@proteinjs/user-server 1.11.1 → 1.13.0

package/dist/src/authorization/UserActivityStamp.js

@@ -0,0 +1,126 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserActivityStamp = void 0;
+var moment_1 = __importDefault(require("moment"));
+var db_1 = require("@proteinjs/db");
+var logger_1 = require("@proteinjs/logger");
+var user_1 = require("@proteinjs/user");
+/**
+ * Writes the LAST-ACTIVITY presence stamp (`user_activity`, one row per user — see
+ * UserActivityTable's contract): "this human made an interactive request just now".
+ *
+ * The TRANSPORT keying lives at the call site — userCache.create runs once per session-cookie
+ * request (wrapRoute's session-cache build) and only there, so seeded/background contexts
+ * (runInUserScope sets session data directly) structurally never reach this class. What this
+ * class owns is the ACCOUNT predicate: machine accounts (`isLoadedFromSource`) are refused —
+ * their requests do arrive over real sessions (e.g. the error bridge's polling), but a machine
+ * logging in is not a person being present.
+ *
+ * Write behavior mirrors DbSessionStore's touch: throttled per user (a presence fact consumed at
+ * day grain needs no finer cadence, and an unthrottled stamp would put a write on EVERY request),
+ * fail-open (a lost stamp is a few minutes of staleness, never a failed request — the returned
+ * promise NEVER rejects), and race-tolerant (concurrent first stamps contend on the scope-unique
+ * index; the loser's error is swallowed as debug).
+ */
+var UserActivityStamp = /** @class */ (function () {
+    function UserActivityStamp() {
+        this.logger = new logger_1.Logger({ name: this.constructor.name });
+    }
+    /**
+     * Record that `user` is present on an interactive request. Fire-and-forget safe: errors are
+     * handled (and logged) here, so callers may `void` the returned promise.
+     */
+    UserActivityStamp.prototype.recordInteractiveRequest = function (user) {
+        var _this = this;
+        var _a;
+        if (!user.id || user.isLoadedFromSource === true) {
+            return Promise.resolve();
+        }
+        var last = (_a = UserActivityStamp.lastStampMs.get(user.id)) !== null && _a !== void 0 ? _a : 0;
+        var now = Date.now();
+        if (now - last < UserActivityStamp.STAMP_INTERVAL_MS) {
+            return Promise.resolve();
+        }
+        UserActivityStamp.lastStampMs.set(user.id, now);
+        if (UserActivityStamp.lastStampMs.size > 10000) {
+            UserActivityStamp.lastStampMs.clear(); // bounded memory; worst case is one extra stamp per user
+        }
+        return this.upsert(user.id).catch(function (error) {
+            // Contention (a concurrent request stamped first, racing the scope-unique index) and real
+            // failures land here alike; both are harmless to the request. Un-throttle so the next
+            // request retries instead of waiting out a full interval on a stamp that never landed.
+            UserActivityStamp.lastStampMs.delete(user.id);
+            _this.logger.error({ message: 'Failed to write user activity stamp', error: error });
+        });
+    };
+    UserActivityStamp.prototype.upsert = function (userId) {
+        return __awaiter(this, void 0, void 0, function () {
+            var db, existing;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        db = (0, db_1.getDbAsSystem)();
+                        return [4 /*yield*/, db.get(user_1.tables.UserActivity, { scope: userId })];
+                    case 1:
+                        existing = _a.sent();
+                        if (!existing) return [3 /*break*/, 3];
+                        return [4 /*yield*/, db.update(user_1.tables.UserActivity, { id: existing.id, lastActiveAt: (0, moment_1.default)() })];
+                    case 2:
+                        _a.sent();
+                        return [3 /*break*/, 5];
+                    case 3: return [4 /*yield*/, db.insert(user_1.tables.UserActivity, { scope: userId, lastActiveAt: (0, moment_1.default)() })];
+                    case 4:
+                        _a.sent();
+                        _a.label = 5;
+                    case 5: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /** Stamp at most this often per user — same cadence class as DbSessionStore.TOUCH_INTERVAL. */
+    UserActivityStamp.STAMP_INTERVAL_MS = 1000 * 60 * 5;
+    /** Process-wide: userCache is a plain object, so throttle state can't live per-instance. */
+    UserActivityStamp.lastStampMs = new Map();
+    return UserActivityStamp;
+}());
+exports.UserActivityStamp = UserActivityStamp;
+//# sourceMappingURL=UserActivityStamp.js.map

package/dist/src/authorization/UserActivityStamp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserActivityStamp.js","sourceRoot":"","sources":["../../../src/authorization/UserActivityStamp.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kDAA4B;AAC5B,oCAA8C;AAC9C,4CAA2C;AAC3C,wCAAuE;AAEvE;;;;;;;;;;;;;;;;GAgBG;AACH;IAAA;QAMU,WAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAqC/D,CAAC;IAnCC;;;OAGG;IACH,oDAAwB,GAAxB,UAAyB,IAAU;QAAnC,iBAoBC;;QAnBC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,EAAE;YAChD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;SAC1B;QACD,IAAM,IAAI,GAAG,MAAA,iBAAiB,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,mCAAI,CAAC,CAAC;QAC7D,IAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,GAAG,iBAAiB,CAAC,iBAAiB,EAAE;YACpD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;SAC1B;QACD,iBAAiB,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,iBAAiB,CAAC,WAAW,CAAC,IAAI,GAAG,KAAK,EAAE;YAC9C,iBAAiB,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,yDAAyD;SACjG;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,UAAC,KAAK;YACtC,0FAA0F;YAC1F,sFAAsF;YACtF,uFAAuF;YACvF,iBAAiB,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9C,KAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,KAAK,OAAA,EAAE,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;IACL,CAAC;IAEa,kCAAM,GAApB,UAAqB,MAAc;;;;;;wBAC3B,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACV,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAA;;wBAA/D,QAAQ,GAAG,SAAoD;6BACjE,QAAQ,EAAR,wBAAQ;wBACV,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,YAAY,EAAE,IAAA,gBAAM,GAAE,EAAkB,CAAC,EAAA;;wBAAjG,SAAiG,CAAC;;4BAElG,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,IAAA,gBAAM,GAAE,EAAkB,CAAC,EAAA;;wBAA/F,SAA+F,CAAC;;;;;;KAEnG;IAzCD,+FAA+F;IACvE,mCAAiB,GAAG,IAAI,GAAG,EAAE,GAAG,CAAC,AAAhB,CAAiB;IAC1D,4FAA4F;IAC7E,6BAAW,GAAG,IAAI,GAAG,EAAkB,AAA5B,CAA6B;IAuCzD,wBAAC;CAAA,AA3CD,IA2CC;AA3CY,8CAAiB"}

package/dist/src/authorization/userCache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"userCache.d.ts","sourceRoot":"","sources":["../../../src/authorization/userCache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,EAAE,IAAI,EAA6C,MAAM,iBAAiB,CAAC;AAKlF,eAAO,MAAM,SAAS,EAAE,gBAAgB,CAAC,IAAI,CA8C5C,CAAC"}
+{"version":3,"file":"userCache.d.ts","sourceRoot":"","sources":["../../../src/authorization/userCache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,EAAE,IAAI,EAA6C,MAAM,iBAAiB,CAAC;AAOlF,eAAO,MAAM,SAAS,EAAE,gBAAgB,CAAC,IAAI,CAqD5C,CAAC"}

package/dist/src/authorization/userCache.js

@@ -45,7 +45,9 @@ var db_1 = require("@proteinjs/db");
 var logger_1 = require("@proteinjs/logger");
 var user_1 = require("@proteinjs/user");
 var DefaultAdminCredentials_1 = require("../authentication/DefaultAdminCredentials");
+var UserActivityStamp_1 = require("./UserActivityStamp");
 var logger = new logger_1.Logger({ name: 'userCache' });
+var userActivityStamp = new UserActivityStamp_1.UserActivityStamp();
 exports.userCache = {
     key: user_1.USER_SESSION_CACHE_KEY,
     create: function (sessionId, userEmail) { return __awaiter(void 0, void 0, void 0, function () {
@@ -84,6 +86,13 @@ exports.userCache = {
                     else if (accountUser) {
                         delete accountUser['password'];
                         user = accountUser;
+                        // LAST ACTIVITY (human presence — UserActivityTable's contract): stamped HERE because
+                        // this cache build runs exactly once per session-cookie request (wrapRoute), i.e. only
+                        // for interactive transport. Background/seeded contexts (runInUserScope) set session
+                        // data directly and never pass through, so machinery acting as the user structurally
+                        // cannot stamp; the stamp itself refuses machine accounts. Fire-and-forget: the
+                        // returned promise never rejects, and a request never waits on its own stamp.
+                        void userActivityStamp.recordInteractiveRequest(user);
                     }
                     else {
                         // A session can outlive its account (row deleted, or a dev auto-login for a never-created

package/dist/src/authorization/userCache.js.map

@@ -1 +1 @@
-{"version":3,"file":"userCache.js","sourceRoot":"","sources":["../../../src/authorization/userCache.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kDAA4B;AAE5B,oCAA8C;AAC9C,4CAA2C;AAC3C,wCAAkF;AAClF,qFAAoF;AAEpF,IAAM,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;AAEpC,QAAA,SAAS,GAA2B;IAC/C,GAAG,EAAE,6BAAsB;IAC3B,MAAM,EAAE,UAAO,SAAiB,EAAE,SAAiB;;;;;oBAC7C,IAAI,GAAG,gBAAS,CAAC;yBACjB,SAAS,EAAT,wBAAS;oBACL,gBAAgB,GAAG,iDAAuB,CAAC,cAAc,EAAE,CAAC;yBAC9D,CAAA,gBAAgB,IAAI,SAAS,IAAI,gBAAgB,CAAC,QAAQ,CAAA,EAA1D,wBAA0D;oBACtD,SAAS,GAAS;wBACtB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,gBAAgB,CAAC,QAAQ;wBAChC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;wBACnC,aAAa,EAAE,IAAI;wBACnB,KAAK,EAAE,CAAC,OAAO,CAAC;wBAChB,OAAO,EAAE,IAAA,gBAAM,GAAE;wBACjB,OAAO,EAAE,IAAA,gBAAM,GAAE;wBACjB,EAAE,EAAE,OAAO;qBACZ,CAAC;oBACF,IAAI,GAAG,SAAS,CAAC;;wBAEG,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;oBAAxF,WAAW,GAAG,SAA0E;oBAC9F,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,aAAa,EAAE;wBACvD,sFAAsF;wBACtF,iFAAiF;wBACjF,4EAA4E;wBAC5E,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,wEAAwE;4BACjF,GAAG,EAAE,EAAE,SAAS,WAAA,EAAE,SAAS,WAAA,EAAE;yBAC9B,CAAC,CAAC;qBACJ;yBAAM,IAAI,WAAW,EAAE;wBACtB,OAAQ,WAAmB,CAAC,UAAU,CAAC,CAAC;wBACxC,IAAI,GAAG,WAAW,CAAC;qBACpB;yBAAM;wBACL,0FAA0F;wBAC1F,+EAA+E;wBAC/E,sFAAsF;wBACtF,yDAAyD;wBACzD,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,iFAAiF;4BAC1F,GAAG,EAAE,EAAE,SAAS,WAAA,EAAE,SAAS,WAAA,EAAE;yBAC9B,CAAC,CAAC;qBACJ;;wBAIL,sBAAO,IAAI,EAAC;;;SACb;CACF,CAAC"}
+{"version":3,"file":"userCache.js","sourceRoot":"","sources":["../../../src/authorization/userCache.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kDAA4B;AAE5B,oCAA8C;AAC9C,4CAA2C;AAC3C,wCAAkF;AAClF,qFAAoF;AACpF,yDAAwD;AAExD,IAAM,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;AACjD,IAAM,iBAAiB,GAAG,IAAI,qCAAiB,EAAE,CAAC;AAErC,QAAA,SAAS,GAA2B;IAC/C,GAAG,EAAE,6BAAsB;IAC3B,MAAM,EAAE,UAAO,SAAiB,EAAE,SAAiB;;;;;oBAC7C,IAAI,GAAG,gBAAS,CAAC;yBACjB,SAAS,EAAT,wBAAS;oBACL,gBAAgB,GAAG,iDAAuB,CAAC,cAAc,EAAE,CAAC;yBAC9D,CAAA,gBAAgB,IAAI,SAAS,IAAI,gBAAgB,CAAC,QAAQ,CAAA,EAA1D,wBAA0D;oBACtD,SAAS,GAAS;wBACtB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,gBAAgB,CAAC,QAAQ;wBAChC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;wBACnC,aAAa,EAAE,IAAI;wBACnB,KAAK,EAAE,CAAC,OAAO,CAAC;wBAChB,OAAO,EAAE,IAAA,gBAAM,GAAE;wBACjB,OAAO,EAAE,IAAA,gBAAM,GAAE;wBACjB,EAAE,EAAE,OAAO;qBACZ,CAAC;oBACF,IAAI,GAAG,SAAS,CAAC;;wBAEG,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;oBAAxF,WAAW,GAAG,SAA0E;oBAC9F,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,aAAa,EAAE;wBACvD,sFAAsF;wBACtF,iFAAiF;wBACjF,4EAA4E;wBAC5E,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,wEAAwE;4BACjF,GAAG,EAAE,EAAE,SAAS,WAAA,EAAE,SAAS,WAAA,EAAE;yBAC9B,CAAC,CAAC;qBACJ;yBAAM,IAAI,WAAW,EAAE;wBACtB,OAAQ,WAAmB,CAAC,UAAU,CAAC,CAAC;wBACxC,IAAI,GAAG,WAAW,CAAC;wBACnB,sFAAsF;wBACtF,uFAAuF;wBACvF,qFAAqF;wBACrF,qFAAqF;wBACrF,gFAAgF;wBAChF,8EAA8E;wBAC9E,KAAK,iBAAiB,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;qBACvD;yBAAM;wBACL,0FAA0F;wBAC1F,+EAA+E;wBAC/E,sFAAsF;wBACtF,yDAAyD;wBACzD,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,iFAAiF;4BAC1F,GAAG,EAAE,EAAE,SAAS,WAAA,EAAE,SAAS,WAAA,EAAE;yBAC9B,CAAC,CAAC;qBACJ;;wBAIL,sBAAO,IAAI,EAAC;;;SACb;CACF,CAAC"}

package/dist/src/migrations/SweepMalformedAccessGrants.d.ts

@@ -0,0 +1,76 @@
+import { Migration, SourceRecordLoader, Table } from '@proteinjs/db';
+import { AccessGrant } from '@proteinjs/user';
+/** One access_grant row as the sweep logs and reports it. */
+export interface AccessGrantSweepRow {
+    id: string;
+    resourceTable?: string;
+    accessLevel: AccessGrant['accessLevel'];
+    created?: string;
+}
+/** A well-formed grant whose principal or resource id no longer resolves to a row (report only). */
+export interface DanglingAccessGrantRow extends AccessGrantSweepRow {
+    principal?: string;
+    resource?: string;
+    reason: 'principal missing' | 'resource missing' | 'resource table not registered';
+}
+export interface SweepMalformedAccessGrantsResult {
+    /** Rows on the invariant's exact complement (NULL principal or NULL resource) — deleted unless `dryRun`. */
+    malformed: number;
+    rows: AccessGrantSweepRow[];
+    dryRun: boolean;
+}
+export interface DanglingAccessGrantsReport {
+    danglingPrincipal: number;
+    danglingResource: number;
+    rows: DanglingAccessGrantRow[];
+}
+/**
+ * ONE-TIME SWEEP of malformed access_grant residue — rows whose `principal` or `resource`
+ * reference is NULL. The AccessGrant well-formedness invariant (`AccessGrantTable.assertWellFormed`)
+ * now refuses that shape at insert, and the session-less scope-root bootstrap no longer mints it;
+ * this migration clears what the two producers left behind before the fix (the test environment
+ * held one; app Deploy to Test 32614670162 crashed on it).
+ *
+ * The sweep's predicate is the invariant's exact complement (`principal IS NULL OR resource IS
+ * NULL`), and it rides BOTH the find and the delete — a well-formed row cannot be selected by the
+ * statement that deletes, whatever the id list. Deletes go through the system Db by id, so the
+ * registered after-delete watchers fire (a grantee's content_reference cleanup rides
+ * `ContentReferenceAccessGrantTableWatcher`). Idempotent: a re-run finds nothing.
+ *
+ * DANGLING references are a separate class and are NOT deleted here: a well-formed grant whose
+ * principal user or resource row was purged out from under it. Those are REPORTED (log +
+ * migration output) so the purge paths that strand them can be named; a delete would be a
+ * symptom patch on a producer this migration does not own.
+ *
+ * App-service/system-db path only — never raw Spanner.
+ */
+export declare class SweepMalformedAccessGrants implements SourceRecordLoader<Migration> {
+    table: Table<Migration>;
+    record: {
+        id: string;
+        description: string;
+        run: () => Promise<{
+            malformed: number;
+            malformedDryRun: number;
+            danglingPrincipal: number;
+            danglingResource: number;
+            malformedRows: AccessGrantSweepRow[];
+            danglingRows: DanglingAccessGrantRow[];
+        }>;
+    };
+    /** Find (and unless `dryRun`, delete) every malformed grant. Each row is logged either way. */
+    sweep(options: {
+        dryRun: boolean;
+    }): Promise<SweepMalformedAccessGrantsResult>;
+    /**
+     * Report-only scan for well-formed grants whose principal or resource row no longer exists —
+     * the purged-user / purged-resource class. Nothing is deleted.
+     */
+    reportDangling(): Promise<DanglingAccessGrantsReport>;
+    /** The well-formedness invariant's exact complement: a NULL principal or a NULL resource. */
+    private malformedPredicate;
+    /** Which of `ids` exist in `table`, resolved as system in bounded IN chunks. */
+    private existingIds;
+    private toRow;
+}
+//# sourceMappingURL=SweepMalformedAccessGrants.d.ts.map

package/dist/src/migrations/SweepMalformedAccessGrants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SweepMalformedAccessGrants.d.ts","sourceRoot":"","sources":["../../../src/migrations/SweepMalformedAccessGrants.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,SAAS,EAKT,kBAAkB,EAClB,KAAK,EAEN,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,WAAW,EAAwB,MAAM,iBAAiB,CAAC;AAGpE,6DAA6D;AAC7D,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,oGAAoG;AACpG,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,mBAAmB,GAAG,kBAAkB,GAAG,+BAA+B,CAAC;CACpF;AAED,MAAM,WAAW,gCAAgC;IAC/C,4GAA4G;IAC5G,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,mBAAmB,EAAE,CAAC;IAC5B,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,0BAA0B;IACzC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,sBAAsB,EAAE,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,0BAA2B,YAAW,kBAAkB,CAAC,SAAS,CAAC;IAC9E,KAAK,mBAAsB;IAC3B,MAAM;;;;;;;;;;;MAqBJ;IAEF,+FAA+F;IACzF,KAAK,CAAC,OAAO,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,gCAAgC,CAAC;IAgCpF;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC,0BAA0B,CAAC;IAoE3D,6FAA6F;IAC7F,OAAO,CAAC,kBAAkB;IAO1B,gFAAgF;YAClE,WAAW;IAkBzB,OAAO,CAAC,KAAK;CAQd"}

package/dist/src/migrations/SweepMalformedAccessGrants.js

@@ -0,0 +1,354 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __asyncValues = (this && this.__asyncValues) || function (o) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var m = o[Symbol.asyncIterator], i;
+    return m ? m.call(o) : (o = typeof __values === "function" ? __values(o) : o[Symbol.iterator](), i = {}, verb("next"), verb("throw"), verb("return"), i[Symbol.asyncIterator] = function () { return this; }, i);
+    function verb(n) { i[n] = o[n] && function (v) { return new Promise(function (resolve, reject) { v = o[n](v), settle(resolve, reject, v.done, v.value); }); }; }
+    function settle(resolve, reject, d, v) { Promise.resolve(v).then(function(v) { resolve({ value: v, done: d }); }, reject); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SweepMalformedAccessGrants = void 0;
+var db_1 = require("@proteinjs/db");
+var user_1 = require("@proteinjs/user");
+var logger_1 = require("@proteinjs/logger");
+/**
+ * ONE-TIME SWEEP of malformed access_grant residue — rows whose `principal` or `resource`
+ * reference is NULL. The AccessGrant well-formedness invariant (`AccessGrantTable.assertWellFormed`)
+ * now refuses that shape at insert, and the session-less scope-root bootstrap no longer mints it;
+ * this migration clears what the two producers left behind before the fix (the test environment
+ * held one; app Deploy to Test 32614670162 crashed on it).
+ *
+ * The sweep's predicate is the invariant's exact complement (`principal IS NULL OR resource IS
+ * NULL`), and it rides BOTH the find and the delete — a well-formed row cannot be selected by the
+ * statement that deletes, whatever the id list. Deletes go through the system Db by id, so the
+ * registered after-delete watchers fire (a grantee's content_reference cleanup rides
+ * `ContentReferenceAccessGrantTableWatcher`). Idempotent: a re-run finds nothing.
+ *
+ * DANGLING references are a separate class and are NOT deleted here: a well-formed grant whose
+ * principal user or resource row was purged out from under it. Those are REPORTED (log +
+ * migration output) so the purge paths that strand them can be named; a delete would be a
+ * symptom patch on a producer this migration does not own.
+ *
+ * App-service/system-db path only — never raw Spanner.
+ */
+var SweepMalformedAccessGrants = /** @class */ (function () {
+    function SweepMalformedAccessGrants() {
+        var _this = this;
+        this.table = db_1.tables.Migration;
+        this.record = {
+            id: '2b7e4d0c-5f1a-4c3e-9b8d-6a2f1e0c7d45',
+            description: 'Sweep malformed access_grant rows (NULL principal or NULL resource — the well-formedness invariant’s complement); report dangling references, no delete.',
+            run: function () { return __awaiter(_this, void 0, void 0, function () {
+                var logger, dry, real, dangling, output;
+                return __generator(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            logger = new logger_1.Logger({ name: SweepMalformedAccessGrants.name });
+                            return [4 /*yield*/, this.sweep({ dryRun: true })];
+                        case 1:
+                            dry = _a.sent();
+                            return [4 /*yield*/, this.sweep({ dryRun: false })];
+                        case 2:
+                            real = _a.sent();
+                            return [4 /*yield*/, this.reportDangling()];
+                        case 3:
+                            dangling = _a.sent();
+                            output = {
+                                malformed: real.malformed,
+                                malformedDryRun: dry.malformed,
+                                danglingPrincipal: dangling.danglingPrincipal,
+                                danglingResource: dangling.danglingResource,
+                                malformedRows: real.rows,
+                                danglingRows: dangling.rows,
+                            };
+                            logger.info({ message: 'SweepMalformedAccessGrants completed', obj: output });
+                            return [2 /*return*/, output];
+                    }
+                });
+            }); },
+        };
+    }
+    /** Find (and unless `dryRun`, delete) every malformed grant. Each row is logged either way. */
+    SweepMalformedAccessGrants.prototype.sweep = function (options) {
+        return __awaiter(this, void 0, void 0, function () {
+            var dryRun, logger, db, findQb, malformed, rows, _i, rows_1, row, _a, malformed_1, grant, deleteQb, result;
+            var _this = this;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        dryRun = options.dryRun;
+                        logger = new logger_1.Logger({ name: SweepMalformedAccessGrants.name });
+                        db = (0, db_1.getDbAsSystem)();
+                        findQb = this.malformedPredicate(new db_1.QueryBuilderFactory().getQueryBuilder(user_1.tables.AccessGrant)).sort([
+                            { field: 'created' },
+                        ]);
+                        return [4 /*yield*/, db.query(user_1.tables.AccessGrant, findQb)];
+                    case 1:
+                        malformed = _b.sent();
+                        rows = malformed.map(function (grant) { return _this.toRow(grant); });
+                        for (_i = 0, rows_1 = rows; _i < rows_1.length; _i++) {
+                            row = rows_1[_i];
+                            logger.info({
+                                message: dryRun ? 'Malformed access_grant (dry run)' : 'Deleting malformed access_grant',
+                                obj: row,
+                            });
+                        }
+                        if (!!dryRun) return [3 /*break*/, 5];
+                        _a = 0, malformed_1 = malformed;
+                        _b.label = 2;
+                    case 2:
+                        if (!(_a < malformed_1.length)) return [3 /*break*/, 5];
+                        grant = malformed_1[_a];
+                        deleteQb = this.malformedPredicate(new db_1.QueryBuilderFactory().getQueryBuilder(user_1.tables.AccessGrant, { id: grant.id }));
+                        return [4 /*yield*/, db.delete(user_1.tables.AccessGrant, deleteQb)];
+                    case 3:
+                        _b.sent();
+                        _b.label = 4;
+                    case 4:
+                        _a++;
+                        return [3 /*break*/, 2];
+                    case 5:
+                        result = { malformed: rows.length, rows: rows, dryRun: dryRun };
+                        logger.info({ message: dryRun ? 'Sweep dry run' : 'Sweep pass', obj: { malformed: rows.length, dryRun: dryRun } });
+                        return [2 /*return*/, result];
+                }
+            });
+        });
+    };
+    /**
+     * Report-only scan for well-formed grants whose principal or resource row no longer exists —
+     * the purged-user / purged-resource class. Nothing is deleted.
+     */
+    SweepMalformedAccessGrants.prototype.reportDangling = function () {
+        var _a, e_1, _b, _c;
+        var _d, _e, _f, _g;
+        return __awaiter(this, void 0, void 0, function () {
+            var logger, db, grants, principalIds, resourceIdsByTable, _h, _j, _k, grant, principalId, resourceId, resourceTable, e_1_1, existingPrincipals, existingResourcesByTable, _loop_1, this_1, _i, _l, tableName, report, _m, grants_1, grant, resourceTable, existingResources, reason, row;
+            return __generator(this, function (_o) {
+                switch (_o.label) {
+                    case 0:
+                        logger = new logger_1.Logger({ name: SweepMalformedAccessGrants.name });
+                        db = (0, db_1.getDbAsSystem)();
+                        grants = [];
+                        principalIds = new Set();
+                        resourceIdsByTable = new Map();
+                        _o.label = 1;
+                    case 1:
+                        _o.trys.push([1, 6, 7, 12]);
+                        _h = true, _j = __asyncValues(new db_1.RecordIterator(user_1.tables.AccessGrant, {}, 200, db));
+                        _o.label = 2;
+                    case 2: return [4 /*yield*/, _j.next()];
+                    case 3:
+                        if (!(_k = _o.sent(), _a = _k.done, !_a)) return [3 /*break*/, 5];
+                        _c = _k.value;
+                        _h = false;
+                        grant = _c;
+                        principalId = (_d = grant.principal) === null || _d === void 0 ? void 0 : _d._id;
+                        resourceId = (_e = grant.resource) === null || _e === void 0 ? void 0 : _e._id;
+                        if (!principalId || !resourceId) {
+                            return [3 /*break*/, 4]; // the malformed class — `sweep` owns it
+                        }
+                        grants.push(grant);
+                        principalIds.add(principalId);
+                        resourceTable = (_f = grant.resourceTable) !== null && _f !== void 0 ? _f : grant.resource._table;
+                        if (!resourceIdsByTable.has(resourceTable)) {
+                            resourceIdsByTable.set(resourceTable, new Set());
+                        }
+                        resourceIdsByTable.get(resourceTable).add(resourceId);
+                        _o.label = 4;
+                    case 4:
+                        _h = true;
+                        return [3 /*break*/, 2];
+                    case 5: return [3 /*break*/, 12];
+                    case 6:
+                        e_1_1 = _o.sent();
+                        e_1 = { error: e_1_1 };
+                        return [3 /*break*/, 12];
+                    case 7:
+                        _o.trys.push([7, , 10, 11]);
+                        if (!(!_h && !_a && (_b = _j.return))) return [3 /*break*/, 9];
+                        return [4 /*yield*/, _b.call(_j)];
+                    case 8:
+                        _o.sent();
+                        _o.label = 9;
+                    case 9: return [3 /*break*/, 11];
+                    case 10:
+                        if (e_1) throw e_1.error;
+                        return [7 /*endfinally*/];
+                    case 11: return [7 /*endfinally*/];
+                    case 12: return [4 /*yield*/, this.existingIds(user_1.tables.User, principalIds)];
+                    case 13:
+                        existingPrincipals = _o.sent();
+                        existingResourcesByTable = new Map();
+                        _loop_1 = function (tableName) {
+                            var table, _p, _q, _r, _s;
+                            return __generator(this, function (_t) {
+                                switch (_t.label) {
+                                    case 0:
+                                        table = (0, db_1.getTables)().find(function (candidate) { return candidate.name === tableName; });
+                                        _q = (_p = existingResourcesByTable).set;
+                                        _r = [tableName];
+                                        if (!table) return [3 /*break*/, 2];
+                                        return [4 /*yield*/, this_1.existingIds(table, resourceIdsByTable.get(tableName))];
+                                    case 1:
+                                        _s = _t.sent();
+                                        return [3 /*break*/, 3];
+                                    case 2:
+                                        _s = null;
+                                        _t.label = 3;
+                                    case 3:
+                                        _q.apply(_p, _r.concat([_s]));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        };
+                        this_1 = this;
+                        _i = 0, _l = Array.from(resourceIdsByTable.keys());
+                        _o.label = 14;
+                    case 14:
+                        if (!(_i < _l.length)) return [3 /*break*/, 17];
+                        tableName = _l[_i];
+                        return [5 /*yield**/, _loop_1(tableName)];
+                    case 15:
+                        _o.sent();
+                        _o.label = 16;
+                    case 16:
+                        _i++;
+                        return [3 /*break*/, 14];
+                    case 17:
+                        report = { danglingPrincipal: 0, danglingResource: 0, rows: [] };
+                        for (_m = 0, grants_1 = grants; _m < grants_1.length; _m++) {
+                            grant = grants_1[_m];
+                            resourceTable = (_g = grant.resourceTable) !== null && _g !== void 0 ? _g : grant.resource._table;
+                            existingResources = existingResourcesByTable.get(resourceTable);
+                            reason = void 0;
+                            if (!existingPrincipals.has(grant.principal._id)) {
+                                reason = 'principal missing';
+                                report.danglingPrincipal++;
+                            }
+                            else if (existingResources === null) {
+                                reason = 'resource table not registered';
+                                report.danglingResource++;
+                            }
+                            else if (!existingResources.has(grant.resource._id)) {
+                                reason = 'resource missing';
+                                report.danglingResource++;
+                            }
+                            if (!reason) {
+                                continue;
+                            }
+                            row = __assign(__assign({}, this.toRow(grant)), { principal: grant.principal._id, resource: grant.resource._id, reason: reason });
+                            report.rows.push(row);
+                            logger.warn({ message: 'Dangling access_grant (report only, not deleted)', obj: row });
+                        }
+                        logger.info({
+                            message: 'Dangling access_grant report',
+                            obj: { danglingPrincipal: report.danglingPrincipal, danglingResource: report.danglingResource },
+                        });
+                        return [2 /*return*/, report];
+                }
+            });
+        });
+    };
+    /** The well-formedness invariant's exact complement: a NULL principal or a NULL resource. */
+    SweepMalformedAccessGrants.prototype.malformedPredicate = function (qb) {
+        return qb.or([
+            { field: 'principal', operator: 'IS NULL' },
+            { field: 'resource', operator: 'IS NULL' },
+        ]);
+    };
+    /** Which of `ids` exist in `table`, resolved as system in bounded IN chunks. */
+    SweepMalformedAccessGrants.prototype.existingIds = function (table, ids) {
+        return __awaiter(this, void 0, void 0, function () {
+            var existing, all, chunkSize, start, chunk, qb, found, _i, found_1, record;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        existing = new Set();
+                        all = Array.from(ids);
+                        chunkSize = 200;
+                        start = 0;
+                        _a.label = 1;
+                    case 1:
+                        if (!(start < all.length)) return [3 /*break*/, 4];
+                        chunk = all.slice(start, start + chunkSize);
+                        qb = new db_1.QueryBuilderFactory()
+                            .getQueryBuilder(table)
+                            .select({ fields: ['id'] })
+                            .condition({ field: 'id', operator: 'IN', value: chunk });
+                        return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(table, qb)];
+                    case 2:
+                        found = (_a.sent());
+                        for (_i = 0, found_1 = found; _i < found_1.length; _i++) {
+                            record = found_1[_i];
+                            existing.add(record.id);
+                        }
+                        _a.label = 3;
+                    case 3:
+                        start += chunkSize;
+                        return [3 /*break*/, 1];
+                    case 4: return [2 /*return*/, existing];
+                }
+            });
+        });
+    };
+    SweepMalformedAccessGrants.prototype.toRow = function (grant) {
+        var _a;
+        return {
+            id: grant.id,
+            resourceTable: grant.resourceTable,
+            accessLevel: grant.accessLevel,
+            created: (_a = grant.created) === null || _a === void 0 ? void 0 : _a.toISOString(),
+        };
+    };
+    return SweepMalformedAccessGrants;
+}());
+exports.SweepMalformedAccessGrants = SweepMalformedAccessGrants;
+//# sourceMappingURL=SweepMalformedAccessGrants.js.map

package/dist/src/migrations/SweepMalformedAccessGrants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SweepMalformedAccessGrants.js","sourceRoot":"","sources":["../../../src/migrations/SweepMalformedAccessGrants.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAWuB;AACvB,wCAAoE;AACpE,4CAA2C;AA8B3C;;;;;;;;;;;;;;;;;;;GAmBG;AACH;IAAA;QAAA,iBAqKC;QApKC,UAAK,GAAG,WAAQ,CAAC,SAAS,CAAC;QAC3B,WAAM,GAAG;YACP,EAAE,EAAE,sCAAsC;YAC1C,WAAW,EACT,0JAA0J;YAC5J,GAAG,EAAE;;;;;4BACG,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC,CAAC;4BAEzD,qBAAM,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAA;;4BAAxC,GAAG,GAAG,SAAkC;4BACjC,qBAAM,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAA;;4BAA1C,IAAI,GAAG,SAAmC;4BAC/B,qBAAM,IAAI,CAAC,cAAc,EAAE,EAAA;;4BAAtC,QAAQ,GAAG,SAA2B;4BACtC,MAAM,GAAG;gCACb,SAAS,EAAE,IAAI,CAAC,SAAS;gCACzB,eAAe,EAAE,GAAG,CAAC,SAAS;gCAC9B,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;gCAC7C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;gCAC3C,aAAa,EAAE,IAAI,CAAC,IAAI;gCACxB,YAAY,EAAE,QAAQ,CAAC,IAAI;6BAC5B,CAAC;4BACF,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;4BAC9E,sBAAO,MAAM,EAAC;;;iBACf;SACF,CAAC;IA8IJ,CAAC;IA5IC,+FAA+F;IACzF,0CAAK,GAAX,UAAY,OAA4B;;;;;;;wBAC9B,MAAM,GAAK,OAAO,OAAZ,CAAa;wBACrB,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC,CAAC;wBAC/D,EAAE,GAAG,IAAA,kBAAa,GAAe,CAAC;wBAElC,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,wBAAmB,EAAE,CAAC,eAAe,CAAC,aAAU,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;4BAC7G,EAAE,KAAK,EAAE,SAAS,EAAE;yBACrB,CAAC,CAAC;wBACe,qBAAM,EAAE,CAAC,KAAK,CAAC,aAAU,CAAC,WAAW,EAAE,MAAM,CAAC,EAAA;;wBAA1D,SAAS,GAAG,SAA8C;wBAC1D,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,UAAC,KAAK,IAAK,OAAA,KAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAjB,CAAiB,CAAC,CAAC;wBACzD,WAAsB,EAAJ,aAAI,EAAJ,kBAAI,EAAJ,IAAI,EAAE;4BAAb,GAAG;4BACZ,MAAM,CAAC,IAAI,CAAC;gCACV,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,iCAAiC;gCACxF,GAAG,EAAE,GAAG;6BACT,CAAC,CAAC;yBACJ;6BAEG,CAAC,MAAM,EAAP,wBAAO;8BACoB,EAAT,uBAAS;;;6BAAT,CAAA,uBAAS,CAAA;wBAAlB,KAAK;wBAER,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CACtC,IAAI,wBAAmB,EAAE,CAAC,eAAe,CAAC,aAAU,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CACpF,CAAC;wBACF,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAA;;wBAAjD,SAAiD,CAAC;;;wBALhC,IAAS,CAAA;;;wBASzB,MAAM,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC;wBACxD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,QAAA,EAAE,EAAE,CAAC,CAAC;wBAC3G,sBAAO,MAAM,EAAC;;;;KACf;IAED;;;OAGG;IACG,mDAAc,GAApB;;;;;;;;wBACQ,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC,CAAC;wBAC/D,EAAE,GAAG,IAAA,kBAAa,GAAe,CAAC;wBAGlC,MAAM,GAAkB,EAAE,CAAC;wBAC3B,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;wBACjC,kBAAkB,GAAG,IAAI,GAAG,EAAuB,CAAC;;;;mCAChC,KAAA,cAAA,IAAI,mBAAc,CAAc,aAAU,CAAC,WAAW,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;;;;;wBAApE,cAAoE;wBAApE,WAAoE;wBAA7E,KAAK,KAAA,CAAA;wBACd,WAAW,GAAG,MAAA,KAAK,CAAC,SAAS,0CAAE,GAAG,CAAC;wBACnC,UAAU,GAAG,MAAA,KAAK,CAAC,QAAQ,0CAAE,GAAG,CAAC;wBACvC,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,EAAE;4BAC/B,wBAAS,CAAC,wCAAwC;yBACnD;wBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBACnB,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;wBACxB,aAAa,GAAG,MAAA,KAAK,CAAC,aAAa,mCAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;wBACnE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE;4BAC1C,kBAAkB,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;yBAClD;wBACD,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;6BAG9B,qBAAM,IAAI,CAAC,WAAW,CAAC,aAAU,CAAC,IAAI,EAAE,YAAY,CAAC,EAAA;;wBAA1E,kBAAkB,GAAG,SAAqD;wBAC1E,wBAAwB,GAAG,IAAI,GAAG,EAA8B,CAAC;4CAC5D,SAAS;;;;;wCACZ,KAAK,GAAG,IAAA,cAAS,GAAE,CAAC,IAAI,CAAC,UAAC,SAAS,IAAK,OAAA,SAAS,CAAC,IAAI,KAAK,SAAS,EAA5B,CAA4B,CAAC,CAAC;wCAC5E,KAAA,CAAA,KAAA,wBAAwB,CAAA,CAAC,GAAG,CAAA;8CAC1B,SAAS;6CACT,KAAK,EAAL,wBAAK;wCAAG,qBAAM,OAAK,WAAW,CAAC,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC,EAAA;;wCAAjE,KAAA,SAAiE,CAAA;;;wCAAG,KAAA,IAAI,CAAA;;;wCAFlF,6BAGC,CAAC;;;;;;8BALyD,EAArC,KAAA,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;;;6BAArC,CAAA,cAAqC,CAAA;wBAAlD,SAAS;sDAAT,SAAS;;;;;wBAAI,IAAqC,CAAA;;;wBAQvD,MAAM,GAA+B,EAAE,iBAAiB,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;wBACnG,WAA0B,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM,EAAE;4BAAjB,KAAK;4BACR,aAAa,GAAG,MAAA,KAAK,CAAC,aAAa,mCAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;4BAC7D,iBAAiB,GAAG,wBAAwB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;4BAClE,MAAM,SAA8C,CAAC;4BACzD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAI,CAAC,EAAE;gCACjD,MAAM,GAAG,mBAAmB,CAAC;gCAC7B,MAAM,CAAC,iBAAiB,EAAE,CAAC;6BAC5B;iCAAM,IAAI,iBAAiB,KAAK,IAAI,EAAE;gCACrC,MAAM,GAAG,+BAA+B,CAAC;gCACzC,MAAM,CAAC,gBAAgB,EAAE,CAAC;6BAC3B;iCAAM,IAAI,CAAC,iBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAI,CAAC,EAAE;gCACvD,MAAM,GAAG,kBAAkB,CAAC;gCAC5B,MAAM,CAAC,gBAAgB,EAAE,CAAC;6BAC3B;4BACD,IAAI,CAAC,MAAM,EAAE;gCACX,SAAS;6BACV;4BACK,GAAG,yBACJ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KACpB,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,EAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAC5B,MAAM,QAAA,GACP,CAAC;4BACF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;4BACtB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,kDAAkD,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;yBACxF;wBAED,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,8BAA8B;4BACvC,GAAG,EAAE,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE;yBAChG,CAAC,CAAC;wBACH,sBAAO,MAAM,EAAC;;;;KACf;IAED,6FAA6F;IACrF,uDAAkB,GAA1B,UAA2B,EAA6B;QACtD,OAAO,EAAE,CAAC,EAAE,CAAC;YACX,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;YAC3C,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAClE,gDAAW,GAAzB,UAA0B,KAAiB,EAAE,GAAgB;;;;;;wBACrD,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;wBAC7B,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACtB,SAAS,GAAG,GAAG,CAAC;wBACb,KAAK,GAAG,CAAC;;;6BAAE,CAAA,KAAK,GAAG,GAAG,CAAC,MAAM,CAAA;wBAC9B,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,CAAC,CAAC;wBAC5C,EAAE,GAAG,IAAI,wBAAmB,EAAE;6BACjC,eAAe,CAAC,KAAK,CAAC;6BACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;6BAC1B,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;wBAC7C,qBAAM,IAAA,kBAAa,GAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,EAAA;;wBAA/C,KAAK,GAAG,CAAC,SAAsC,CAAa;wBAClE,WAA0B,EAAL,eAAK,EAAL,mBAAK,EAAL,IAAK,EAAE;4BAAjB,MAAM;4BACf,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;yBACzB;;;wBATqC,KAAK,IAAI,SAAS,CAAA;;4BAW1D,sBAAO,QAAQ,EAAC;;;;KACjB;IAEO,0CAAK,GAAb,UAAc,KAAkB;;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,MAAA,KAAK,CAAC,OAAO,0CAAE,WAAW,EAAE;SACtC,CAAC;IACJ,CAAC;IACH,iCAAC;AAAD,CAAC,AArKD,IAqKC;AArKY,gEAA0B"}

package/dist/src/routes/devLogin.d.ts

@@ -13,6 +13,11 @@ import { Route } from '@proteinjs/server-api';
  * Domain rail: `?email` must share `DEV_AUTO_LOGIN_EMAIL`'s domain — even a dev server must not
  * mint sessions (much less accounts) for arbitrary domains; anything else answers 400.
  *
+ * Shape rail: `?email` must be a well-formed address (the house `emailRegex`). The domain rail
+ * alone let `?email=brent+lane-a@…` through when the `+` was left unencoded — a query-string `+`
+ * decodes to a SPACE, so the route minted a stray `brent lane-a@…` account. The 400 names the
+ * remedy (`%2B`) because plus-addressing is the fan-out convention this door exists for.
+ *
  * A missing account is created through the normal signup creation path (`Signup.createAccount`)
  * as a normal test user — password `test`, matching the seeded test-account convention, so
  * interactive login works for the same identity. Composes with userCache's missing-account→guest

package/dist/src/routes/devLogin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"devLogin.d.ts","sourceRoot":"","sources":["../../../src/routes/devLogin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAW9C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,QAAQ,EAAE,KAuCtB,CAAC"}
+{"version":3,"file":"devLogin.d.ts","sourceRoot":"","sources":["../../../src/routes/devLogin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAY9C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,QAAQ,EAAE,KAgDtB,CAAC"}