@omnitron-dev/omnitron 0.3.1 → 0.3.2

package/dist/services/access.rpc-service.js

@@ -0,0 +1,248 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { sql } from 'kysely';
+import { Service, Public } from '@omnitron-dev/titan/decorators';
+import { Errors } from '@omnitron-dev/titan/errors';
+import { validateAccessRequirements } from '@omnitron-dev/titan/netron/auth';
+import { readMethodMetadata } from '@omnitron-dev/titan/netron/transport/http/middleware';
+import { ADMIN_ROLES, VIEWER_ROLES, ROLE_DESCRIPTIONS, isOmnitronRole } from '../shared/roles.js';
+import { daemonPrincipal, revokeDaemonAuthority } from './daemon-principal.js';
+import { consolePasswordError } from '../shared/dto/auth.js';
+const columns = ['id', 'username', 'displayName', 'role', 'createdAt', 'lastLoginAt'];
+function account(row) {
+    return {
+        ...row,
+        createdAt: new Date(row.createdAt).toISOString(),
+        lastLoginAt: row.lastLoginAt ? new Date(row.lastLoginAt).toISOString() : null,
+    };
+}
+function id(value) {
+    if (typeof value !== 'string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value))
+        throw Errors.badRequest('A valid account ID is required');
+    return value;
+}
+/** Human control-plane accounts. Application roles and service identities stay separate. */
+let AccessRpcService = class AccessRpcService {
+    db;
+    auth;
+    audit;
+    netron;
+    constructor(db, auth, audit, netron) {
+        this.db = db;
+        this.auth = auth;
+        this.audit = audit;
+        this.netron = netron;
+    }
+    async describe() {
+        const { context, role } = await daemonPrincipal(this.auth, 'viewer');
+        const capabilities = [];
+        for (const stub of this.netron.peer.stubs.values()) {
+            const { name, version, methods } = stub.definition.meta;
+            if (!name.startsWith('Omnitron') || stub.definition.parentId)
+                continue;
+            for (const method of Object.keys(methods)) {
+                const gate = readMethodMetadata(stub.instance, method)?.auth;
+                if (gate === undefined)
+                    continue; // An undeclared gate cannot become a UI grant.
+                const requirements = typeof gate === 'object' ? gate : {};
+                const conditional = Boolean(Array.isArray(requirements.policies) ? requirements.policies.length : requirements.policies);
+                const allowed = !conditional &&
+                    validateAccessRequirements(context, requirements).allowed &&
+                    (this.netron.authorizationManager?.canAccessMethod(`${name}@${version}`, method, context) ?? false);
+                capabilities.push({
+                    service: name,
+                    method,
+                    roles: requirements.roles ?? [],
+                    allowed,
+                    conditional,
+                    ...(gate === false || requirements.allowAnonymous ? { anonymous: true } : {}),
+                });
+            }
+        }
+        return {
+            userId: context.userId,
+            role,
+            roles: ROLE_DESCRIPTIONS.map((r) => ({ ...r })),
+            capabilities: capabilities.sort((a, b) => `${a.service}.${a.method}`.localeCompare(`${b.service}.${b.method}`)),
+        };
+    }
+    async listUsers(data = {}) {
+        await daemonPrincipal(this.auth, 'admin');
+        let query = this.db.selectFrom('omnitron_users').select(columns).orderBy('id').limit(101);
+        if (data.after)
+            query = query.where('id', '>', id(data.after));
+        const rows = await query.execute();
+        return { users: rows.slice(0, 100).map(account), next: rows.length > 100 ? rows[99].id : null };
+    }
+    /** Serialize role changes and recheck the actor inside the same transaction. */
+    async transaction(fn) {
+        const actor = await daemonPrincipal(this.auth, 'admin');
+        return this.db.transaction().execute(async (trx) => {
+            await sql `select pg_advisory_xact_lock(hashtext('omnitron:console-accounts'))`.execute(trx);
+            if (actor.sessionId) {
+                const current = await trx
+                    .selectFrom('omnitron_users')
+                    .innerJoin('omnitron_sessions', 'omnitron_sessions.userId', 'omnitron_users.id')
+                    .select('omnitron_users.role')
+                    .where('omnitron_users.id', '=', actor.context.userId)
+                    .where('omnitron_sessions.id', '=', actor.sessionId)
+                    .where('omnitron_sessions.expiresAt', '>', new Date())
+                    .executeTakeFirst();
+                if (current?.role !== 'admin')
+                    throw Errors.forbidden('Administrator session was revoked or changed');
+            }
+            return fn(trx, actor.context.userId);
+        });
+    }
+    async createUser(data) {
+        await daemonPrincipal(this.auth, 'admin');
+        if (!data || typeof data.username !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9._@+-]{0,127}$/.test(data.username))
+            throw Errors.badRequest('Username must contain 1–128 letters, digits or . _ @ + -');
+        if (!isOmnitronRole(data.role))
+            throw Errors.badRequest('Unknown console role');
+        const passwordError = consolePasswordError(data.password);
+        if (passwordError)
+            throw Errors.badRequest(passwordError);
+        if (data.displayName !== undefined && (typeof data.displayName !== 'string' || data.displayName.length > 128))
+            throw Errors.badRequest('Display name is limited to 128 characters');
+        const passwordHash = await this.auth.hashPassword(data.password);
+        return this.transaction(async (trx) => {
+            if (await trx.selectFrom('omnitron_users').select('id').where('username', '=', data.username).executeTakeFirst())
+                throw Errors.badRequest('Username already exists');
+            const row = await trx
+                .insertInto('omnitron_users')
+                .values({
+                username: data.username,
+                displayName: data.displayName?.trim() || null,
+                passwordHash,
+                role: data.role,
+                totpSecret: null,
+                totpEnabled: false,
+                pgpPublicKey: null,
+                pgpEnabled: false,
+                lastLoginAt: null,
+                lockedUntil: null,
+            })
+                .returning(columns)
+                .executeTakeFirstOrThrow();
+            await this.audit
+                .inTransaction(trx)
+                .record({
+                action: 'account.create',
+                outcome: 'ok',
+                resourceType: 'account',
+                resourceId: row.id,
+                details: { username: row.username, role: row.role },
+            }, true);
+            return account(row);
+        });
+    }
+    async setRole(data) {
+        const target = id(data?.id);
+        if (!isOmnitronRole(data.role) || typeof data.previous !== 'string')
+            throw Errors.badRequest('Unknown console role');
+        await this.transaction(async (trx, actorId) => {
+            if (target === actorId)
+                throw Errors.forbidden('Ask another administrator to change your own role');
+            const user = await trx
+                .selectFrom('omnitron_users')
+                .select(['id', 'role'])
+                .where('id', '=', target)
+                .forUpdate()
+                .executeTakeFirst();
+            if (!user)
+                throw Errors.notFound('Account');
+            if (user.role !== data.previous)
+                throw Errors.badRequest('Role changed since you opened this account; refresh and retry');
+            if (user.role === data.role)
+                return;
+            if (user.role === 'admin' && data.role !== 'admin') {
+                const other = await trx
+                    .selectFrom('omnitron_users')
+                    .select('id')
+                    .where('role', '=', 'admin')
+                    .where('id', '!=', target)
+                    .executeTakeFirst();
+                if (!other)
+                    throw Errors.forbidden('The last administrator cannot be demoted');
+            }
+            await trx
+                .updateTable('omnitron_users')
+                .set({ role: data.role, updatedAt: new Date() })
+                .where('id', '=', target)
+                .execute();
+            await trx.deleteFrom('omnitron_sessions').where('userId', '=', target).execute();
+            await this.audit
+                .inTransaction(trx)
+                .record({
+                action: 'account.role.change',
+                outcome: 'ok',
+                resourceType: 'account',
+                resourceId: target,
+                details: { previous: user.role, role: data.role },
+            }, true);
+        });
+        this.invalidateAuthority(target);
+    }
+    async revokeSessions(data) {
+        const target = id(data?.id);
+        const revoked = await this.transaction(async (trx) => {
+            if (!(await trx.selectFrom('omnitron_users').select('id').where('id', '=', target).executeTakeFirst()))
+                throw Errors.notFound('Account');
+            const result = await trx.deleteFrom('omnitron_sessions').where('userId', '=', target).executeTakeFirst();
+            const count = Number(result.numDeletedRows);
+            await this.audit
+                .inTransaction(trx)
+                .record({ action: 'account.sessions.revoke', outcome: 'ok', resourceType: 'account', resourceId: target, details: { count } }, true);
+            return count;
+        });
+        this.invalidateAuthority(target);
+        return { revoked };
+    }
+    invalidateAuthority(userId) {
+        revokeDaemonAuthority(this.netron, userId);
+    }
+};
+__decorate([
+    Public({ auth: { roles: VIEWER_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], AccessRpcService.prototype, "describe", null);
+__decorate([
+    Public({ auth: { roles: ADMIN_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AccessRpcService.prototype, "listUsers", null);
+__decorate([
+    Public({ auth: { roles: ADMIN_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AccessRpcService.prototype, "createUser", null);
+__decorate([
+    Public({ auth: { roles: ADMIN_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AccessRpcService.prototype, "setRole", null);
+__decorate([
+    Public({ auth: { roles: ADMIN_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AccessRpcService.prototype, "revokeSessions", null);
+AccessRpcService = __decorate([
+    Service({ name: 'OmnitronAccess' }),
+    __metadata("design:paramtypes", [Function, Function, Function, Function])
+], AccessRpcService);
+export { AccessRpcService };
+//# sourceMappingURL=access.rpc-service.js.map

package/dist/services/access.rpc-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.rpc-service.js","sourceRoot":"","sources":["../../src/services/access.rpc-service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAiC,MAAM,QAAQ,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEpD,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sDAAsD,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAKlG,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,CAAU,CAAC;AAC/F,SAAS,OAAO,CAAC,GAOhB;IACC,OAAO;QACL,GAAG,GAAG;QACN,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QAChD,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;KAC9E,CAAC;AACJ,CAAC;AACD,SAAS,EAAE,CAAC,KAAc;IACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,iEAAiE,CAAC,IAAI,CAAC,KAAK,CAAC;QAC7G,MAAM,MAAM,CAAC,UAAU,CAAC,gCAAgC,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4FAA4F;AAErF,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAER,EAAE;IACF,IAAI;IACJ,KAAK;IACL,MAAM;IAJzB,YACmB,EAA4B,EAC5B,IAAiB,EACjB,KAAmB,EACnB,MAAc;kBAHd,EAAE;oBACF,IAAI;qBACJ,KAAK;sBACL,MAAM;IACtB,CAAC;IAGE,AAAN,KAAK,CAAC,QAAQ;QACZ,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACrE,MAAM,YAAY,GAAkC,EAAE,CAAC;QACvD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ;gBAAE,SAAS;YACvE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC;gBAC7D,IAAI,IAAI,KAAK,SAAS;oBAAE,SAAS,CAAC,+CAA+C;gBACjF,MAAM,YAAY,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,MAAM,WAAW,GAAG,OAAO,CACzB,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAC5F,CAAC;gBACF,MAAM,OAAO,GACX,CAAC,WAAW;oBACZ,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,OAAO;oBACzD,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,eAAe,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;gBACtG,YAAY,CAAC,IAAI,CAAC;oBAChB,OAAO,EAAE,IAAI;oBACb,MAAM;oBACN,KAAK,EAAE,YAAY,CAAC,KAAK,IAAI,EAAE;oBAC/B,OAAO;oBACP,WAAW;oBACX,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,MAAO;YACvB,IAAI;YACJ,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/C,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SAChH,CAAC;IACJ,CAAC;IAGK,AAAN,KAAK,CAAC,SAAS,CAAC,IAAI,GAAuB,EAAE;QAC3C,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1F,IAAI,IAAI,CAAC,KAAK;YAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnG,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,WAAW,CAAI,EAAuE;QAClG,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjD,MAAM,GAAG,CAAA,qEAAqE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5F,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,MAAM,OAAO,GAAG,MAAM,GAAG;qBACtB,UAAU,CAAC,gBAAgB,CAAC;qBAC5B,SAAS,CAAC,mBAAmB,EAAE,0BAA0B,EAAE,mBAAmB,CAAC;qBAC/E,MAAM,CAAC,qBAAqB,CAAC;qBAC7B,KAAK,CAAC,mBAAmB,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,MAAO,CAAC;qBACtD,KAAK,CAAC,sBAAsB,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC;qBACnD,KAAK,CAAC,6BAA6B,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;qBACrD,gBAAgB,EAAE,CAAC;gBACtB,IAAI,OAAO,EAAE,IAAI,KAAK,OAAO;oBAAE,MAAM,MAAM,CAAC,SAAS,CAAC,8CAA8C,CAAC,CAAC;YACxG,CAAC;YACD,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,MAAO,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU,CAAC,IAKhB;QACC,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC3G,MAAM,MAAM,CAAC,UAAU,CAAC,0DAA0D,CAAC,CAAC;QACtF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,MAAM,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;QAChF,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,aAAa;YAAE,MAAM,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,GAAG,CAAC;YAC3G,MAAM,MAAM,CAAC,UAAU,CAAC,2CAA2C,CAAC,CAAC;QACvE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACpC,IAAI,MAAM,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,gBAAgB,EAAE;gBAC9G,MAAM,MAAM,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,GAAG;iBAClB,UAAU,CAAC,gBAAgB,CAAC;iBAC5B,MAAM,CAAC;gBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI;gBAC7C,YAAY;gBACZ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,KAAK;gBAClB,YAAY,EAAE,IAAI;gBAClB,UAAU,EAAE,KAAK;gBACjB,WAAW,EAAE,IAAI;gBACjB,WAAW,EAAE,IAAI;aAClB,CAAC;iBACD,SAAS,CAAC,OAAO,CAAC;iBAClB,uBAAuB,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,KAAK;iBACb,aAAa,CAAC,GAAG,CAAC;iBAClB,MAAM,CACL;gBACE,MAAM,EAAE,gBAAgB;gBACxB,OAAO,EAAE,IAAI;gBACb,YAAY,EAAE,SAAS;gBACvB,UAAU,EAAE,GAAG,CAAC,EAAE;gBAClB,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;aACpD,EACD,IAAI,CACL,CAAC;YACJ,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAC,IAAyD;QACrE,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;YACjE,MAAM,MAAM,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;YAC5C,IAAI,MAAM,KAAK,OAAO;gBAAE,MAAM,MAAM,CAAC,SAAS,CAAC,mDAAmD,CAAC,CAAC;YACpG,MAAM,IAAI,GAAG,MAAM,GAAG;iBACnB,UAAU,CAAC,gBAAgB,CAAC;iBAC5B,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;iBACtB,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;iBACxB,SAAS,EAAE;iBACX,gBAAgB,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI;gBAAE,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ;gBAC7B,MAAM,MAAM,CAAC,UAAU,CAAC,+DAA+D,CAAC,CAAC;YAC3F,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;gBAAE,OAAO;YACpC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACnD,MAAM,KAAK,GAAG,MAAM,GAAG;qBACpB,UAAU,CAAC,gBAAgB,CAAC;qBAC5B,MAAM,CAAC,IAAI,CAAC;qBACZ,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;qBAC3B,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC;qBACzB,gBAAgB,EAAE,CAAC;gBACtB,IAAI,CAAC,KAAK;oBAAE,MAAM,MAAM,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,GAAG;iBACN,WAAW,CAAC,gBAAgB,CAAC;iBAC7B,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBAC/C,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;iBACxB,OAAO,EAAE,CAAC;YACb,MAAM,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;YACjF,MAAM,IAAI,CAAC,KAAK;iBACb,aAAa,CAAC,GAAG,CAAC;iBAClB,MAAM,CACL;gBACE,MAAM,EAAE,qBAAqB;gBAC7B,OAAO,EAAE,IAAI;gBACb,YAAY,EAAE,SAAS;gBACvB,UAAU,EAAE,MAAM;gBAClB,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;aAClD,EACD,IAAI,CACL,CAAC;QACN,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc,CAAC,IAAoB;QACvC,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACnD,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,gBAAgB,EAAE,CAAC;gBACpG,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,gBAAgB,EAAE,CAAC;YACzG,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAC5C,MAAM,IAAI,CAAC,KAAK;iBACb,aAAa,CAAC,GAAG,CAAC;iBAClB,MAAM,CACL,EAAE,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EACrH,IAAI,CACL,CAAC;YACJ,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IAEO,mBAAmB,CAAC,MAAc;QACxC,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AA1LO;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;;;;gDAkCzC;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;iDAOxC;AAuBK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;kDAiDxC;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;+CA8CxC;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;sDAkBxC;AA9LU,gBAAgB;IAD5B,OAAO,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;;GACvB,gBAAgB,CAmM5B"}

package/dist/services/alert.service.d.ts

@@ -18,7 +18,7 @@
  */
 import { type Kysely } from 'kysely';
 import type { OmnitronDatabase } from '../database/schema.js';
-import type { OrchestratorService } from '../orchestrator/orchestrator.service.js';
+import type { OrchestratorControl as OrchestratorService } from '../orchestrator/execution-contract.js';
 import { type ILoggerModule } from '@omnitron-dev/titan/module/logger';
 import { ALERT_EXPRESSION_FORMS, isAlertExpressionParseable, type AlertRuleFields } from '../shared/alert-expression.js';
 export { ALERT_EXPRESSION_FORMS, isAlertExpressionParseable };

package/dist/services/alert.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"alert.service.d.ts","sourceRoot":"","sources":["../../src/services/alert.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAO,KAAK,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAEnF,OAAO,EAAwB,KAAK,aAAa,EAAgB,MAAM,mCAAmC,CAAC;AAC3G,OAAO,EACL,sBAAsB,EAGtB,0BAA0B,EAC1B,KAAK,eAAe,EACrB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,CAAC;AAE9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAiB,MAAM,yBAAyB,CAAC;AAU/G,YAAY,EACV,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AA4GjC,oFAAoF;AACpF,eAAO,MAAM,OAAO,gFAAgF,CAAC;AAgBrG;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,QAAQ,GAAG,iBAAiB,CAAC,GAAG,MAAM,CAM5G;AAMD,qBACa,YAAY;IAYM,OAAO,CAAC,QAAQ,CAAC,EAAE;IAClB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAMzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAlB5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IAEjC;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAE1D,YACgC,YAAY,EAAE,aAAa,EACb,EAAE,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAC3B,YAAY,EAAE,mBAAmB,EAM7D,QAAQ,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,iBAAiB,GAAG,cAAc,GAAG,mBAAmB,CAAC,CAAC,YAAA,EAGpH;IAED,yEAAyE;IACzE,OAAO,CAAC,UAAU;IAUlB;;;OAGG;IACG,QAAQ,CAAC,GAAG,GAAE,MAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwGtD;IAED,6EAA6E;IAC7E,OAAO,CAAC,SAAS,CAA+E;YAElF,UAAU;IAgBxB;;;;;;;;OAQG;YACW,cAAc;IAoE5B,2EAA2E;IAC3E,OAAO,CAAC,WAAW;IAUnB,yFAAyF;YAC3E,SAAS;IA8BvB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAcd,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAGrC;IAED,oGAAoG;IAC9F,UAAU,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,CAW1D;IAED,yFAAyF;IACnF,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAkBlF;IAEK,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;IAEK,SAAS,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAMrG;IAED;;;;;;;OAOG;IACG,eAAe,CAAC,KAAK,SAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CA0DzD;IAED;;;;;;;;;;;;;OAaG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAcxE;IAEK,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC,CAuCxC;CACF"}
+{"version":3,"file":"alert.service.d.ts","sourceRoot":"","sources":["../../src/services/alert.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAO,KAAK,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,mBAAmB,IAAI,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAExG,OAAO,EAAwB,KAAK,aAAa,EAAgB,MAAM,mCAAmC,CAAC;AAC3G,OAAO,EACL,sBAAsB,EAGtB,0BAA0B,EAC1B,KAAK,eAAe,EACrB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,CAAC;AAE9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAiB,MAAM,yBAAyB,CAAC;AAU/G,YAAY,EACV,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AA4GjC,oFAAoF;AACpF,eAAO,MAAM,OAAO,gFAAgF,CAAC;AAgBrG;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,QAAQ,GAAG,iBAAiB,CAAC,GAAG,MAAM,CAM5G;AAMD,qBACa,YAAY;IAYM,OAAO,CAAC,QAAQ,CAAC,EAAE;IAClB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAMzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAlB5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IAEjC;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAE1D,YACgC,YAAY,EAAE,aAAa,EACb,EAAE,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAC3B,YAAY,EAAE,mBAAmB,EAM7D,QAAQ,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,iBAAiB,GAAG,cAAc,GAAG,mBAAmB,CAAC,CAAC,YAAA,EAGpH;IAED,yEAAyE;IACzE,OAAO,CAAC,UAAU;IAUlB;;;OAGG;IACG,QAAQ,CAAC,GAAG,GAAE,MAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwGtD;IAED,6EAA6E;IAC7E,OAAO,CAAC,SAAS,CAA+E;YAElF,UAAU;IAgBxB;;;;;;;;OAQG;YACW,cAAc;IAoE5B,2EAA2E;IAC3E,OAAO,CAAC,WAAW;IAUnB,yFAAyF;YAC3E,SAAS;IA8BvB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAcd,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAGrC;IAED,oGAAoG;IAC9F,UAAU,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,CAW1D;IAED,yFAAyF;IACnF,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAkBlF;IAEK,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;IAEK,SAAS,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAMrG;IAED;;;;;;;OAOG;IACG,eAAe,CAAC,KAAK,SAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CA0DzD;IAED;;;;;;;;;;;;;OAaG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAcxE;IAEK,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC,CAuCxC;CACF"}

package/dist/services/alert.service.js

@@ -619,7 +619,7 @@ AlertService = __decorate([
     __param(2, Inject(ORCHESTRATOR_TOKEN)),
     __param(3, Optional()),
     __param(3, Inject(PROJECT_SERVICE_TOKEN)),
-    __metadata("design:paramtypes", [Object, Function, Function, Object])
+    __metadata("design:paramtypes", [Object, Function, Object, Object])
 ], AlertService);
 export { AlertService };
 // =============================================================================

package/dist/services/anonymous-input.d.ts

@@ -1,26 +1,5 @@
-/**
- * Shape checks for the daemon's anonymous RPC surface.
- *
- * `@Public({ auth: { allowAnonymous: true } })` is worn by exactly seven
- * handlers: the five on `OmnitronAuth`, `OmnitronFleet.heartbeat` and
- * `OmnitronTelemetry.pushBatch`. They are the only methods an unauthenticated
- * caller can reach — probing all 122 daemon methods without a token returns
- * 401 or 404 for every other one.
- *
- * None of them looked at what it was given. `signIn(undefined)` destructured
- * `{ username }` off nothing and the caller got a 500 carrying
- * `Cannot destructure property 'username' of 'request'` — our fault reported
- * for their malformed request, a stack-shaped string handed to someone who
- * has not authenticated, and noise in the log that looks like a daemon defect.
- *
- * These say 400 and name the field instead. They are deliberately small: the
- * point is that the handler behind them never sees a shape it cannot read,
- * not to re-validate what the service itself enforces.
- */
 /** Assert `value` is a plain object, for a handler that takes one. */
 export declare function requirePayload(value: unknown, method: string): Record<string, unknown>;
 /** Assert a required non-empty string field. */
 export declare function requireString(payload: Record<string, unknown>, field: string, method: string): string;
-/** Assert a required array field. */
-export declare function requireArray(payload: Record<string, unknown>, field: string, method: string): unknown[];
 //# sourceMappingURL=anonymous-input.d.ts.map

package/dist/services/anonymous-input.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-input.d.ts","sourceRoot":"","sources":["../../src/services/anonymous-input.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKtF;AAED,gDAAgD;AAChD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAMrG;AAED,qCAAqC;AACrC,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,CAMvG"}
+{"version":3,"file":"anonymous-input.d.ts","sourceRoot":"","sources":["../../src/services/anonymous-input.ts"],"names":[],"mappings":"AAGA,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKtF;AAED,gDAAgD;AAChD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAMrG"}

package/dist/services/anonymous-input.js

@@ -1,22 +1,4 @@
-/**
- * Shape checks for the daemon's anonymous RPC surface.
- *
- * `@Public({ auth: { allowAnonymous: true } })` is worn by exactly seven
- * handlers: the five on `OmnitronAuth`, `OmnitronFleet.heartbeat` and
- * `OmnitronTelemetry.pushBatch`. They are the only methods an unauthenticated
- * caller can reach — probing all 122 daemon methods without a token returns
- * 401 or 404 for every other one.
- *
- * None of them looked at what it was given. `signIn(undefined)` destructured
- * `{ username }` off nothing and the caller got a 500 carrying
- * `Cannot destructure property 'username' of 'request'` — our fault reported
- * for their malformed request, a stack-shaped string handed to someone who
- * has not authenticated, and noise in the log that looks like a daemon defect.
- *
- * These say 400 and name the field instead. They are deliberately small: the
- * point is that the handler behind them never sees a shape it cannot read,
- * not to re-validate what the service itself enforces.
- */
+/** Validate untrusted authentication payloads before reading their fields. */
 import { Errors } from '@omnitron-dev/titan/errors';
 /** Assert `value` is a plain object, for a handler that takes one. */
 export function requirePayload(value, method) {
@@ -33,12 +15,4 @@ export function requireString(payload, field, method) {
     }
     return v;
 }
-/** Assert a required array field. */
-export function requireArray(payload, field, method) {
-    const v = payload[field];
-    if (!Array.isArray(v)) {
-        throw Errors.badRequest(`${method}: '${field}' must be an array`);
-    }
-    return v;
-}
 //# sourceMappingURL=anonymous-input.js.map

package/dist/services/anonymous-input.js.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-input.js","sourceRoot":"","sources":["../../src/services/anonymous-input.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEpD,sEAAsE;AACtE,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,MAAc;IAC3D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,8BAA8B,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,aAAa,CAAC,OAAgC,EAAE,KAAa,EAAE,MAAc;IAC3F,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,MAAM,KAAK,8BAA8B,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,YAAY,CAAC,OAAgC,EAAE,KAAa,EAAE,MAAc;IAC1F,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,MAAM,KAAK,oBAAoB,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"anonymous-input.js","sourceRoot":"","sources":["../../src/services/anonymous-input.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEpD,sEAAsE;AACtE,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,MAAc;IAC3D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,8BAA8B,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,aAAa,CAAC,OAAgC,EAAE,KAAa,EAAE,MAAc;IAC3F,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,MAAM,KAAK,8BAA8B,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/services/audit.service.d.ts

@@ -45,11 +45,13 @@
  * console reads too) reads either convention, including the older one of
  * naming the failure in the action (`node.upgrade.failed`).
  *
- * Best-effort by design: the action has already happened — or already failed
+ * Best-effort by default: the action has already happened — or already failed
  * — when this is called, and failing it afterwards would turn an unrecorded
  * change into a broken one. A write that fails is reported at error with the
  * action it could not record, which is the state an operator needs to know
  * about.
+ * Actions that require an audit record BEFORE execution pass `required: true`.
+ * Those callers fail closed when the database is absent or the insert fails.
  */
 import type { Kysely } from 'kysely';
 import type { ILogger } from '@omnitron-dev/titan/module/logger';
@@ -86,33 +88,8 @@ export interface AuditEntry {
  */
 export declare const ACTOR_TYPES: readonly ['user', 'service', 'system'];
 export type ActorType = (typeof ACTOR_TYPES)[number];
-export interface AuditRow {
-    id: string;
-    action: string;
-    actorId: string | null;
-    actorType: string;
-    resourceType: string;
-    resourceId: string | null;
-    details: Record<string, unknown> | null;
-    ipAddress: string | null;
-    createdAt: string;
-}
-export interface AuditQuery {
-    /** Newest first. Capped by `MAX_AUDIT_PAGE`. */
-    readonly limit?: number | undefined;
-    readonly action?: string | undefined;
-    readonly resourceType?: string | undefined;
-    readonly actorId?: string | undefined;
-    /**
-     * `user`, `service` or `system` — what the ACTOR column prints for a row
-     * with no id. `actorId` alone could not select those: 171 of the master's
-     * 178 rows had a null id, and `--actor system` compared `system` with it
-     * and found nothing.
-     */
-    readonly actorType?: string | undefined;
-    /** Keyset: rows strictly older than this ISO timestamp. */
-    readonly before?: string | undefined;
-}
+import type { AuditRow, AuditQuery } from '../shared/dto/audit.js';
+export type { AuditRow, AuditQuery } from '../shared/dto/audit.js';
 /**
  * The most rows one call may ask for.
  *
@@ -121,7 +98,8 @@ export interface AuditQuery {
  * learned this the same way.
  */
 export declare const MAX_AUDIT_PAGE = 500;
-/** `details`, with anything that looks like a credential removed. */
+/** Preserve structured facts, with bounded recursion and redaction at every level.
+ * Applied at write AND read so historical array payloads cannot expose credentials. */
 export declare function scrubDetails(details: Record<string, unknown> | null | undefined): Record<string, unknown> | null;
 /**
  * A failure as a row keeps it: the first line of what the error said, with a
@@ -148,7 +126,9 @@ export declare class AuditService {
     db: Kysely<OmnitronDatabase> | null);
     /** Whether anything written here can be read back. */
     get available(): boolean;
-    record(entry: AuditEntry): Promise<void>;
+    /** Include the audit row in the caller's transaction; rollback both on failure. */
+    inTransaction(db: Kysely<OmnitronDatabase>): AuditService;
+    record(entry: AuditEntry, required?: boolean): Promise<void>;
     list(query?: AuditQuery): Promise<AuditRow[]>;
     /**
      * The newest row for each resource, for one action — «what each stack last

package/dist/services/audit.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.service.d.ts","sourceRoot":"","sources":["../../src/services/audit.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAEjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAG/D,uDAAuD;AACvD,MAAM,WAAW,UAAU;IACzB,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,oCAAoC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAChD;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;IAC9D;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAC5C,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,YAAI,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAC;AAClE,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,gDAAgD;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,MAAM,CAAC;AAKlC,qEAAqE;AACrE,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAClD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAYhC;AAKD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAepD;AAED,uEAAuE;AACvE,wBAAgB,YAAY,IAAI;IAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAU/E;AAED,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,qFAAqF;IACrF,OAAO,CAAC,QAAQ,CAAC,EAAE;IAHrB,YACmB,MAAM,EAAE,OAAO;IAChC,qFAAqF;IACpE,EAAE,EAAE,MAAM,CAAC,gBAAgB,CAAC,GAAG,IAAI,EAClD;IAEJ,sDAAsD;IACtD,IAAI,SAAS,IAAI,OAAO,CAEvB;IAEK,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAmC7C;IAEK,IAAI,CAAC,KAAK,GAAE,UAAe,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CA8BtD;IAED;;;;;;;;;OASG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAY3D;CACF"}
+{"version":3,"file":"audit.service.d.ts","sourceRoot":"","sources":["../../src/services/audit.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAGjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAG/D,uDAAuD;AACvD,MAAM,WAAW,UAAU;IACzB,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,oCAAoC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAChD;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;IAC9D;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAC5C,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,YAAI,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAC;AAClE,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACnE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,MAAM,CAAC;AAKlC;uFACuF;AACvF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAwBhH;AAKD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAepD;AAED,uEAAuE;AACvE,wBAAgB,YAAY,IAAI;IAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAU/E;AAED,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,qFAAqF;IACrF,OAAO,CAAC,QAAQ,CAAC,EAAE;IAHrB,YACmB,MAAM,EAAE,OAAO;IAChC,qFAAqF;IACpE,EAAE,EAAE,MAAM,CAAC,gBAAgB,CAAC,GAAG,IAAI,EAClD;IAEJ,sDAAsD;IACtD,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,mFAAmF;IACnF,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,gBAAgB,CAAC,GAAG,YAAY,CAExD;IAEK,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAuC/D;IAEK,IAAI,CAAC,KAAK,GAAE,UAAe,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CA8CtD;IAED;;;;;;;;;OASG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAa3D;CACF"}

package/dist/services/audit.service.js

@@ -45,12 +45,15 @@
  * console reads too) reads either convention, including the older one of
  * naming the failure in the action (`node.upgrade.failed`).
  *
- * Best-effort by design: the action has already happened — or already failed
+ * Best-effort by default: the action has already happened — or already failed
  * — when this is called, and failing it afterwards would turn an unrecorded
  * change into a broken one. A write that fails is reported at error with the
  * action it could not record, which is the state an operator needs to know
  * about.
+ * Actions that require an audit record BEFORE execution pass `required: true`.
+ * Those callers fail closed when the database is absent or the insert fails.
  */
+import { redactDiagnosticText } from '@omnitron-dev/titan/diagnostics';
 import { redactTokens } from '../release/publish.js';
 import { getCurrentAuth, getRequestContext } from './auth-context.js';
 /**
@@ -67,21 +70,43 @@ export const ACTOR_TYPES = ['user', 'service', 'system'];
  */
 export const MAX_AUDIT_PAGE = 500;
 /** Keys whose VALUE is a credential, whatever the caller meant by them. */
-const SECRET_KEY = /password|passphrase|secret|token|credential|privatekey|apikey/i;
-/** `details`, with anything that looks like a credential removed. */
+const SECRET_KEY = /password|passphrase|secret|token|credential|private[_-]?key|api[_-]?key|authorization|cookie|mnemonic|seed/i;
+/** Preserve structured facts, with bounded recursion and redaction at every level.
+ * Applied at write AND read so historical array payloads cannot expose credentials. */
 export function scrubDetails(details) {
     if (!details)
         return null;
-    const out = {};
-    for (const [key, value] of Object.entries(details)) {
-        if (SECRET_KEY.test(key)) {
-            out[key] = '[redacted]';
-            continue;
+    const active = new WeakSet();
+    let remaining = 1000;
+    const visit = (value, depth) => {
+        if (--remaining < 0 || depth > 8)
+            return '[truncated]';
+        if (typeof value === 'string')
+            return redactDiagnosticText(value);
+        if (value === null || typeof value === 'number' || typeof value === 'boolean')
+            return value;
+        if (typeof value !== 'object')
+            return '[unsupported]';
+        if (active.has(value))
+            return '[circular]';
+        active.add(value);
+        try {
+            if (Array.isArray(value)) {
+                const items = value.slice(0, 100).map(item => visit(item, depth + 1));
+                if (value.length > 100)
+                    items.push('[truncated]');
+                return items;
+            }
+            const entries = Object.entries(value).slice(0, 100).map(([key, item]) => [key, SECRET_KEY.test(key) ? '[redacted]' : visit(item, depth + 1)]);
+            if (Object.keys(value).length > 100)
+                entries.push(['[truncated]', true]);
+            return Object.fromEntries(entries);
         }
-        // One level. A nested object is a payload, and this table takes facts.
-        out[key] = value && typeof value === 'object' && !Array.isArray(value) ? '[object]' : value;
-    }
-    return out;
+        finally {
+            active.delete(value);
+        }
+    };
+    return visit(details, 0);
 }
 /** The longest failure a row keeps. The whole error is in the daemon log. */
 const MAX_FAILURE_TEXT = 300;
@@ -116,8 +141,8 @@ export function currentActor() {
         return { actorId: null, actorType: 'system' };
     const roles = auth.roles ?? [];
     // A master reaching a node carries `service_role` and no human behind it.
-    if (roles.includes('service_role') && !auth.userId) {
-        return { actorId: null, actorType: 'service' };
+    if (roles.includes('service_role')) {
+        return { actorId: auth.userId || null, actorType: 'service' };
     }
     return { actorId: auth.userId ?? null, actorType: auth.userId ? 'user' : 'system' };
 }
@@ -134,9 +159,16 @@ export class AuditService {
     get available() {
         return this.db !== null;
     }
-    async record(entry) {
-        if (!this.db)
+    /** Include the audit row in the caller's transaction; rollback both on failure. */
+    inTransaction(db) {
+        return new AuditService(this.logger, db);
+    }
+    async record(entry, required = false) {
+        if (!this.db) {
+            if (required)
+                throw new Error('Audit storage is required for this operation');
             return;
+        }
         const { actorId, actorType } = currentActor();
         const ipAddress = getRequestContext()?.ipAddress ?? null;
         // After the scrub, so neither can be mistaken for something to redact;
@@ -164,7 +196,9 @@ export class AuditService {
                 .execute();
         }
         catch (err) {
-            this.logger.error({ action: entry.action, resource: `${entry.resourceType}:${entry.resourceId ?? '-'}`, error: err.message }, 'Could not record this action in the audit log — it happened and nothing recorded it');
+            this.logger.error({ action: entry.action, resource: `${entry.resourceType}:${entry.resourceId ?? '-'}`, error: err.message }, required ? 'Required audit write failed; operation refused' : 'Could not record this action in the audit log — it happened and nothing recorded it');
+            if (required)
+                throw new Error('Audit storage is unavailable; operation refused', { cause: err });
         }
     }
     async list(query = {}) {
@@ -179,6 +213,10 @@ export class AuditService {
             throw new Error(`limit is a number of entries, 1 to ${MAX_AUDIT_PAGE} — not "${String(query.limit)}"`);
         }
         const limit = Math.min(MAX_AUDIT_PAGE, Math.max(1, Math.floor(asked)));
+        if (query.before && query.beforeId)
+            throw new Error('Use before or beforeId, not both');
+        if (query.beforeId && !/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(query.beforeId))
+            throw new Error('beforeId must be an audit entry UUID');
         const before = query.before ? new Date(query.before) : null;
         if (before && Number.isNaN(before.getTime())) {
             throw new Error(`before is an ISO timestamp such as 2026-09-22T21:20:37Z — not "${String(query.before)}"`);
@@ -187,6 +225,7 @@ export class AuditService {
             .selectFrom('omnitron_audit_log')
             .selectAll()
             .orderBy('createdAt', 'desc')
+            .orderBy('id', 'desc')
             .limit(limit);
         if (query.action)
             q = q.where('action', '=', query.action);
@@ -198,7 +237,21 @@ export class AuditService {
             q = q.where('actorType', '=', query.actorType);
         if (before)
             q = q.where('createdAt', '<', before);
+        if (query.beforeId) {
+            const id = query.beforeId;
+            // Keep PostgreSQL microseconds inside SQL: converting the anchor to Date loses precision.
+            const anchor = this.db.selectFrom('omnitron_audit_log as cursor').select('cursor.createdAt').where('cursor.id', '=', id);
+            q = q.where(eb => eb.or([
+                eb('createdAt', '<', anchor),
+                eb.and([eb('createdAt', '=', anchor), eb('id', '<', id)]),
+            ]));
+        }
         const rows = await q.execute();
+        if (query.beforeId && rows.length === 0) {
+            const exists = await this.db.selectFrom('omnitron_audit_log').select('id').where('id', '=', query.beforeId).executeTakeFirst();
+            if (!exists)
+                throw new Error('Audit page cursor is no longer available; refresh the query');
+        }
         return rows.map(toAuditRow);
     }
     /**
@@ -222,6 +275,7 @@ export class AuditService {
             .where('resourceId', 'is not', null)
             .orderBy('resourceId')
             .orderBy('createdAt', 'desc')
+            .orderBy('id', 'desc')
             .execute();
         return rows.map(toAuditRow);
     }
@@ -234,7 +288,7 @@ function toAuditRow(r) {
         actorType: r.actorType,
         resourceType: r.resourceType,
         resourceId: r.resourceId ?? null,
-        details: r.details ?? null,
+        details: scrubDetails(r.details ?? null),
         ipAddress: r.ipAddress ?? null,
         createdAt: r.createdAt instanceof Date ? r.createdAt.toISOString() : String(r.createdAt),
     };