@omnitron-dev/omnitron 0.3.1 → 0.3.2

package/dist/services/audit.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.service.js","sourceRoot":"","sources":["../../src/services/audit.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAMH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AA4BtE;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAC;AAgClE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAElC,2EAA2E;AAC3E,MAAM,UAAU,GAAG,gEAAgE,CAAC;AAEpF,qEAAqE;AACrE,MAAM,UAAU,YAAY,CAC1B,OAAmD;IAEnD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;YACxB,SAAS;QACX,CAAC;QACD,uEAAuE;QACvE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,sEAAsE;IACtE,MAAM,OAAO,GACX,GAAG,YAAY,KAAK;QAClB,CAAC,CAAC,GAAG,CAAC,OAAO;QACb,CAAC,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAQ,GAA6B,CAAC,OAAO,KAAK,QAAQ;YAC5F,CAAC,CAAE,GAA2B,CAAC,OAAO;YACtC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpB,MAAM,KAAK,GACT,OAAO;SACJ,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,0BAA0B,CAAC;IACnE,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9F,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY;IAC1B,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAEzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,0EAA0E;IAC1E,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtF,CAAC;AAED,MAAM,OAAO,YAAY;IAEJ,MAAM;IAEN,EAAE;IAHrB,YACmB,MAAe;IAChC,qFAAqF;IACpE,EAAmC;sBAFnC,MAAM;kBAEN,EAAE;IAClB,CAAC;IAEJ,sDAAsD;IACtD,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAiB;QAC5B,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO;QACrB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,iBAAiB,EAAE,EAAE,SAAS,IAAI,IAAI,CAAC;QAEzD,uEAAuE;QACvE,uDAAuD;QACvD,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO;YAC3B,CAAC,CAAC;gBACE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACnB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5G;YACH,CAAC,CAAC,QAAQ,CAAC;QAEb,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE;iBACV,UAAU,CAAC,oBAAoB,CAAC;iBAChC,MAAM,CAAC;gBACN,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO;gBACP,SAAS;gBACT,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;gBACpC,OAAO,EAAE,OAAgB;gBACzB,SAAS;aACD,CAAC;iBACV,OAAO,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EACrH,qFAAqF,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAK,GAAe,EAAE;QAC/B,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACxB,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,cAAc,WAAW,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,kEAAkE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7G,CAAC;QAED,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE;aACZ,UAAU,CAAC,oBAAoB,CAAC;aAChC,SAAS,EAAE;aACX,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;aAC5B,KAAK,CAAC,KAAK,CAAC,CAAC;QAEhB,IAAI,KAAK,CAAC,MAAM;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,YAAY;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7E,IAAI,KAAK,CAAC,OAAO;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,KAAK,CAAC,SAAS;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,MAAM;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,MAAe,CAAC,CAAC;QAE3D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,oBAAoB,CAAC;aAChC,UAAU,CAAC,YAAY,CAAC;aACxB,SAAS,EAAE;aACX,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;aAC5B,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC;aACnC,OAAO,CAAC,YAAY,CAAC;aACrB,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;aAC5B,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;CACF;AAED,SAAS,UAAU,CAAC,CAUnB;IACC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;QAChC,OAAO,EAAG,CAAC,CAAC,OAA0C,IAAI,IAAI;QAC9D,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC9B,SAAS,EAAE,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;KACzF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"audit.service.js","sourceRoot":"","sources":["../../src/services/audit.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAIH,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAGvE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AA4BtE;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAC;AAMlE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAElC,2EAA2E;AAC3E,MAAM,UAAU,GAAG,6GAA6G,CAAC;AAEjI;uFACuF;AACvF,MAAM,UAAU,YAAY,CAAC,OAAmD;IAC9E,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,OAAO,EAAU,CAAC;IACrC,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,KAAa,EAAW,EAAE;QACvD,IAAI,EAAE,SAAS,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,aAAa,CAAC;QACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC5F,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,eAAe,CAAC;QACtD,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;gBACtE,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;oBAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAClD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CACtE,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAU,CAAC,CAAC;YAChF,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;YACzE,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;gBAAS,CAAC;YAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC;IACF,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC,CAA4B,CAAC;AACtD,CAAC;AAED,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,sEAAsE;IACtE,MAAM,OAAO,GACX,GAAG,YAAY,KAAK;QAClB,CAAC,CAAC,GAAG,CAAC,OAAO;QACb,CAAC,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAQ,GAA6B,CAAC,OAAO,KAAK,QAAQ;YAC5F,CAAC,CAAE,GAA2B,CAAC,OAAO;YACtC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpB,MAAM,KAAK,GACT,OAAO;SACJ,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,0BAA0B,CAAC;IACnE,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9F,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY;IAC1B,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAEzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,0EAA0E;IAC1E,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtF,CAAC;AAED,MAAM,OAAO,YAAY;IAEJ,MAAM;IAEN,EAAE;IAHrB,YACmB,MAAe;IAChC,qFAAqF;IACpE,EAAmC;sBAFnC,MAAM;kBAEN,EAAE;IAClB,CAAC;IAEJ,sDAAsD;IACtD,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC;IAC1B,CAAC;IAED,mFAAmF;IACnF,aAAa,CAAC,EAA4B;QACxC,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAiB,EAAE,QAAQ,GAAG,KAAK;QAC9C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,iBAAiB,EAAE,EAAE,SAAS,IAAI,IAAI,CAAC;QAEzD,uEAAuE;QACvE,uDAAuD;QACvD,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO;YAC3B,CAAC,CAAC;gBACE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACnB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5G;YACH,CAAC,CAAC,QAAQ,CAAC;QAEb,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE;iBACV,UAAU,CAAC,oBAAoB,CAAC;iBAChC,MAAM,CAAC;gBACN,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO;gBACP,SAAS;gBACT,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;gBACpC,OAAO,EAAE,OAAgB;gBACzB,SAAS;aACD,CAAC;iBACV,OAAO,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EACrH,QAAQ,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,qFAAqF,CACpJ,CAAC;YACF,IAAI,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAK,GAAe,EAAE;QAC/B,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACxB,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,cAAc,WAAW,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvE,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACxF,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,gDAAgD,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACtJ,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,kEAAkE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7G,CAAC;QAED,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE;aACZ,UAAU,CAAC,oBAAoB,CAAC;aAChC,SAAS,EAAE;aACX,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;aAC5B,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;aACrB,KAAK,CAAC,KAAK,CAAC,CAAC;QAEhB,IAAI,KAAK,CAAC,MAAM;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,YAAY;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7E,IAAI,KAAK,CAAC,OAAO;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,KAAK,CAAC,SAAS;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,MAAM;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,MAAe,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;YAC1B,0FAA0F;YAC1F,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,8BAA8B,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACzH,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;gBACtB,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC;gBAC5B,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;aAC1D,CAAC,CAAC,CAAC;QACN,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAC/H,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,oBAAoB,CAAC;aAChC,UAAU,CAAC,YAAY,CAAC;aACxB,SAAS,EAAE;aACX,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;aAC5B,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC;aACnC,OAAO,CAAC,YAAY,CAAC;aACrB,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;aAC5B,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;aACrB,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;CACF;AAED,SAAS,UAAU,CAAC,CAUnB;IACC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;QAChC,OAAO,EAAE,YAAY,CAAE,CAAC,CAAC,OAA0C,IAAI,IAAI,CAAC;QAC5E,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC9B,SAAS,EAAE,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;KACzF,CAAC;AACJ,CAAC"}

package/dist/services/auth-context.d.ts

@@ -55,5 +55,7 @@ export declare function runWithAuth<T>(authContext: AuthContext, fn: () => T | P
  */
 export declare function createAuthContextWrapper(options?: {
     trustProxy?: boolean;
+    assertReady?: () => void;
+    validatePrincipal?: (context: AuthContext) => Promise<void>;
 }): (metadata: Map<string, unknown>, fn: () => Promise<unknown>) => Promise<unknown>;
 //# sourceMappingURL=auth-context.d.ts.map

package/dist/services/auth-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-context.d.ts","sourceRoot":"","sources":["../../src/services/auth-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID,wEAAwE;AACxE,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAEzD;AAYD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,WAAW,GAAG,IAAI,CAEnD;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,WAAW,CAMzC;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAEjG;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAO,cACrD,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,MAAM,OAAO,CAAC,OAAO,CAAC,KAAG,OAAO,CAAC,OAAO,CAAC,CAY5F"}
+{"version":3,"file":"auth-context.d.ts","sourceRoot":"","sources":["../../src/services/auth-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID,wEAAwE;AACxE,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAEzD;AAYD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,WAAW,GAAG,IAAI,CAEnD;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,WAAW,CAMzC;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAEjG;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,GAAE;IAChD,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;IAAC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACxG,cACoB,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,MAAM,OAAO,CAAC,OAAO,CAAC,KAAG,OAAO,CAAC,OAAO,CAAC,CAc5F"}

package/dist/services/auth-context.js

@@ -61,7 +61,10 @@ export function runWithAuth(authContext, fn) {
  */
 export function createAuthContextWrapper(options = {}) {
     return async (metadata, fn) => {
+        options.assertReady?.();
         const authCtx = metadata.get('authContext');
+        if (authCtx)
+            await options.validatePrincipal?.(authCtx);
         const requestCtx = {};
         const ip = resolveClientIp(metadata, options.trustProxy === true);
         if (ip)
@@ -69,7 +72,7 @@ export function createAuthContextWrapper(options = {}) {
         const peerId = metadata.get('peerId');
         if (typeof peerId === 'string' && peerId.length > 0)
             requestCtx.peerId = peerId;
-        const run = () => (authCtx ? runWithAuth(authCtx, fn) : fn());
+        const run = () => authContextStorage.run(authCtx, fn);
         return requestContextStorage.run(requestCtx, run);
     };
 }

package/dist/services/auth-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-context.js","sourceRoot":"","sources":["../../src/services/auth-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAoBrD,MAAM,qBAAqB,GAAG,IAAI,iBAAiB,EAAkB,CAAC;AAEtE,wEAAwE;AACxE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,qBAAqB,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,yCAAyC;AACzC,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,IAAI,iBAAiB,EAAe,CAAC;AAEhE,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,kBAAkB,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,WAAW,EAAE,CAAC,MAAM,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAI,WAAwB,EAAE,EAAwB;IAC/E,OAAO,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAO,GAA6B,EAAE;IAC7E,OAAO,KAAK,EAAE,QAA8B,EAAE,EAA0B,EAAoB,EAAE;QAC5F,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,CAA4B,CAAC;QACvE,MAAM,UAAU,GAAmB,EAAE,CAAC;QAEtC,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;QAClE,IAAI,EAAE;YAAE,UAAU,CAAC,SAAS,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC;QAEhF,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9D,OAAO,qBAAqB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,eAAe,CAAC,QAA8B,EAAE,UAAmB;IAC1E,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAElC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACnF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,gEAAgE;QAChE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC9C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACpE,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"auth-context.js","sourceRoot":"","sources":["../../src/services/auth-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAoBrD,MAAM,qBAAqB,GAAG,IAAI,iBAAiB,EAAkB,CAAC;AAEtE,wEAAwE;AACxE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,qBAAqB,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,yCAAyC;AACzC,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,IAAI,iBAAiB,EAA2B,CAAC;AAE5E,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,kBAAkB,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,WAAW,EAAE,CAAC,MAAM,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAI,WAAwB,EAAE,EAAwB;IAC/E,OAAO,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAO,GAE5C,EAAE;IACJ,OAAO,KAAK,EAAE,QAA8B,EAAE,EAA0B,EAAoB,EAAE;QAC5F,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,CAA4B,CAAC;QACvE,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,UAAU,GAAmB,EAAE,CAAC;QAEtC,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;QAClE,IAAI,EAAE;YAAE,UAAU,CAAC,SAAS,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC;QAEhF,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACtD,OAAO,qBAAqB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,eAAe,CAAC,QAA8B,EAAE,UAAmB;IAC1E,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAElC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACnF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,gEAAgE;QAChE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC9C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACpE,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC"}

package/dist/services/auth.rpc-service.d.ts

@@ -13,10 +13,12 @@
  * @Public({ auth: true }) = auth required (role-based access possible)
  * @Public() = default (follows configureAuth rules)
  */
+import type { Netron } from '@omnitron-dev/titan/netron';
 import type { AuthService, OmnitronSignInResult, OmnitronAuthUser, OmnitronActiveSession } from './auth.service.js';
 export declare class AuthRpcService {
     private readonly authService;
-    constructor(authService: AuthService);
+    private readonly netron?;
+    constructor(authService: AuthService, netron?: Netron | undefined);
     signIn(data: {
         username: string;
         password: string;

package/dist/services/auth.rpc-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.rpc-service.d.ts","sourceRoot":"","sources":["../../src/services/auth.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,OAAO,KAAK,EACV,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,mBAAmB,CAAC;AAE3B,qBACa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,WAAW;IAAxC,YAA6B,WAAW,EAAE,WAAW,EAAI;IAOnD,MAAM,CAAC,IAAI,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAWhC;IAGK,aAAa,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACpD,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CAKD;IAGK,eAAe,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAC1D,KAAK,EAAE,OAAO,CAAC;QACf,IAAI,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;QACpC,OAAO,CAAC,EAAE;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC;KAC7C,CAAC,CAMD;IAGK,cAAc,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACzD,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,oBAAoB,CAAC;KAC/B,CAAC,CAKD;IAGK,OAAO,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAaxE;IAOK,iBAAiB,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAI1D;IAGK,cAAc,CAAC,IAAI,EAAE;QACzB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAKhC;CACF"}
+{"version":3,"file":"auth.rpc-service.d.ts","sourceRoot":"","sources":["../../src/services/auth.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EACV,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,mBAAmB,CAAC;AAE3B,qBACa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,WAAW;IAAe,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAA/E,YAA6B,WAAW,EAAE,WAAW,EAAmB,MAAM,CAAC,EAAE,MAAM,YAAA,EAAI;IAOrF,MAAM,CAAC,IAAI,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAWhC;IAGK,aAAa,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACpD,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CAKD;IAGK,eAAe,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAC1D,KAAK,EAAE,OAAO,CAAC;QACf,IAAI,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;QACpC,OAAO,CAAC,EAAE;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC;KAC7C,CAAC,CAMD;IAGK,cAAc,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACzD,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,oBAAoB,CAAC;KAC/B,CAAC,CAKD;IAGK,OAAO,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAcxE;IAOK,iBAAiB,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAI1D;IAGK,cAAc,CAAC,IAAI,EAAE;QACzB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAShC;CACF"}

package/dist/services/auth.rpc-service.js

@@ -26,10 +26,13 @@ import { Service, Public } from '@omnitron-dev/titan/decorators';
 import { Errors } from '@omnitron-dev/titan/errors';
 import { requirePayload, requireString } from './anonymous-input.js';
 import { getCurrentAuth, requireAuth, getRequestContext } from './auth-context.js';
+import { revokeDaemonAuthority } from './daemon-principal.js';
 let AuthRpcService = class AuthRpcService {
     authService;
-    constructor(authService) {
+    netron;
+    constructor(authService, netron) {
         this.authService = authService;
+        this.netron = netron;
     }
     // ===========================================================================
     // Public (anonymous) endpoints — no token required
@@ -71,13 +74,15 @@ let AuthRpcService = class AuthRpcService {
         const sessionId = requireString(requirePayload(data, 'signOut'), 'sessionId', 'signOut');
         // If authenticated, verify session ownership
         const auth = getCurrentAuth();
+        const sessionOwner = await this.authService.validateSession(sessionId);
         if (auth) {
-            const sessionOwner = await this.authService.validateSession(sessionId);
             if (sessionOwner && sessionOwner.id !== auth.userId) {
                 throw Errors.forbidden('Cannot revoke another user\'s session');
             }
         }
         await this.authService.signOut(sessionId);
+        if (sessionOwner && this.netron)
+            revokeDaemonAuthority(this.netron, sessionOwner.id, { only: sessionId });
         return { success: true };
     }
     // ===========================================================================
@@ -90,8 +95,13 @@ let AuthRpcService = class AuthRpcService {
     }
     async changePassword(data) {
         const auth = requireAuth();
+        const payload = requirePayload(data, 'changePassword');
+        requireString(payload, 'oldPassword', 'changePassword');
+        requireString(payload, 'newPassword', 'changePassword');
         const sessionId = auth.metadata?.sessionId;
         await this.authService.changePassword(auth.userId, data.oldPassword, data.newPassword, sessionId);
+        if (this.netron)
+            revokeDaemonAuthority(this.netron, auth.userId, { except: sessionId });
         return { success: true };
     }
 };
@@ -139,7 +149,7 @@ __decorate([
 ], AuthRpcService.prototype, "changePassword", null);
 AuthRpcService = __decorate([
     Service({ name: 'OmnitronAuth' }),
-    __metadata("design:paramtypes", [Function])
+    __metadata("design:paramtypes", [Function, Function])
 ], AuthRpcService);
 export { AuthRpcService };
 //# sourceMappingURL=auth.rpc-service.js.map

package/dist/services/auth.rpc-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.rpc-service.js","sourceRoot":"","sources":["../../src/services/auth.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAS5E,IAAM,cAAc,GAApB,MAAM,cAAc;IACI,WAAW;IAAxC,YAA6B,WAAwB;2BAAxB,WAAW;IAAgB,CAAC;IAEzD,8EAA8E;IAC9E,mDAAmD;IACnD,8EAA8E;IAGxE,AAAN,KAAK,CAAC,MAAM,CAAC,IAIZ;QACC,sEAAsE;QACtE,kEAAkE;QAClE,yEAAyE;QACzE,uDAAuD;QACvD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/C,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC7C,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAE7C,MAAM,SAAS,GAAG,iBAAiB,EAAE,EAAE,SAAS,CAAC;QACjD,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAGK,AAAN,KAAK,CAAC,aAAa,CAAC,IAAuB;QAKzC,MAAM,KAAK,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IAC7E,CAAC;IAGK,AAAN,KAAK,CAAC,eAAe,CAAC,IAA2B;QAK/C,MAAM,SAAS,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;QACzG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC9G,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc,CAAC,IAA2B;QAI9C,MAAM,SAAS,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAC,IAA2B;QACvC,MAAM,SAAS,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAEzF,6CAA6C;QAC7C,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YACvE,IAAI,YAAY,IAAI,YAAY,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;gBACpD,MAAM,MAAM,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,8EAA8E;IAC9E,+DAA+D;IAC/D,8EAA8E;IAGxE,AAAN,KAAK,CAAC,iBAAiB;QACrB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAI,IAAI,CAAC,QAAgB,EAAE,SAAS,CAAC;QACpD,OAAO,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpE,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc,CAAC,IAGpB;QACC,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAI,IAAI,CAAC,QAAgB,EAAE,SAAS,CAAC;QACpD,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAClG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AA1FO;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;4CAgB1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;mDAU1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;qDAW1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;oDAS1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;6CAc1C;AAOK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;;;uDAKtB;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;;;oDAStB;AAjGU,cAAc;IAD1B,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;;GACrB,cAAc,CAkG1B"}
+{"version":3,"file":"auth.rpc-service.js","sourceRoot":"","sources":["../../src/services/auth.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAUvD,IAAM,cAAc,GAApB,MAAM,cAAc;IACI,WAAW;IAAgC,MAAM;IAA9E,YAA6B,WAAwB,EAAmB,MAAe;2BAA1D,WAAW;sBAAgC,MAAM;IAAY,CAAC;IAE3F,8EAA8E;IAC9E,mDAAmD;IACnD,8EAA8E;IAGxE,AAAN,KAAK,CAAC,MAAM,CAAC,IAIZ;QACC,sEAAsE;QACtE,kEAAkE;QAClE,yEAAyE;QACzE,uDAAuD;QACvD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/C,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC7C,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAE7C,MAAM,SAAS,GAAG,iBAAiB,EAAE,EAAE,SAAS,CAAC;QACjD,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAGK,AAAN,KAAK,CAAC,aAAa,CAAC,IAAuB;QAKzC,MAAM,KAAK,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IAC7E,CAAC;IAGK,AAAN,KAAK,CAAC,eAAe,CAAC,IAA2B;QAK/C,MAAM,SAAS,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;QACzG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC9G,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc,CAAC,IAA2B;QAI9C,MAAM,SAAS,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAC,IAA2B;QACvC,MAAM,SAAS,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAEzF,6CAA6C;QAC7C,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,YAAY,IAAI,YAAY,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;gBACpD,MAAM,MAAM,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,YAAY,IAAI,IAAI,CAAC,MAAM;YAAE,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1G,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,8EAA8E;IAC9E,+DAA+D;IAC/D,8EAA8E;IAGxE,AAAN,KAAK,CAAC,iBAAiB;QACrB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAI,IAAI,CAAC,QAAgB,EAAE,SAAS,CAAC;QACpD,OAAO,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpE,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc,CAAC,IAGpB;QACC,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACvD,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;QACxD,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;QACxD,MAAM,SAAS,GAAI,IAAI,CAAC,QAAgB,EAAE,SAAS,CAAC;QACpD,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAClG,IAAI,IAAI,CAAC,MAAM;YAAE,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACxF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AA/FO;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;4CAgB1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;mDAU1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;qDAW1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;oDAS1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;6CAe1C;AAOK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;;;uDAKtB;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;;;oDAatB;AAtGU,cAAc;IAD1B,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;;GACrB,cAAc,CAuG1B"}

package/dist/services/auth.service.d.ts

@@ -29,15 +29,6 @@ export declare class AuthService {
     signIn(request: OmnitronSignInRequest, origin?: {
         ipAddress?: string;
     }): Promise<OmnitronSignInResult>;
-    /**
-     * Record a failed sign-in and lock the account once the streak crosses the
-     * threshold. The lockout grows exponentially with each additional failure
-     * past the threshold, capped at LOCKOUT_MAX_MS.
-     *
-     * State is persisted rather than held in memory: a daemon restart — which
-     * an attacker may be able to provoke — must not hand back a clean slate.
-     */
-    private registerFailedAttempt;
     /**
      * A scrypt hash of a random secret, computed once per process.
      *
@@ -56,24 +47,23 @@ export declare class AuthService {
     validateToken(token: string): Promise<{
         userId: string;
         sessionId: string;
+        role: string;
+    } | null>;
+    /** One indexed join per admitted call. Store failure is unavailable, never a false revocation. */
+    validateSessionAuthority(userId: string, sessionId: string): Promise<{
+        userId: string;
+        sessionId: string;
+        role: string;
     } | null>;
     getActiveSessions(userId: string, currentSessionId?: string): Promise<OmnitronActiveSession[]>;
     refreshSession(sessionId: string): Promise<OmnitronSignInResult | null>;
     changePassword(userId: string, oldPassword: string, newPassword: string, currentSessionId?: string): Promise<void>;
     hashPassword(password: string): Promise<string>;
     /**
-     * Is the seeded `admin` account still using the password it shipped with?
-     *
-     * Migration 001 seeds `admin` / `admin` and its comment says the password
-     * "MUST be changed on first login". Nothing enforced that — no flag, no
-     * gate, no check anywhere in this daemon. A comment is not a control.
-     *
-     * The daemon binds loopback by default and the console does too, so this
-     * only matters where an operator has deliberately published one of them.
-     * That is exactly the moment to ask, which is what the caller does.
-     *
-     * Answers false when the account is gone or renamed: the question is about
-     * a shipped credential, not about weak passwords in general.
+     * Is the shipped password still accepted by any Console account? Renaming
+     * or demoting the seeded account must not bypass publication admission.
+     * Keyset paging bounds memory; this check runs before external publication,
+     * not on every login or RPC. New credentials already require 15 characters.
      */
     isUsingSeededAdminPassword(): Promise<boolean>;
     verifyPassword(password: string, hash: string): Promise<boolean>;

package/dist/services/auth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../src/services/auth.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,uBAAuB,CAAC;AAQ/B,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAuB/B,qBACa,WAAW;IAYO,OAAO,CAAC,QAAQ,CAAC,EAAE;IAXhD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAa;IACvC,sDAAsD;IACtD,OAAO,CAAC,gBAAgB,CAAgC;IAQxD,YAC8C,EAAE,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAC9C,SAAS,EAAE,MAAM,EAW5C;IAMD;;;;;;;OAOG;IACG,MAAM,CACV,OAAO,EAAE,qBAAqB,EAC9B,MAAM,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAoE/B;IAMD;;;;;;;OAOG;YACW,qBAAqB;IAWnC;;;;;OAKG;YACW,SAAS;IASjB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9C;IAMK,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAmCzE;IAED;;OAEG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAS3E;IAMK,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAgDxF;IAMK,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAiBnG;IAMK,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CA8C5E;IAMK,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BvH;IAMK,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIpD;IAED;;;;;;;;;;;;;OAaG;IACG,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,CASnD;IAEK,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASrE;YAMa,UAAU;IAcxB,sDAAsD;IAChD,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC,CAO9C;CACF"}
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../src/services/auth.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,uBAAuB,CAAC;AAQ/B,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AA2B/B,qBACa,WAAW;IAYO,OAAO,CAAC,QAAQ,CAAC,EAAE;IAXhD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAa;IACvC,sDAAsD;IACtD,OAAO,CAAC,gBAAgB,CAAgC;IAQxD,YAC8C,EAAE,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAC9C,SAAS,EAAE,MAAM,EAW5C;IAMD;;;;;;;OAOG;IACG,MAAM,CACV,OAAO,EAAE,qBAAqB,EAC9B,MAAM,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAyE/B;IAED;;;;;OAKG;YACW,SAAS;IASjB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9C;IAMK,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAmCzE;IAED;;OAEG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAS3E;IAMK,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAmBtG;IAED,kGAAkG;IAC5F,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAarI;IAMK,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAiBnG;IAMK,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CA8C5E;IAMK,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCvH;IAMK,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIpD;IAED;;;;;OAKG;IACG,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,CAYnD;IAEK,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASrE;YAMa,UAAU;IAcxB,sDAAsD;IAChD,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC,CAO9C;CACF"}

package/dist/services/auth.service.js

@@ -24,6 +24,8 @@ import { randomBytes, randomUUID, scrypt, timingSafeEqual } from 'node:crypto';
 import { computeLockout } from './lockout.js';
 import { promisify } from 'node:util';
 import { SignJWT, jwtVerify } from 'jose';
+import { Errors } from '@omnitron-dev/titan/errors';
+import { consolePasswordError } from '../shared/dto/auth.js';
 import { Injectable, Inject } from '@omnitron-dev/titan/decorators';
 import { OMNITRON_DB_TOKEN, JWT_SECRET_TOKEN } from '../shared/tokens.js';
 const scryptAsync = promisify(scrypt);
@@ -36,10 +38,14 @@ const KEY_LENGTH = 64;
  * What migration 001 seeds. Named here so the check below cannot drift from
  * the migration silently — if the seed changes, this is the other half.
  */
-const SEEDED_ADMIN_USERNAME = 'admin';
 const SEEDED_ADMIN_PASSWORD = 'admin';
 const SESSION_DURATION_MS = 24 * 60 * 60 * 1000; // 24 hours
 const JWT_EXPIRY = '1h';
+function assertSignInUnlocked(until) {
+    const remaining = until ? until.getTime() - Date.now() : 0;
+    if (remaining > 0)
+        throw new Error(`Account temporarily locked — try again in ${Math.ceil(remaining / 1000)}s`);
+}
 // =============================================================================
 // Auth Service
 // =============================================================================
@@ -79,85 +85,72 @@ let AuthService = class AuthService {
      */
     async signIn(request, origin = {}) {
         const { username, password, userAgent } = request;
-        // 1. Find user
-        const user = await this.db
-            .selectFrom('omnitron_users')
-            .selectAll()
+        const candidate = await this.db.selectFrom('omnitron_users')
+            .select(['id', 'passwordHash', 'lockedUntil'])
             .where('username', '=', username)
             .executeTakeFirst();
-        // 2. Reject while locked out, before spending a scrypt on it.
-        if (user?.lockedUntil && new Date(user.lockedUntil) > new Date()) {
-            const seconds = Math.ceil((new Date(user.lockedUntil).getTime() - Date.now()) / 1000);
-            throw new Error(`Account temporarily locked — try again in ${seconds}s`);
-        }
-        // 3. Verify password.
-        //
-        // An unknown username still costs a full scrypt against a throwaway hash.
-        // Returning early on "no such user" made sign-in measurably faster for
-        // absent accounts than for present ones, which is a username oracle on
-        // the infrastructure control plane: scrypt here takes ~100ms, so the
-        // difference was trivially observable over the network.
-        const valid = user
-            ? await this.verifyPassword(password, user.passwordHash)
-            : await this.verifyPassword(password, await this.decoyHash());
-        if (!user || !valid) {
-            if (user)
-                await this.registerFailedAttempt(user.id, user.failedLoginAttempts);
+        assertSignInUnlocked(candidate?.lockedUntil);
+        // Hash outside the transaction so slow password checks never hold a row
+        // lock or pool connection. Unknown usernames pay the same verification cost.
+        const valid = await this.verifyPassword(password, candidate?.passwordHash ?? (await this.decoyHash()));
+        if (!candidate)
             throw new Error('Invalid credentials');
-        }
-        // 4. Create session (include role in JWT for RBAC enforcement)
-        const sessionId = randomUUID();
-        const expiresAt = new Date(Date.now() + SESSION_DURATION_MS);
-        const accessToken = await this.issueToken(user.id, sessionId, user.role);
-        await this.db
-            .insertInto('omnitron_sessions')
-            .values({
-            id: sessionId,
-            userId: user.id,
-            token: accessToken,
-            expiresAt,
-            ipAddress: origin.ipAddress ?? null,
-            userAgent: userAgent ?? null,
-        })
-            .execute();
-        // 5. Update last login and clear the failure streak
-        await this.db
-            .updateTable('omnitron_users')
-            .set({ lastLoginAt: new Date(), failedLoginAttempts: 0, lockedUntil: null })
-            .where('id', '=', user.id)
-            .execute();
-        return {
-            user: {
-                id: user.id,
-                username: user.username,
-                displayName: user.displayName,
-                role: user.role,
-                totpEnabled: user.totpEnabled,
-                pgpEnabled: user.pgpEnabled,
-            },
-            session: { id: sessionId, expiresAt },
-            accessToken,
-        };
-    }
-    // ===========================================================================
-    // Brute-force throttling
-    // ===========================================================================
-    /**
-     * Record a failed sign-in and lock the account once the streak crosses the
-     * threshold. The lockout grows exponentially with each additional failure
-     * past the threshold, capped at LOCKOUT_MAX_MS.
-     *
-     * State is persisted rather than held in memory: a daemon restart — which
-     * an attacker may be able to provoke — must not hand back a clean slate.
-     */
-    async registerFailedAttempt(userId, currentAttempts) {
-        const attempts = currentAttempts + 1;
-        const lockedUntil = computeLockout(attempts);
-        await this.db
-            .updateTable('omnitron_users')
-            .set({ failedLoginAttempts: attempts, lockedUntil })
-            .where('id', '=', userId)
-            .execute();
+        const result = await this.db.transaction().execute(async (trx) => {
+            // Serialize account transitions across every client and daemon. Re-read the
+            // credential and role in case either changed while scrypt was running.
+            const user = await trx.selectFrom('omnitron_users')
+                .select(['id', 'username', 'passwordHash', 'displayName', 'role', 'totpEnabled', 'pgpEnabled',
+                'failedLoginAttempts', 'lockedUntil'])
+                .where('id', '=', candidate.id)
+                .forUpdate()
+                .executeTakeFirst();
+            if (!user || user.passwordHash !== candidate.passwordHash || user.username !== username)
+                return null;
+            if (!valid) {
+                // Every check admitted before the lock counts once. New arrivals
+                // during the lock are refused before hashing and cannot extend it.
+                const attempts = user.failedLoginAttempts + 1;
+                await trx.updateTable('omnitron_users')
+                    .set({ failedLoginAttempts: attempts, lockedUntil: computeLockout(attempts) })
+                    .where('id', '=', user.id)
+                    .execute();
+                return null;
+            }
+            assertSignInUnlocked(user.lockedUntil);
+            const sessionId = randomUUID();
+            const expiresAt = new Date(Date.now() + SESSION_DURATION_MS);
+            const accessToken = await this.issueToken(user.id, sessionId, user.role);
+            await trx.insertInto('omnitron_sessions')
+                .values({
+                id: sessionId,
+                userId: user.id,
+                token: accessToken,
+                expiresAt,
+                ipAddress: origin.ipAddress ?? null,
+                userAgent: userAgent ?? null,
+            })
+                .execute();
+            await trx.updateTable('omnitron_users')
+                .set({ lastLoginAt: new Date(), failedLoginAttempts: 0, lockedUntil: null })
+                .where('id', '=', user.id)
+                .execute();
+            return {
+                user: {
+                    id: user.id,
+                    username: user.username,
+                    displayName: user.displayName,
+                    role: user.role,
+                    totpEnabled: user.totpEnabled,
+                    pgpEnabled: user.pgpEnabled,
+                },
+                session: { id: sessionId, expiresAt },
+                accessToken,
+            };
+        });
+        // Returning from the transaction first commits a recorded failed attempt.
+        if (!result)
+            throw new Error('Invalid credentials');
+        return result;
     }
     /**
      * A scrypt hash of a random secret, computed once per process.
@@ -240,37 +233,7 @@ let AuthService = class AuthService {
             const sessionId = payload['sid'];
             if (!userId || !sessionId)
                 return null;
-            // The session lookup gets its own catch, because a database that cannot
-            // answer is not a revoked session.
-            //
-            // Both used to return null from the outer catch, and the daemon turns
-            // null into `Session has been revoked or expired` with a 401. So every
-            // operator, during a database outage, was told their session had been
-            // revoked — an affirmative claim about their account, made at the one
-            // moment the platform could not check, and the kind of message that
-            // sends someone looking for a security incident. Signing in again does
-            // not help either: that path needs the same database.
-            let session;
-            try {
-                session = await this.db
-                    .selectFrom('omnitron_sessions')
-                    .select(['id', 'expiresAt'])
-                    .where('id', '=', sessionId)
-                    .where('userId', '=', userId)
-                    .executeTakeFirst();
-            }
-            catch (err) {
-                throw Object.assign(new Error('Session store is unavailable'), {
-                    code: 'SESSION_STORE_UNAVAILABLE',
-                    statusCode: 503,
-                    cause: err,
-                });
-            }
-            if (!session)
-                return null;
-            if (new Date(session.expiresAt) < new Date())
-                return null;
-            return { userId, sessionId };
+            return await this.validateSessionAuthority(userId, sessionId);
         }
         catch (err) {
             // A token that does not verify is the normal answer here. The lookup
@@ -280,6 +243,23 @@ let AuthService = class AuthService {
             return null;
         }
     }
+    /** One indexed join per admitted call. Store failure is unavailable, never a false revocation. */
+    async validateSessionAuthority(userId, sessionId) {
+        let session;
+        try {
+            session = await this.db.selectFrom('omnitron_sessions')
+                .innerJoin('omnitron_users', 'omnitron_users.id', 'omnitron_sessions.userId')
+                .select(['omnitron_sessions.id', 'omnitron_sessions.expiresAt', 'omnitron_users.role'])
+                .where('omnitron_sessions.id', '=', sessionId).where('omnitron_sessions.userId', '=', userId)
+                .executeTakeFirst();
+        }
+        catch (error) {
+            throw Object.assign(new Error('Session store is unavailable'), { code: 'SESSION_STORE_UNAVAILABLE', statusCode: 503, cause: error });
+        }
+        if (!session || !Number.isFinite(new Date(session.expiresAt).getTime()) || new Date(session.expiresAt).getTime() <= Date.now())
+            return null;
+        return { userId, sessionId, role: session.role };
+    }
     // ===========================================================================
     // Get Active Sessions
     // ===========================================================================
@@ -349,6 +329,9 @@ let AuthService = class AuthService {
     // Change Password
     // ===========================================================================
     async changePassword(userId, oldPassword, newPassword, currentSessionId) {
+        const passwordError = consolePasswordError(newPassword);
+        if (passwordError)
+            throw Errors.badRequest(passwordError);
         const user = await this.db
             .selectFrom('omnitron_users')
             .select(['id', 'passwordHash'])
@@ -362,17 +345,22 @@ let AuthService = class AuthService {
             throw new Error('Invalid current password');
         }
         const newHash = await this.hashPassword(newPassword);
-        await this.db
-            .updateTable('omnitron_users')
-            .set({ passwordHash: newHash, updatedAt: new Date() })
-            .where('id', '=', userId)
-            .execute();
-        // Revoke all sessions except the caller's current session
-        let query = this.db.deleteFrom('omnitron_sessions').where('userId', '=', userId);
-        if (currentSessionId) {
-            query = query.where('id', '!=', currentSessionId);
-        }
-        await query.execute();
+        await this.db.transaction().execute(async (trx) => {
+            const changed = await trx
+                .updateTable('omnitron_users')
+                .set({ passwordHash: newHash, updatedAt: new Date() })
+                .where('id', '=', userId)
+                .where('passwordHash', '=', user.passwordHash)
+                .executeTakeFirst();
+            if (!changed.numUpdatedRows)
+                throw new Error('Invalid current password');
+            // Revoke all sessions except the caller's current session
+            let query = trx.deleteFrom('omnitron_sessions').where('userId', '=', userId);
+            if (currentSessionId) {
+                query = query.where('id', '!=', currentSessionId);
+            }
+            await query.execute();
+        });
     }
     // ===========================================================================
     // Password Hashing (crypto.scrypt — no external deps)
@@ -383,28 +371,26 @@ let AuthService = class AuthService {
         return `scrypt:${salt.toString('hex')}:${derived.toString('hex')}`;
     }
     /**
-     * Is the seeded `admin` account still using the password it shipped with?
-     *
-     * Migration 001 seeds `admin` / `admin` and its comment says the password
-     * "MUST be changed on first login". Nothing enforced that — no flag, no
-     * gate, no check anywhere in this daemon. A comment is not a control.
-     *
-     * The daemon binds loopback by default and the console does too, so this
-     * only matters where an operator has deliberately published one of them.
-     * That is exactly the moment to ask, which is what the caller does.
-     *
-     * Answers false when the account is gone or renamed: the question is about
-     * a shipped credential, not about weak passwords in general.
+     * Is the shipped password still accepted by any Console account? Renaming
+     * or demoting the seeded account must not bypass publication admission.
+     * Keyset paging bounds memory; this check runs before external publication,
+     * not on every login or RPC. New credentials already require 15 characters.
      */
     async isUsingSeededAdminPassword() {
-        const user = await this.db
-            .selectFrom('omnitron_users')
-            .select(['passwordHash'])
-            .where('username', '=', SEEDED_ADMIN_USERNAME)
-            .executeTakeFirst();
-        if (!user)
-            return false;
-        return this.verifyPassword(SEEDED_ADMIN_PASSWORD, user.passwordHash);
+        let after;
+        for (;;) {
+            let query = this.db.selectFrom('omnitron_users').select(['id', 'passwordHash']).orderBy('id').limit(100);
+            if (after !== undefined)
+                query = query.where('id', '>', after);
+            const users = await query.execute();
+            for (const user of users) {
+                if (await this.verifyPassword(SEEDED_ADMIN_PASSWORD, user.passwordHash))
+                    return true;
+            }
+            if (users.length < 100)
+                return false;
+            after = users.at(-1).id;
+        }
     }
     async verifyPassword(password, hash) {
         const parts = hash.split(':');