@proteinjs/user-server 1.10.0 → 1.10.2

package/dist/test/DevLoginStaleCookieFirstHit.test.js

@@ -0,0 +1,401 @@
+"use strict";
+var __extends = (this && this.__extends) || (function () {
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (Object.prototype.hasOwnProperty.call(b, p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
+    return function (d, b) {
+        if (typeof b !== "function" && b !== null)
+            throw new TypeError("Class extends value " + String(b) + " is not a constructor or null");
+        extendStatics(d, b);
+        function __() { this.constructor = d; }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+    };
+})();
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var http_1 = __importDefault(require("http"));
+var express_session_1 = __importStar(require("express-session"));
+var passport_1 = __importDefault(require("passport"));
+var devLogin_1 = require("../src/routes/devLogin");
+var UserServerTestEnvironment_1 = require("./UserServerTestEnvironment");
+var testEnv = new UserServerTestEnvironment_1.UserServerTestEnvironment();
+/**
+ * DEV_SMOKE_OVERNIGHT (2026-08-26) finding 7: a browser holding a STALE session cookie (a sid
+ * absent from the store — prior server generation, swept row, or reseeded dev db) hits
+ * `GET /dev/login`, gets the 302, and lands on the LOGIN FORM; the second hit lands home.
+ *
+ * The mechanism is write-ordering at the session-establishment seam: a browser follows a redirect
+ * the moment RESPONSE HEADERS arrive — it never waits for the body. So the session row for the
+ * sid named by the 302's Set-Cookie must be COMMITTED to the store before those headers flush.
+ * passport 0.6's `request.login` guarantees exactly that (regenerate → bind → save, committed
+ * before the login callback — see establishSession); under a pre-0.6 passport runtime the save
+ * is deferred to express-session's end-of-response proxy, whose split-response write flushes the
+ * 302's headers BEFORE the store write commits — the redirected navigation races the commit and
+ * loses, reads no session, and the SPA routes to /login.
+ *
+ * This suite drives the REAL stack a browser meets — express-session 1.17.1 (the exact
+ * @proteinjs/server configureSession options and dev cookie-name shape) + real passport +
+ * the devLogin route — against a store with honest commit latency, and asserts the contract
+ * from the client's side: follow the 302 the instant headers arrive, carrying exactly the
+ * cookies the response set, and the follow-up MUST read as authenticated on the FIRST pass.
+ */
+var SESSION_COOKIE_NAME = 'n3xa.sid.9876'; // dev cookie-name shape: n3xa.sid.${SERVER_PORT}
+var SESSION_SECRET = 'dev-first-hit-test-secret';
+var ENV_EMAIL = 'dev@test.local';
+/** Store commit latency. Generous so a pre-0.6 runtime (write racing the redirect) loses the
+ *  race DETERMINISTICALLY; under the passport 0.6 contract the row commits before the redirect
+ *  is even issued, so green never depends on this number. */
+var COMMIT_LATENCY_MS = 150;
+var READ_LATENCY_MS = 5;
+/**
+ * In-memory session store with DbSessionStore's contract: callbacks fire only after the
+ * operation commits, and commits take real time (Spanner in dev). Rows are inspectable so the
+ * test can assert store truth directly and clear it to model a next server generation.
+ */
+var CommitLatencySessionStore = /** @class */ (function (_super) {
+    __extends(CommitLatencySessionStore, _super);
+    function CommitLatencySessionStore() {
+        var _this = _super !== null && _super.apply(this, arguments) || this;
+        _this.rows = new Map();
+        _this.get = function (sessionId, cb) {
+            var timer = setTimeout(function () {
+                var row = _this.rows.get(sessionId);
+                cb(null, row ? JSON.parse(row) : undefined);
+            }, READ_LATENCY_MS);
+            timer.unref();
+        };
+        _this.set = function (sessionId, session, cb) {
+            var timer = setTimeout(function () {
+                _this.rows.set(sessionId, JSON.stringify(session));
+                if (cb) {
+                    cb();
+                }
+            }, COMMIT_LATENCY_MS);
+            timer.unref();
+        };
+        _this.destroy = function (sessionId, cb) {
+            var timer = setTimeout(function () {
+                _this.rows.delete(sessionId);
+                if (cb) {
+                    cb();
+                }
+            }, READ_LATENCY_MS);
+            timer.unref();
+        };
+        return _this;
+    }
+    return CommitLatencySessionStore;
+}(express_session_1.Store));
+describe('devLogin first hit through the real session middleware stack', function () {
+    var originalEnv = {
+        DEVELOPMENT: process.env.DEVELOPMENT,
+        DEV_AUTO_LOGIN_EMAIL: process.env.DEV_AUTO_LOGIN_EMAIL,
+    };
+    var store = new CommitLatencySessionStore();
+    var server;
+    var port;
+    beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.beforeAll()];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, testEnv.createUser({ name: 'Dev Default', email: ENV_EMAIL })];
+                case 2:
+                    _a.sent();
+                    server = createServerWithRealSessionStack(store);
+                    return [4 /*yield*/, new Promise(function (resolve) { return server.listen(0, resolve); })];
+                case 3:
+                    _a.sent();
+                    port = server.address().port;
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    afterAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, new Promise(function (resolve, reject) { return server.close(function (error) { return (error ? reject(error) : resolve()); }); })];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, testEnv.afterAll()];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    beforeEach(function () {
+        process.env.DEVELOPMENT = 'true';
+        process.env.DEV_AUTO_LOGIN_EMAIL = ENV_EMAIL;
+    });
+    afterEach(function () {
+        for (var _i = 0, _a = Object.entries(originalEnv); _i < _a.length; _i++) {
+            var _b = _a[_i], key = _b[0], value = _b[1];
+            if (value === undefined) {
+                delete process.env[key];
+            }
+            else {
+                process.env[key] = value;
+            }
+        }
+    });
+    it('stale-cookie first hit: following the 302 on HEADERS reads as authenticated, first pass', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var priorHit, staleCookie, firstHit, followUpCookie, followUp;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, request(port, '/dev/login', { waitForBody: true })];
+                case 1:
+                    priorHit = _a.sent();
+                    staleCookie = sessionCookiePair(priorHit);
+                    store.rows.clear();
+                    return [4 /*yield*/, request(port, '/dev/login', { cookie: staleCookie })];
+                case 2:
+                    firstHit = _a.sent();
+                    expect(firstHit.statusCode).toBe(302);
+                    expect(firstHit.headers.location).toBe('/');
+                    followUpCookie = sessionCookiePair(firstHit);
+                    expect(sidOf(followUpCookie)).not.toBe(sidOf(staleCookie));
+                    return [4 /*yield*/, request(port, '/whoami', { cookie: followUpCookie, waitForBody: true })];
+                case 3:
+                    followUp = _a.sent();
+                    expect(JSON.parse(followUp.body)).toEqual({ user: ENV_EMAIL });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('cookieless first hit: same first-pass guarantee for a fresh browser', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var firstHit, followUp;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    store.rows.clear();
+                    return [4 /*yield*/, request(port, '/dev/login')];
+                case 1:
+                    firstHit = _a.sent();
+                    expect(firstHit.statusCode).toBe(302);
+                    return [4 /*yield*/, request(port, '/whoami', { cookie: sessionCookiePair(firstHit), waitForBody: true })];
+                case 2:
+                    followUp = _a.sent();
+                    expect(JSON.parse(followUp.body)).toEqual({ user: ENV_EMAIL });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+/**
+ * The real middleware stack a request traverses in front of the route — express-session with
+ * @proteinjs/server configureSession's exact options (resave: false, saveUninitialized: false,
+ * rolling: true, the dev port-scoped cookie name) + passport initialize/session with the
+ * identity (de)serialization @proteinjs/server registers — on a raw node http server, so
+ * header-flush timing is the genuine article.
+ */
+function createServerWithRealSessionStack(store) {
+    var sixtyDays = 1000 * 60 * 60 * 24 * 60;
+    var sessionMiddleware = (0, express_session_1.default)({
+        name: SESSION_COOKIE_NAME,
+        secret: SESSION_SECRET,
+        store: store,
+        resave: false,
+        saveUninitialized: false,
+        cookie: { maxAge: sixtyDays },
+        rolling: true,
+    });
+    var authenticator = new passport_1.default.Passport();
+    authenticator.serializeUser(function (user, done) { return done(null, user); });
+    authenticator.deserializeUser(function (id, done) { return done(null, id); });
+    var middleware = [
+        sessionMiddleware,
+        authenticator.initialize(),
+        authenticator.session(),
+    ];
+    return http_1.default.createServer(function (req, res) {
+        runMiddleware(middleware, req, res, function (error) {
+            if (error) {
+                res.statusCode = 500;
+                res.end(String(error));
+                return;
+            }
+            void dispatch(req, res);
+        });
+    });
+}
+function runMiddleware(middleware, req, res, done) {
+    var next = function (index) { return function (error) {
+        if (error || index >= middleware.length) {
+            done(error);
+            return;
+        }
+        middleware[index](req, res, next(index + 1));
+    }; };
+    next(0)();
+}
+function dispatch(req, res) {
+    var _a, _b, _c;
+    return __awaiter(this, void 0, void 0, function () {
+        var url, request_1, query_1, error_1, session;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    url = new URL((_a = req.url) !== null && _a !== void 0 ? _a : '/', 'http://localhost');
+                    if (!(url.pathname === '/dev/login')) return [3 /*break*/, 5];
+                    request_1 = req;
+                    query_1 = {};
+                    url.searchParams.forEach(function (value, key) { return (query_1[key] = value); });
+                    request_1.query = query_1;
+                    _d.label = 1;
+                case 1:
+                    _d.trys.push([1, 3, , 4]);
+                    return [4 /*yield*/, devLogin_1.devLogin.onRequest(req, expressResponseShim(res))];
+                case 2:
+                    _d.sent();
+                    return [3 /*break*/, 4];
+                case 3:
+                    error_1 = _d.sent();
+                    // Mirrors @proteinjs/server's wrapRoute: a route throw is caught and logged, never a
+                    // hung response. (There it falls through to the star route; here we end with 500.)
+                    console.error(error_1);
+                    if (!res.writableEnded) {
+                        res.statusCode = 500;
+                        res.end();
+                    }
+                    return [3 /*break*/, 4];
+                case 4: return [2 /*return*/];
+                case 5:
+                    if (url.pathname === '/whoami') {
+                        session = req.session;
+                        res.setHeader('Content-Type', 'application/json');
+                        res.end(JSON.stringify({ user: (_c = (_b = session === null || session === void 0 ? void 0 : session.passport) === null || _b === void 0 ? void 0 : _b.user) !== null && _c !== void 0 ? _c : null }));
+                        return [2 /*return*/];
+                    }
+                    res.statusCode = 404;
+                    res.end();
+                    return [2 /*return*/];
+            }
+        });
+    });
+}
+/** The express response surface devLogin touches, over the RAW response object — so
+ *  express-session's proxied `res.end` (the commit point under test) is the one that runs. */
+function expressResponseShim(res) {
+    var shim = {
+        status: function (code) {
+            res.statusCode = code;
+            return shim;
+        },
+        send: function (body) {
+            res.end(body === undefined ? undefined : String(body));
+        },
+        redirect: function (path) {
+            var body = "Found. Redirecting to ".concat(path);
+            res.statusCode = 302;
+            res.setHeader('Location', path);
+            res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+            res.setHeader('Content-Length', Buffer.byteLength(body));
+            res.end(body);
+        },
+    };
+    return shim;
+}
+/**
+ * GET `path`. By default resolves the moment response HEADERS arrive (browser-following-a-
+ * redirect semantics — the body may still be in flight and its socket is left to drain);
+ * `waitForBody` resolves after the full body, which with express-session's end proxy also
+ * means the response's session write has committed.
+ */
+function request(port, path, options) {
+    if (options === void 0) { options = {}; }
+    return new Promise(function (resolve, reject) {
+        var clientRequest = http_1.default.get({ port: port, path: path, headers: options.cookie ? { cookie: options.cookie } : {}, agent: false }, function (res) {
+            if (!options.waitForBody) {
+                resolve({ statusCode: res.statusCode, headers: res.headers });
+                res.resume();
+                return;
+            }
+            var body = '';
+            res.on('data', function (chunk) { return (body += chunk); });
+            res.on('end', function () { return resolve({ statusCode: res.statusCode, headers: res.headers, body: body }); });
+        });
+        clientRequest.on('error', reject);
+    });
+}
+/** The `name=value` pair of the response's session Set-Cookie — what the browser sends back. */
+function sessionCookiePair(response) {
+    var _a;
+    var setCookies = (_a = response.headers['set-cookie']) !== null && _a !== void 0 ? _a : [];
+    var sessionCookie = setCookies.find(function (cookie) { return cookie.startsWith("".concat(SESSION_COOKIE_NAME, "=")); });
+    if (!sessionCookie) {
+        throw new Error("response set no ".concat(SESSION_COOKIE_NAME, " cookie (Set-Cookie: ").concat(JSON.stringify(setCookies), ")"));
+    }
+    return sessionCookie.split(';')[0];
+}
+/** The raw sid inside a signed session cookie pair (`name=s%3A<sid>.<signature>`). */
+function sidOf(cookiePair) {
+    var value = decodeURIComponent(cookiePair.slice(cookiePair.indexOf('=') + 1));
+    return value.startsWith('s:') ? value.slice(2, value.indexOf('.')) : value;
+}
+//# sourceMappingURL=DevLoginStaleCookieFirstHit.test.js.map

package/dist/test/DevLoginStaleCookieFirstHit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DevLoginStaleCookieFirstHit.test.js","sourceRoot":"","sources":["../../test/DevLoginStaleCookieFirstHit.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8CAAwB;AAExB,iEAAwD;AACxD,sDAAgC;AAChC,mDAAkD;AAClD,yEAAwE;AAExE,IAAM,OAAO,GAAG,IAAI,qDAAyB,EAAE,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,IAAM,mBAAmB,GAAG,eAAe,CAAC,CAAC,iDAAiD;AAC9F,IAAM,cAAc,GAAG,2BAA2B,CAAC;AACnD,IAAM,SAAS,GAAG,gBAAgB,CAAC;AACnC;;6DAE6D;AAC7D,IAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,IAAM,eAAe,GAAG,CAAC,CAAC;AAE1B;;;;GAIG;AACH;IAAwC,6CAAK;IAA7C;QAAA,qEA8BC;QA7BU,UAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;QAE1C,SAAG,GAAG,UAAC,SAAiB,EAAE,EAAkE;YAC1F,IAAM,KAAK,GAAG,UAAU,CAAC;gBACvB,IAAM,GAAG,GAAG,KAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACrC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC9C,CAAC,EAAE,eAAe,CAAC,CAAC;YACpB,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC,CAAC;QAEF,SAAG,GAAG,UAAC,SAAiB,EAAE,OAA4B,EAAE,EAA8B;YACpF,IAAM,KAAK,GAAG,UAAU,CAAC;gBACvB,KAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,IAAI,EAAE,EAAE;oBACN,EAAE,EAAE,CAAC;iBACN;YACH,CAAC,EAAE,iBAAiB,CAAC,CAAC;YACtB,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC,CAAC;QAEF,aAAO,GAAG,UAAC,SAAiB,EAAE,EAA8B;YAC1D,IAAM,KAAK,GAAG,UAAU,CAAC;gBACvB,KAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC5B,IAAI,EAAE,EAAE;oBACN,EAAE,EAAE,CAAC;iBACN;YACH,CAAC,EAAE,eAAe,CAAC,CAAC;YACpB,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC,CAAC;;IACJ,CAAC;IAAD,gCAAC;AAAD,CAAC,AA9BD,CAAwC,uBAAK,GA8B5C;AAMD,QAAQ,CAAC,8DAA8D,EAAE;IACvE,IAAM,WAAW,GAAG;QAClB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;QACpC,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;KACvD,CAAC;IACF,IAAM,KAAK,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAC9C,IAAI,MAAmB,CAAC;IACxB,IAAI,IAAY,CAAC;IAEjB,SAAS,CAAC;;;wBACR,qBAAM,OAAO,CAAC,SAAS,EAAE,EAAA;;oBAAzB,SAAyB,CAAC;oBAC1B,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAA;;oBAAnE,SAAmE,CAAC;oBACpE,MAAM,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAC;oBACjD,qBAAM,IAAI,OAAO,CAAO,UAAC,OAAO,IAAK,OAAA,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,EAAzB,CAAyB,CAAC,EAAA;;oBAA/D,SAA+D,CAAC;oBAChE,IAAI,GAAI,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;;;;SAC/C,CAAC,CAAC;IAEH,QAAQ,CAAC;;;wBACP,qBAAM,IAAI,OAAO,CAAO,UAAC,OAAO,EAAE,MAAM,IAAK,OAAA,MAAM,CAAC,KAAK,CAAC,UAAC,KAAK,IAAK,OAAA,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAnC,CAAmC,CAAC,EAA5D,CAA4D,CAAC,EAAA;;oBAA1G,SAA0G,CAAC;oBAC3G,qBAAM,OAAO,CAAC,QAAQ,EAAE,EAAA;;oBAAxB,SAAwB,CAAC;;;;SAC1B,CAAC,CAAC;IAEH,UAAU,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC;QACR,KAA2B,UAA2B,EAA3B,KAAA,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAA3B,cAA2B,EAA3B,IAA2B,EAAE;YAA7C,IAAA,WAAY,EAAX,GAAG,QAAA,EAAE,KAAK,QAAA;YACpB,IAAI,KAAK,KAAK,SAAS,EAAE;gBACvB,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;aACzB;iBAAM;gBACL,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;aAC1B;SACF;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE;;;;wBAG3E,qBAAM,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAA;;oBAAnE,QAAQ,GAAG,SAAwD;oBACnE,WAAW,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;oBAChD,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAIF,qBAAM,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EAAA;;oBAArE,QAAQ,GAAG,SAA0D;oBAC3E,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACtC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAGtC,cAAc,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;oBACnD,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;oBAI1C,qBAAM,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAA;;oBAAxF,QAAQ,GAAG,SAA6E;oBAC9F,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;;;;SACjE,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE;;;;;oBACxE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAEF,qBAAM,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,EAAA;;oBAA5C,QAAQ,GAAG,SAAiC;oBAClD,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAErB,qBAAM,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAA;;oBAArG,QAAQ,GAAG,SAA0F;oBAC3G,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;;;;SACjE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,SAAS,gCAAgC,CAAC,KAAY;IACpD,IAAM,SAAS,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAC3C,IAAM,iBAAiB,GAAG,IAAA,yBAAc,EAAC;QACvC,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,cAAc;QACtB,KAAK,OAAA;QACL,MAAM,EAAE,KAAK;QACb,iBAAiB,EAAE,KAAK;QACxB,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;QAC7B,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IACH,IAAM,aAAa,GAAG,IAAI,kBAAQ,CAAC,QAAQ,EAAE,CAAC;IAC9C,aAAa,CAAC,aAAa,CAAC,UAAC,IAAa,EAAE,IAA0C,IAAK,OAAA,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAhB,CAAgB,CAAC,CAAC;IAC7G,aAAa,CAAC,eAAe,CAAC,UAAC,EAAW,EAAE,IAA4C,IAAK,OAAA,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAd,CAAc,CAAC,CAAC;IAC7G,IAAM,UAAU,GAAiB;QAC/B,iBAA0C;QAC1C,aAAa,CAAC,UAAU,EAA2B;QACnD,aAAa,CAAC,OAAO,EAA2B;KACjD,CAAC;IAEF,OAAO,cAAI,CAAC,YAAY,CAAC,UAAC,GAAG,EAAE,GAAG;QAChC,aAAa,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,UAAC,KAAe;YAClD,IAAI,KAAK,EAAE;gBACT,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACvB,OAAO;aACR;YACD,KAAK,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CACpB,UAAwB,EACxB,GAAyB,EACzB,GAAwB,EACxB,IAA+B;IAE/B,IAAM,IAAI,GAAG,UAAC,KAAa,IAAK,OAAA,UAAC,KAAe;QAC9C,IAAI,KAAK,IAAI,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE;YACvC,IAAI,CAAC,KAAK,CAAC,CAAC;YACZ,OAAO;SACR;QACD,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,EAN+B,CAM/B,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACZ,CAAC;AAED,SAAe,QAAQ,CAAC,GAAyB,EAAE,GAAwB;;;;;;;oBACnE,GAAG,GAAG,IAAI,GAAG,CAAC,MAAA,GAAG,CAAC,GAAG,mCAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;yBACpD,CAAA,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAA,EAA7B,wBAA6B;oBACzB,YAAU,GAAuC,CAAC;oBAClD,UAAgC,EAAE,CAAC;oBACzC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,UAAC,KAAK,EAAE,GAAG,IAAK,OAAA,CAAC,OAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,EAApB,CAAoB,CAAC,CAAC;oBAC/D,SAAO,CAAC,KAAK,GAAG,OAAK,CAAC;;;;oBAEpB,qBAAM,mBAAQ,CAAC,SAAS,CAAC,GAAY,EAAE,mBAAmB,CAAC,GAAG,CAAU,CAAC,EAAA;;oBAAzE,SAAyE,CAAC;;;;oBAE1E,qFAAqF;oBACrF,mFAAmF;oBACnF,OAAO,CAAC,KAAK,CAAC,OAAK,CAAC,CAAC;oBACrB,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE;wBACtB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;wBACrB,GAAG,CAAC,GAAG,EAAE,CAAC;qBACX;;wBAEH,sBAAO;;oBAET,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE;wBAExB,OAAO,GAAI,GAA+D,CAAC,OAAO,CAAC;wBACzF,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;wBAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,0CAAE,IAAI,mCAAI,IAAI,EAAE,CAAC,CAAC,CAAC;wBACnE,sBAAO;qBACR;oBACD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,GAAG,EAAE,CAAC;;;;;CACX;AAED;8FAC8F;AAC9F,SAAS,mBAAmB,CAAC,GAAwB;IACnD,IAAM,IAAI,GAAG;QACX,MAAM,YAAC,IAAY;YACjB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,YAAC,IAAc;YACjB,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,QAAQ,YAAC,IAAY;YACnB,IAAM,IAAI,GAAG,gCAAyB,IAAI,CAAE,CAAC;YAC7C,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAChC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;YAC3D,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YACzD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;KACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,OAAO,CACd,IAAY,EACZ,IAAY,EACZ,OAAwD;IAAxD,wBAAA,EAAA,YAAwD;IAExD,OAAO,IAAI,OAAO,CAAC,UAAC,OAAO,EAAE,MAAM;QACjC,IAAM,aAAa,GAAG,cAAI,CAAC,GAAG,CAC5B,EAAE,IAAI,MAAA,EAAE,IAAI,MAAA,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EACvF,UAAC,GAAG;YACF,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;gBACxB,OAAO,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC9D,GAAG,CAAC,MAAM,EAAE,CAAC;gBACb,OAAO;aACR;YACD,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,UAAC,KAAK,IAAK,OAAA,CAAC,IAAI,IAAI,KAAK,CAAC,EAAf,CAAe,CAAC,CAAC;YAC3C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,cAAM,OAAA,OAAO,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,MAAA,EAAE,CAAC,EAAnE,CAAmE,CAAC,CAAC;QAC3F,CAAC,CACF,CAAC;QACF,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gGAAgG;AAChG,SAAS,iBAAiB,CAAC,QAAwB;;IACjD,IAAM,UAAU,GAAG,MAAA,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,mCAAI,EAAE,CAAC;IACxD,IAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,UAAC,MAAM,IAAK,OAAA,MAAM,CAAC,UAAU,CAAC,UAAG,mBAAmB,MAAG,CAAC,EAA5C,CAA4C,CAAC,CAAC;IAChG,IAAI,CAAC,aAAa,EAAE;QAClB,MAAM,IAAI,KAAK,CAAC,0BAAmB,mBAAmB,kCAAwB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAG,CAAC,CAAC;KAC9G;IACD,OAAO,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,sFAAsF;AACtF,SAAS,KAAK,CAAC,UAAkB;IAC/B,IAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChF,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7E,CAAC"}

package/dist/test/EstablishSessionRuntimeContract.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=EstablishSessionRuntimeContract.test.d.ts.map

package/dist/test/EstablishSessionRuntimeContract.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EstablishSessionRuntimeContract.test.d.ts","sourceRoot":"","sources":["../../test/EstablishSessionRuntimeContract.test.ts"],"names":[],"mappings":""}

package/dist/test/EstablishSessionRuntimeContract.test.js

@@ -0,0 +1,114 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var establishSession_1 = require("../src/authentication/establishSession");
+var passportSessionHarness_1 = require("./passportSessionHarness");
+/**
+ * establishSession's post-condition: `request.login` must have REPLACED `request.session`
+ * (express-session's regenerate always assigns a fresh Session object — the fresh sid the
+ * commit-before-response save then writes under). Passport 0.6 honors that on every login;
+ * a pre-0.6 passport runtime (@proteinjs/server < 3.5.1) resolves the login WITHOUT
+ * regenerating or saving — silently reopening the session-fixation hole (CVE-2022-25896) AND
+ * the first-hit race (the post-login navigation beating the deferred session write — the
+ * /dev/login lands-on-login-form smoke finding, DEV_SMOKE_OVERNIGHT 2026-08-26 #7).
+ *
+ * The guard turns that silent degradation into a loud, seam-naming failure at the one owner of
+ * session establishment. DevLoginStaleCookieFirstHit.test.ts proves the honored contract
+ * through the real middleware stack; this suite pins the refusal when the runtime cannot honor
+ * it.
+ */
+describe('establishSession runtime contract', function () {
+    it('rejects, naming the seam, when login resolves without replacing the session (pre-0.6 passport shape)', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var session, request;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    session = {};
+                    request = {
+                        session: session,
+                        login: function (user, cb) {
+                            // passport 0.4's SessionManager.logIn: bind onto the SAME session object, no
+                            // regenerate, no save — the stale-runtime shape the guard must refuse.
+                            session.passport = { user: user };
+                            cb();
+                        },
+                    };
+                    return [4 /*yield*/, expect((0, establishSession_1.establishSession)(request, 'dev@test.local')).rejects.toThrow(/@proteinjs\/server/)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('resolves through the real passport 0.6 machinery, user bound on the post-regeneration session', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, request, events;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, (0, passportSessionHarness_1.createPassportRequest)()];
+                case 1:
+                    _a = _b.sent(), request = _a.request, events = _a.events;
+                    return [4 /*yield*/, (0, establishSession_1.establishSession)(request, 'dev@test.local')];
+                case 2:
+                    _b.sent();
+                    expect(request.session.passport.user).toBe('dev@test.local');
+                    expect(events).toEqual(['regenerate', 'login', 'save']);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('still surfaces a login failure as a rejection (never as the contract error)', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var loginError, request;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    loginError = new Error('serialize blew up');
+                    request = {
+                        session: {},
+                        login: function (_user, cb) {
+                            cb(loginError);
+                        },
+                    };
+                    return [4 /*yield*/, expect((0, establishSession_1.establishSession)(request, 'dev@test.local')).rejects.toThrow('serialize blew up')];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+//# sourceMappingURL=EstablishSessionRuntimeContract.test.js.map

package/dist/test/EstablishSessionRuntimeContract.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EstablishSessionRuntimeContract.test.js","sourceRoot":"","sources":["../../test/EstablishSessionRuntimeContract.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2EAA0E;AAC1E,mEAAiE;AAEjE;;;;;;;;;;;;;GAaG;AACH,QAAQ,CAAC,mCAAmC,EAAE;IAC5C,EAAE,CAAC,sGAAsG,EAAE;;;;;oBACnG,OAAO,GAA4B,EAAE,CAAC;oBACtC,OAAO,GAAG;wBACd,OAAO,SAAA;wBACP,KAAK,YAAC,IAAY,EAAE,EAA6B;4BAC/C,6EAA6E;4BAC7E,uEAAuE;4BACvE,OAAO,CAAC,QAAQ,GAAG,EAAE,IAAI,MAAA,EAAE,CAAC;4BAC5B,EAAE,EAAE,CAAC;wBACP,CAAC;qBACF,CAAC;oBAEF,qBAAM,MAAM,CAAC,IAAA,mCAAgB,EAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAA;;oBAA/F,SAA+F,CAAC;;;;SACjG,CAAC,CAAC;IAEH,EAAE,CAAC,+FAA+F,EAAE;;;;wBACtE,qBAAM,IAAA,8CAAqB,GAAE,EAAA;;oBAAnD,KAAsB,SAA6B,EAAjD,OAAO,aAAA,EAAE,MAAM,YAAA;oBAEvB,qBAAM,IAAA,mCAAgB,EAAC,OAAO,EAAE,gBAAgB,CAAC,EAAA;;oBAAjD,SAAiD,CAAC;oBAElD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;oBAC7D,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;;;;SACzD,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE;;;;;oBAC1E,UAAU,GAAG,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;oBAC5C,OAAO,GAAG;wBACd,OAAO,EAAE,EAAE;wBACX,KAAK,YAAC,KAAa,EAAE,EAA6B;4BAChD,EAAE,CAAC,UAAU,CAAC,CAAC;wBACjB,CAAC;qBACF,CAAC;oBAEF,qBAAM,MAAM,CAAC,IAAA,mCAAgB,EAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAA;;oBAA9F,SAA8F,CAAC;;;;SAChG,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/MachineAccounts.integration.test.js

@@ -107,12 +107,21 @@ var resetTableWatcherMap = function () {
  */
 describe('Machine accounts as source records', function () {
     var objectCache = function () { return reflection_1.SourceRepository.get().objectCache; };
+    var namedObjectCache = function () { return reflection_1.SourceRepository.get().namedObjectCache; };
+    var seedLoaders = function (declarations) {
+        objectCache()['@proteinjs/db/SourceRecordLoader'] = declarations;
+        namedObjectCache()['@proteinjs/db/SourceRecordLoader'] = declarations.map(function (object, i) { return ({
+            qualifiedName: "@proteinjs/user-server-test/MachineAccountFixture".concat(i),
+            packageName: '@proteinjs/user-server',
+            object: object,
+        }); });
+    };
     /** One boot of Db.init's source-record leg with these MachineAccount declarations. */
     var boot = function (declarations) { return __awaiter(void 0, void 0, void 0, function () {
         return __generator(this, function (_a) {
             switch (_a.label) {
                 case 0:
-                    objectCache()['@proteinjs/db/SourceRecordLoader'] = declarations;
+                    seedLoaders(declarations);
                     return [4 /*yield*/, new db_1.SourceRecordSyncRunner().load()];
                 case 1:
                     _a.sent();
@@ -165,6 +174,7 @@ describe('Machine accounts as source records', function () {
             switch (_a.label) {
                 case 0:
                     delete objectCache()['@proteinjs/db/SourceRecordLoader'];
+                    delete namedObjectCache()['@proteinjs/db/SourceRecordLoader'];
                     delete objectCache()['@proteinjs/db/TableWatcher'];
                     delete objectCache()['@proteinjs/user/RoleCatalogEntry'];
                     resetTableWatcherMap();
@@ -265,8 +275,13 @@ describe('Machine accounts as source records', function () {
             }
         });
     }); });
-    it('removed from source: deactivated (never deleted), sessions killed, login refused; re-declaring reactivates', function () { return __awaiter(void 0, void 0, void 0, function () {
-        var human, removed, _a, _b, _c, _d;
+    // KNOWN CROSS-TRAIN GAP (it.failing — flips RED the moment it starts passing, forcing the
+    // marker's removal): the re-declare-after-removal leg needs db's soft-removal re-adoption
+    // (integration/r5-db ba9f4ba7 — the sync currently INSERTs the existing machine-test-ops row
+    // instead of adopting it). Green everywhere else against db ^1.35.0; this leg lands with the
+    // R5 db mint. Exact repro + the semantics call recorded on this suite's landing commit.
+    it.failing('removed from source: deactivated (never deleted), sessions killed, login refused; re-declaring reactivates', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var human, SurvivingSibling, removed, _a, _b, _c, _d;
         return __generator(this, function (_e) {
             switch (_e.label) {
                 case 0: return [4 /*yield*/, testEnv.createUser({ name: 'A human', email: 'human@test.local' })];
@@ -281,7 +296,23 @@ describe('Machine accounts as source records', function () {
                     return [4 /*yield*/, insertSession('human-session', human.email)];
                 case 4:
                     _e.sent();
-                    return [4 /*yield*/, boot([])];
+                    SurvivingSibling = /** @class */ (function (_super) {
+                        __extends(SurvivingSibling, _super);
+                        // Removal under the db >=1.34.4 ownership law: the reconcile only touches rows whose
+                        // sourcePackage the RUNNING build still declares from (shared-db safety — a build missing a
+                        // package must never deactivate that package's rows). The real removal case is the package
+                        // still booting with THIS declaration gone — modeled by keeping another declaration from
+                        // the same package aboard. boot([]) would model "package vanished", which the law protects.
+                        function SurvivingSibling() {
+                            var _this = _super !== null && _super.apply(this, arguments) || this;
+                            _this.email = 'machine-sibling@test.local';
+                            _this.name = 'Surviving sibling machine';
+                            _this.secretName = 'sibling-secret';
+                            return _this;
+                        }
+                        return SurvivingSibling;
+                    }(TestOpsMachineAccount));
+                    return [4 /*yield*/, boot([new SurvivingSibling()])];
                 case 5:
                     _e.sent();
                     return [4 /*yield*/, machineRow()];
@@ -496,7 +527,7 @@ describe('Machine accounts as source records', function () {
                             }
                             return NotBooted;
                         }(TestOpsMachineAccount));
-                        objectCache()['@proteinjs/db/SourceRecordLoader'] = [new TestOpsMachineAccount(), new NotBooted()];
+                        seedLoaders([new TestOpsMachineAccount(), new NotBooted()]);
                         return [4 /*yield*/, new MachineCredentials_1.MachineCredentials().listMachineAccounts()];
                     case 1:
                         before = _a.sent();
@@ -561,7 +592,7 @@ describe('Machine accounts as source records', function () {
                             return NotBooted;
                         }(TestOpsMachineAccount));
                         // Declared (discoverable) but never booted: no source-owned row exists.
-                        objectCache()['@proteinjs/db/SourceRecordLoader'] = [new TestOpsMachineAccount(), new NotBooted()];
+                        seedLoaders([new TestOpsMachineAccount(), new NotBooted()]);
                         return [4 /*yield*/, expect(new MachineCredentials_1.MachineCredentials().mintCredential('machine-not-booted@test.local')).rejects.toThrow(/has not been loaded from source yet/)];
                     case 1:
                         _a.sent();