@grantjs/schema 1.19.0 → 1.20.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@grantjs/schema",
-  "version": "1.19.0",
+  "version": "1.20.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/events/event-catalog.ts

@@ -152,6 +152,7 @@ export const EVENT_TYPES = [
   'user.deleted',
   'project.user_updated',
   'project.user_email_changed',
+  'project.user_password_set',
   'api_key.deleted',
   'tag.created',
   'tag.updated',
@@ -228,6 +229,8 @@ export const EVENT_CATALOG: Readonly<Record<EventType, EventCatalogEntry>> = {
   'user.deleted': webhookOnly('membership'),
   'project.user_updated': webhookOnly('membership'),
   'project.user_email_changed': webhookOnly('membership'),
+  // Every project-credential write that changes the stored hash, any source. data.after = { projectId, userId, source }: never a hash or a password.
+  'project.user_password_set': webhookOnly('membership'),
   'api_key.deleted': webhookOnly('security'),
   'tag.created': webhookOnly('iam'),
   'tag.updated': webhookOnly('iam'),

package/src/generated/graphql.ts

@@ -1310,6 +1310,16 @@ export type UpsertProjectOAuthConnectionMutation = {
   };
 };
 
+export type ExportProjectUserCredentialsQueryVariables = Exact<{
+  input: Types.ExportProjectUserCredentialsInput;
+}>;
+
+export type ExportProjectUserCredentialsQuery = {
+  exportProjectUserCredentials: {
+    users: Array<{ userId: string; password: { algorithm: string; hash: string } | null }>;
+  };
+};
+
 export type CancelProjectSyncMutationVariables = Exact<{
   id: string | number;
   scope: Types.Scope;
@@ -2188,6 +2198,20 @@ export type SetProjectUserEmailMutation = {
   };
 };
 
+export type SetProjectUserPasswordMutationVariables = Exact<{
+  input: Types.SetProjectUserPasswordInput;
+}>;
+
+export type SetProjectUserPasswordMutation = {
+  setProjectUserPassword: {
+    id: string;
+    name: string;
+    metadata: Record<string, unknown>;
+    createdAt: Date;
+    updatedAt: Date;
+  };
+};
+
 export type UpdateUserMutationVariables = Exact<{
   id: string | number;
   input: Types.UpdateUserInput;
@@ -7467,6 +7491,74 @@ export const UpsertProjectOAuthConnectionDocument = {
   UpsertProjectOAuthConnectionMutation,
   UpsertProjectOAuthConnectionMutationVariables
 >;
+export const ExportProjectUserCredentialsDocument = {
+  kind: 'Document',
+  definitions: [
+    {
+      kind: 'OperationDefinition',
+      operation: 'query',
+      name: { kind: 'Name', value: 'ExportProjectUserCredentials' },
+      variableDefinitions: [
+        {
+          kind: 'VariableDefinition',
+          variable: { kind: 'Variable', name: { kind: 'Name', value: 'input' } },
+          type: {
+            kind: 'NonNullType',
+            type: {
+              kind: 'NamedType',
+              name: { kind: 'Name', value: 'ExportProjectUserCredentialsInput' },
+            },
+          },
+        },
+      ],
+      selectionSet: {
+        kind: 'SelectionSet',
+        selections: [
+          {
+            kind: 'Field',
+            name: { kind: 'Name', value: 'exportProjectUserCredentials' },
+            arguments: [
+              {
+                kind: 'Argument',
+                name: { kind: 'Name', value: 'input' },
+                value: { kind: 'Variable', name: { kind: 'Name', value: 'input' } },
+              },
+            ],
+            selectionSet: {
+              kind: 'SelectionSet',
+              selections: [
+                {
+                  kind: 'Field',
+                  name: { kind: 'Name', value: 'users' },
+                  selectionSet: {
+                    kind: 'SelectionSet',
+                    selections: [
+                      { kind: 'Field', name: { kind: 'Name', value: 'userId' } },
+                      {
+                        kind: 'Field',
+                        name: { kind: 'Name', value: 'password' },
+                        selectionSet: {
+                          kind: 'SelectionSet',
+                          selections: [
+                            { kind: 'Field', name: { kind: 'Name', value: 'algorithm' } },
+                            { kind: 'Field', name: { kind: 'Name', value: 'hash' } },
+                          ],
+                        },
+                      },
+                    ],
+                  },
+                },
+              ],
+            },
+          },
+        ],
+      },
+    },
+  ],
+} as unknown as DocumentNode<
+  ExportProjectUserCredentialsQuery,
+  ExportProjectUserCredentialsQueryVariables
+>;
 export const CancelProjectSyncDocument = {
   kind: 'Document',
   definitions: [
@@ -11215,6 +11307,58 @@ export const SetProjectUserEmailDocument = {
     },
   ],
 } as unknown as DocumentNode<SetProjectUserEmailMutation, SetProjectUserEmailMutationVariables>;
+export const SetProjectUserPasswordDocument = {
+  kind: 'Document',
+  definitions: [
+    {
+      kind: 'OperationDefinition',
+      operation: 'mutation',
+      name: { kind: 'Name', value: 'SetProjectUserPassword' },
+      variableDefinitions: [
+        {
+          kind: 'VariableDefinition',
+          variable: { kind: 'Variable', name: { kind: 'Name', value: 'input' } },
+          type: {
+            kind: 'NonNullType',
+            type: {
+              kind: 'NamedType',
+              name: { kind: 'Name', value: 'SetProjectUserPasswordInput' },
+            },
+          },
+        },
+      ],
+      selectionSet: {
+        kind: 'SelectionSet',
+        selections: [
+          {
+            kind: 'Field',
+            name: { kind: 'Name', value: 'setProjectUserPassword' },
+            arguments: [
+              {
+                kind: 'Argument',
+                name: { kind: 'Name', value: 'input' },
+                value: { kind: 'Variable', name: { kind: 'Name', value: 'input' } },
+              },
+            ],
+            selectionSet: {
+              kind: 'SelectionSet',
+              selections: [
+                { kind: 'Field', name: { kind: 'Name', value: 'id' } },
+                { kind: 'Field', name: { kind: 'Name', value: 'name' } },
+                { kind: 'Field', name: { kind: 'Name', value: 'metadata' } },
+                { kind: 'Field', name: { kind: 'Name', value: 'createdAt' } },
+                { kind: 'Field', name: { kind: 'Name', value: 'updatedAt' } },
+              ],
+            },
+          },
+        ],
+      },
+    },
+  ],
+} as unknown as DocumentNode<
+  SetProjectUserPasswordMutation,
+  SetProjectUserPasswordMutationVariables
+>;
 export const UpdateUserDocument = {
   kind: 'Document',
   definitions: [

package/src/generated/resolvers.ts

@@ -271,6 +271,7 @@ export type ResolversTypes = ResolversObject<{
   CreateUserSessionInput: Types.CreateUserSessionInput;
   CreateWebhookSubscriptionMutationInput: Types.CreateWebhookSubscriptionMutationInput;
   CredentialExportData: ResolverTypeWrapper<Types.CredentialExportData>;
+  CredentialKind: Types.CredentialKind;
   Date: ResolverTypeWrapper<Types.Scalars['Date']['output']>;
   DeleteApiKeyInput: Types.DeleteApiKeyInput;
   DeleteMyAccountsInput: Types.DeleteMyAccountsInput;
@@ -281,6 +282,9 @@ export type ResolversTypes = ResolversObject<{
   EmailVerificationProofType: Types.EmailVerificationProofType;
   ExchangeApiKeyInput: Types.ExchangeApiKeyInput;
   ExchangeApiKeyResult: ResolverTypeWrapper<Types.ExchangeApiKeyResult>;
+  ExportProjectUserCredentialsInput: Types.ExportProjectUserCredentialsInput;
+  ExportedPasswordCredential: ResolverTypeWrapper<Types.ExportedPasswordCredential>;
+  ExportedProjectUserCredential: ResolverTypeWrapper<Types.ExportedProjectUserCredential>;
   GenerateMyMfaRecoveryCodesInput: Types.GenerateMyMfaRecoveryCodesInput;
   GetUserAuthenticationMethodsInput: Types.GetUserAuthenticationMethodsInput;
   GetUserSessionsInput: Types.GetUserSessionsInput;
@@ -385,7 +389,9 @@ export type ResolversTypes = ResolversObject<{
   ProjectTag: ResolverTypeWrapper<Types.ProjectTag>;
   ProjectUser: ResolverTypeWrapper<Types.ProjectUser>;
   ProjectUserApiKey: ResolverTypeWrapper<Types.ProjectUserApiKey>;
+  ProjectUserCredentialExport: ResolverTypeWrapper<Types.ProjectUserCredentialExport>;
   ProjectUserGroup: ResolverTypeWrapper<Types.ProjectUserGroup>;
+  ProjectUserPasswordCredential: ResolverTypeWrapper<Types.ProjectUserPasswordCredential>;
   ProjectUserPermission: ResolverTypeWrapper<Types.ProjectUserPermission>;
   Query: ResolverTypeWrapper<Record<PropertyKey, never>>;
   QueryAccountProjectApiKeysInput: Types.QueryAccountProjectApiKeysInput;
@@ -502,6 +508,7 @@ export type ResolversTypes = ResolversObject<{
   SetMyNotificationPreferenceInput: Types.SetMyNotificationPreferenceInput;
   SetMyPrimaryMfaDeviceInput: Types.SetMyPrimaryMfaDeviceInput;
   SetProjectUserEmailInput: Types.SetProjectUserEmailInput;
+  SetProjectUserPasswordInput: Types.SetProjectUserPasswordInput;
   SigningKey: ResolverTypeWrapper<Types.SigningKey>;
   SortOrder: Types.SortOrder;
   StartProjectExportInput: Types.StartProjectExportInput;
@@ -692,6 +699,9 @@ export type ResolversParentTypes = ResolversObject<{
   EmailVerificationProofInput: Types.EmailVerificationProofInput;
   ExchangeApiKeyInput: Types.ExchangeApiKeyInput;
   ExchangeApiKeyResult: Types.ExchangeApiKeyResult;
+  ExportProjectUserCredentialsInput: Types.ExportProjectUserCredentialsInput;
+  ExportedPasswordCredential: Types.ExportedPasswordCredential;
+  ExportedProjectUserCredential: Types.ExportedProjectUserCredential;
   GenerateMyMfaRecoveryCodesInput: Types.GenerateMyMfaRecoveryCodesInput;
   GetUserAuthenticationMethodsInput: Types.GetUserAuthenticationMethodsInput;
   GetUserSessionsInput: Types.GetUserSessionsInput;
@@ -772,7 +782,9 @@ export type ResolversParentTypes = ResolversObject<{
   ProjectTag: Types.ProjectTag;
   ProjectUser: Types.ProjectUser;
   ProjectUserApiKey: Types.ProjectUserApiKey;
+  ProjectUserCredentialExport: Types.ProjectUserCredentialExport;
   ProjectUserGroup: Types.ProjectUserGroup;
+  ProjectUserPasswordCredential: Types.ProjectUserPasswordCredential;
   ProjectUserPermission: Types.ProjectUserPermission;
   Query: Record<PropertyKey, never>;
   QueryAccountProjectApiKeysInput: Types.QueryAccountProjectApiKeysInput;
@@ -885,6 +897,7 @@ export type ResolversParentTypes = ResolversObject<{
   SetMyNotificationPreferenceInput: Types.SetMyNotificationPreferenceInput;
   SetMyPrimaryMfaDeviceInput: Types.SetMyPrimaryMfaDeviceInput;
   SetProjectUserEmailInput: Types.SetProjectUserEmailInput;
+  SetProjectUserPasswordInput: Types.SetProjectUserPasswordInput;
   SigningKey: Types.SigningKey;
   StartProjectExportInput: Types.StartProjectExportInput;
   String: Types.Scalars['String']['output'];
@@ -1325,6 +1338,28 @@ export type ExchangeApiKeyResultResolvers<
   expiresIn?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
 }>;
 
+export type ExportedPasswordCredentialResolvers<
+  ContextType = any,
+  ParentType extends ResolversParentTypes['ExportedPasswordCredential'] =
+    ResolversParentTypes['ExportedPasswordCredential'],
+> = ResolversObject<{
+  algorithm?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+  hash?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+}>;
+
+export type ExportedProjectUserCredentialResolvers<
+  ContextType = any,
+  ParentType extends ResolversParentTypes['ExportedProjectUserCredential'] =
+    ResolversParentTypes['ExportedProjectUserCredential'],
+> = ResolversObject<{
+  password?: Resolver<
+    Types.Maybe<ResolversTypes['ExportedPasswordCredential']>,
+    ParentType,
+    ContextType
+  >;
+  userId?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
+}>;
+
 export type GroupResolvers<
   ContextType = any,
   ParentType extends ResolversParentTypes['Group'] = ResolversParentTypes['Group'],
@@ -1968,6 +2003,12 @@ export type MutationResolvers<
     ContextType,
     RequireFields<Types.MutationSetProjectUserEmailArgs, 'input'>
   >;
+  setProjectUserPassword?: Resolver<
+    ResolversTypes['User'],
+    ParentType,
+    ContextType,
+    RequireFields<Types.MutationSetProjectUserPasswordArgs, 'input'>
+  >;
   setupMfa?: Resolver<ResolversTypes['MfaSetupResponse'], ParentType, ContextType>;
   startProjectExport?: Resolver<
     ResolversTypes['ProjectSyncJob'],
@@ -2846,6 +2887,14 @@ export type ProjectUserApiKeyResolvers<
   __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
 }>;
 
+export type ProjectUserCredentialExportResolvers<
+  ContextType = any,
+  ParentType extends ResolversParentTypes['ProjectUserCredentialExport'] =
+    ResolversParentTypes['ProjectUserCredentialExport'],
+> = ResolversObject<{
+  users?: Resolver<Array<ResolversTypes['ExportedProjectUserCredential']>, ParentType, ContextType>;
+}>;
+
 export type ProjectUserGroupResolvers<
   ContextType = any,
   ParentType extends ResolversParentTypes['ProjectUserGroup'] =
@@ -2861,6 +2910,16 @@ export type ProjectUserGroupResolvers<
   __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
 }>;
 
+export type ProjectUserPasswordCredentialResolvers<
+  ContextType = any,
+  ParentType extends ResolversParentTypes['ProjectUserPasswordCredential'] =
+    ResolversParentTypes['ProjectUserPasswordCredential'],
+> = ResolversObject<{
+  fingerprint?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+  source?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+  updatedAt?: Resolver<ResolversTypes['Date'], ParentType, ContextType>;
+}>;
+
 export type ProjectUserPermissionResolvers<
   ContextType = any,
   ParentType extends ResolversParentTypes['ProjectUserPermission'] =
@@ -2888,6 +2947,12 @@ export type QueryResolvers<
     RequireFields<Types.QueryApiKeysArgs, 'scope'>
   >;
   authSignupPolicy?: Resolver<ResolversTypes['AuthSignupPolicy'], ParentType, ContextType>;
+  exportProjectUserCredentials?: Resolver<
+    ResolversTypes['ProjectUserCredentialExport'],
+    ParentType,
+    ContextType,
+    RequireFields<Types.QueryExportProjectUserCredentialsArgs, 'input'>
+  >;
   groups?: Resolver<
     ResolversTypes['GroupPage'],
     ParentType,
@@ -3445,6 +3510,11 @@ export type UserResolvers<
   id?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
   metadata?: Resolver<ResolversTypes['JSON'], ParentType, ContextType>;
   name?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+  passwordCredential?: Resolver<
+    Types.Maybe<ResolversTypes['ProjectUserPasswordCredential']>,
+    ParentType,
+    ContextType
+  >;
   permissionCount?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
   pictureUrl?: Resolver<Types.Maybe<ResolversTypes['String']>, ParentType, ContextType>;
   primaryTag?: Resolver<Types.Maybe<ResolversTypes['Tag']>, ParentType, ContextType>;
@@ -3766,6 +3836,8 @@ export type Resolvers<ContextType = any> = ResolversObject<{
   CredentialExportData?: CredentialExportDataResolvers<ContextType>;
   Date?: GraphQLScalarType;
   ExchangeApiKeyResult?: ExchangeApiKeyResultResolvers<ContextType>;
+  ExportedPasswordCredential?: ExportedPasswordCredentialResolvers<ContextType>;
+  ExportedProjectUserCredential?: ExportedProjectUserCredentialResolvers<ContextType>;
   Group?: GroupResolvers<ContextType>;
   GroupPage?: GroupPageResolvers<ContextType>;
   GroupPermission?: GroupPermissionResolvers<ContextType>;
@@ -3824,7 +3896,9 @@ export type Resolvers<ContextType = any> = ResolversObject<{
   ProjectTag?: ProjectTagResolvers<ContextType>;
   ProjectUser?: ProjectUserResolvers<ContextType>;
   ProjectUserApiKey?: ProjectUserApiKeyResolvers<ContextType>;
+  ProjectUserCredentialExport?: ProjectUserCredentialExportResolvers<ContextType>;
   ProjectUserGroup?: ProjectUserGroupResolvers<ContextType>;
+  ProjectUserPasswordCredential?: ProjectUserPasswordCredentialResolvers<ContextType>;
   ProjectUserPermission?: ProjectUserPermissionResolvers<ContextType>;
   Query?: QueryResolvers<ContextType>;
   RefreshSessionResponse?: RefreshSessionResponseResolvers<ContextType>;

package/src/generated/schema-types.ts

@@ -808,6 +808,15 @@ export type CredentialExportData = {
   updatedAt: Scalars['Date']['output'];
 };
 
+/**
+ * A kind of credential that can be exported. Extensible: a later kind is added here,
+ * not as a second export.
+ */
+export enum CredentialKind {
+  /** The project password credential (bcrypt hash). */
+  Password = 'PASSWORD',
+}
+
 export type DeleteApiKeyInput = {
   hardDelete?: InputMaybe<Scalars['Boolean']['input']>;
   id: Scalars['ID']['input'];
@@ -853,6 +862,31 @@ export type ExchangeApiKeyResult = {
   expiresIn: Scalars['Int']['output'];
 };
 
+export type ExportProjectUserCredentialsInput = {
+  /** Credential kinds to export. Defaults to `[PASSWORD]`. */
+  kinds?: InputMaybe<Array<CredentialKind>>;
+  /** Project scope the members belong to. */
+  scope: Scope;
+  /** Project members to export. Every id must be a member of the project, otherwise the whole call fails with not found (no partial export). */
+  userIds: Array<Scalars['ID']['input']>;
+};
+
+/** A stored password hash in CDM shape. Secret-equivalent: handle like a credential. */
+export type ExportedPasswordCredential = {
+  __typename?: 'ExportedPasswordCredential';
+  /** Hash algorithm, for example `bcrypt`. */
+  algorithm: Scalars['String']['output'];
+  /** The stored hash string. */
+  hash: Scalars['String']['output'];
+};
+
+export type ExportedProjectUserCredential = {
+  __typename?: 'ExportedProjectUserCredential';
+  /** `null` when the member has no project password credential. */
+  password?: Maybe<ExportedPasswordCredential>;
+  userId: Scalars['ID']['output'];
+};
+
 export type GenerateMyMfaRecoveryCodesInput = {
   factorId?: InputMaybe<Scalars['ID']['input']>;
 };
@@ -1295,6 +1329,14 @@ export type Mutation = {
    * `project.user_email_changed` carries ids only, never the address.
    */
   setProjectUserEmail: User;
+  /**
+   * Set or replace a project member's password. Project scopes only: the operator supplies the
+   * password, and the password policy is enforced server-side. Writes the project credential with
+   * source `admin-set` (a later CDM import never overwrites it) and revokes the user's project-app grants.
+   * The password is never returned, logged or carried by any event; `project.user_password_set`
+   * carries ids and the credential source only.
+   */
+  setProjectUserPassword: User;
   setupMfa: MfaSetupResponse;
   /**
    * Enqueue an asynchronous CDM **export** job for the given project. The worker
@@ -1661,6 +1703,10 @@ export type MutationSetProjectUserEmailArgs = {
   input: SetProjectUserEmailInput;
 };
 
+export type MutationSetProjectUserPasswordArgs = {
+  input: SetProjectUserPasswordInput;
+};
+
 export type MutationStartProjectExportArgs = {
   id: Scalars['ID']['input'];
   input: StartProjectExportInput;
@@ -2534,6 +2580,12 @@ export type ProjectUserApiKey = Auditable & {
   userId: Scalars['ID']['output'];
 };
 
+/** Result of `exportProjectUserCredentials`. This is the one place a credential hash leaves Grant. */
+export type ProjectUserCredentialExport = {
+  __typename?: 'ProjectUserCredentialExport';
+  users: Array<ExportedProjectUserCredential>;
+};
+
 export type ProjectUserGroup = Auditable & {
   __typename?: 'ProjectUserGroup';
   createdAt: Scalars['Date']['output'];
@@ -2545,6 +2597,20 @@ export type ProjectUserGroup = Auditable & {
   userId: Scalars['ID']['output'];
 };
 
+/** Non-secret facts about a user's project password credential. Never contains the hash or the password. */
+export type ProjectUserPasswordCredential = {
+  __typename?: 'ProjectUserPasswordCredential';
+  /**
+   * Lowercase hex SHA-256 of the stored hash string. A change detector, not a secret: it lets a
+   * caller see that the password changed without learning anything usable from it.
+   */
+  fingerprint: Scalars['String']['output'];
+  /** How the credential was written (for example `reset`, `cdm-import` or `admin-set`). A plain string: the schema has no credential-source enum. */
+  source: Scalars['String']['output'];
+  /** When the stored credential last changed. */
+  updatedAt: Scalars['Date']['output'];
+};
+
 export type ProjectUserPermission = Auditable & {
   __typename?: 'ProjectUserPermission';
   createdAt: Scalars['Date']['output'];
@@ -2562,6 +2628,14 @@ export type Query = {
   apiKeys: ApiKeyPage;
   /** Public signup policy. No authentication required. */
   authSignupPolicy: AuthSignupPolicy;
+  /**
+   * Export project members' password hashes in CDM shape, for a downstream identity mirror.
+   * This is the one audited exception to "APIs expose only whether a password exists": it
+   * requires `ProjectUser:ExportCredentials` (held by no standard group), every call is audited,
+   * and it returns hashes. Any non-member in `userIds` fails the whole call; members without a
+   * project credential are listed with `password: null`.
+   */
+  exportProjectUserCredentials: ProjectUserCredentialExport;
   groups: GroupPage;
   invitation?: Maybe<OrganizationInvitation>;
   /** Evaluate authorization for the current session or API key token. */
@@ -2630,6 +2704,10 @@ export type QueryApiKeysArgs = {
   sort?: InputMaybe<ApiKeySortInput>;
 };
 
+export type QueryExportProjectUserCredentialsArgs = {
+  input: ExportProjectUserCredentialsInput;
+};
+
 export type QueryGroupsArgs = {
   ids?: InputMaybe<Array<Scalars['ID']['input']>>;
   limit?: InputMaybe<Scalars['Int']['input']>;
@@ -3565,6 +3643,16 @@ export type SetProjectUserEmailInput = {
   userId: Scalars['ID']['input'];
 };
 
+export type SetProjectUserPasswordInput = {
+  /**
+   * The new password, chosen by the operator. Project-scope only. The password policy is enforced
+   * server-side; the value is never returned, logged or carried by any event.
+   */
+  password: Scalars['String']['input'];
+  scope: Scope;
+  userId: Scalars['ID']['input'];
+};
+
 /**
  * Signing key for a scope (e.g. project). Used for RS256 API key tokens; public key is exposed in JWKS.
  * Only project scopes (accountProject, organizationProject) have manageable keys; system key is internal.
@@ -4135,6 +4223,13 @@ export type User = Auditable & {
   id: Scalars['ID']['output'];
   metadata: Scalars['JSON']['output'];
   name: Scalars['String']['output'];
+  /**
+   * Non-secret facts about the user's password credential in the request's project scope. `null` outside a
+   * project scope, when the user has no project credential there, or when the caller lacks
+   * `ProjectUser:ExportCredentials` (never an error). `fingerprint` is the lowercase hex SHA-256 of the
+   * stored hash string: a change detector, not a secret. The password and the hash are never returned here.
+   */
+  passwordCredential?: Maybe<ProjectUserPasswordCredential>;
   permissionCount: Scalars['Int']['output'];
   pictureUrl?: Maybe<Scalars['String']['output']>;
   primaryTag?: Maybe<Tag>;

package/src/operations/project-users/exportProjectUserCredentials.graphql

@@ -0,0 +1,11 @@
+query ExportProjectUserCredentials($input: ExportProjectUserCredentialsInput!) {
+  exportProjectUserCredentials(input: $input) {
+    users {
+      userId
+      password {
+        algorithm
+        hash
+      }
+    }
+  }
+}

package/src/operations/users/setProjectUserPassword.graphql

@@ -0,0 +1,9 @@
+mutation SetProjectUserPassword($input: SetProjectUserPasswordInput!) {
+  setProjectUserPassword(input: $input) {
+    id
+    name
+    metadata
+    createdAt
+    updatedAt
+  }
+}

package/src/schema/project-users/inputs/export-project-user-credentials.graphql

@@ -0,0 +1,8 @@
+input ExportProjectUserCredentialsInput {
+  "Project scope the members belong to."
+  scope: Scope!
+  "Project members to export. Every id must be a member of the project, otherwise the whole call fails with not found (no partial export)."
+  userIds: [ID!]!
+  "Credential kinds to export. Defaults to `[PASSWORD]`."
+  kinds: [CredentialKind!] = [PASSWORD]
+}

package/src/schema/project-users/queries/export-project-user-credentials.graphql

@@ -0,0 +1,12 @@
+extend type Query {
+  """
+  Export project members' password hashes in CDM shape, for a downstream identity mirror.
+  This is the one audited exception to "APIs expose only whether a password exists": it
+  requires `ProjectUser:ExportCredentials` (held by no standard group), every call is audited,
+  and it returns hashes. Any non-member in `userIds` fails the whole call; members without a
+  project credential are listed with `password: null`.
+  """
+  exportProjectUserCredentials(
+    input: ExportProjectUserCredentialsInput!
+  ): ProjectUserCredentialExport!
+}

package/src/schema/project-users/types/credential-kind.graphql

@@ -0,0 +1,8 @@
+"""
+A kind of credential that can be exported. Extensible: a later kind is added here,
+not as a second export.
+"""
+enum CredentialKind {
+  "The project password credential (bcrypt hash)."
+  PASSWORD
+}

package/src/schema/project-users/types/project-user-credential-export.graphql

@@ -0,0 +1,22 @@
+"""
+Result of `exportProjectUserCredentials`. This is the one place a credential hash leaves Grant.
+"""
+type ProjectUserCredentialExport {
+  users: [ExportedProjectUserCredential!]!
+}
+
+type ExportedProjectUserCredential {
+  userId: ID!
+  "`null` when the member has no project password credential."
+  password: ExportedPasswordCredential
+}
+
+"""
+A stored password hash in CDM shape. Secret-equivalent: handle like a credential.
+"""
+type ExportedPasswordCredential {
+  "Hash algorithm, for example `bcrypt`."
+  algorithm: String!
+  "The stored hash string."
+  hash: String!
+}

package/src/schema/project-users/types/project-user-password-credential.graphql

@@ -0,0 +1,14 @@
+"""
+Non-secret facts about a user's project password credential. Never contains the hash or the password.
+"""
+type ProjectUserPasswordCredential {
+  "How the credential was written (for example `reset`, `cdm-import` or `admin-set`). A plain string: the schema has no credential-source enum."
+  source: String!
+  "When the stored credential last changed."
+  updatedAt: Date!
+  """
+  Lowercase hex SHA-256 of the stored hash string. A change detector, not a secret: it lets a
+  caller see that the password changed without learning anything usable from it.
+  """
+  fingerprint: String!
+}

package/src/schema/users/inputs/set-project-user-password.graphql

@@ -0,0 +1,9 @@
+input SetProjectUserPasswordInput {
+  userId: ID!
+  """
+  The new password, chosen by the operator. Project-scope only. The password policy is enforced
+  server-side; the value is never returned, logged or carried by any event.
+  """
+  password: String!
+  scope: Scope!
+}

package/src/schema/users/mutations/set-project-user-password.graphql

@@ -0,0 +1,10 @@
+extend type Mutation {
+  """
+  Set or replace a project member's password. Project scopes only: the operator supplies the
+  password, and the password policy is enforced server-side. Writes the project credential with
+  source `admin-set` (a later CDM import never overwrites it) and revokes the user's project-app grants.
+  The password is never returned, logged or carried by any event; `project.user_password_set`
+  carries ids and the credential source only.
+  """
+  setProjectUserPassword(input: SetProjectUserPasswordInput!): User!
+}

package/src/schema/users/types/user.graphql

@@ -14,6 +14,13 @@ type User implements Auditable {
   tagCount: Int!
   authenticationMethods: [UserAuthenticationMethod!]
   accounts: [Account!]
+  """
+  Non-secret facts about the user's password credential in the request's project scope. `null` outside a
+  project scope, when the user has no project credential there, or when the caller lacks
+  `ProjectUser:ExportCredentials` (never an error). `fingerprint` is the lowercase hex SHA-256 of the
+  stored hash string: a change detector, not a secret. The password and the hash are never returned here.
+  """
+  passwordCredential: ProjectUserPasswordCredential
   createdAt: Date!
   updatedAt: Date!
   deletedAt: Date

package/src/sdl-contract.test.ts

@@ -52,10 +52,11 @@ describe('operation documents', () => {
   // 136 after closed-install: AuthSignupPolicyDocument (publicSignupEnabled, bootstrapOpen).
   // 137 after CDM imports by reference: RequestProjectSyncUploadUrlDocument.
   // 138 after operator-set-email: SetProjectUserEmailDocument.
+  // 140 after operator-set-password: SetProjectUserPasswordDocument, ExportProjectUserCredentialsDocument.
   // Updating this number is the point of the pin, not a nuisance: every change
   // to it should be a line in a commit message.
   it('finds every document under src/operations', () => {
-    expect(files).toHaveLength(138);
+    expect(files).toHaveLength(140);
   });
 
   it.each(files.map((f) => [relative(process.cwd(), f), f]))('%s validates', (_label, file) => {
@@ -68,7 +69,7 @@ describe('graph reachability', () => {
   const schema = buildMergedSchema();
 
   /**
-   * 175 of 382 declared types cannot be reached from Query or Mutation. They are
+   * 175 of 389 declared types cannot be reached from Query or Mutation. They are
    * not dead: most are consumed as generated TypeScript by apps/api, and the
    * *SearchableField enums are runtime search configuration. But every one of them
    * ships in the schema `makeExecutableSchema` serves.
@@ -81,6 +82,12 @@ describe('graph reachability', () => {
    * Was 181 of 388 before pass 5 slice 4 removed six declarations that were
    * unreferenced in SDL and in all TypeScript. The reachable count did not change
    * (207 before and after), which is what makes those six safe to have deleted.
+   *
+   * operator-set-password declared seven types (382 -> 389 declared). While
+   * `passwordCredential` sat on `ProjectUser`, which no query or mutation returns,
+   * `ProjectUserPasswordCredential` was unreachable and the pin was 176. It now sits on
+   * `User`, so the type is reachable and the pin is back to 175; the other six new
+   * types are reachable through the new mutation and query.
    */
   const UNREACHABLE_FROM_ROOT = 175;