@omnitron-dev/omnitron 0.3.1 → 0.3.3

package/dist/services/wait-for-postgres.js.map

@@ -1 +1 @@
-{"version":3,"file":"wait-for-postgres.js","sourceRoot":"","sources":["../../src/services/wait-for-postgres.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,IAAY,EACZ,IAAY,EACZ,QAAgB,EAChB,SAAiB;IAEjB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IACvC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAuB,EAAE,CAAC,CAAC,CAAC;IAEzF,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,SAAuB,EAAS,EAAE;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,kBAAkB,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,KAAK,CACd,eAAe,IAAI,IAAI,IAAI,IAAI,IAAI,YAAY,MAAM,YAAY,SAAS,OAAO,IAAI,EAAE,EACvF,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAC7C,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,SAAS,GAAiB,IAAI,CAAC;IAEnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,qEAAqE;QACrE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,EAAE,GAAG,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;gBAChD,MAAM,IAAI,GAAG,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE;oBACrD,IAAI,CAAC,GAAG,EAAE,CAAC;oBACX,OAAO,CAAC,IAAI,CAAC,CAAC;gBAChB,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;oBACzB,SAAS,GAAG,GAAY,CAAC;oBACzB,OAAO,CAAC,KAAK,CAAC,CAAC;gBACjB,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE;oBAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,CAAC;gBACjB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,IAAI,EAAE;gBAAE,OAAO;YACf,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,OAAO,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,CAAC;QAChH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC/B,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAY,CAAC;YACzB,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACnC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,MAAM,OAAO,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"wait-for-postgres.js","sourceRoot":"","sources":["../../src/services/wait-for-postgres.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,IAAY,EACZ,IAAY,EACZ,QAAgB,EAChB,SAAiB,EACjB,gBAAyB;IAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IACvC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAEtC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,SAAuB,EAAS,EAAE;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,kBAAkB,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,KAAK,CACd,eAAe,IAAI,IAAI,IAAI,IAAI,IAAI,YAAY,MAAM,YAAY,SAAS,OAAO,IAAI,EAAE,EACvF,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAC7C,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,SAAS,GAAiB,IAAI,CAAC;IAEnC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU;YAC1E,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,uBAAuB,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC/B,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAY,CAAC;YACzB,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACnC,qFAAqF;YACrF,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAE,GAAyB,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;gBACzF,MAAM,OAAO,CAAC,mCAAmC,EAAE,SAAS,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACxC,IAAI,SAAS,GAAG,CAAC;gBAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,MAAM,OAAO,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;AACnD,CAAC"}

package/dist/shared/build-stamp.d.ts

@@ -11,10 +11,13 @@ export interface BuildStamp {
     commit: string;
     /** Whether the tree held uncommitted changes when it was. */
     dirty: boolean;
-    /** When, ISO 8601. */
+    /** ISO 8601 source time for reproducible builds; wall clock for legacy/development builds. */
     builtAt: string;
+    timeBasis?: 'source' | 'build';
 }
 export declare const BUILD_STAMP_FILE = "BUILD.json";
+/** Decode the same build identity from disk, or from a pinned release archive. */
+export declare function parseBuildStamp(input: unknown): BuildStamp | null;
 /** The stamp in `dir`, or `null` when there is none or it cannot be read as one. */
 export declare function readBuildStamp(dir: string): BuildStamp | null;
 /**

package/dist/shared/build-stamp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-stamp.d.ts","sourceRoot":"","sources":["../../src/shared/build-stamp.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,MAAM,WAAW,UAAU;IACzB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,KAAK,EAAE,OAAO,CAAC;IACf,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAS7D;AAED;;;;GAIG;AACH,eAAO,MAAM,SAAS,EAAE,UAAU,GAAG,IAGjC,CAAC"}
+{"version":3,"file":"build-stamp.d.ts","sourceRoot":"","sources":["../../src/shared/build-stamp.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,MAAM,WAAW,UAAU;IACzB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,KAAK,EAAE,OAAO,CAAC;IACf,8FAA8F;IAC9F,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CAChC;AAED,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CAOjE;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAM7D;AAED;;;;GAIG;AACH,eAAO,MAAM,SAAS,EAAE,UAAU,GAAG,IAGjC,CAAC"}

package/dist/shared/build-stamp.js

@@ -10,15 +10,23 @@ import { readFileSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 export const BUILD_STAMP_FILE = 'BUILD.json';
+/** Decode the same build identity from disk, or from a pinned release archive. */
+export function parseBuildStamp(input) {
+    if (!input || typeof input !== 'object')
+        return null;
+    const raw = input;
+    if (typeof raw.commit !== 'string' || !/^[0-9a-f]{7,40}$/.test(raw.commit))
+        return null;
+    if (typeof raw.dirty !== 'boolean' || typeof raw.builtAt !== 'string')
+        return null;
+    if (raw.timeBasis !== undefined && raw.timeBasis !== 'source' && raw.timeBasis !== 'build')
+        return null;
+    return { commit: raw.commit, dirty: raw.dirty, builtAt: raw.builtAt, ...(raw.timeBasis ? { timeBasis: raw.timeBasis } : {}) };
+}
 /** The stamp in `dir`, or `null` when there is none or it cannot be read as one. */
 export function readBuildStamp(dir) {
     try {
-        const raw = JSON.parse(readFileSync(path.join(dir, BUILD_STAMP_FILE), 'utf8'));
-        if (typeof raw.commit !== 'string' || !/^[0-9a-f]{7,40}$/.test(raw.commit))
-            return null;
-        if (typeof raw.dirty !== 'boolean' || typeof raw.builtAt !== 'string')
-            return null;
-        return { commit: raw.commit, dirty: raw.dirty, builtAt: raw.builtAt };
+        return parseBuildStamp(JSON.parse(readFileSync(path.join(dir, BUILD_STAMP_FILE), 'utf8')));
     }
     catch {
         return null;

package/dist/shared/build-stamp.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-stamp.js","sourceRoot":"","sources":["../../src/shared/build-stamp.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAWzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAwB,CAAC;QACtG,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACxF,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnF,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAsB,CAAC,GAAG,EAAE;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClG,CAAC,CAAC,EAAE,CAAC"}
+{"version":3,"file":"build-stamp.js","sourceRoot":"","sources":["../../src/shared/build-stamp.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAYzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,GAAG,GAAG,KAA4B,CAAC;IACzC,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnF,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACxG,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAChI,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAsB,CAAC,GAAG,EAAE;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClG,CAAC,CAAC,EAAE,CAAC"}

package/dist/shared/describe-error.d.ts

@@ -1,22 +1,2 @@
-/**
- * What went wrong, in words, when the error itself has none.
- *
- * The commonest failure a daemon meets — the database is unreachable —
- * arrives as an `AggregateError`, because Node resolves a host to several
- * addresses and fails on each. That error's own `message` is the EMPTY
- * STRING; the reasons live in `.errors`, and `${err.message}` prints nothing
- * at all.
- *
- * Measured: `sync.service` logged «Failed to ingest sync entry» 76 659 times
- * in one hour with `error: ""` in every record, while the cause — OrbStack
- * down, so the master's own Postgres never came up — was named in three lines
- * of the file next to it.
- *
- * This lived as a private function in `commands/doctor.ts`, which meant the
- * one place that most needed it did not have it. A sibling with the same job
- * and a deeper walk (`cause`, error codes, recursion) lives in
- * `@omnitron-dev/titan-database`'s `utils/describe-error.ts`; if these two
- * ever need to agree on more than they do now, that is the one to keep.
- */
-export declare function describeError(err: unknown): string;
+export { describeError } from '@omnitron-dev/titan/diagnostics';
 //# sourceMappingURL=describe-error.d.ts.map

package/dist/shared/describe-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe-error.d.ts","sourceRoot":"","sources":["../../src/shared/describe-error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAclD"}
+{"version":3,"file":"describe-error.d.ts","sourceRoot":"","sources":["../../src/shared/describe-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC"}

package/dist/shared/describe-error.js

@@ -1,39 +1,2 @@
-/**
- * What went wrong, in words, when the error itself has none.
- *
- * The commonest failure a daemon meets — the database is unreachable —
- * arrives as an `AggregateError`, because Node resolves a host to several
- * addresses and fails on each. That error's own `message` is the EMPTY
- * STRING; the reasons live in `.errors`, and `${err.message}` prints nothing
- * at all.
- *
- * Measured: `sync.service` logged «Failed to ingest sync entry» 76 659 times
- * in one hour with `error: ""` in every record, while the cause — OrbStack
- * down, so the master's own Postgres never came up — was named in three lines
- * of the file next to it.
- *
- * This lived as a private function in `commands/doctor.ts`, which meant the
- * one place that most needed it did not have it. A sibling with the same job
- * and a deeper walk (`cause`, error codes, recursion) lives in
- * `@omnitron-dev/titan-database`'s `utils/describe-error.ts`; if these two
- * ever need to agree on more than they do now, that is the one to keep.
- */
-export function describeError(err) {
-    if (!err)
-        return 'unknown error';
-    if (typeof err === 'string')
-        return err;
-    const e = err;
-    // An AggregateError's own `message` is empty — the reason hides in
-    // `errors[]`. Identical reasons (one per resolved address) collapse.
-    if (Array.isArray(e.errors) && e.errors.length > 0) {
-        const reasons = e.errors.map((x) => x.message || x.code).filter(Boolean);
-        const inner = [...new Set(reasons)].join('; ');
-        if (inner)
-            return e.code ? `${inner} (${e.code})` : inner;
-    }
-    if (e.message)
-        return e.code ? `${e.message} (${e.code})` : e.message;
-    return e.code ?? 'unknown error';
-}
+export { describeError } from '@omnitron-dev/titan/diagnostics';
 //# sourceMappingURL=describe-error.js.map

package/dist/shared/describe-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"describe-error.js","sourceRoot":"","sources":["../../src/shared/describe-error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,eAAe,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,CAAC,GAAG,GAA+F,CAAC;IAE1G,mEAAmE;IACnE,qEAAqE;IACrE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa,CAAC;QACrF,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,KAAK;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACtE,OAAO,CAAC,CAAC,IAAI,IAAI,eAAe,CAAC;AACnC,CAAC"}
+{"version":3,"file":"describe-error.js","sourceRoot":"","sources":["../../src/shared/describe-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC"}

package/dist/shared/dto/access.d.ts

@@ -0,0 +1,55 @@
+export type ConsoleRole = 'viewer' | 'operator' | 'admin';
+export interface ConsoleCapability {
+    service: string;
+    method: string;
+    roles: string[];
+    allowed: boolean;
+    /** Dynamic policies require invocation arguments; never grant them speculatively. */
+    conditional: boolean;
+    /** True only when the published method explicitly allows anonymous calls. */
+    anonymous?: boolean;
+}
+export interface ConsoleAccess {
+    userId: string;
+    role: ConsoleRole;
+    roles: Array<{
+        role: ConsoleRole;
+        label: string;
+        description: string;
+    }>;
+    capabilities: ConsoleCapability[];
+}
+export interface ConsoleAccount {
+    id: string;
+    username: string;
+    displayName: string | null;
+    role: string;
+    createdAt: string;
+    lastLoginAt: string | null;
+}
+export interface IOmnitronAccessService {
+    describe(): Promise<ConsoleAccess>;
+    listUsers(data?: {
+        after?: string;
+    }): Promise<{
+        users: ConsoleAccount[];
+        next: string | null;
+    }>;
+    createUser(data: {
+        username: string;
+        displayName?: string;
+        password: string;
+        role: ConsoleRole;
+    }): Promise<ConsoleAccount>;
+    setRole(data: {
+        id: string;
+        role: ConsoleRole;
+        previous: string;
+    }): Promise<void>;
+    revokeSessions(data: {
+        id: string;
+    }): Promise<{
+        revoked: number;
+    }>;
+}
+//# sourceMappingURL=access.d.ts.map

package/dist/shared/dto/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../../src/shared/dto/access.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC;AAE1D,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,qFAAqF;IACrF,WAAW,EAAE,OAAO,CAAC;IACrB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,WAAW,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE,YAAY,EAAE,iBAAiB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IACnC,SAAS,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAChG,UAAU,CAAC,IAAI,EAAE;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,WAAW,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,OAAO,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,WAAW,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,cAAc,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpE"}

package/dist/shared/dto/access.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=access.js.map

package/dist/shared/dto/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../../src/shared/dto/access.ts"],"names":[],"mappings":""}

package/dist/shared/dto/audit.d.ts

@@ -0,0 +1,32 @@
+/** Wire contracts shared by the CLI, Console and daemon. */
+export interface AuditRow {
+    id: string;
+    action: string;
+    actorId: string | null;
+    actorType: string;
+    resourceType: string;
+    resourceId: string | null;
+    details: Record<string, unknown> | null;
+    ipAddress: string | null;
+    createdAt: string;
+}
+export interface AuditQuery {
+    /** Newest first. Capped by `MAX_AUDIT_PAGE`. */
+    readonly limit?: number | undefined;
+    readonly action?: string | undefined;
+    readonly resourceType?: string | undefined;
+    readonly actorId?: string | undefined;
+    /**
+     * `user`, `service` or `system` — what the ACTOR column prints for a row
+     * with no id. `actorId` alone could not select those: 171 of the master's
+     * 178 rows had a null id, and `--actor system` compared `system` with it
+     * and found nothing.
+     */
+    readonly actorType?: string | undefined;
+    /** Keyset: rows strictly older than this ISO timestamp. */
+    readonly before?: string | undefined;
+    /** Stable page cursor: row ID. The database retains timestamp precision and breaks ties by ID.
+     * Mutually exclusive with before; missing/deleted cursors require refreshing the query. */
+    readonly beforeId?: string | undefined;
+}
+//# sourceMappingURL=audit.d.ts.map

package/dist/shared/dto/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/shared/dto/audit.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAE5D,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,gDAAgD;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC;+FAC2F;IAC3F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC"}

package/dist/shared/dto/audit.js

@@ -0,0 +1,3 @@
+/** Wire contracts shared by the CLI, Console and daemon. */
+export {};
+//# sourceMappingURL=audit.js.map

package/dist/shared/dto/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/shared/dto/audit.ts"],"names":[],"mappings":"AAAA,4DAA4D"}

package/dist/shared/dto/auth.d.ts

@@ -21,6 +21,8 @@ export interface OmnitronSignInRequest {
      */
     userAgent?: string;
 }
+/** Shared by account creation and password changes, on server and in Console. */
+export declare function consolePasswordError(value: unknown): string | null;
 export interface OmnitronAuthUser {
     id: string;
     username: string;

package/dist/shared/dto/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/shared/dto/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/shared/dto/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,iFAAiF;AACjF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAGlE;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB"}

package/dist/shared/dto/auth.js

@@ -10,5 +10,9 @@
  *
  * The DTO barrier only holds if it depends on nothing behind it.
  */
-export {};
+/** Shared by account creation and password changes, on server and in Console. */
+export function consolePasswordError(value) {
+    return typeof value === 'string' && Array.from(value).length >= 15 && new TextEncoder().encode(value).length <= 256
+        ? null : 'Password must contain at least 15 characters and at most 256 UTF-8 bytes';
+}
 //# sourceMappingURL=auth.js.map

package/dist/shared/dto/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/shared/dto/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/shared/dto/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAcH,iFAAiF;AACjF,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,GAAG;QACjH,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,0EAA0E,CAAC;AACxF,CAAC"}

package/dist/shared/dto/backend.d.ts

@@ -0,0 +1,50 @@
+import type { BuildStamp } from '../build-stamp.js';
+/** Counters all resident backends must report before transferring control. */
+export declare const BACKEND_ACTIVITY_COUNTERS: readonly ['terminalSessions', 'fileTransfers', 'pipelineRuns', 'releaseBuilds'];
+export interface BackendRuntimeStatus {
+    mode: 'coupled' | 'resident';
+    handoffSupported: boolean;
+    reason?: string;
+    owner?: {
+        id: string;
+        pid: number;
+        startedAt: string;
+    };
+    /** The build loaded by the process running applications. Older owners omit it. */
+    ownerBuild?: BuildStamp | null;
+    /** Absent on older backends; an empty map means the owner advertised none. */
+    ownerCapabilities?: Readonly<Record<string, number>>;
+    epoch?: number;
+    phase?: string;
+    observedAgeMs?: number;
+    connection?: {
+        status: 'connected' | 'unavailable' | 'owner-changed';
+        observedAt: string | null;
+        error: string | null;
+    };
+    recovery?: {
+        status: 'pending' | 'ready' | 'unavailable';
+        at: string | null;
+        reason: string | null;
+    };
+    supervision?: {
+        type: 'independent';
+        guardianPid: number;
+        ownerUnit: string;
+        backendUnit: string;
+    };
+    blockers: Record<typeof BACKEND_ACTIVITY_COUNTERS[number], number> & {
+        kernelRollouts?: number;
+        backupOperations?: number;
+    };
+}
+/** Binds admission to the resident observed by authenticated daemon status. */
+export interface ApplicationOwnerObservation {
+    owner: NonNullable<BackendRuntimeStatus['owner']>;
+    epoch: number;
+}
+/** Readable even when application inventory cannot be observed. */
+export interface IOmnitronBackendService {
+    status(): Promise<BackendRuntimeStatus>;
+}
+//# sourceMappingURL=backend.d.ts.map

package/dist/shared/dto/backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../../src/shared/dto/backend.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,8EAA8E;AAC9E,eAAO,MAAM,yBAAyB,YAAI,kBAAkB,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe,CAAU,CAAC;AAEzH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,SAAS,GAAG,UAAU,CAAC;IAC7B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,kFAAkF;IAClF,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE;QACX,MAAM,EAAE,WAAW,GAAG,aAAa,GAAG,eAAe,CAAC;QACtD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;KACtB,CAAC;IACF,QAAQ,CAAC,EAAE;QAAE,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,aAAa,CAAC;QAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACrG,WAAW,CAAC,EAAE;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IACnG,QAAQ,EAAE,MAAM,CAAC,OAAO,yBAAyB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7H;AAED,+EAA+E;AAC/E,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,WAAW,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,mEAAmE;AACnE,MAAM,WAAW,uBAAuB;IACtC,MAAM,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACzC"}

package/dist/shared/dto/backend.js

@@ -0,0 +1,3 @@
+/** Counters all resident backends must report before transferring control. */
+export const BACKEND_ACTIVITY_COUNTERS = ['terminalSessions', 'fileTransfers', 'pipelineRuns', 'releaseBuilds'];
+//# sourceMappingURL=backend.js.map

package/dist/shared/dto/backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["../../../src/shared/dto/backend.ts"],"names":[],"mappings":"AAEA,8EAA8E;AAC9E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,kBAAkB,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe,CAAU,CAAC"}

package/dist/shared/dto/backups.d.ts

@@ -12,5 +12,104 @@ export interface BackupInfo {
     size: number;
     createdAt: string;
     compressed: boolean;
+    /** Explicit object bucket; absent on legacy storage backups (the `storage` bucket). */
+    bucket?: string;
+}
+export type BackupArtifactRequest = {
+    project: string;
+    stack: string;
+} & ({
+    kind: 'storage-objects';
+    bucket: string;
+} | {
+    kind: 'tor-keys';
+});
+/**
+ * How one pass ended. `empty` is its own word: a pass that found nothing to
+ * back up did not succeed, and must not read as if it had.
+ */
+export type BackupPassOutcome = 'ok' | 'partial' | 'failed' | 'empty';
+/** One entry of a pass: a database, or a `full`-only artefact. */
+export interface BackupPassEntry {
+    target: string;
+    ok: boolean;
+    id?: string;
+    size?: number;
+    error?: string;
+    /**
+     * A running stack this pass could not reach at all — its databases are not
+     * on this host. Reported with the pass, and left out of its outcome: it is
+     * a gap in what the master can do, not a dump that failed.
+     */
+    skipped?: boolean;
+}
+/**
+ * Where a backup came from. The index row used to hold id, database,
+ * filename, size, createdAt, compressed — no stack — so a listing could not
+ * say whose `main` a row was, and a restore went to whichever stack happened
+ * to be first.
+ */
+export type BackupOrigin = {
+    project: string;
+    stack: string;
+} | 'control-plane';
+/** A backup as listed: the wire DTO, plus where it came from. */
+export interface BackupRecord extends BackupInfo {
+    /** The project and stack a stack database belongs to. Absent on rows written before it was recorded. */
+    project?: string;
+    stack?: string;
+    /** `control-plane` for the daemon's own state (`omnitron`, `daemon-state`). */
+    scope?: 'stack' | 'control-plane';
+}
+/** A running stack, and whether `all` can reach its databases from this host. */
+export interface BackupStackCoverage {
+    project: string;
+    stack: string;
+    /** The databases `all` dumps for it; empty when it has none this host can reach. */
+    databases: string[];
+    /** Why its databases are not backed up from here; absent when they are. */
+    notBackedUp?: string;
+}
+/** What the last pass of one target did — persisted, so it outlives a restart. */
+export interface BackupPassRecord {
+    target: string;
+    trigger: 'schedule' | 'manual';
+    startedAt: string;
+    finishedAt: string;
+    outcome: BackupPassOutcome;
+    ok: number;
+    total: number;
+    failures: Array<{
+        target: string;
+        error: string;
+    }>;
+    /** Running stacks the pass could not reach, and why. */
+    notBackedUp?: Array<{
+        stack: string;
+        reason: string;
+    }>;
+}
+/** A configured schedule, and what it last did. */
+export interface BackupScheduleStatus {
+    target: string;
+    /** The specification as stored — cron, preset, or ms. */
+    spec: string;
+    /** `describeSchedule` of it, or null when the stored spec cannot be read. */
+    schedule: string | null;
+    /** Why the stored spec cannot be read: configured, and not running. */
+    error?: string;
+    armed: boolean;
+    /** The last pass this target ran, from any daemon run; null if none was recorded. */
+    lastPass: BackupPassRecord | null;
+    /** The target's newest backup in the index — what its next run is measured from. */
+    lastBackupAt: string | null;
+    /** When the armed timer fires, or null when the schedule is not armed. */
+    nextRunAt: string | null;
+}
+/** Everything `backup schedules` and `backup list` need beyond the index rows. */
+export interface BackupStatus {
+    schedules: BackupScheduleStatus[];
+    /** Every running stack, and whether this host backs its databases up. */
+    stacks: BackupStackCoverage[];
 }
 //# sourceMappingURL=backups.d.ts.map

package/dist/shared/dto/backups.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backups.d.ts","sourceRoot":"","sources":["../../../src/shared/dto/backups.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;CACrB"}
+{"version":3,"file":"backups.d.ts","sourceRoot":"","sources":["../../../src/shared/dto/backups.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,qBAAqB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,CACrE;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CACvB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEtE,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,eAAe,CAAC;AAEhF,iEAAiE;AACjE,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,wGAAwG;IACxG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,KAAK,CAAC,EAAE,OAAO,GAAG,eAAe,CAAC;CACnC;AAED,iFAAiF;AACjF,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD,wDAAwD;IACxD,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxD;AAED,mDAAmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,qFAAqF;IACrF,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAClC,oFAAoF;IACpF,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,0EAA0E;IAC1E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,oBAAoB,EAAE,CAAC;IAClC,yEAAyE;IACzE,MAAM,EAAE,mBAAmB,EAAE,CAAC;CAC/B"}

package/dist/shared/dto/cluster.d.ts

@@ -0,0 +1,44 @@
+/** Operator-visible operations supported by the recipient protocol in this build. */
+export declare const FENCED_OPERATIONS: readonly ["stack.stop", "stack.resume-installed"];
+export type ElectionState = 'follower' | 'candidate' | 'leader';
+export interface ClusterStateInfo {
+    nodeId: string;
+    clusterId: string;
+    state: ElectionState;
+    /** Durable decimal epoch. Null until authority has been observed. */
+    term: string | null;
+    leaderId: string | null;
+    peers: number;
+    uptime: number;
+    coordination: 'postgres-lease';
+    authority: 'confirmed' | 'unavailable' | 'expired' | 'stopped' | 'contended';
+    reason: string | null;
+    leaseExpiresAt: string | null;
+    leaseRemainingMs: number;
+    /** A leadership observation does not fence an external side effect. */
+    effectFencing: 'recipient-required';
+    fencedOperations: typeof FENCED_OPERATIONS;
+}
+export type ClusterParticipation = (ClusterStateInfo & {
+    participant: 'controller';
+    enabled: true;
+}) | {
+    participant: 'worker';
+    enabled: true;
+    clusterId: string;
+    nodeId: string;
+    coordination: 'postgres-lease';
+    fencedOperations: typeof FENCED_OPERATIONS;
+} | {
+    participant: 'standalone';
+    enabled: false;
+};
+/** Older controllers reported only a subset of the election fields and sometimes a numeric term. */
+export type NodeClusterObservation = Partial<Omit<ClusterStateInfo, 'state' | 'term' | 'fencedOperations'>> & {
+    participant?: string;
+    enabled?: boolean;
+    state?: string;
+    term?: string | number | null;
+    fencedOperations?: readonly string[];
+};
+//# sourceMappingURL=cluster.d.ts.map

package/dist/shared/dto/cluster.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cluster.d.ts","sourceRoot":"","sources":["../../../src/shared/dto/cluster.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,eAAO,MAAM,iBAAiB,mDAAmE,CAAC;AAElG,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAC;AAChE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,CAAC;IACrB,qEAAqE;IACrE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,gBAAgB,CAAC;IAC/B,SAAS,EAAE,WAAW,GAAG,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;IAC7E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,aAAa,EAAE,oBAAoB,CAAC;IACpC,gBAAgB,EAAE,OAAO,iBAAiB,CAAC;CAC5C;AAED,MAAM,MAAM,oBAAoB,GAC5B,CAAC,gBAAgB,GAAG;IAAE,WAAW,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC,GACjE;IAAE,WAAW,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,gBAAgB,CAAC;IAAC,gBAAgB,EAAE,OAAO,iBAAiB,CAAA;CAAE,GACvJ;IAAE,WAAW,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,KAAK,CAAA;CAAE,CAAC;AAElD,oGAAoG;AACpG,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,CAAC,CAAC,GAAG;IAC5G,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,CAAC"}

package/dist/shared/dto/cluster.js

@@ -0,0 +1,3 @@
+/** Operator-visible operations supported by the recipient protocol in this build. */
+export const FENCED_OPERATIONS = Object.freeze(['stack.stop', 'stack.resume-installed']);
+//# sourceMappingURL=cluster.js.map

package/dist/shared/dto/cluster.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cluster.js","sourceRoot":"","sources":["../../../src/shared/dto/cluster.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,wBAAwB,CAAU,CAAC,CAAC"}