G,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB1G;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBpG"}

package/dist/services/backup-storage.js

@@ -0,0 +1,195 @@
+import { execFile } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { create, extract, list } from 'tar';
+import { dumpToFile, restoreFromFile } from './backup-pipeline.js';
+export function validateStorageBucket(bucket) {
+    if (typeof bucket !== 'string' || bucket.length < 3 || bucket.length > 63 ||
+        !/^[a-z0-9][a-z0-9.-]*[a-z0-9]$/.test(bucket) || /\.\.|\.-|-\./.test(bucket) || /^\d+\.\d+\.\d+\.\d+$/.test(bucket))
+        throw new Error('A storage backup requires an explicit valid S3 bucket name');
+}
+/** Bounded argv execution: credentials are environment values, never shell text or argv. */
+async function command(args, env) {
+    return new Promise((resolve, reject) => {
+        execFile('docker', args, { env: { ...process.env, ...env }, timeout: 600_000, maxBuffer: 16 * 1024 * 1024 }, (error, stdout, stderr) => {
+            if (!error) {
+                resolve(stdout);
+                return;
+            }
+            let detail = String(stderr || error.message).slice(0, 4096);
+            for (const value of [env?.['MC_AK'], env?.['MC_SK']])
+                if (value)
+                    detail = detail.split(value).join('[redacted]');
+            reject(new Error(`Storage backup command failed: ${detail}`));
+        });
+    });
+}
+const initialize = 'set -eu; umask 077; mkdir "$OMNI_BACKUP_STAGE"; ' +
+    'export MC_CONFIG_DIR="$OMNI_BACKUP_STAGE/config"; ' +
+    'mc alias set omniBackup http://localhost:9000 "$MC_AK" "$MC_SK" >/dev/null; ';
+function inventory(data) {
+    if (Buffer.byteLength(data) > 16 * 1024 * 1024)
+        throw new Error('Storage inventory exceeds the 16 MiB backup limit');
+    const records = [];
+    const names = new Set();
+    for (const line of data.split('\n').filter(Boolean)) {
+        const item = JSON.parse(line);
+        const key = item['key'], size = item['size'], etag = item['etag'];
+        // mc normalizes object names. Refuse keyspaces a filesystem mirror cannot represent losslessly.
+        if (item['status'] !== 'success' || item['type'] !== 'file' || typeof key !== 'string' || !key ||
+            key.includes('\\') || [...key].some(character => character.charCodeAt(0) < 32) || key.startsWith('/') || key.endsWith('/') ||
+            key.split('/').some(part => !part || part === '.' || part === '..') ||
+            typeof size !== 'number' || !Number.isSafeInteger(size) || size < 0 || typeof etag !== 'string' || !etag)
+            throw new Error('Storage contains an unsupported object key or unreadable inventory entry');
+        const normalized = key.normalize('NFC').toLowerCase();
+        if (names.has(normalized))
+            throw new Error('Storage object names collide on a portable filesystem');
+        names.add(normalized);
+        records.push({ key, size, etag });
+    }
+    for (const key of names) {
+        for (let parent = path.posix.dirname(key); parent !== '.'; parent = path.posix.dirname(parent))
+            if (names.has(parent))
+                throw new Error('Storage object is also a directory prefix; cannot mirror it losslessly');
+    }
+    return records.sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0);
+}
+async function listInventory(target, remote) {
+    return inventory(await inContainer(target, remote, 'set -eu; export MC_CONFIG_DIR="$OMNI_BACKUP_STAGE/config"; ' +
+        'mc ls --recursive --json "omniBackup/$MC_BUCKET"'));
+}
+/** Settle every started transfer before releasing its shared credential directory. */
+async function transferObjects(objects, transfer) {
+    for (let offset = 0; offset < objects.length; offset += 4) {
+        const results = await Promise.allSettled(objects.slice(offset, offset + 4).map(transfer));
+        const failed = results.find(result => result.status === 'rejected');
+        if (failed?.status === 'rejected')
+            throw failed.reason;
+    }
+}
+function objectCommand(target, remote, operation, key) {
+    return { args: ['exec', ...(operation === 'pipe' ? ['-i'] : []), '-e', 'MC_CONFIG_DIR',
+            target.container, 'mc', operation, `omniBackup/${target.bucket}/${key}`],
+        options: { env: { ...process.env, MC_CONFIG_DIR: `${remote}/config` } } };
+}
+async function verifyMirroredKeys(directory, objects) {
+    const remaining = new Map(objects.map(item => [item.key, item.size]));
+    const visit = async (folder) => {
+        for (const name of await fs.readdir(path.join(directory, folder))) {
+            const relative = folder ? folder + '/' + name : name;
+            const stat = await fs.lstat(path.join(directory, relative));
+            if (stat.isDirectory())
+                await visit(relative);
+            else if (!stat.isFile() || stat.nlink !== 1 || remaining.get(relative) !== stat.size)
+                throw new Error('Mirrored object names or sizes differ from the source inventory');
+            else
+                remaining.delete(relative);
+        }
+    };
+    await visit('');
+    if (remaining.size)
+        throw new Error('Storage mirror omitted objects from the source inventory');
+}
+async function inContainer(target, remote, script) {
+    return command(['exec', '-e', 'MC_AK', '-e', 'MC_SK', '-e', 'MC_BUCKET', '-e', 'OMNI_BACKUP_STAGE',
+        target.container, 'sh', '-c', script], {
+        MC_AK: target.accessKey, MC_SK: target.secretKey, MC_BUCKET: target.bucket, OMNI_BACKUP_STAGE: remote,
+    });
+}
+/** Validate every entry before extracting: object backups contain only regular files and directories. */
+export async function validateStorageArchive(file) {
+    let invalid;
+    let entries = 0;
+    await list({ file, strict: true, onReadEntry(entry) {
+            const name = entry.path.replace(/\/$/, '');
+            if (++entries > 1_000_000 || !['File', 'Directory'].includes(entry.type) || name.includes('\\') || name.includes('\0') ||
+                name.split('/').some(part => !part || part === '.' || part === '..') ||
+                (name !== '_bk_storage' && !name.startsWith('_bk_storage/')) ||
+                !Number.isSafeInteger(entry.size) || entry.size < 0)
+                invalid ??= `Invalid storage backup archive member: ${entry.path}`;
+        } });
+    if (invalid)
+        throw new Error(invalid);
+    if (!entries)
+        throw new Error('Storage backup archive is empty');
+}
+async function withStorageStage(target, directory, mode, work) {
+    validateStorageBucket(target.bucket);
+    if (!/^[a-f0-9]{64}$/.test(target.container))
+        throw new Error('Storage backup requires an immutable container identity');
+    if (!target.accessKey || !target.secretKey)
+        throw new Error('Storage backup credentials are unavailable');
+    const token = randomUUID();
+    const local = path.join(directory, `.storage-${mode}-${token.slice(0, 8)}`);
+    const remote = `/tmp/omnitron-backup-${token}`;
+    await fs.mkdir(local, { mode: 0o700 });
+    const outcome = await work(local, remote).then(value => ({ ok: true, value }), error => ({ ok: false, error }));
+    // Every operation owns its paths. Concurrent passes cannot delete one another's snapshot.
+    const cleanup = await Promise.allSettled([
+        command(['exec', target.container, 'rm', '-rf', remote]), fs.rm(local, { recursive: true, force: true }),
+    ]);
+    if (!outcome.ok)
+        throw outcome.error;
+    if (cleanup.some(result => result.status === 'rejected'))
+        throw new Error('Storage backup data transfer finished, but temporary snapshot cleanup is unconfirmed');
+    return outcome.value;
+}
+/** Current object contents only; this is not a versioned-volume or cross-service transaction snapshot. */
+export async function backupStorageObjects(target, destination) {
+    const partial = destination + '.partial';
+    try {
+        await withStorageStage(target, path.dirname(destination), 'stage', async (local, remote) => {
+            await inContainer(target, remote, initialize + 'mc stat "omniBackup/$MC_BUCKET" >/dev/null');
+            const before = await listInventory(target, remote);
+            await fs.mkdir(path.join(local, '_bk_storage'));
+            // Stream through the common backup pipeline. Docker cp cannot read tmpfs mounts.
+            await transferObjects(before, async (object) => {
+                const objectFile = path.join(local, '_bk_storage', object.key);
+                await fs.mkdir(path.dirname(objectFile), { recursive: true });
+                const { args, options } = objectCommand(target, remote, 'cat', object.key);
+                await dumpToFile('docker', args, objectFile, false, options);
+            });
+            await verifyMirroredKeys(path.join(local, '_bk_storage'), before);
+            if (JSON.stringify(before) !== JSON.stringify(await listInventory(target, remote)))
+                throw new Error('Storage changed during the snapshot; quiesce writers and retry');
+            await create({ file: partial, cwd: local, gzip: true, strict: true, portable: true }, ['_bk_storage']);
+            await fs.chmod(partial, 0o600);
+            await validateStorageArchive(partial);
+        });
+        await fs.rename(partial, destination);
+    }
+    catch (error) {
+        await fs.rm(partial, { force: true });
+        throw error;
+    }
+}
+export async function restoreStorageObjects(target, file) {
+    await withStorageStage(target, path.dirname(file), 'restore', async (local, remote) => {
+        // Validate and extract the same private copy even if the caller replaces its input path.
+        const snapshot = path.join(local, 'snapshot.tar.gz');
+        await fs.copyFile(file, snapshot);
+        await fs.chmod(snapshot, 0o600);
+        await validateStorageArchive(snapshot);
+        await extract({ file: snapshot, cwd: local, strict: true, preserveOwner: false });
+        if (!(await fs.lstat(path.join(local, '_bk_storage'))).isDirectory())
+            throw new Error('Storage backup has no object directory');
+        await inContainer(target, remote, initialize + 'mc stat "omniBackup/$MC_BUCKET" >/dev/null');
+        const files = [];
+        const visit = async (folder) => {
+            for (const name of await fs.readdir(path.join(local, '_bk_storage', folder))) {
+                const key = folder ? folder + '/' + name : name;
+                if ((await fs.lstat(path.join(local, '_bk_storage', key))).isDirectory())
+                    await visit(key);
+                else
+                    files.push(key);
+            }
+        };
+        await visit('');
+        await transferObjects(files, async (key) => {
+            const { args, options } = objectCommand(target, remote, 'pipe', key);
+            await restoreFromFile('docker', args, path.join(local, '_bk_storage', key), false, options);
+        });
+    });
+}
+//# sourceMappingURL=backup-storage.js.map