@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/dist/modules/agent-instructions/index.js

@@ -0,0 +1,4 @@
+export { composeAgentInstructions, prefixToolDescription, PLATFORM_HEADER, TOOL_PREFIX_LINE, PREAMBLE_CAP, TOOL_PREFIX_CAP, PREAMBLE_FILE, PREFIXED_TOOLS, PREAMBLE_TRUNCATION_MARKER, } from './compose.js';
+export { readAgentPreamble } from './read-preamble.js';
+export { createAgentInstructionsRoutes } from './agent-instructions.routes.js';
+//# sourceMappingURL=index.js.map

package/dist/modules/agent-instructions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/agent-instructions/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,aAAa,EACb,cAAc,EACd,0BAA0B,GAE3B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,iBAAiB,EAAoD,MAAM,oBAAoB,CAAC;AACzG,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/modules/agent-instructions/read-preamble.d.ts

@@ -0,0 +1,37 @@
+import { type IFsProbe } from '../../shared/fs.contract.js';
+import type { WorkspaceService } from '../workspace/workspace.service.js';
+/** The one reader both the hosted proxy and the agent-facing route call. */
+export type AgentPreambleReader = () => Promise<string | null>;
+/** The two workspace operations the reader needs, so a test can stand in for the service. */
+export type PreambleWorkspace = Pick<WorkspaceService, 'getOrCreateForBranch' | 'getWorkspacePath'>;
+/**
+ * The raw content of `mcp-description.md` on the default branch, read with
+ * PLATFORM privileges: the root is default-deny for reads, and the preamble is
+ * a broadcast the admin writes for every connected agent, so it is never read
+ * as the caller. `null` only for an ABSENT file (the disk's own definition of
+ * absence); any other failure throws, so a disk fault never masquerades as
+ * "no preamble". The workspace is
+ * created first when it does not exist yet, exactly as the plugin archive
+ * route does.
+ *
+ * SYMLINKS ARE REFUSED, the same rule the plugin archive applies. This file is
+ * read as the platform and sent to every agent, so a link at this name (they
+ * only arrive by direct git push; the platform's own write paths never create
+ * one) would broadcast whatever the server process can read. `lstat` rejects a
+ * link or any non-regular entry before the open, and the open itself uses
+ * `O_NOFOLLOW` and reads through the handle it checked, so the bytes sent come
+ * from the inode the check passed rather than from a path swapped in between.
+ * The rule covers the WHOLE path below the workspace, not only the final
+ * component: the repository folder resolved through a link would put a
+ * regular file at the name with the link a level up, so the path's realpath
+ * must equal the spelled path under the workspace's own — identity, as the
+ * archive demands it, not mere containment. (The workspace root may itself
+ * sit behind a link — a mounted volume — which is the operator's, not the
+ * repository's, and is allowed.)
+ *
+ * Inside the workspace the repository is the `<kbDirName>/` folder, so the
+ * path is `<kbDirName>/mcp-description.md`, the same shape `SkillService` and
+ * the archive route use.
+ */
+export declare function readAgentPreamble(workspace: PreambleWorkspace, kbDirName: string, disk: IFsProbe): Promise<string | null>;
+//# sourceMappingURL=read-preamble.d.ts.map

package/dist/modules/agent-instructions/read-preamble.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-preamble.d.ts","sourceRoot":"","sources":["../../../src/modules/agent-instructions/read-preamble.ts"],"names":[],"mappings":"AAIA,OAAO,EAAa,KAAK,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAG1E,4EAA4E;AAC5E,MAAM,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAE/D,6FAA6F;AAC7F,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,kBAAkB,CAAC,CAAC;AAEpG;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,iBAAiB,EAC5B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiCxB"}

package/dist/modules/agent-instructions/read-preamble.js

@@ -0,0 +1,81 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
+import { workspaceIdForBranch } from '../../shared/workspace-id.js';
+import { isAbsence } from '../../shared/fs.contract.js';
+import { PREAMBLE_FILE } from './compose.js';
+/**
+ * The raw content of `mcp-description.md` on the default branch, read with
+ * PLATFORM privileges: the root is default-deny for reads, and the preamble is
+ * a broadcast the admin writes for every connected agent, so it is never read
+ * as the caller. `null` only for an ABSENT file (the disk's own definition of
+ * absence); any other failure throws, so a disk fault never masquerades as
+ * "no preamble". The workspace is
+ * created first when it does not exist yet, exactly as the plugin archive
+ * route does.
+ *
+ * SYMLINKS ARE REFUSED, the same rule the plugin archive applies. This file is
+ * read as the platform and sent to every agent, so a link at this name (they
+ * only arrive by direct git push; the platform's own write paths never create
+ * one) would broadcast whatever the server process can read. `lstat` rejects a
+ * link or any non-regular entry before the open, and the open itself uses
+ * `O_NOFOLLOW` and reads through the handle it checked, so the bytes sent come
+ * from the inode the check passed rather than from a path swapped in between.
+ * The rule covers the WHOLE path below the workspace, not only the final
+ * component: the repository folder resolved through a link would put a
+ * regular file at the name with the link a level up, so the path's realpath
+ * must equal the spelled path under the workspace's own — identity, as the
+ * archive demands it, not mere containment. (The workspace root may itself
+ * sit behind a link — a mounted volume — which is the operator's, not the
+ * repository's, and is allowed.)
+ *
+ * Inside the workspace the repository is the `<kbDirName>/` folder, so the
+ * path is `<kbDirName>/mcp-description.md`, the same shape `SkillService` and
+ * the archive route use.
+ */
+export async function readAgentPreamble(workspace, kbDirName, disk) {
+    await workspace.getOrCreateForBranch(DEFAULT_BRANCH);
+    const wsDir = await workspace.getWorkspacePath(workspaceIdForBranch(DEFAULT_BRANCH));
+    const abs = path.join(wsDir, kbDirName, PREAMBLE_FILE);
+    const found = await disk.lstatOrNull(abs);
+    if (found === null)
+        return null;
+    if (!found.isFile())
+        throw notRegular(found.isSymbolicLink() ? 'symlink' : found.isDirectory() ? 'directory' : 'special file');
+    const [realWorkspace, realFile] = await Promise.all([
+        fs.realpath(wsDir),
+        fs.realpath(abs).catch((err) => {
+            if (isAbsence(err))
+                return null; // deleted since the lstat: an absence, not a failure
+            throw err;
+        }),
+    ]);
+    if (realFile === null)
+        return null;
+    if (realFile !== path.join(realWorkspace, kbDirName, PREAMBLE_FILE))
+        throw notRegular('path through a symlink');
+    const handle = await fs
+        .open(abs, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0))
+        .catch((err) => {
+        if (isAbsence(err))
+            return null; // deleted since the lstat: an absence, not a failure
+        if (err.code === 'ELOOP')
+            throw notRegular('symlink'); // O_NOFOLLOW's spelling of "the final component is a link"
+        throw err;
+    });
+    if (handle === null)
+        return null;
+    try {
+        if (!(await handle.stat()).isFile())
+            throw notRegular('special file');
+        return await handle.readFile('utf8');
+    }
+    finally {
+        await handle.close();
+    }
+}
+function notRegular(kind) {
+    return new Error(`${PREAMBLE_FILE} on branch "${DEFAULT_BRANCH}" is a ${kind}, not a regular file at its own place; ` +
+        'refusing to read it. Replace it with a plain markdown file in the repository folder.');
+}
+//# sourceMappingURL=read-preamble.js.map

package/dist/modules/agent-instructions/read-preamble.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-preamble.js","sourceRoot":"","sources":["../../../src/modules/agent-instructions/read-preamble.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,SAAS,EAAiB,MAAM,6BAA6B,CAAC;AAEvE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAQ7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAA4B,EAC5B,SAAiB,EACjB,IAAc;IAEd,MAAM,SAAS,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IAEvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;QAAE,MAAM,UAAU,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAE/H,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClD,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAClB,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtC,IAAI,SAAS,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,CAAC,qDAAqD;YACtF,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC;KACH,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,aAAa,CAAC;QAAE,MAAM,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAEhH,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;SACjE,KAAK,CAAC,CAAC,GAA0B,EAAE,EAAE;QACpC,IAAI,SAAS,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,qDAAqD;QACtF,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;YAAE,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,2DAA2D;QAClH,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;IACL,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAAE,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC;QACtE,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,KAAK,CACd,GAAG,aAAa,eAAe,cAAc,UAAU,IAAI,yCAAyC;QAClG,sFAAsF,CACzF,CAAC;AACJ,CAAC"}

package/dist/modules/auth/account-erasure.service.d.ts

@@ -1,4 +1,9 @@
 import type { Database } from '../database/connection.js';
+import type { IReviewWorkflowService } from '../workflow/review-workflow/review-workflow.interface.js';
+/** The anonymised id of one erasure — how a commit or log may name the account. */
+export declare function erasedAccountId(erasureId: string): string;
+/** The placeholder email anonymised audit rows carry for one erasure. */
+export declare function erasedEmailFor(erasureId: string): string;
 /** A user row as the admin surface needs it (no avatar, no timestamps churn). */
 export interface AdminUserView {
     id: string;
@@ -67,14 +72,35 @@ export interface IErasureParticipant {
  */
 export interface IAccountErasureService {
     listUsers(): Promise<AdminUserView[]>;
-    /** Erase `userId`. Returns false when no such user exists. */
-    eraseUser(userId: string): Promise<boolean>;
+    /**
+     * Erase `userId`. Returns false when no such user exists. `erasureId` fixes
+     * the anonymised identity (`deleted-<erasureId>@erased.invalid`) so a caller
+     * can name the erased account elsewhere — e.g. a commit message — without
+     * the email; random when omitted.
+     */
+    eraseUser(userId: string, opts?: {
+        erasureId?: string;
+    }): Promise<boolean>;
 }
 export declare class AccountErasureService implements IAccountErasureService {
     private readonly db;
+    /**
+     * The review workflow owns the approvals and the lock their writers take,
+     * so it does the rewrite (see `IReviewWorkflowService.eraseApprover`);
+     * this module only decides WHEN, inside its own transaction.
+     */
+    private readonly reviewWorkflow;
     private readonly participants;
-    constructor(db: Database, participants?: IErasureParticipant[]);
+    constructor(db: Database, 
+    /**
+     * The review workflow owns the approvals and the lock their writers take,
+     * so it does the rewrite (see `IReviewWorkflowService.eraseApprover`);
+     * this module only decides WHEN, inside its own transaction.
+     */
+    reviewWorkflow: Pick<IReviewWorkflowService, 'eraseApprover'>, participants?: IErasureParticipant[]);
     listUsers(): Promise<AdminUserView[]>;
-    eraseUser(userId: string): Promise<boolean>;
+    eraseUser(userId: string, opts?: {
+        erasureId?: string;
+    }): Promise<boolean>;
 }
 //# sourceMappingURL=account-erasure.service.d.ts.map

package/dist/modules/auth/account-erasure.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-erasure.service.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account-erasure.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAc1D,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9E,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,aAAa,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;CAC7F;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACtC,8DAA8D;IAC9D,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7C;AAED,qBAAa,qBAAsB,YAAW,sBAAsB;IAEhE,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,YAAY;gBADZ,EAAE,EAAE,QAAQ,EACZ,YAAY,GAAE,mBAAmB,EAAO;IAGrD,SAAS,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAQrC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CA4ElD"}
+{"version":3,"file":"account-erasure.service.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account-erasure.service.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAevG,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,yEAAyE;AACzE,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9E,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,aAAa,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;CAC7F;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACtC;;;;;OAKG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5E;AAED,qBAAa,qBAAsB,YAAW,sBAAsB;IAEhE,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAPZ,EAAE,EAAE,QAAQ;IAC7B;;;;OAIG;IACc,cAAc,EAAE,IAAI,CAAC,sBAAsB,EAAE,eAAe,CAAC,EAC7D,YAAY,GAAE,mBAAmB,EAAO;IAGrD,SAAS,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAQrC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,OAAO,CAAC;CA6JrF"}

package/dist/modules/auth/account-erasure.service.js

@@ -1,11 +1,29 @@
 import { randomUUID } from 'node:crypto';
-import { eq } from 'drizzle-orm';
-import { changeRequests, externalApiKeys, fileLocks, oauthAuthCodes, oauthTokens, pendingCommits, prComments, prFileApprovals, prMergeLog, users, } from '../database/schema.js';
+import { logger } from '../../shared/logging.js';
+const log = logger('account-erasure');
+import { and, eq, notExists } from 'drizzle-orm';
+import { changeRequests, externalApiKeys, fileLocks, oauthAuthCodes, oauthTokens, pendingCommits, pluginJoinRequests, prComments, prFileApprovals, prMergeLog, users, } from '../database/schema.js';
+/** The anonymised id of one erasure — how a commit or log may name the account. */
+export function erasedAccountId(erasureId) {
+    return `deleted-${erasureId}`;
+}
+/** The placeholder email anonymised audit rows carry for one erasure. */
+export function erasedEmailFor(erasureId) {
+    return `${erasedAccountId(erasureId)}@erased.invalid`;
+}
 export class AccountErasureService {
     db;
+    reviewWorkflow;
     participants;
-    constructor(db, participants = []) {
+    constructor(db, 
+    /**
+     * The review workflow owns the approvals and the lock their writers take,
+     * so it does the rewrite (see `IReviewWorkflowService.eraseApprover`);
+     * this module only decides WHEN, inside its own transaction.
+     */
+    reviewWorkflow, participants = []) {
         this.db = db;
+        this.reviewWorkflow = reviewWorkflow;
         this.participants = participants;
     }
     async listUsers() {
@@ -15,14 +33,14 @@ export class AccountErasureService {
             .orderBy(users.email);
         return rows.map((r) => ({ ...r, createdAt: r.createdAt.getTime() }));
     }
-    async eraseUser(userId) {
+    async eraseUser(userId, opts = {}) {
         const [user] = await this.db.select().from(users).where(eq(users.id, userId)).limit(1);
         if (!user)
             return false;
         const target = {
             userId,
             email: user.email.toLowerCase(),
-            erasedEmail: `deleted-${randomUUID()}@erased.invalid`,
+            erasedEmail: erasedEmailFor(opts.erasureId ?? randomUUID()),
             erasedName: 'Deleted user',
         };
         // Participant pre-passes (e.g. chat threads + their Mastra memory) run
@@ -42,11 +60,41 @@ export class AccountErasureService {
             await tx.delete(oauthTokens).where(eq(oauthTokens.userId, userId));
             // Personal-data rows the core owns.
             await tx.delete(fileLocks).where(eq(fileLocks.holderUserId, userId));
-            // Audit rows: anonymize in place (no user FK on these; they key by email).
+            // Recorded plugin join requests. DELETED, not anonymised like the audit
+            // rows below: the row carries the person's address and name, it is not
+            // part of the review trail (the change request it opened is, and that
+            // is anonymised with the rest), and the table is unique on
+            // `(requester_email, plugin_key)` — so a row left behind would be
+            // INHERITED by a later account signing in with the same address, which
+            // would see a stranger's request as its own and be unable to make a new
+            // one. Sign-in is get-or-create by email, so that is not hypothetical.
+            //
+            // A JOB MAY BE MID-FLIGHT against one of these rows, and this statement
+            // says nothing to it — it is a background clone and push in another
+            // stack, possibly in another process, with no transaction to join. What
+            // stops it opening a change request in an erased person's name is the
+            // other side of the same delete: the job holds a fencing token from
+            // `plugin_join_requests.claim_token`, it re-beats that claim before the
+            // change request (see `PluginJoinRequestJobs.attempt`), and a beat
+            // against a row that no longer exists matches nothing. The job reads
+            // that as its claim being gone and stops without opening anything or
+            // writing anything back — so no row is resurrected here either.
             await tx
-                .update(prFileApprovals)
-                .set({ approverEmail: target.erasedEmail, approverName: target.erasedName })
-                .where(eq(prFileApprovals.approverEmail, target.email));
+                .delete(pluginJoinRequests)
+                .where(eq(pluginJoinRequests.requesterEmail, target.email));
+            // Audit rows: anonymize in place (no user FK on these; they key by email).
+            //
+            // The approvals belong to the review workflow, and so does the lock
+            // their writers take — one of those writers COPIES rows (a change request
+            // bringing itself up to date re-pins the approvals its merge did not
+            // disturb onto the new head), and a copy that read this person's row a
+            // moment before the rewrite would insert their real address back
+            // afterwards. The workflow takes that lock exclusively and rewrites the
+            // rows, in THIS transaction, so it stays held until the erasure commits.
+            await this.reviewWorkflow.eraseApprover(tx, target.email, {
+                email: target.erasedEmail,
+                name: target.erasedName,
+            });
             await tx
                 .update(prMergeLog)
                 .set({ triggeredByEmail: target.erasedEmail, triggeredByName: target.erasedName })
@@ -80,11 +128,49 @@ export class AccountErasureService {
             // Finally the user row (plus its ON DELETE CASCADE dependents).
             await tx.delete(users).where(eq(users.id, userId));
         });
+        // The two second passes below run BEFORE the callbacks, not after them: a
+        // callback talks to an external store and can reject, and the erasure it
+        // would abandon is already committed — `eraseUser` cannot be retried into
+        // it, so a pass sequenced behind a failing callback is a pass that may
+        // never run at all. Nothing here depends on a callback having succeeded.
+        // The second pass for the approvals, for the same kind of reason as the one
+        // the change requests already had.
+        //
+        // The lock above orders this erasure against every writer that takes it,
+        // and `approveFile` re-reads the account under that lock before it writes
+        // — so an approval in flight when this commits is refused rather than
+        // landing in the erased name. This is the belt to that pair of braces: it
+        // costs one statement, it is idempotent, and it means the guarantee does
+        // not rest on every future writer of this table remembering the lock. A
+        // row that got in anyway is rewritten here.
+        //
+        // Only while NO account answers to the address, exactly as below: someone
+        // who signs in again at it since the commit is a new person, and the
+        // approvals they make are their own.
+        await this.db
+            .update(prFileApprovals)
+            .set({ approverEmail: target.erasedEmail, approverName: target.erasedName })
+            .where(and(eq(prFileApprovals.approverEmail, target.email), notExists(this.db.select({ id: users.id }).from(users).where(eq(users.email, target.email)))));
+        // Once more, after the commit, for the one writer that can still be
+        // holding the person's name: a join-request job that confirmed its claim
+        // just before the delete above landed and opened its change request just
+        // after. The delete is what stops it — the next confirmation finds no
+        // row — but the open it was already inside lands in the real name. The
+        // update is idempotent, so a second pass costs one statement and closes
+        // that window for a request that landed by now; the job's own re-check
+        // of the requester right before it opens (see `PluginJoinRequestJobs`)
+        // narrows what can land after. Only while NO account answers to the
+        // address: one made again with the same email since the commit is a new
+        // person, and their requests are their own.
+        await this.db
+            .update(changeRequests)
+            .set({ authorEmail: target.erasedEmail, authorName: target.erasedName })
+            .where(and(eq(changeRequests.authorEmail, target.email), notExists(this.db.select({ id: users.id }).from(users).where(eq(users.email, target.email)))));
         // Post-commit callbacks (e.g. Mastra memory cleanup for chat threads
         // captured inside the transaction).
         for (const cb of postCommit)
             await cb();
-        console.log(`[account-erasure] erased user id=${userId}`);
+        log.info(`erased user id=${userId}`);
         return true;
     }
 }

package/dist/modules/auth/account-erasure.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-erasure.service.js","sourceRoot":"","sources":["../../../src/modules/auth/account-erasure.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EACL,cAAc,EACd,eAAe,EACf,SAAS,EACT,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,eAAe,EACf,UAAU,EACV,KAAK,GACN,MAAM,uBAAuB,CAAC;AA8E/B,MAAM,OAAO,qBAAqB;IAEb;IACA;IAFnB,YACmB,EAAY,EACZ,eAAsC,EAAE;QADxC,OAAE,GAAF,EAAE,CAAU;QACZ,iBAAY,GAAZ,YAAY,CAA4B;IACxD,CAAC;IAEJ,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;aAC1F,IAAI,CAAC,KAAK,CAAC;aACX,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAc;QAC5B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAExB,MAAM,MAAM,GAAkB;YAC5B,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;YAC/B,WAAW,EAAE,WAAW,UAAU,EAAE,iBAAiB;YACrD,UAAU,EAAE,cAAc;SAC3B,CAAC;QAEF,uEAAuE;QACvE,mEAAmE;QACnE,yEAAyE;QACzE,oDAAoD;QACpD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,MAAM;gBAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,UAAU,GAA+B,EAAE,CAAC;QAClD,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACrC,uEAAuE;YACvE,4DAA4D;YAC5D,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YAC3E,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACzE,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YAEnE,oCAAoC;YACpC,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;YAErE,2EAA2E;YAC3E,MAAM,EAAE;iBACL,MAAM,CAAC,eAAe,CAAC;iBACvB,GAAG,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;iBAC3E,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,MAAM,EAAE;iBACL,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,eAAe,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;iBACjF,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACxD,MAAM,EAAE;iBACL,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;iBACvE,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACnD,MAAM,EAAE;iBACL,MAAM,CAAC,cAAc,CAAC;iBACtB,GAAG,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;iBACvE,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACvD,yEAAyE;YACzE,yEAAyE;YACzE,oEAAoE;YACpE,MAAM,EAAE;iBACL,MAAM,CAAC,cAAc,CAAC;iBACtB,GAAG,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;iBACvE,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAEvD,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,uCAAuC;YACvC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClC,IAAI,CAAC,CAAC,CAAC,aAAa;oBAAE,SAAS;gBAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBAC7C,IAAI,EAAE;oBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9B,CAAC;YAED,gEAAgE;YAChE,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,qEAAqE;QACrE,oCAAoC;QACpC,KAAK,MAAM,EAAE,IAAI,UAAU;YAAE,MAAM,EAAE,EAAE,CAAC;QAExC,OAAO,CAAC,GAAG,CAAC,oCAAoC,MAAM,EAAE,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"account-erasure.service.js","sourceRoot":"","sources":["../../../src/modules/auth/account-erasure.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,EACL,cAAc,EACd,eAAe,EACf,SAAS,EACT,cAAc,EACd,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,UAAU,EACV,KAAK,GACN,MAAM,uBAAuB,CAAC;AAE/B,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,OAAO,WAAW,SAAS,EAAE,CAAC;AAChC,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,iBAAiB,CAAC;AACxD,CAAC;AAmFD,MAAM,OAAO,qBAAqB;IAEb;IAMA;IACA;IARnB,YACmB,EAAY;IAC7B;;;;OAIG;IACc,cAA6D,EAC7D,eAAsC,EAAE;QAPxC,OAAE,GAAF,EAAE,CAAU;QAMZ,mBAAc,GAAd,cAAc,CAA+C;QAC7D,iBAAY,GAAZ,YAAY,CAA4B;IACxD,CAAC;IAEJ,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;aAC1F,IAAI,CAAC,KAAK,CAAC;aACX,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,OAA+B,EAAE;QAC/D,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAExB,MAAM,MAAM,GAAkB;YAC5B,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;YAC/B,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,SAAS,IAAI,UAAU,EAAE,CAAC;YAC3D,UAAU,EAAE,cAAc;SAC3B,CAAC;QAEF,uEAAuE;QACvE,mEAAmE;QACnE,yEAAyE;QACzE,oDAAoD;QACpD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,MAAM;gBAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,UAAU,GAA+B,EAAE,CAAC;QAClD,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACrC,uEAAuE;YACvE,4DAA4D;YAC5D,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YAC3E,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACzE,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YAEnE,oCAAoC;YACpC,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;YACrE,wEAAwE;YACxE,uEAAuE;YACvE,sEAAsE;YACtE,2DAA2D;YAC3D,kEAAkE;YAClE,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,EAAE;YACF,wEAAwE;YACxE,oEAAoE;YACpE,wEAAwE;YACxE,sEAAsE;YACtE,oEAAoE;YACpE,wEAAwE;YACxE,mEAAmE;YACnE,qEAAqE;YACrE,qEAAqE;YACrE,gEAAgE;YAChE,MAAM,EAAE;iBACL,MAAM,CAAC,kBAAkB,CAAC;iBAC1B,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAE9D,2EAA2E;YAC3E,EAAE;YACF,oEAAoE;YACpE,0EAA0E;YAC1E,qEAAqE;YACrE,uEAAuE;YACvE,iEAAiE;YACjE,wEAAwE;YACxE,yEAAyE;YACzE,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE;gBACxD,KAAK,EAAE,MAAM,CAAC,WAAW;gBACzB,IAAI,EAAE,MAAM,CAAC,UAAU;aACxB,CAAC,CAAC;YACH,MAAM,EAAE;iBACL,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,eAAe,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;iBACjF,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACxD,MAAM,EAAE;iBACL,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;iBACvE,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACnD,MAAM,EAAE;iBACL,MAAM,CAAC,cAAc,CAAC;iBACtB,GAAG,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;iBACvE,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACvD,yEAAyE;YACzE,yEAAyE;YACzE,oEAAoE;YACpE,MAAM,EAAE;iBACL,MAAM,CAAC,cAAc,CAAC;iBACtB,GAAG,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;iBACvE,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAEvD,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,uCAAuC;YACvC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClC,IAAI,CAAC,CAAC,CAAC,aAAa;oBAAE,SAAS;gBAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBAC7C,IAAI,EAAE;oBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9B,CAAC;YAED,gEAAgE;YAChE,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QAEzE,4EAA4E;QAC5E,mCAAmC;QACnC,EAAE;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,sEAAsE;QACtE,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,4CAA4C;QAC5C,EAAE;QACF,0EAA0E;QAC1E,qEAAqE;QACrE,qCAAqC;QACrC,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;aAC3E,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,EAC/C,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAC7F,CACF,CAAC;QAEJ,oEAAoE;QACpE,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,wEAAwE;QACxE,4CAA4C;QAC5C,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,cAAc,CAAC;aACtB,GAAG,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;aACvE,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,EAC5C,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAC7F,CACF,CAAC;QAEJ,qEAAqE;QACrE,oCAAoC;QACpC,KAAK,MAAM,EAAE,IAAI,UAAU;YAAE,MAAM,EAAE,EAAE,CAAC;QAExC,GAAG,CAAC,IAAI,CAAC,kBAAkB,MAAM,EAAE,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/modules/auth/account.routes.d.ts

@@ -1,16 +1,19 @@
 import express from 'express';
 import type { AuthService } from './auth.service.js';
-import type { IAccountErasureService } from './account-erasure.service.js';
+import { type IAccountErasureService } from './account-erasure.service.js';
 import type { IAdminAccessService } from '../admin/admin.interface.js';
+import type { UserAccessRemovalService } from '../access/user-access-removal.service.js';
 import './auth.middleware.js';
 /**
  * Admin account management — the ONE account surface (the core User Accounts
  * page): list accounts, create/reset password accounts, and permanently
  * erase one (the GDPR Art. 17 path — hard-deletes the user's personal data
  * and anonymizes their audit rows; overlays contribute their slices via
- * {@link AccountErasureService}'s participants). Gated per request by
+ * {@link AccountErasureService}'s participants), optionally removing the
+ * address from roles, groups and access rules too
+ * ({@link UserAccessRemovalService}). Gated per request by
  * {@link IAdminAccessService} — the Admin role in `roles.yaml`, plus the env
  * bootstrap admin (always-admin, see AdminAccessService).
  */
-export declare function createAccountRoutes(authService: AuthService, adminAccess: IAdminAccessService, accountErasure: Pick<IAccountErasureService, 'eraseUser'>): express.Router;
+export declare function createAccountRoutes(authService: Pick<AuthService, 'listAccounts' | 'createAccount' | 'getUserById'>, adminAccess: IAdminAccessService, accountErasure: Pick<IAccountErasureService, 'eraseUser'>, accessRemoval?: Pick<UserAccessRemovalService, 'report' | 'assertRemovable' | 'remove' | 'filesNaming'>): express.Router;
 //# sourceMappingURL=account.routes.d.ts.map

package/dist/modules/auth/account.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,mBAAmB,EAChC,cAAc,EAAE,IAAI,CAAC,sBAAsB,EAAE,WAAW,CAAC,GACxD,OAAO,CAAC,MAAM,CAsEhB"}
+{"version":3,"file":"account.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAO9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AAGzF,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,eAAe,GAAG,aAAa,CAAC,EAChF,WAAW,EAAE,mBAAmB,EAChC,cAAc,EAAE,IAAI,CAAC,sBAAsB,EAAE,WAAW,CAAC,EACzD,aAAa,CAAC,EAAE,IAAI,CAAC,wBAAwB,EAAE,QAAQ,GAAG,iBAAiB,GAAG,QAAQ,GAAG,aAAa,CAAC,GACtG,OAAO,CAAC,MAAM,CA0JhB"}

package/dist/modules/auth/account.routes.js

@@ -1,15 +1,24 @@
 import express from 'express';
+import { randomUUID } from 'node:crypto';
+import { logger } from '../../shared/logging.js';
+import { printable } from '../../shared/printable.js';
+const log = logger('accounts');
+import { erasedAccountId } from './account-erasure.service.js';
+import { sendError } from '../access/admin-route-helpers.js';
+import { WorkflowDomainError } from '../../shared/domain-errors.js';
 import './auth.middleware.js'; // Express Request augmentation
 /**
  * Admin account management — the ONE account surface (the core User Accounts
  * page): list accounts, create/reset password accounts, and permanently
  * erase one (the GDPR Art. 17 path — hard-deletes the user's personal data
  * and anonymizes their audit rows; overlays contribute their slices via
- * {@link AccountErasureService}'s participants). Gated per request by
+ * {@link AccountErasureService}'s participants), optionally removing the
+ * address from roles, groups and access rules too
+ * ({@link UserAccessRemovalService}). Gated per request by
  * {@link IAdminAccessService} — the Admin role in `roles.yaml`, plus the env
  * bootstrap admin (always-admin, see AdminAccessService).
  */
-export function createAccountRoutes(authService, adminAccess, accountErasure) {
+export function createAccountRoutes(authService, adminAccess, accountErasure, accessRemoval) {
     const router = express.Router();
     const requireAdmin = async (req, res, next) => {
         if (!(await adminAccess.isAdmin(req.userEmail))) {
@@ -18,7 +27,8 @@ export function createAccountRoutes(authService, adminAccess, accountErasure) {
         }
         next();
     };
-    // GET /api/admin/accounts — id, email, name, whether a password is set.
+    // GET /api/admin/accounts — id, email, name, whether a password hash is
+    // stored, and whether the account is the env bootstrap admin.
     router.get('/admin/accounts', requireAdmin, async (_req, res) => {
         res.json({ accounts: await authService.listAccounts() });
     });
@@ -40,9 +50,37 @@ export function createAccountRoutes(authService, adminAccess, accountErasure) {
             res.status(400).json({ error: msg });
         }
     });
-    // DELETE /api/admin/accounts/:userId — permanent erasure (moved from the
-    // enterprise admin router with the split-repair: deleting accounts is core
-    // platform functionality, not an enterprise extra).
+    // GET /api/admin/accounts/:userId/references — how many places in the
+    // knowledge base name this account's address (roles, groups, access rules,
+    // file grants) and whether removing them is allowed. Feeds the delete
+    // confirmation; the counts never include the address itself.
+    router.get('/admin/accounts/:userId/references', requireAdmin, async (req, res) => {
+        if (!accessRemoval) {
+            res.status(404).json({ error: 'Not available' });
+            return;
+        }
+        try {
+            const user = await authService.getUserById(String(req.params.userId));
+            if (!user) {
+                res.status(404).json({ error: 'No such user' });
+                return;
+            }
+            // The ACTING admin's address, not the target's: `unwritable` answers
+            // "which of these files can *you* not clean up?".
+            res.json(await accessRemoval.report(user.email, req.userEmail ?? ''));
+        }
+        catch (err) {
+            sendError(res, err, 'accounts');
+        }
+    });
+    // DELETE /api/admin/accounts/:userId[?removeFromAccess=1] — permanent
+    // erasure (moved from the enterprise admin router with the split-repair:
+    // deleting accounts is core platform functionality, not an enterprise
+    // extra). With `removeFromAccess`, the address is also removed from
+    // roles.yaml, group files and every access rule in ONE commit, AFTER the
+    // erasure: a failed commit never un-deletes the account, it reports the
+    // files that still name the user (200 + `accessRemoval`) so the admin can
+    // fix them. Without it, the account is deleted as before (204).
     router.delete('/admin/accounts/:userId', requireAdmin, async (req, res) => {
         const userId = String(req.params.userId);
         // Self-erasure would delete the account authorizing the request mid-flight
@@ -52,22 +90,83 @@ export function createAccountRoutes(authService, adminAccess, accountErasure) {
             res.status(400).json({ error: 'You cannot erase your own account. Ask another admin.' });
             return;
         }
+        const flag = String(req.query.removeFromAccess ?? '');
+        const removeFromAccess = accessRemoval !== undefined && (flag === '1' || flag === 'true');
+        // Captured BEFORE erasure (the row is gone after) and held only in memory
+        // for the removal below — never logged, never returned.
+        let email = null;
+        let actor = null;
+        if (removeFromAccess) {
+            try {
+                const user = await authService.getUserById(userId);
+                if (!user) {
+                    res.status(404).json({ error: 'No such user' });
+                    return;
+                }
+                email = user.email;
+                // The existing guards: the deployment owner and the last Admin are
+                // refused up front, before anything is erased.
+                await accessRemoval.assertRemovable(email);
+                actor = (req.userId ? await authService.getUserById(req.userId) : null) ?? {
+                    id: req.userId ?? 'unknown',
+                    email: req.userEmail ?? 'unknown',
+                    name: req.userEmail ?? 'unknown',
+                };
+            }
+            catch (err) {
+                sendError(res, err, 'accounts');
+                return;
+            }
+        }
+        const erasureId = randomUUID();
         try {
-            const erased = await accountErasure.eraseUser(userId);
+            const erased = removeFromAccess
+                ? await accountErasure.eraseUser(userId, { erasureId })
+                : await accountErasure.eraseUser(userId);
             // Accountability record for the destructive path: WHO erased WHOM, by
             // id only — the target's email must not outlive the erasure in logs.
-            console.log('[accounts] erasure audit:', JSON.stringify({ action: 'erase-user', actorUserId: req.userId, targetUserId: userId, erased }));
+            log.info('erasure audit:', { action: 'erase-user', actorUserId: req.userId, targetUserId: userId, erased });
             if (!erased) {
                 res.status(404).json({ error: 'No such user' });
                 return;
             }
-            res.status(204).end();
         }
         catch (err) {
-            console.error('[accounts] user erasure failed:', err);
+            log.error('user erasure failed:', { err });
             res.status(500).json({ error: 'Failed to erase user' });
+            return;
+        }
+        if (!removeFromAccess || email === null || actor === null) {
+            res.status(204).end();
+            return;
+        }
+        const accountId = erasedAccountId(erasureId);
+        try {
+            const result = await accessRemoval.remove(actor, email, accountId);
+            log.info('erasure audit:', { action: 'remove-from-access', actorUserId: req.userId, account: accountId, files: result.removedFrom.length });
+            res.json({ erased: true, accessRemoval: { ok: true, ...result } });
+        }
+        catch (err) {
+            // `remove` throws only before its commit lands, so nothing was removed.
+            log.error(`removing erased account ${accountId} from access files failed: ${errorText(err)}`);
+            // null, not []: an unreadable scan is no proof that no file names them.
+            let stillNamedIn = null;
+            try {
+                stillNamedIn = await accessRemoval.filesNaming(email);
+            }
+            catch (scanErr) {
+                log.warn(`could not list the files still naming erased account ${accountId}: ${errorText(scanErr)}`);
+            }
+            const message = err instanceof WorkflowDomainError && err.status < 500
+                ? err.message
+                : 'The change to roles, groups and access rules could not be committed.';
+            res.json({ erased: true, accessRemoval: { ok: false, error: message, removedFrom: [], stillNamedIn } });
         }
     });
     return router;
 }
+/** An error's message as one escaped log token — never a raw stack. */
+function errorText(err) {
+    return printable(err instanceof Error ? err.message : String(err));
+}
 //# sourceMappingURL=account.routes.js.map

package/dist/modules/auth/account.routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"account.routes.js","sourceRoot":"","sources":["../../../src/modules/auth/account.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAI9B,OAAO,sBAAsB,CAAC,CAAC,+BAA+B;AAE9D;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAwB,EACxB,WAAgC,EAChC,cAAyD;IAEzD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,YAAY,GAA2B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpE,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,wEAAwE;IACxE,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,4EAA4E;IAC5E,kCAAkC;IAClC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAIrC,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,CAAC,MAAM,CAAC,yBAAyB,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,2EAA2E;QAC3E,wEAAwE;QACxE,mCAAmC;QACnC,IAAI,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACtD,sEAAsE;YACtE,qEAAqE;YACrE,OAAO,CAAC,GAAG,CACT,2BAA2B,EAC3B,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAChG,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"account.routes.js","sourceRoot":"","sources":["../../../src/modules/auth/account.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AAG/B,OAAO,EAAE,eAAe,EAA+B,MAAM,8BAA8B,CAAC;AAG5F,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,sBAAsB,CAAC,CAAC,+BAA+B;AAE9D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAgF,EAChF,WAAgC,EAChC,cAAyD,EACzD,aAAuG;IAEvG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,YAAY,GAA2B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpE,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,wEAAwE;IACxE,8DAA8D;IAC9D,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,4EAA4E;IAC5E,kCAAkC;IAClC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAIrC,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,2EAA2E;IAC3E,sEAAsE;IACtE,6DAA6D;IAC7D,MAAM,CAAC,GAAG,CAAC,oCAAoC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,qEAAqE;YACrE,kDAAkD;YAClD,GAAG,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,gEAAgE;IAChE,MAAM,CAAC,MAAM,CAAC,yBAAyB,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,2EAA2E;QAC3E,wEAAwE;QACxE,mCAAmC;QACnC,IAAI,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,gBAAgB,GAAG,aAAa,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC;QAE1F,0EAA0E;QAC1E,wDAAwD;QACxD,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,KAAK,GAAoB,IAAI,CAAC;QAClC,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;gBACnD,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;oBAChD,OAAO;gBACT,CAAC;gBACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;gBACnB,mEAAmE;gBACnE,+CAA+C;gBAC/C,MAAM,aAAc,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC5C,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;oBACzE,EAAE,EAAE,GAAG,CAAC,MAAM,IAAI,SAAS;oBAC3B,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;oBACjC,IAAI,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;iBACjC,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,gBAAgB;gBAC7B,CAAC,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC;gBACvD,CAAC,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC3C,sEAAsE;YACtE,qEAAqE;YACrE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5G,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,gBAAgB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,aAAc,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACpE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5I,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,GAAG,CAAC,KAAK,CAAC,2BAA2B,SAAS,8BAA8B,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9F,wEAAwE;YACxE,IAAI,YAAY,GAAoB,IAAI,CAAC;YACzC,IAAI,CAAC;gBACH,YAAY,GAAG,MAAM,aAAc,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,GAAG,CAAC,IAAI,CAAC,wDAAwD,SAAS,KAAK,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACvG,CAAC;YACD,MAAM,OAAO,GACX,GAAG,YAAY,mBAAmB,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;gBACpD,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,sEAAsE,CAAC;YAC7E,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uEAAuE;AACvE,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,SAAS,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/modules/auth/auth.routes.d.ts

@@ -13,9 +13,11 @@ export declare const AUTH_COOKIE_MAX_AGE_S: number;
  * (e.g. the enterprise "Sign in with Microsoft", owned by its sharepoint
  * module). A plugin mounts its own routes under `/auth/<key>/…` and is
  * advertised to the login screen by the capability probe, which renders one
- * button per provider from `label` + `startPath`. A plugin is only present
- * when its machinery is configured AND the instance hasn't switched it off —
- * presence means enabled.
+ * button per provider from `label` + `startPath`. A plugin is advertised while
+ * it is present and — if it implements {@link AuthProviderPlugin.isEnabled} —
+ * says it is enabled. That second half lets a provider configured at runtime
+ * (the generic OIDC one, from the setup screen) mount once at boot and appear
+ * the moment its configuration is complete.
  */
 export interface AuthProviderPlugin {
     /** Probe key + route namespace (e.g. 'oidc' → /auth/oidc/…). */
@@ -24,6 +26,11 @@ export interface AuthProviderPlugin {
     readonly label: string;
     /** Browser navigation target that starts the flow (e.g. '/api/auth/oidc/login'). */
     readonly startPath: string;
+    /**
+     * Whether the login screen should offer it right now; asked on every probe.
+     * Absent means always — a plugin whose presence is its enablement.
+     */
+    isEnabled?(): boolean;
     /** Mount the provider's routes (login redirect, callback) on the auth router. */
     mountRoutes(router: express.Router, authService: AuthService): void;
 }