@capybara-hq/kernel 0.1.0-rc.6 → 0.1.0-rc.8

package/dist/http/api.module.js

@@ -43,6 +43,7 @@ import { FilePreviewersController } from "../files/previewers.controller.js";
 import { AuthController } from "../identity/auth.controller.js";
 import { AuthGuard } from "../identity/auth.guard.js";
 import { IdentityModule } from "../identity/identity.module.js";
+import { InitialPasswordsController } from "../identity/initial-passwords.controller.js";
 import { MeController } from "../identity/me.controller.js";
 import { BindController, MeIdentitiesController, SsoController, } from "../identity/sso.controller.js";
 import { InboxModule } from "../inbox/inbox.module.js";
@@ -75,6 +76,7 @@ import { UiController } from "../ui/views.controller.js";
 const CONTROLLERS = [
     AuthController,
     MeController,
+    InitialPasswordsController,
     OrgsController,
     OrgSettingsController,
     InvitationsController,

package/dist/identity/accounts.d.ts

@@ -10,6 +10,11 @@ export interface Account {
     email: string | null;
     status: "active" | "disabled";
     isSuperAdmin: boolean;
+    /**
+     * The account signed in with a generated initial password and must set its own before anything
+     * else (Platform tool spec §14.5 item 2): the auth guard refuses every other route until then.
+     */
+    mustChangePassword: boolean;
     createdAt: Date;
 }
 /** 超级管理员可改的账号字段。 */
@@ -19,8 +24,8 @@ export type AccountPatch = {
     isSuperAdmin?: boolean;
 };
 /** 构造 `Account` 所需的 accounts 列（供跨表查询 select 使用）。 */
-export declare const ACCOUNT_COLUMNS: readonly ["accounts.id", "accounts.display_name", "accounts.email", "accounts.status", "accounts.is_super_admin", "accounts.created_at"];
-type AccountRow = Pick<Selectable<AccountsTable>, "id" | "display_name" | "email" | "status" | "is_super_admin" | "created_at">;
+export declare const ACCOUNT_COLUMNS: readonly ["accounts.id", "accounts.display_name", "accounts.email", "accounts.status", "accounts.is_super_admin", "accounts.must_change_password", "accounts.created_at"];
+type AccountRow = Pick<Selectable<AccountsTable>, "id" | "display_name" | "email" | "status" | "is_super_admin" | "must_change_password" | "created_at">;
 export declare function toAccount(r: AccountRow): Account;
 export interface LocalAccountInput {
     login: string;
@@ -28,6 +33,18 @@ export interface LocalAccountInput {
     displayName: string;
     email?: string;
     superAdmin?: boolean;
+    /** The account must set its own password at first sign-in (a generated initial password). */
+    mustChangePassword?: boolean;
+}
+/** Options of {@link AccountsService.createByAdmin}. */
+export interface AdminCreateOptions {
+    /** Merged into the `account.created` audit detail (e.g. the Platform tool's `via: "agent"`). */
+    auditDetail?: Record<string, unknown>;
+    /**
+     * Runs in the creation's transaction right after the insert (the generated password is sealed
+     * there), so the account and what goes with it commit or roll back together.
+     */
+    inTransaction?: (account: Account) => Promise<void>;
 }
 /**
  * Accounts: local account creation, authentication and administration. Every write is
@@ -54,7 +71,14 @@ export declare class AccountsService {
      * `forbidden`), creates the account and audits `account.created`. The hash is computed before
      * the lock.
      */
-    createByAdmin(input: LocalAccountInput, actorAccountId: string, actorTokenId?: string): Promise<Account>;
+    createByAdmin(input: LocalAccountInput, actorAccountId: string, actorTokenId?: string, opts?: AdminCreateOptions): Promise<Account>;
+    /**
+     * Whether `login` is free for a new local account (`account.login_taken` otherwise) and well
+     * formed (`validation_failed`): the read a caller checks before asking a person to confirm.
+     */
+    assertLoginFree(login: string): Promise<void>;
+    /** The local login of each account that has one (accounts without are left out). */
+    localLogins(accountIds: readonly string[]): Promise<Map<string, string>>;
     private createByAdminIn;
     /**
      * CLI: creates a super admin without checking whether the deployment is set up; a taken
@@ -75,6 +99,19 @@ export declare class AccountsService {
     /** 按账号 id 校验本地密码（改密码时核对旧密码）；没有本地密码、超长或不符 → false。 */
     verifyPassword(accountId: string, password: string): Promise<boolean>;
     get(id: string): Promise<Account | undefined>;
+    /**
+     * A person's preferences (run context spec §3.4): `timeZone` is their time zone setting (IANA),
+     * null = follow the browser. Missing account → null.
+     */
+    preferences(accountId: string): Promise<{
+        timeZone: string | null;
+    }>;
+    /** Sets a person's preferences (the caller validated the time zone). */
+    setPreferences(accountId: string, prefs: {
+        timeZone: string | null;
+    }): Promise<{
+        timeZone: string | null;
+    }>;
     /** 按 id 升序分页，`after` 为上一页最后一个 id。 */
     list(opts: {
         limit: number;
@@ -97,7 +134,9 @@ export declare class AccountsService {
      * all or nothing; returns the revoked session ids, whose Redis markers the caller writes after
      * the commit (the fast path; a failure is only a warning: auth reads PG).
      */
-    updateAccount(id: string, patch: AccountPatch, actorAccountId: string, actorTokenId?: string): Promise<{
+    updateAccount(id: string, patch: AccountPatch, actorAccountId: string, actorTokenId?: string, opts?: {
+        auditDetail?: Record<string, unknown>;
+    }): Promise<{
         account: Account;
         revokedSessionIds: string[];
     }>;

package/dist/identity/accounts.js

@@ -26,6 +26,7 @@ export const ACCOUNT_COLUMNS = [
     "accounts.email",
     "accounts.status",
     "accounts.is_super_admin",
+    "accounts.must_change_password",
     "accounts.created_at",
 ];
 export function toAccount(r) {
@@ -35,6 +36,7 @@ export function toAccount(r) {
         email: r.email,
         status: r.status,
         isSuperAdmin: r.is_super_admin,
+        mustChangePassword: r.must_change_password,
         createdAt: r.created_at,
     };
 }
@@ -87,10 +89,37 @@ let AccountsService = class AccountsService {
      * `forbidden`), creates the account and audits `account.created`. The hash is computed before
      * the lock.
      */
-    async createByAdmin(input, actorAccountId, actorTokenId) {
-        return this.createByAdminIn(await prepareLocal(input), actorAccountId, actorTokenId);
+    async createByAdmin(input, actorAccountId, actorTokenId, opts = {}) {
+        return this.createByAdminIn(await prepareLocal(input), actorAccountId, actorTokenId, opts);
     }
-    async createByAdminIn(prepared, actorAccountId, actorTokenId) {
+    /**
+     * Whether `login` is free for a new local account (`account.login_taken` otherwise) and well
+     * formed (`validation_failed`): the read a caller checks before asking a person to confirm.
+     */
+    async assertLoginFree(login) {
+        const external = normalizeLogin(login);
+        const taken = await this.db
+            .selectFrom("identities")
+            .select("account_id")
+            .where("source", "=", "local")
+            .where("external_id", "=", external)
+            .executeTakeFirst();
+        if (taken)
+            throw new ApiError("account.login_taken", "Login is already taken");
+    }
+    /** The local login of each account that has one (accounts without are left out). */
+    async localLogins(accountIds) {
+        if (accountIds.length === 0)
+            return new Map();
+        const rows = await this.db
+            .selectFrom("identities")
+            .select(["account_id", "external_id"])
+            .where("source", "=", "local")
+            .where("account_id", "in", accountIds)
+            .execute();
+        return new Map(rows.map((r) => [r.account_id, r.external_id]));
+    }
+    async createByAdminIn(prepared, actorAccountId, actorTokenId, opts) {
         await this.adminLock.lockAndAuthorize(actorAccountId);
         const a = await this.insertLocal(prepared);
         await audit(this.db.db, {
@@ -98,8 +127,13 @@ let AccountsService = class AccountsService {
             ...(actorTokenId !== undefined && { actorTokenId }),
             action: "account.created",
             target: a.id,
-            detail: { superAdmin: a.isSuperAdmin },
+            detail: {
+                superAdmin: a.isSuperAdmin,
+                ...(a.mustChangePassword && { mustChangePassword: true }),
+                ...opts.auditDetail,
+            },
         });
+        await opts.inTransaction?.(a);
         return a;
     }
     /**
@@ -164,6 +198,7 @@ let AccountsService = class AccountsService {
             "accounts.email_verified",
             "accounts.status",
             "accounts.is_super_admin",
+            "accounts.must_change_password",
             "accounts.created_at",
             "accounts.updated_at",
             "local_passwords.password_hash",
@@ -201,6 +236,27 @@ let AccountsService = class AccountsService {
             .executeTakeFirst();
         return row && toAccount(row);
     }
+    /**
+     * A person's preferences (run context spec §3.4): `timeZone` is their time zone setting (IANA),
+     * null = follow the browser. Missing account → null.
+     */
+    async preferences(accountId) {
+        const row = await this.db
+            .selectFrom("accounts")
+            .select("time_zone")
+            .where("id", "=", accountId)
+            .executeTakeFirst();
+        return { timeZone: row?.time_zone ?? null };
+    }
+    /** Sets a person's preferences (the caller validated the time zone). */
+    async setPreferences(accountId, prefs) {
+        await this.db
+            .updateTable("accounts")
+            .set({ time_zone: prefs.timeZone, updated_at: new Date() })
+            .where("id", "=", accountId)
+            .execute();
+        return this.preferences(accountId);
+    }
     /** 按 id 升序分页，`after` 为上一页最后一个 id。 */
     async list(opts) {
         let q = this.db.selectFrom("accounts").selectAll().orderBy("id").limit(opts.limit);
@@ -224,6 +280,17 @@ let AccountsService = class AccountsService {
     }
     async changePasswordIn(accountId, passwordHash, exceptSessionId) {
         await this.writePassword(accountId, passwordHash);
+        // the person set their own password: the generated one is no longer theirs to be shown
+        await this.db
+            .updateTable("accounts")
+            .set({ must_change_password: false })
+            .where("id", "=", accountId)
+            .where("must_change_password", "=", true)
+            .execute();
+        await this.db
+            .deleteFrom("account_initial_passwords")
+            .where("account_id", "=", accountId)
+            .execute();
         const sessions = await this.db
             .updateTable("sessions")
             .set({ revoked_at: sql `now()` })
@@ -250,7 +317,7 @@ let AccountsService = class AccountsService {
      * all or nothing; returns the revoked session ids, whose Redis markers the caller writes after
      * the commit (the fast path; a failure is only a warning: auth reads PG).
      */
-    async updateAccount(id, patch, actorAccountId, actorTokenId) {
+    async updateAccount(id, patch, actorAccountId, actorTokenId, opts = {}) {
         // Every super admin write is serialized by one lock and re-checks the actor under it: two
         // admins revoking each other concurrently cannot leave none, and a just-revoked admin's
         // request in flight fails
@@ -265,7 +332,7 @@ let AccountsService = class AccountsService {
         return this.applyUpdate(before, patch, {
             actorAccountId,
             ...(actorTokenId !== undefined && { actorTokenId }),
-            detail: patch,
+            detail: { ...patch, ...opts.auditDetail },
         });
     }
     /**
@@ -335,6 +402,7 @@ let AccountsService = class AccountsService {
             display_name: input.displayName,
             email: input.email ?? null,
             is_super_admin: input.superAdmin ?? false,
+            must_change_password: input.mustChangePassword ?? false,
         })
             .returningAll()
             .executeTakeFirstOrThrow();

package/dist/identity/auth.guard.js

@@ -13,7 +13,7 @@ import { ApiError } from "../errors.js";
 import { AccountsService } from "./accounts.js";
 import { ApiTokenService } from "./api-tokens.js";
 import { ACCESS_COOKIE } from "./cookies.js";
-import { ALLOW_SERVICE_KEY, PUBLIC_KEY, SESSION_ONLY_KEY, SUPER_ADMIN_KEY, } from "./principal.js";
+import { ALLOW_SERVICE_KEY, PASSWORD_CHANGE_KEY, PUBLIC_KEY, SESSION_ONLY_KEY, SUPER_ADMIN_KEY, } from "./principal.js";
 import { SessionService } from "./sessions.js";
 /** CSRF 头：Cookie 认证的非安全请求（及所有公开路由的非安全请求）必须带 `X-Capybara-Csrf: 1`。 */
 export const CSRF_HEADER = "x-capybara-csrf";
@@ -76,6 +76,8 @@ export async function authorizeSuperAdmin(req, s) {
     if (p.kind === "service") {
         throw new ApiError("forbidden", "Service tokens cannot access this endpoint");
     }
+    if (p.account.mustChangePassword)
+        throw passwordChangeRequired();
     if (!p.account.isSuperAdmin)
         throw new ApiError("forbidden", "Super admin required");
 }
@@ -94,6 +96,8 @@ export async function authenticateOrgUploader(req, s) {
     if (resolved.principal.kind === "service") {
         throw new ApiError("forbidden", "Service tokens cannot access this endpoint");
     }
+    if (resolved.principal.account.mustChangePassword)
+        throw passwordChangeRequired();
     return resolved.principal;
 }
 /**
@@ -159,6 +163,9 @@ let AuthGuard = class AuthGuard {
         if (flag(SESSION_ONLY_KEY) && !(p.kind === "user" && p.via === "session")) {
             throw new ApiError("auth.session_required", "This endpoint requires a web session");
         }
+        if (p.kind === "user" && p.account.mustChangePassword && !flag(PASSWORD_CHANGE_KEY)) {
+            throw passwordChangeRequired();
+        }
         if (flag(SUPER_ADMIN_KEY) && !(p.kind === "user" && p.account.isSuperAdmin)) {
             throw new ApiError("forbidden", "Super admin required");
         }
@@ -173,6 +180,8 @@ AuthGuard = __decorate([
     __param(3, Inject(ApiTokenService))
 ], AuthGuard);
 export { AuthGuard };
+/** An account signed in with a generated initial password reaches nothing until it changes it. */
+const passwordChangeRequired = () => new ApiError("auth.password_change_required", "Set a new password first: this account signed in with a generated initial password");
 function requireActive(account) {
     if (account.status !== "active") {
         throw new ApiError("auth.account_disabled", "Account is disabled");

package/dist/identity/cookies.d.ts

@@ -29,3 +29,9 @@ export declare function clearSessionCookies(reply: FastifyReply): void;
  * Path cookie and the new one sends both, the more specific Path first.
  */
 export declare function refreshCookieValues(header: string | undefined): string[];
+/**
+ * The startup warning for an http trial that cannot sign in: session cookies are Secure but the
+ * configured public URL is plain http, so browsers drop them. Null when cookies are not Secure,
+ * or the public URL is https or unset (an unset URL says nothing about how people reach the app).
+ */
+export declare function insecurePublicUrlWarning(cfg: KernelConfig): string | null;

package/dist/identity/cookies.js

@@ -68,3 +68,17 @@ export function refreshCookieValues(header) {
     }
     return out;
 }
+/**
+ * The startup warning for an http trial that cannot sign in: session cookies are Secure but the
+ * configured public URL is plain http, so browsers drop them. Null when cookies are not Secure,
+ * or the public URL is https or unset (an unset URL says nothing about how people reach the app).
+ */
+export function insecurePublicUrlWarning(cfg) {
+    const url = cfg.http.publicUrl;
+    if (!cfg.auth.cookieSecure || url === undefined || !url.startsWith("http://"))
+        return null;
+    const host = new URL(url).hostname;
+    if (host === "localhost" || host.endsWith(".localhost") || host === "127.0.0.1")
+        return null;
+    return `http.publicUrl is ${url} (plain http) while auth.cookieSecure is true: browsers drop the Secure session cookies, so sign-in will not stick. Serve the app over HTTPS, or for a short http trial set auth.cookieSecure=false (CAPYBARA_AUTH__COOKIE_SECURE=false; CAPYBARA_COOKIE_SECURE=false in the compose .env)`;
+}

package/dist/identity/identity.module.js

@@ -13,6 +13,7 @@ import { ApiTokenService } from "./api-tokens.js";
 import { IdentityBinding } from "./binding.js";
 import { ExternalIdentities } from "./external.js";
 import { ExternalIdentityLock } from "./external-identity-lock.js";
+import { InitialPasswords } from "./initial-passwords.js";
 import { SessionService } from "./sessions.js";
 import { SettingsService } from "./settings.js";
 import { SsoFlow } from "./sso.js";
@@ -40,6 +41,7 @@ IdentityModule = __decorate([
             ExternalIdentities,
             IdentityBinding,
             SsoFlow,
+            InitialPasswords,
         ],
         exports: [
             AccountsModule,
@@ -50,6 +52,7 @@ IdentityModule = __decorate([
             ExternalIdentities,
             IdentityBinding,
             SsoFlow,
+            InitialPasswords,
         ],
     })
 ], IdentityModule);

package/dist/identity/initial-passwords.controller.d.ts

@@ -0,0 +1,22 @@
+import { z } from "zod";
+import { type OrgContext } from "../orgs/org.guard.js";
+import { InitialPasswords } from "./initial-passwords.js";
+import { type Principal } from "./principal.js";
+declare const ApprovalParams: z.ZodObject<{
+    approvalId: z.ZodString;
+}, z.core.$strip>;
+/**
+ * The generated initial password of an account the super admin's agent created (Platform tool
+ * spec §14.5 item 2): shown once, on the web, to the person who approved the `accounts.create`
+ * call. A POST because reading consumes it.
+ */
+export declare class InitialPasswordsController {
+    private readonly passwords;
+    constructor(passwords: InitialPasswords);
+    reveal(principal: Principal, org: OrgContext, params: z.infer<typeof ApprovalParams>): Promise<{
+        accountId: string;
+        login: string | null;
+        password: string;
+    }>;
+}
+export {};

package/dist/identity/initial-passwords.controller.js

@@ -0,0 +1,49 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Controller, HttpCode, Inject, Post } from "@nestjs/common";
+import { z } from "zod";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+import { ZParam } from "../infra/validation/zod-params.js";
+import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
+import { InitialPasswords } from "./initial-passwords.js";
+import { CurrentPrincipal, requireUser, SessionOnly, SuperAdmin, } from "./principal.js";
+const ApprovalParams = z.object({ approvalId: z.string().min(1).max(100) });
+class ApprovalParamsDto extends createZodDto(ApprovalParams, "InitialPasswordParams") {
+}
+/**
+ * The generated initial password of an account the super admin's agent created (Platform tool
+ * spec §14.5 item 2): shown once, on the web, to the person who approved the `accounts.create`
+ * call. A POST because reading consumes it.
+ */
+let InitialPasswordsController = class InitialPasswordsController {
+    passwords;
+    constructor(passwords) {
+        this.passwords = passwords;
+    }
+    async reveal(principal, org, params) {
+        const p = requireUser(principal);
+        return this.passwords.reveal(org.orgId, params.approvalId, p.account.id);
+    }
+};
+__decorate([
+    Post(),
+    HttpCode(200),
+    OrgAction("org.read"),
+    SuperAdmin(),
+    SessionOnly(),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZParam(ApprovalParamsDto))
+], InitialPasswordsController.prototype, "reveal", null);
+InitialPasswordsController = __decorate([
+    Controller("api/v1/orgs/:orgId/approvals/:approvalId/initial-password"),
+    __param(0, Inject(InitialPasswords))
+], InitialPasswordsController);
+export { InitialPasswordsController };

package/dist/identity/initial-passwords.d.ts

@@ -0,0 +1,61 @@
+import type { Keyring } from "../ctx/secrets.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { type Account, AccountsService } from "./accounts.js";
+/**
+ * How long a generated password waits for its reader. The approving person reads it right after
+ * the call runs; one that is never read expires (the account can still be disabled and recreated).
+ */
+export declare const INITIAL_PASSWORD_TTL_MS: number;
+/** The tool key of the approval a generated password belongs to. */
+export declare const CREATE_ACCOUNT_TOOL_KEY = "Platform:accounts.create";
+/** A one-time initial password, cryptographically random. */
+export declare function generateInitialPassword(): string;
+/** Where a generated password is delivered: the approved tool call and the person who approved. */
+export interface InitialPasswordDelivery {
+    conversationId: string;
+    /** The run of the call: a call id is unique only within its run. */
+    runId: string;
+    callId: string;
+    /** The account that may read it: the actor who confirmed the call. */
+    recipientAccountId: string;
+}
+/**
+ * Accounts created with a kernel-generated one-time password (Platform tool spec §14.5 item 2).
+ * The password never leaves the kernel except through {@link reveal}: it is not returned to the
+ * caller, not written to the audit, the event log or the logs. It is sealed with the master keyring
+ * in the creation's transaction and read once, on the web, by the person who approved the call.
+ */
+export declare class InitialPasswords {
+    private readonly db;
+    readonly txHost: TransactionHost;
+    private readonly keyring;
+    private readonly accounts;
+    constructor(db: KernelDb, txHost: TransactionHost, keyring: Keyring, accounts: AccountsService);
+    /**
+     * Creates a local account (never a super admin) with a generated password it must change at
+     * first sign-in, and seals the password for `to`. Returns the account only.
+     */
+    createAccount(input: {
+        login: string;
+        displayName: string;
+        email?: string;
+    }, actorAccountId: string, to: InitialPasswordDelivery, auditDetail?: Record<string, unknown>): Promise<Account>;
+    /** Stores the sealed password in the creation's transaction (the hourly job drops expired ones). */
+    private seal;
+    /**
+     * The password created by an approved `accounts.create` call, read once by the person who
+     * approved it (`approvalId` in `orgId`, decided by `accountId`), then deleted. Anything else (not
+     * that person, not approved, not run yet, read already, expired) is
+     * `account.initial_password_unavailable`, saying nothing about which. Audits the read (without
+     * the password).
+     */
+    reveal(orgId: string, approvalId: string, accountId: string): Promise<{
+        accountId: string;
+        login: string | null;
+        password: string;
+    }>;
+}
+/** Deletes the sealed passwords past `expires_at`; returns how many. */
+export declare function deleteExpiredInitialPasswords(db: KernelSchemaDb): Promise<number>;

package/dist/identity/initial-passwords.job.d.ts

@@ -0,0 +1,16 @@
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { LockService } from "../infra/lock/lock.service.js";
+import type { KernelLogger } from "../log.js";
+/** The hourly cleanup of expired sealed initial passwords (`@LockedCron`). */
+export declare const INITIAL_PASSWORD_CLEANUP_JOB = "initial-password-cleanup";
+/**
+ * Deletes generated initial passwords nobody read before they expired (Platform tool spec §14.5
+ * item 2), once per tick across replicas; the worker role's.
+ */
+export declare class InitialPasswordCleanupJob {
+    private readonly db;
+    readonly lockService: LockService;
+    readonly log: KernelLogger;
+    constructor(db: KernelDb, lockService: LockService, log: KernelLogger);
+    cleanup(): Promise<void>;
+}

package/dist/identity/initial-passwords.job.js

@@ -0,0 +1,46 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { LockService } from "../infra/lock/lock.service.js";
+import { LockedCron } from "../infra/schedule/locked-cron.decorator.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { deleteExpiredInitialPasswords } from "./initial-passwords.js";
+/** The hourly cleanup of expired sealed initial passwords (`@LockedCron`). */
+export const INITIAL_PASSWORD_CLEANUP_JOB = "initial-password-cleanup";
+/**
+ * Deletes generated initial passwords nobody read before they expired (Platform tool spec §14.5
+ * item 2), once per tick across replicas; the worker role's.
+ */
+let InitialPasswordCleanupJob = class InitialPasswordCleanupJob {
+    db;
+    lockService;
+    log;
+    constructor(db, lockService, log) {
+        this.db = db;
+        this.lockService = lockService;
+        this.log = log;
+    }
+    async cleanup() {
+        const n = await deleteExpiredInitialPasswords(this.db.db);
+        if (n > 0)
+            this.log.info("expired initial passwords deleted", { count: n });
+    }
+};
+__decorate([
+    LockedCron("20 * * * *", { name: INITIAL_PASSWORD_CLEANUP_JOB })
+], InitialPasswordCleanupJob.prototype, "cleanup", null);
+InitialPasswordCleanupJob = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(LockService)),
+    __param(2, Inject(KERNEL_LOGGER))
+], InitialPasswordCleanupJob);
+export { InitialPasswordCleanupJob };