ovtools 0.0.0-stage → 1.0.0

package/dist/api/checks.js

@@ -0,0 +1,173 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCheck = runCheck;
+const client_1 = require("../ssh/client");
+const hostkeys_1 = require("./hostkeys");
+const nodes_1 = require("./nodes");
+function authFrom(body, side) {
+    const method = String((side === 'old' ? body.oldAuth : body.newAuth) || 'password') === 'key' ? 'key' : 'password';
+    return {
+        method,
+        password: side === 'old' ? body.oldPassword : body.newPassword,
+        keyPath: side === 'old' ? body.oldKey : body.newKey,
+    };
+}
+async function gatherHost(ip, auth) {
+    const facts = {
+        ip,
+        reachable: false,
+        wallet: null,
+        role: null,
+        git: false,
+        toolsMissing: [],
+        freeGB: null,
+        node: null,
+        needsTrust: false,
+        hostkeyIssue: false,
+        fingerprint: null,
+    };
+    try {
+        const client = await (0, client_1.createSSHClient)({ host: ip, port: 22, username: 'root', auth });
+        facts.reachable = true;
+        const probe = await client.exec([
+            'echo "WALLET=$(cat /opt/octra/libv_litecore/.keys/validator/wallet.json 2>/dev/null | jq -r ".address // empty" 2>/dev/null || true)"',
+            'echo "ROLE=$(grep -m1 \'^OCTRA_OPERATOR_ROLE=\' /opt/octra/libv_litecore/.keys/validator/node.env 2>/dev/null | cut -d= -f2 || true)"',
+            'echo "GIT=$(test -d /opt/octra/libv_litecore/.git && echo yes || echo no)"',
+            'M=""; for t in curl jq rsync git tar systemd-run; do command -v "$t" >/dev/null 2>&1 || M="$M $t"; done; echo "TOOLS=${M# }"',
+            'echo "FREE=$(df -BG --output=avail /var/lib/octra 2>/dev/null | tail -1 | tr -dc "0-9" || true)"',
+        ].join('; '), { timeout: 120000 });
+        for (const line of probe.stdout.split('\n')) {
+            if (line.startsWith('WALLET='))
+                facts.wallet = line.slice(7).trim() || null;
+            else if (line.startsWith('ROLE='))
+                facts.role = line.slice(5).trim() || null;
+            else if (line.startsWith('GIT='))
+                facts.git = line.slice(4).trim() === 'yes';
+            else if (line.startsWith('TOOLS='))
+                facts.toolsMissing = line.slice(6).trim().split(/\s+/).filter(Boolean);
+            else if (line.startsWith('FREE=')) {
+                const raw = line.slice(5).trim();
+                const n = Number(raw);
+                facts.freeGB = raw !== '' && Number.isFinite(n) ? n : null;
+            }
+        }
+        await client.disconnect();
+    }
+    catch (err) {
+        facts.error = err.message;
+        facts.hostkeyIssue = (0, hostkeys_1.isHostKeyError)(facts.error);
+        facts.needsTrust = facts.hostkeyIssue;
+        facts.fingerprint = err?.hostFingerprint || null;
+    }
+    try {
+        facts.node = await (0, nodes_1.probeNode)(ip);
+    }
+    catch {
+        facts.node = null;
+    }
+    return facts;
+}
+function row(items, id, label, status, detail) {
+    items.push({ id, label, status, detail });
+}
+async function runCheck(body) {
+    const started = Date.now();
+    const program = String(body.program || 'migrate').toLowerCase();
+    const oldIp = String(body.oldIp || '').trim();
+    const newIp = String(body.newIp || '').trim();
+    const oldAuth = authFrom(body, 'old');
+    const newAuth = authFrom(body, 'new');
+    const items = [];
+    const needsTrust = [];
+    if (program === 'migrate') {
+        if (!oldIp || !newIp)
+            throw new Error('both source and target addresses are required');
+        if (oldIp === newIp)
+            throw new Error('source and target must differ');
+    }
+    else if (!newIp) {
+        throw new Error('the node address is required');
+    }
+    const [initialOldFacts, initialNewFacts] = await Promise.all([
+        program === 'migrate' ? gatherHost(oldIp, oldAuth) : Promise.resolve(null),
+        gatherHost(newIp, newAuth),
+    ]);
+    let oldFacts = initialOldFacts;
+    let newFacts = initialNewFacts;
+    // A reinstalled VPS legitimately presents a new host key. Check accepts the
+    // key this handshake just saw and re-probes, so the operator is never blocked
+    // on a button; the button stays as the fallback when no key could be read.
+    const autoTrust = async (facts, auth, role) => {
+        if (!facts || !facts.hostkeyIssue)
+            return facts;
+        const trust = await (0, hostkeys_1.trustHostKey)(facts.ip, auth);
+        if (!trust.ok) {
+            if (!needsTrust.includes(facts.ip))
+                needsTrust.push(facts.ip);
+            row(items, `hostkey-${role}`, `${role === 'node' ? 'Node' : role[0].toUpperCase() + role.slice(1)} host key changed`, 'fail', `server presents ${facts.fingerprint || 'a new key'} - auto-trust failed (${trust.detail}): press 'Trust host key for ${facts.ip}'`);
+            return facts;
+        }
+        row(items, `hostkey-${role}`, `${role === 'node' ? 'Node' : role[0].toUpperCase() + role.slice(1)} host key auto-trusted`, 'warn', `reinstalled VPS - new key accepted automatically: ${trust.fingerprint || facts.fingerprint || '?'} (${trust.detail})`);
+        return gatherHost(facts.ip, auth);
+    };
+    oldFacts = await autoTrust(oldFacts, oldAuth, 'source');
+    newFacts = await autoTrust(newFacts, newAuth, program === 'migrate' ? 'target' : 'node');
+    if (!newFacts)
+        throw new Error('the node did not answer the SSH probe');
+    const addFacts = (facts, role) => {
+        const tag = role === 'node' ? 'node' : role;
+        row(items, `${role}-reach`, `${tag} reachable (${facts.ip})`, facts.reachable ? 'ok' : 'fail', facts.reachable ? 'SSH login works' : (facts.error || 'no SSH connection'));
+        if (facts.needsTrust && !needsTrust.includes(facts.ip))
+            needsTrust.push(facts.ip);
+        if (!facts.reachable)
+            return;
+        row(items, `${role}-tools`, `${tag} host tools`, facts.toolsMissing.length ? 'warn' : 'ok', facts.toolsMissing.length ? `missing: ${facts.toolsMissing.join(', ')} (the deploy installs them)` : 'curl, jq, rsync, git, tar, systemd-run present');
+        row(items, `${role}-wallet`, `${tag} wallet identity`, facts.wallet ? 'ok' : (role === 'source' ? 'fail' : 'ok'), facts.wallet || (role === 'source' ? 'wallet.json not found - this host is not the running node' : 'no wallet yet (fresh host)'));
+        row(items, `${role}-disk`, `${tag} data volume space`, facts.freeGB === null ? 'warn' : facts.freeGB >= 60 ? 'ok' : 'fail', facts.freeGB === null ? 'data volume not prepared yet - prep runs pre-run.sh' : `${facts.freeGB} GB free on /var/lib/octra`);
+        if (facts.node && facts.node.reachable) {
+            const validator = facts.node.validator || {};
+            const active = Boolean(validator.active);
+            row(items, `${role}-api`, `${tag} node API`, 'ok', `reachable, role=${active ? 'validator' : (validator.state || 'observer')}`);
+        }
+        else {
+            row(items, `${role}-api`, `${tag} node API`, facts.wallet ? 'warn' : 'ok', facts.wallet ? 'the node does not answer :8080/status' : 'no node yet (fresh host)');
+        }
+    };
+    if (oldFacts) {
+        addFacts(oldFacts, 'source');
+        if (oldFacts.node && oldFacts.node.reachable) {
+            const active = Boolean(oldFacts.node.validator?.active);
+            row(items, 'source-active', 'source is the active validator', active ? 'ok' : 'warn', active ? 'validator is active' : 'the source does not report validator_active=true');
+        }
+    }
+    addFacts(newFacts, program === 'migrate' ? 'target' : 'node');
+    if (program === 'migrate') {
+        const targetHasIdentity = Boolean(newFacts.wallet);
+        row(items, 'target-fresh', 'target has no competing identity', targetHasIdentity ? 'warn' : 'ok', targetHasIdentity ? 'the target already has a wallet - prep will refuse unless it is this migration copy' : 'fresh target');
+    }
+    if (program === 'deploy' && newFacts.wallet) {
+        row(items, 'target-fresh', 'target is fresh', 'fail', 'this host already has a node identity (wallet.json) - use Migrate, or wipe the volume explicitly');
+    }
+    const counts = { ok: 0, warn: 0, fail: 0 };
+    for (const item of items)
+        counts[item.status]++;
+    const ready = counts.fail === 0;
+    const readyManage = program !== 'manage' || (newFacts.reachable && Boolean(newFacts.node?.validator?.active));
+    const readyUpgrade = program !== 'manage' || (newFacts.reachable && Boolean(newFacts.wallet) && newFacts.git);
+    const result = {
+        ready,
+        readyManage,
+        readyUpgrade,
+        program,
+        sourceIp: oldIp || undefined,
+        targetIp: newIp,
+        items,
+        counts,
+        durationMs: Date.now() - started,
+        checkedAt: Date.now(),
+        needsTrust: needsTrust.length ? needsTrust : undefined,
+    };
+    const key = program === 'migrate' ? `${oldIp}|${newIp}` : `${program}|${newIp}`;
+    return { key, result };
+}
+//# sourceMappingURL=checks.js.map

package/dist/api/checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../src/api/checks.ts"],"names":[],"mappings":";;AAsFA,4BAwGC;AA7LD,0CAAgD;AAChD,yCAA0D;AAC1D,mCAAoC;AAiBpC,SAAS,QAAQ,CAAC,IAAS,EAAE,IAAmB;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IACnH,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW;QAC9D,OAAO,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM;KACpD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,EAAU,EAAE,IAAc;IAClD,MAAM,KAAK,GAAc;QACvB,EAAE;QACF,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,KAAK;QACV,YAAY,EAAE,EAAE;QAChB,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,KAAK;QACnB,WAAW,EAAE,IAAI;KAClB,CAAC;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAe,EAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QACvB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAC7B;YACE,uIAAuI;YACvI,uIAAuI;YACvI,4EAA4E;YAC5E,8HAA8H;YAC9H,kGAAkG;SACnG,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,EAAE,OAAO,EAAE,MAAM,EAAE,CACpB,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;iBACvE,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;iBACxE,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC;iBACxE,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;iBACtG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACjC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;gBACtB,KAAK,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,KAAK,GAAI,GAAa,CAAC,OAAO,CAAC;QACrC,KAAK,CAAC,YAAY,GAAG,IAAA,yBAAc,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC;QACtC,KAAK,CAAC,WAAW,GAAI,GAAW,EAAE,eAAe,IAAI,IAAI,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC;QACH,KAAK,CAAC,IAAI,GAAG,MAAM,IAAA,iBAAS,EAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IACpB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,GAAG,CAAC,KAAiB,EAAE,EAAU,EAAE,KAAa,EAAE,MAA0B,EAAE,MAAe;IACpG,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAC5C,CAAC;AAEM,KAAK,UAAU,QAAQ,CAAC,IAAS;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAChE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACvF,IAAI,KAAK,KAAK,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACxE,CAAC;SAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3D,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1E,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC;KAC3B,CAAC,CAAC;IACH,IAAI,QAAQ,GAAqB,eAAe,CAAC;IACjD,IAAI,QAAQ,GAAqB,eAAe,CAAC;IAEjD,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,MAAM,SAAS,GAAG,KAAK,EACrB,KAAuB,EACvB,IAAc,EACd,IAAkC,EACP,EAAE;QAC7B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,IAAA,uBAAY,EAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,KAAK,EAAE,WAAW,IAAI,EAAE,EAAE,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,EAAE,MAAM,EAC1H,mBAAmB,KAAK,CAAC,WAAW,IAAI,WAAW,yBAAyB,KAAK,CAAC,MAAM,gCAAgC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;YACvI,OAAO,KAAK,CAAC;QACf,CAAC;QACD,GAAG,CAAC,KAAK,EAAE,WAAW,IAAI,EAAE,EAAE,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,wBAAwB,EAAE,MAAM,EAC/H,qDAAqD,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,IAAI,GAAG,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1H,OAAO,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC;IAEF,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxD,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACzF,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAExE,MAAM,QAAQ,GAAG,CAAC,KAAgB,EAAE,IAAkC,EAAE,EAAE;QACxE,MAAM,GAAG,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5C,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,EAAE,GAAG,GAAG,eAAe,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,mBAAmB,CAAC,CAAC,CAAC;QAC3K,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,KAAK,CAAC,SAAS;YAAE,OAAO;QAC7B,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,EAAE,GAAG,GAAG,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC;QACnP,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,SAAS,EAAE,GAAG,GAAG,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,2DAA2D,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC;QACpP,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,OAAO,EAAE,GAAG,GAAG,oBAAoB,EAAE,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,4BAA4B,CAAC,CAAC;QACzP,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACzC,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,MAAM,EAAE,GAAG,GAAG,WAAW,EAAE,IAAI,EAAE,mBAAmB,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAClI,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,MAAM,EAAE,GAAG,GAAG,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;QAClK,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC7B,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACxD,GAAG,CAAC,KAAK,EAAE,eAAe,EAAE,gCAAgC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC;QAC7K,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,QAAQ,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAE9D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,iBAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnD,GAAG,CAAC,KAAK,EAAE,cAAc,EAAE,kCAAkC,EAAE,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,qFAAqF,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAChO,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5C,GAAG,CAAC,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,EAAE,kGAAkG,CAAC,CAAC;IAC5J,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;IAChC,MAAM,WAAW,GAAG,OAAO,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9G,MAAM,YAAY,GAAG,OAAO,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC;IAE9G,MAAM,MAAM,GAAgB;QAC1B,KAAK;QACL,WAAW;QACX,YAAY;QACZ,OAAO;QACP,QAAQ,EAAE,KAAK,IAAI,SAAS;QAC5B,QAAQ,EAAE,KAAK;QACf,KAAK;QACL,MAAM;QACN,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;QAChC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;KACvD,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,KAAK,EAAE,CAAC;IAChF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC"}

package/dist/api/hostkeys.d.ts

@@ -0,0 +1,10 @@
+import type { HostAuth } from '../types';
+export declare function loadHostkeys(): Promise<Record<string, string>>;
+export declare function trustHostKey(ip: string, auth: HostAuth): Promise<{
+    ok: boolean;
+    detail: string;
+    fingerprint?: string;
+}>;
+export declare function removeHostKey(ip: string): Promise<void>;
+export declare function isHostKeyError(message: string): boolean;
+//# sourceMappingURL=hostkeys.d.ts.map

package/dist/api/hostkeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostkeys.d.ts","sourceRoot":"","sources":["../../src/api/hostkeys.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAEpE;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAkC7H;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI7D;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvD"}

package/dist/api/hostkeys.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadHostkeys = loadHostkeys;
+exports.trustHostKey = trustHostKey;
+exports.removeHostKey = removeHostKey;
+exports.isHostKeyError = isHostKeyError;
+const constants_1 = require("../constants");
+const helpers_1 = require("../utils/helpers");
+const client_1 = require("../ssh/client");
+async function loadHostkeys() {
+    return (await (0, helpers_1.readJSON)(constants_1.HOST_KEYS_FILE)) || {};
+}
+async function trustHostKey(ip, auth) {
+    let fingerprint = '';
+    try {
+        const client = await (0, client_1.createSSHClient)({
+            host: ip,
+            port: 22,
+            username: 'root',
+            auth,
+            ignorePinnedHostKey: true,
+        });
+        fingerprint = client.hostFingerprint || '';
+        await client.disconnect();
+        if (!fingerprint)
+            return { ok: false, detail: 'the host did not present a key' };
+        const map = await loadHostkeys();
+        map[ip] = fingerprint;
+        await (0, helpers_1.writeJSON)(constants_1.HOST_KEYS_FILE, map);
+        return { ok: true, detail: `host key for ${ip} pinned`, fingerprint };
+    }
+    catch (err) {
+        // The handshake (and therefore the host key) happens before password/key
+        // auth. A wrong password still gives us the presented key, so pin it: the
+        // credential error is reported separately and must not block a re-check.
+        fingerprint = err?.hostFingerprint || fingerprint;
+        if (fingerprint) {
+            const map = await loadHostkeys();
+            map[ip] = fingerprint;
+            await (0, helpers_1.writeJSON)(constants_1.HOST_KEYS_FILE, map);
+            return {
+                ok: true,
+                detail: `host key accepted but the login still fails: ${err.message}`,
+                fingerprint,
+            };
+        }
+        return { ok: false, detail: err.message };
+    }
+}
+async function removeHostKey(ip) {
+    const map = await loadHostkeys();
+    delete map[ip];
+    await (0, helpers_1.writeJSON)(constants_1.HOST_KEYS_FILE, map);
+}
+function isHostKeyError(message) {
+    return /host denied|verification failed|host key|fingerprint/i.test(message);
+}
+//# sourceMappingURL=hostkeys.js.map

package/dist/api/hostkeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostkeys.js","sourceRoot":"","sources":["../../src/api/hostkeys.ts"],"names":[],"mappings":";;AAKA,oCAEC;AAED,oCAkCC;AAED,sCAIC;AAED,wCAEC;AArDD,4CAA8C;AAC9C,8CAAuD;AACvD,0CAAgD;AAGzC,KAAK,UAAU,YAAY;IAChC,OAAO,CAAC,MAAM,IAAA,kBAAQ,EAAyB,0BAAc,CAAC,CAAC,IAAI,EAAE,CAAC;AACxE,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,EAAU,EAAE,IAAc;IAC3D,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAe,EAAC;YACnC,IAAI,EAAE,EAAE;YACR,IAAI,EAAE,EAAE;YACR,QAAQ,EAAE,MAAM;YAChB,IAAI;YACJ,mBAAmB,EAAE,IAAI;SAC1B,CAAC,CAAC;QACH,WAAW,GAAG,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;QAC3C,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;QACjF,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;QACjC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC;QACtB,MAAM,IAAA,mBAAS,EAAC,0BAAc,EAAE,GAAG,CAAC,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IACxE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,WAAW,GAAI,GAAW,EAAE,eAAe,IAAI,WAAW,CAAC;QAC3D,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;YACjC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC;YACtB,MAAM,IAAA,mBAAS,EAAC,0BAAc,EAAE,GAAG,CAAC,CAAC;YACrC,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,gDAAiD,GAAa,CAAC,OAAO,EAAE;gBAChF,WAAW;aACZ,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,aAAa,CAAC,EAAU;IAC5C,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;IACjC,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC;IACf,MAAM,IAAA,mBAAS,EAAC,0BAAc,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,SAAgB,cAAc,CAAC,OAAe;IAC5C,OAAO,uDAAuD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/E,CAAC"}

package/dist/api/jobs.d.ts

@@ -0,0 +1,33 @@
+import type { JobRequest, JobState, LogEntry, Settings } from '../types';
+import { Logger } from '../utils/helpers';
+export declare function normalizeSettings(raw: Partial<Settings> | null | undefined): Settings;
+export declare function loadSettings(): Promise<Settings>;
+export declare class JobManager {
+    private state;
+    private logger;
+    private listeners;
+    private orchestrator;
+    private lastLogAt;
+    private activationTimer;
+    private exitTimer;
+    subscribe(listener: (entry: LogEntry) => void): () => void;
+    snapshot(): JobState;
+    lines(since: number): LogEntry[];
+    getLogger(): Logger | null;
+    start(request: JobRequest): Promise<JobState>;
+    private execute;
+    cancel(): boolean;
+    dispose(): void;
+    private auth;
+    private validateAuth;
+    private validateCertDir;
+    private rawBond;
+    private onEntry;
+    private startActivationWatch;
+    private startExitWatch;
+    private clearActivation;
+    private clearExit;
+    private clearWatchers;
+}
+export declare const jobs: JobManager;
+//# sourceMappingURL=jobs.d.ts.map

package/dist/api/jobs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jobs.d.ts","sourceRoot":"","sources":["../../src/api/jobs.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACzE,OAAO,EAAgB,MAAM,EAAY,MAAM,kBAAkB,CAAC;AAelE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,QAAQ,CAYrF;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC,CAMtD;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,KAAK,CAIX;IACF,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,SAAS,CAAwC;IACzD,OAAO,CAAC,YAAY,CAA8E;IAClG,OAAO,CAAC,SAAS,CAAc;IAC/B,OAAO,CAAC,eAAe,CAA+B;IACtD,OAAO,CAAC,SAAS,CAA+B;IAEhD,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,GAAG,MAAM,IAAI;IAK1D,QAAQ,IAAI,QAAQ;IAWpB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,EAAE;IAIhC,SAAS,IAAI,MAAM,GAAG,IAAI;IAIpB,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC;YAwJrC,OAAO;IAyCrB,MAAM,IAAI,OAAO;IAOjB,OAAO,IAAI,IAAI;IAIf,OAAO,CAAC,IAAI;YASE,YAAY;YAaZ,eAAe;IAU7B,OAAO,CAAC,OAAO;IAOf,OAAO,CAAC,OAAO;IA6Bf,OAAO,CAAC,oBAAoB;IAiC5B,OAAO,CAAC,cAAc;IA8CtB,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,SAAS;IAOjB,OAAO,CAAC,aAAa;CAQtB;AAED,eAAO,MAAM,IAAI,YAAmB,CAAC"}