@proteinjs/user-server 1.18.0 → 1.20.0

package/dist/src/authorization/UserActivityStamp.js

@@ -46,33 +46,35 @@ var logger_1 = require("@proteinjs/logger");
 var user_1 = require("@proteinjs/user");
 /**
  * Writes the LAST-ACTIVITY presence stamp (`user_activity`, one row per user — see
- * UserActivityTable's contract): "this human made an interactive request just now".
+ * UserActivityTable's contract): "this person gave a page input just now".
  *
- * The TRANSPORT keying lives at the call site — userCache.create runs once per session-cookie
- * request (wrapRoute's session-cache build) and only there, so seeded/background contexts
- * (runInUserScope sets session data directly) structurally never reach this class. What this
- * class owns is the ACCOUNT predicate: machine accounts (`isLoadedFromSource`) are refused —
- * their requests do arrive over real sessions (e.g. the error bridge's polling), but a machine
- * logging in is not a person being present.
+ * The INPUT keying lives at the call site — the UserPresence service is the only caller, and
+ * the page reports through it only from a real pointer / key / touch / wheel event. The
+ * per-request session build (userCache.create) does NOT call this: it runs for every request
+ * over a session cookie, and that transport is what an idle tab produces all day (polls, socket
+ * re-joins on reconnect, the reload a deploy pushes) — presence keyed on it read every user as
+ * "active today" (founder finding 2026-09-12). What this class owns is the ACCOUNT predicate:
+ * the guest identity and machine accounts (`machine` — the one owner of "is this a machine",
+ * founder ruling 2026-09-02) are refused, whatever door they arrive through.
  *
  * Write behavior mirrors DbSessionStore's touch: throttled per user (a presence fact consumed at
- * day grain needs no finer cadence, and an unthrottled stamp would put a write on EVERY request),
- * fail-open (a lost stamp is a few minutes of staleness, never a failed request — the returned
- * promise NEVER rejects), and race-tolerant (concurrent first stamps contend on the scope-unique
- * index; the loser's error is swallowed as debug).
+ * day grain needs no finer cadence, and the page already throttles its reports — this is the
+ * belt), fail-open (a lost stamp is a few minutes of staleness, never a failed call — the
+ * returned promise NEVER rejects), and race-tolerant (concurrent first stamps contend on the
+ * scope-unique index; the loser's error is swallowed as debug).
  */
 var UserActivityStamp = /** @class */ (function () {
     function UserActivityStamp() {
         this.logger = new logger_1.Logger({ name: this.constructor.name });
     }
     /**
-     * Record that `user` is present on an interactive request. Fire-and-forget safe: errors are
-     * handled (and logged) here, so callers may `void` the returned promise.
+     * Record that `user` gave a page human input. Fire-and-forget safe: errors are handled (and
+     * logged) here, so callers may `void` the returned promise.
      */
-    UserActivityStamp.prototype.recordInteractiveRequest = function (user) {
+    UserActivityStamp.prototype.recordHumanInput = function (user) {
         var _this = this;
         var _a;
-        if (!user.id || user.isLoadedFromSource === true) {
+        if (!user.id || user.id === user_1.guestUser.id || user.machine === true) {
             return Promise.resolve();
         }
         var last = (_a = UserActivityStamp.lastStampMs.get(user.id)) !== null && _a !== void 0 ? _a : 0;
@@ -85,9 +87,9 @@ var UserActivityStamp = /** @class */ (function () {
             UserActivityStamp.lastStampMs.clear(); // bounded memory; worst case is one extra stamp per user
         }
         return this.upsert(user.id).catch(function (error) {
-            // Contention (a concurrent request stamped first, racing the scope-unique index) and real
-            // failures land here alike; both are harmless to the request. Un-throttle so the next
-            // request retries instead of waiting out a full interval on a stamp that never landed.
+            // Contention (a concurrent report stamped first, racing the scope-unique index) and real
+            // failures land here alike; both are harmless to the caller. Un-throttle so the next
+            // report retries instead of waiting out a full interval on a stamp that never landed.
             UserActivityStamp.lastStampMs.delete(user.id);
             _this.logger.error({ message: 'Failed to write user activity stamp', error: error });
         });
@@ -118,7 +120,7 @@ var UserActivityStamp = /** @class */ (function () {
     };
     /** Stamp at most this often per user — same cadence class as DbSessionStore.TOUCH_INTERVAL. */
     UserActivityStamp.STAMP_INTERVAL_MS = 1000 * 60 * 5;
-    /** Process-wide: userCache is a plain object, so throttle state can't live per-instance. */
+    /** Process-wide: the throttle outlives any one service instance. */
     UserActivityStamp.lastStampMs = new Map();
     return UserActivityStamp;
 }());

package/dist/src/authorization/UserActivityStamp.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserActivityStamp.js","sourceRoot":"","sources":["../../../src/authorization/UserActivityStamp.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kDAA4B;AAC5B,oCAA8C;AAC9C,4CAA2C;AAC3C,wCAAuE;AAEvE;;;;;;;;;;;;;;;;GAgBG;AACH;IAAA;QAMU,WAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAqC/D,CAAC;IAnCC;;;OAGG;IACH,oDAAwB,GAAxB,UAAyB,IAAU;QAAnC,iBAoBC;;QAnBC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,EAAE;YAChD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;SAC1B;QACD,IAAM,IAAI,GAAG,MAAA,iBAAiB,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,mCAAI,CAAC,CAAC;QAC7D,IAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,GAAG,iBAAiB,CAAC,iBAAiB,EAAE;YACpD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;SAC1B;QACD,iBAAiB,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,iBAAiB,CAAC,WAAW,CAAC,IAAI,GAAG,KAAK,EAAE;YAC9C,iBAAiB,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,yDAAyD;SACjG;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,UAAC,KAAK;YACtC,0FAA0F;YAC1F,sFAAsF;YACtF,uFAAuF;YACvF,iBAAiB,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9C,KAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,KAAK,OAAA,EAAE,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;IACL,CAAC;IAEa,kCAAM,GAApB,UAAqB,MAAc;;;;;;wBAC3B,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACV,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAA;;wBAA/D,QAAQ,GAAG,SAAoD;6BACjE,QAAQ,EAAR,wBAAQ;wBACV,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,YAAY,EAAE,IAAA,gBAAM,GAAE,EAAkB,CAAC,EAAA;;wBAAjG,SAAiG,CAAC;;4BAElG,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,IAAA,gBAAM,GAAE,EAAkB,CAAC,EAAA;;wBAA/F,SAA+F,CAAC;;;;;;KAEnG;IAzCD,+FAA+F;IACvE,mCAAiB,GAAG,IAAI,GAAG,EAAE,GAAG,CAAC,AAAhB,CAAiB;IAC1D,4FAA4F;IAC7E,6BAAW,GAAG,IAAI,GAAG,EAAkB,AAA5B,CAA6B;IAuCzD,wBAAC;CAAA,AA3CD,IA2CC;AA3CY,8CAAiB"}
+{"version":3,"file":"UserActivityStamp.js","sourceRoot":"","sources":["../../../src/authorization/UserActivityStamp.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kDAA4B;AAC5B,oCAA8C;AAC9C,4CAA2C;AAC3C,wCAAkF;AAElF;;;;;;;;;;;;;;;;;;GAkBG;AACH;IAAA;QAMU,WAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAqC/D,CAAC;IAnCC;;;OAGG;IACH,4CAAgB,GAAhB,UAAiB,IAAkC;QAAnD,iBAoBC;;QAnBC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,KAAK,gBAAS,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE;YACjE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;SAC1B;QACD,IAAM,IAAI,GAAG,MAAA,iBAAiB,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,mCAAI,CAAC,CAAC;QAC7D,IAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,GAAG,iBAAiB,CAAC,iBAAiB,EAAE;YACpD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;SAC1B;QACD,iBAAiB,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,iBAAiB,CAAC,WAAW,CAAC,IAAI,GAAG,KAAK,EAAE;YAC9C,iBAAiB,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,yDAAyD;SACjG;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,UAAC,KAAK;YACtC,yFAAyF;YACzF,qFAAqF;YACrF,sFAAsF;YACtF,iBAAiB,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9C,KAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,KAAK,OAAA,EAAE,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;IACL,CAAC;IAEa,kCAAM,GAApB,UAAqB,MAAc;;;;;;wBAC3B,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACV,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAA;;wBAA/D,QAAQ,GAAG,SAAoD;6BACjE,QAAQ,EAAR,wBAAQ;wBACV,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,YAAY,EAAE,IAAA,gBAAM,GAAE,EAAkB,CAAC,EAAA;;wBAAjG,SAAiG,CAAC;;4BAElG,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,IAAA,gBAAM,GAAE,EAAkB,CAAC,EAAA;;wBAA/F,SAA+F,CAAC;;;;;;KAEnG;IAzCD,+FAA+F;IACvE,mCAAiB,GAAG,IAAI,GAAG,EAAE,GAAG,CAAC,AAAhB,CAAiB;IAC1D,oEAAoE;IACrD,6BAAW,GAAG,IAAI,GAAG,EAAkB,AAA5B,CAA6B;IAuCzD,wBAAC;CAAA,AA3CD,IA2CC;AA3CY,8CAAiB"}

package/dist/src/authorization/userCache.d.ts

@@ -1,4 +1,13 @@
 import { SessionDataCache } from '@proteinjs/server-api';
 import { User } from '@proteinjs/user';
+/**
+ * The per-request session-cache build: resolves the session's email to the account row every
+ * request that rides a session cookie (wrapRoute), and every socket event (util-server's
+ * SocketSessionContext). It resolves IDENTITY only — it does not write the presence stamp
+ * (`user_activity`, UserActivityTable's contract): this build runs for an idle tab's polls, a
+ * socket's room re-joins on every reconnect, the reload a deploy pushes onto every open tab —
+ * transport, not a person. Presence is written from the page's human-input report alone
+ * (UserPresence.recordPresence).
+ */
 export declare const userCache: SessionDataCache<User>;
 //# sourceMappingURL=userCache.d.ts.map

package/dist/src/authorization/userCache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"userCache.d.ts","sourceRoot":"","sources":["../../../src/authorization/userCache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,EAAE,IAAI,EAA6C,MAAM,iBAAiB,CAAC;AAOlF,eAAO,MAAM,SAAS,EAAE,gBAAgB,CAAC,IAAI,CAqD5C,CAAC"}
+{"version":3,"file":"userCache.d.ts","sourceRoot":"","sources":["../../../src/authorization/userCache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,EAAE,IAAI,EAA6C,MAAM,iBAAiB,CAAC;AAKlF;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,EAAE,gBAAgB,CAAC,IAAI,CA8C5C,CAAC"}

package/dist/src/authorization/userCache.js

@@ -45,9 +45,16 @@ var db_1 = require("@proteinjs/db");
 var logger_1 = require("@proteinjs/logger");
 var user_1 = require("@proteinjs/user");
 var DefaultAdminCredentials_1 = require("../authentication/DefaultAdminCredentials");
-var UserActivityStamp_1 = require("./UserActivityStamp");
 var logger = new logger_1.Logger({ name: 'userCache' });
-var userActivityStamp = new UserActivityStamp_1.UserActivityStamp();
+/**
+ * The per-request session-cache build: resolves the session's email to the account row every
+ * request that rides a session cookie (wrapRoute), and every socket event (util-server's
+ * SocketSessionContext). It resolves IDENTITY only — it does not write the presence stamp
+ * (`user_activity`, UserActivityTable's contract): this build runs for an idle tab's polls, a
+ * socket's room re-joins on every reconnect, the reload a deploy pushes onto every open tab —
+ * transport, not a person. Presence is written from the page's human-input report alone
+ * (UserPresence.recordPresence).
+ */
 exports.userCache = {
     key: user_1.USER_SESSION_CACHE_KEY,
     create: function (sessionId, userEmail) { return __awaiter(void 0, void 0, void 0, function () {
@@ -86,13 +93,6 @@ exports.userCache = {
                     else if (accountUser) {
                         delete accountUser['password'];
                         user = accountUser;
-                        // LAST ACTIVITY (human presence — UserActivityTable's contract): stamped HERE because
-                        // this cache build runs exactly once per session-cookie request (wrapRoute), i.e. only
-                        // for interactive transport. Background/seeded contexts (runInUserScope) set session
-                        // data directly and never pass through, so machinery acting as the user structurally
-                        // cannot stamp; the stamp itself refuses machine accounts. Fire-and-forget: the
-                        // returned promise never rejects, and a request never waits on its own stamp.
-                        void userActivityStamp.recordInteractiveRequest(user);
                     }
                     else {
                         // A session can outlive its account (row deleted, or a dev auto-login for a never-created

package/dist/src/authorization/userCache.js.map

@@ -1 +1 @@
-{"version":3,"file":"userCache.js","sourceRoot":"","sources":["../../../src/authorization/userCache.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kDAA4B;AAE5B,oCAA8C;AAC9C,4CAA2C;AAC3C,wCAAkF;AAClF,qFAAoF;AACpF,yDAAwD;AAExD,IAAM,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;AACjD,IAAM,iBAAiB,GAAG,IAAI,qCAAiB,EAAE,CAAC;AAErC,QAAA,SAAS,GAA2B;IAC/C,GAAG,EAAE,6BAAsB;IAC3B,MAAM,EAAE,UAAO,SAAiB,EAAE,SAAiB;;;;;oBAC7C,IAAI,GAAG,gBAAS,CAAC;yBACjB,SAAS,EAAT,wBAAS;oBACL,gBAAgB,GAAG,iDAAuB,CAAC,cAAc,EAAE,CAAC;yBAC9D,CAAA,gBAAgB,IAAI,SAAS,IAAI,gBAAgB,CAAC,QAAQ,CAAA,EAA1D,wBAA0D;oBACtD,SAAS,GAAS;wBACtB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,gBAAgB,CAAC,QAAQ;wBAChC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;wBACnC,aAAa,EAAE,IAAI;wBACnB,KAAK,EAAE,CAAC,OAAO,CAAC;wBAChB,OAAO,EAAE,IAAA,gBAAM,GAAE;wBACjB,OAAO,EAAE,IAAA,gBAAM,GAAE;wBACjB,EAAE,EAAE,OAAO;qBACZ,CAAC;oBACF,IAAI,GAAG,SAAS,CAAC;;wBAEG,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;oBAAxF,WAAW,GAAG,SAA0E;oBAC9F,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,aAAa,EAAE;wBACvD,sFAAsF;wBACtF,iFAAiF;wBACjF,4EAA4E;wBAC5E,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,wEAAwE;4BACjF,GAAG,EAAE,EAAE,SAAS,WAAA,EAAE,SAAS,WAAA,EAAE;yBAC9B,CAAC,CAAC;qBACJ;yBAAM,IAAI,WAAW,EAAE;wBACtB,OAAQ,WAAmB,CAAC,UAAU,CAAC,CAAC;wBACxC,IAAI,GAAG,WAAW,CAAC;wBACnB,sFAAsF;wBACtF,uFAAuF;wBACvF,qFAAqF;wBACrF,qFAAqF;wBACrF,gFAAgF;wBAChF,8EAA8E;wBAC9E,KAAK,iBAAiB,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;qBACvD;yBAAM;wBACL,0FAA0F;wBAC1F,+EAA+E;wBAC/E,sFAAsF;wBACtF,yDAAyD;wBACzD,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,iFAAiF;4BAC1F,GAAG,EAAE,EAAE,SAAS,WAAA,EAAE,SAAS,WAAA,EAAE;yBAC9B,CAAC,CAAC;qBACJ;;wBAIL,sBAAO,IAAI,EAAC;;;SACb;CACF,CAAC"}
+{"version":3,"file":"userCache.js","sourceRoot":"","sources":["../../../src/authorization/userCache.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kDAA4B;AAE5B,oCAA8C;AAC9C,4CAA2C;AAC3C,wCAAkF;AAClF,qFAAoF;AAEpF,IAAM,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;AAEjD;;;;;;;;GAQG;AACU,QAAA,SAAS,GAA2B;IAC/C,GAAG,EAAE,6BAAsB;IAC3B,MAAM,EAAE,UAAO,SAAiB,EAAE,SAAiB;;;;;oBAC7C,IAAI,GAAG,gBAAS,CAAC;yBACjB,SAAS,EAAT,wBAAS;oBACL,gBAAgB,GAAG,iDAAuB,CAAC,cAAc,EAAE,CAAC;yBAC9D,CAAA,gBAAgB,IAAI,SAAS,IAAI,gBAAgB,CAAC,QAAQ,CAAA,EAA1D,wBAA0D;oBACtD,SAAS,GAAS;wBACtB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,gBAAgB,CAAC,QAAQ;wBAChC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;wBACnC,aAAa,EAAE,IAAI;wBACnB,KAAK,EAAE,CAAC,OAAO,CAAC;wBAChB,OAAO,EAAE,IAAA,gBAAM,GAAE;wBACjB,OAAO,EAAE,IAAA,gBAAM,GAAE;wBACjB,EAAE,EAAE,OAAO;qBACZ,CAAC;oBACF,IAAI,GAAG,SAAS,CAAC;;wBAEG,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;oBAAxF,WAAW,GAAG,SAA0E;oBAC9F,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,aAAa,EAAE;wBACvD,sFAAsF;wBACtF,iFAAiF;wBACjF,4EAA4E;wBAC5E,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,wEAAwE;4BACjF,GAAG,EAAE,EAAE,SAAS,WAAA,EAAE,SAAS,WAAA,EAAE;yBAC9B,CAAC,CAAC;qBACJ;yBAAM,IAAI,WAAW,EAAE;wBACtB,OAAQ,WAAmB,CAAC,UAAU,CAAC,CAAC;wBACxC,IAAI,GAAG,WAAW,CAAC;qBACpB;yBAAM;wBACL,0FAA0F;wBAC1F,+EAA+E;wBAC/E,sFAAsF;wBACtF,yDAAyD;wBACzD,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,iFAAiF;4BAC1F,GAAG,EAAE,EAAE,SAAS,WAAA,EAAE,SAAS,WAAA,EAAE;yBAC9B,CAAC,CAAC;qBACJ;;wBAIL,sBAAO,IAAI,EAAC;;;SACb;CACF,CAAC"}

package/dist/src/routes/DevBootstrapRoles.d.ts

@@ -0,0 +1,21 @@
+import type { BootstrapRolesOutcome } from '../services/Roles';
+/**
+ * The `DEV_BOOTSTRAP_ROLES` contract of the dev role-bootstrap door (routes/devLogin.ts):
+ *
+ *   DEV_BOOTSTRAP_ROLES='email:role[,role];email:role…'
+ *
+ * Addresses and roles are trimmed; addresses are lowercased (the normalization every account
+ * email gets); a repeated address unions its roles; an entry with no `:`, no address or no role
+ * is ignored (malformed input is skipped, never fatal). The door grants the listed roles the
+ * account does not hold and logs ONE marker line per hit for a listed address —
+ * `[dev-bootstrap] <email>: granted a, b; held c; refused d (why)` — which tooling that provisions
+ * a development database can read back from the server log as proof of the grant.
+ */
+export declare class DevBootstrapRoles {
+    /** The roles listed for `email` in the process env (empty when the variable is unset or the address is not listed). */
+    static rolesFor(email: string): string[];
+    static parse(value: string | undefined): Map<string, string[]>;
+    /** The one marker line per hit — a log contract its readers parse; change the shape only together with them. */
+    static markerLine(email: string, outcome: BootstrapRolesOutcome): string;
+}
+//# sourceMappingURL=DevBootstrapRoles.d.ts.map

package/dist/src/routes/DevBootstrapRoles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DevBootstrapRoles.d.ts","sourceRoot":"","sources":["../../../src/routes/DevBootstrapRoles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,qBAAa,iBAAiB;IAC5B,uHAAuH;IACvH,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAqB9D,gHAAgH;IAChH,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,MAAM;CAOzE"}

package/dist/src/routes/DevBootstrapRoles.js

@@ -0,0 +1,64 @@
+"use strict";
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DevBootstrapRoles = void 0;
+/**
+ * The `DEV_BOOTSTRAP_ROLES` contract of the dev role-bootstrap door (routes/devLogin.ts):
+ *
+ *   DEV_BOOTSTRAP_ROLES='email:role[,role];email:role…'
+ *
+ * Addresses and roles are trimmed; addresses are lowercased (the normalization every account
+ * email gets); a repeated address unions its roles; an entry with no `:`, no address or no role
+ * is ignored (malformed input is skipped, never fatal). The door grants the listed roles the
+ * account does not hold and logs ONE marker line per hit for a listed address —
+ * `[dev-bootstrap] <email>: granted a, b; held c; refused d (why)` — which tooling that provisions
+ * a development database can read back from the server log as proof of the grant.
+ */
+var DevBootstrapRoles = /** @class */ (function () {
+    function DevBootstrapRoles() {
+    }
+    /** The roles listed for `email` in the process env (empty when the variable is unset or the address is not listed). */
+    DevBootstrapRoles.rolesFor = function (email) {
+        var _a;
+        return (_a = DevBootstrapRoles.parse(process.env.DEV_BOOTSTRAP_ROLES).get(email.trim().toLowerCase())) !== null && _a !== void 0 ? _a : [];
+    };
+    DevBootstrapRoles.parse = function (value) {
+        var _a;
+        var entries = new Map();
+        for (var _i = 0, _b = (value !== null && value !== void 0 ? value : '').split(';'); _i < _b.length; _i++) {
+            var entry = _b[_i];
+            var colon = entry.indexOf(':');
+            if (colon < 0) {
+                continue;
+            }
+            var email = entry.slice(0, colon).trim().toLowerCase();
+            var roles = entry
+                .slice(colon + 1)
+                .split(',')
+                .map(function (role) { return role.trim(); })
+                .filter(Boolean);
+            if (!email || roles.length === 0) {
+                continue;
+            }
+            entries.set(email, Array.from(new Set(__spreadArray(__spreadArray([], ((_a = entries.get(email)) !== null && _a !== void 0 ? _a : []), true), roles, true))));
+        }
+        return entries;
+    };
+    /** The one marker line per hit — a log contract its readers parse; change the shape only together with them. */
+    DevBootstrapRoles.markerLine = function (email, outcome) {
+        var list = function (items) { return (items.length ? items.join(', ') : '(none)'); };
+        return ("[dev-bootstrap] ".concat(email, ": granted ").concat(list(outcome.granted), "; held ").concat(list(outcome.held), "; ") +
+            "refused ".concat(list(outcome.refused.map(function (refusal) { return "".concat(refusal.role, " (").concat(refusal.why, ")"); }))));
+    };
+    return DevBootstrapRoles;
+}());
+exports.DevBootstrapRoles = DevBootstrapRoles;
+//# sourceMappingURL=DevBootstrapRoles.js.map

package/dist/src/routes/DevBootstrapRoles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DevBootstrapRoles.js","sourceRoot":"","sources":["../../../src/routes/DevBootstrapRoles.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA;;;;;;;;;;;GAWG;AACH;IAAA;IAmCA,CAAC;IAlCC,uHAAuH;IAChH,0BAAQ,GAAf,UAAgB,KAAa;;QAC3B,OAAO,MAAA,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,mCAAI,EAAE,CAAC;IACxG,CAAC;IAEM,uBAAK,GAAZ,UAAa,KAAyB;;QACpC,IAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC5C,KAAoB,UAAwB,EAAxB,KAAA,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAxB,cAAwB,EAAxB,IAAwB,EAAE;YAAzC,IAAM,KAAK,SAAA;YACd,IAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,KAAK,GAAG,CAAC,EAAE;gBACb,SAAS;aACV;YACD,IAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACzD,IAAM,KAAK,GAAG,KAAK;iBAChB,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;iBAChB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,UAAC,IAAI,IAAK,OAAA,IAAI,CAAC,IAAI,EAAE,EAAX,CAAW,CAAC;iBAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;YACnB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;gBAChC,SAAS;aACV;YACD,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,iCAAK,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,mCAAI,EAAE,CAAC,SAAK,KAAK,QAAE,CAAC,CAAC,CAAC;SACpF;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gHAAgH;IACzG,4BAAU,GAAjB,UAAkB,KAAa,EAAE,OAA8B;QAC7D,IAAM,IAAI,GAAG,UAAC,KAAe,IAAK,OAAA,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAA5C,CAA4C,CAAC;QAC/E,OAAO,CACL,0BAAmB,KAAK,uBAAa,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAU,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAI;YAC1F,kBAAW,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAC,OAAO,IAAK,OAAA,UAAG,OAAO,CAAC,IAAI,eAAK,OAAO,CAAC,GAAG,MAAG,EAAlC,CAAkC,CAAC,CAAC,CAAE,CACxF,CAAC;IACJ,CAAC;IACH,wBAAC;AAAD,CAAC,AAnCD,IAmCC;AAnCY,8CAAiB"}

package/dist/src/routes/devLogin.d.ts

@@ -33,6 +33,17 @@ import { Route } from '@proteinjs/server-api';
  * Test and prod never set it — the omission is the safety, the same idiom as the gates. The
  * outcome is logged as ONE marker line, `Dev bootstrap admin door: <granted|admin-exists>`,
  * which the n3xa compose-estate boot proof reads from the server log to PROVE the grant landed.
+ *
+ * Role-bootstrap door (`DEV_BOOTSTRAP_ROLES='email:role[,role];email:role…'`, the grammar in
+ * DevBootstrapRoles.ts): the first-admin door leaves every OTHER account role-less, and a
+ * consumer's admin-grant-only roles then need an admin's act on every fresh development database.
+ * Behind the same two gates, when the resolved address is listed, the listed roles the account
+ * does not hold are granted through `Roles.bootstrapRoles` — once each, audited, never revoking,
+ * never break-glass (refused and named, like a role the catalog does not know); the grant precedes
+ * the session so the first page load carries the roles. ONE marker line per hit for a listed
+ * address, `[dev-bootstrap] <email>: granted …; held …; refused …`, is what provisioning tooling
+ * reads back as proof. The variable absent = nothing changes; the gates closed = 404 regardless; a
+ * deployment outside development never sets it.
  */
 export declare const devLogin: Route;
 //# sourceMappingURL=devLogin.d.ts.map

package/dist/src/routes/devLogin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"devLogin.d.ts","sourceRoot":"","sources":["../../../src/routes/devLogin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAa9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,QAAQ,EAAE,KAsDtB,CAAC"}
+{"version":3,"file":"devLogin.d.ts","sourceRoot":"","sources":["../../../src/routes/devLogin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAc9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,QAAQ,EAAE,KA4DtB,CAAC"}

package/dist/src/routes/devLogin.js

@@ -42,6 +42,7 @@ var util_1 = require("@proteinjs/util");
 var establishSession_1 = require("../authentication/establishSession");
 var Roles_1 = require("../services/Roles");
 var Signup_1 = require("../services/Signup");
+var DevBootstrapRoles_1 = require("./DevBootstrapRoles");
 var logger = new logger_1.Logger({ name: 'devLogin' });
 /** Lowercased domain of an email address (the whole string when there is no `@`, which can never
  *  equal a real env domain — so malformed params fall out at the domain rail). */
@@ -80,12 +81,23 @@ var emailDomain = function (address) { return address.slice(address.lastIndexOf(
  * Test and prod never set it — the omission is the safety, the same idiom as the gates. The
  * outcome is logged as ONE marker line, `Dev bootstrap admin door: <granted|admin-exists>`,
  * which the n3xa compose-estate boot proof reads from the server log to PROVE the grant landed.
+ *
+ * Role-bootstrap door (`DEV_BOOTSTRAP_ROLES='email:role[,role];email:role…'`, the grammar in
+ * DevBootstrapRoles.ts): the first-admin door leaves every OTHER account role-less, and a
+ * consumer's admin-grant-only roles then need an admin's act on every fresh development database.
+ * Behind the same two gates, when the resolved address is listed, the listed roles the account
+ * does not hold are granted through `Roles.bootstrapRoles` — once each, audited, never revoking,
+ * never break-glass (refused and named, like a role the catalog does not know); the grant precedes
+ * the session so the first page load carries the roles. ONE marker line per hit for a listed
+ * address, `[dev-bootstrap] <email>: granted …; held …; refused …`, is what provisioning tooling
+ * reads back as proof. The variable absent = nothing changes; the gates closed = 404 regardless; a
+ * deployment outside development never sets it.
  */
 exports.devLogin = {
     path: '/dev/login',
     method: 'get',
     onRequest: function (request, response) { return __awaiter(void 0, void 0, void 0, function () {
-        var envEmail, email, emailParam, requested, creation, bootstrapEmail, outcome;
+        var envEmail, email, emailParam, requested, creation, bootstrapEmail, outcome, bootstrapRoles, outcome;
         var _a, _b, _c;
         return __generator(this, function (_d) {
             switch (_d.label) {
@@ -132,11 +144,19 @@ exports.devLogin = {
                     outcome = _d.sent();
                     logger.info({ message: "Dev bootstrap admin door: ".concat(outcome), obj: { email: email } });
                     _d.label = 3;
-                case 3: 
+                case 3:
+                    bootstrapRoles = DevBootstrapRoles_1.DevBootstrapRoles.rolesFor(email);
+                    if (!(bootstrapRoles.length > 0)) return [3 /*break*/, 5];
+                    return [4 /*yield*/, new Roles_1.Roles().bootstrapRoles(email, bootstrapRoles)];
+                case 4:
+                    outcome = _d.sent();
+                    logger.info({ message: DevBootstrapRoles_1.DevBootstrapRoles.markerLine(email, outcome) });
+                    _d.label = 5;
+                case 5: 
                 // establishSession commits the session row before the redirect — the redirected GET / must
                 // never read the store ahead of the write (observed: first /dev/login load landed on /login).
                 return [4 /*yield*/, (0, establishSession_1.establishSession)(request, email)];
-                case 4:
+                case 6:
                     // establishSession commits the session row before the redirect — the redirected GET / must
                     // never read the store ahead of the write (observed: first /dev/login load landed on /login).
                     _d.sent();

package/dist/src/routes/devLogin.js.map

@@ -1 +1 @@
-{"version":3,"file":"devLogin.js","sourceRoot":"","sources":["../../../src/routes/devLogin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,4CAA2C;AAC3C,wCAA6C;AAC7C,uEAAsE;AACtE,2CAA0C;AAC1C,6CAA4C;AAE5C,IAAM,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAEhD;kFACkF;AAClF,IAAM,WAAW,GAAG,UAAC,OAAe,IAAK,OAAA,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAzD,CAAyD,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACU,QAAA,QAAQ,GAAU;IAC7B,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,KAAK;IACb,SAAS,EAAE,UAAO,OAAY,EAAE,QAAQ;;;;;;oBAChC,QAAQ,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,oBAAoB,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBACjE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE;wBACzC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;wBAC5B,sBAAO;qBACR;oBAEG,KAAK,GAAG,QAAQ,CAAC;oBACf,UAAU,GAAG,MAAA,OAAO,CAAC,KAAK,0CAAE,KAAK,CAAC;oBACxC,IAAI,UAAU,KAAK,SAAS,EAAE;wBACtB,SAAS,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC1E,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,WAAW,CAAC,QAAQ,CAAC,EAAE;4BACpD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mDAA4C,WAAW,CAAC,QAAQ,CAAC,YAAS,CAAC,CAAC;4BACtG,sBAAO;yBACR;wBACD,IAAI,CAAC,iBAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;4BAC/B,QAAQ;iCACL,MAAM,CAAC,GAAG,CAAC;iCACX,IAAI,CACH,wBAAgB,SAAS,4EAAiE;gCACxF,uEAAgE,WAAW,CAAC,QAAQ,CAAC,MAAG,CAC3F,CAAC;4BACJ,sBAAO;yBACR;wBACD,KAAK,GAAG,SAAS,CAAC;qBACnB;oBACD,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;oBAEX,qBAAM,IAAI,eAAM,EAAE,CAAC,aAAa,CAAC;4BAChD,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;4BACxC,KAAK,OAAA;4BACL,QAAQ,EAAE,MAAM;4BAChB,aAAa,EAAE,KAAK;4BACpB,SAAS,EAAE,IAAI;yBAChB,CAAC,EAAA;;oBANI,QAAQ,GAAG,SAMf;oBACF,IAAI,QAAQ,KAAK,SAAS,EAAE;wBAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;qBACzF;oBAEK,cAAc,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,yBAAyB,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;yBACtF,CAAA,cAAc,IAAI,KAAK,KAAK,cAAc,CAAA,EAA1C,wBAA0C;oBAC5B,qBAAM,IAAI,aAAK,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,EAAA;;oBAAjD,OAAO,GAAG,SAAuC;oBACvD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oCAA6B,OAAO,CAAE,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;;;gBAGnF,2FAA2F;gBAC3F,8FAA8F;gBAC9F,qBAAM,IAAA,mCAAgB,EAAC,OAAO,EAAE,KAAK,CAAC,EAAA;;oBAFtC,2FAA2F;oBAC3F,8FAA8F;oBAC9F,SAAsC,CAAC;oBACvC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;oBAC/E,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;;;;SACxB;CACF,CAAC"}
+{"version":3,"file":"devLogin.js","sourceRoot":"","sources":["../../../src/routes/devLogin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,4CAA2C;AAC3C,wCAA6C;AAC7C,uEAAsE;AACtE,2CAA0C;AAC1C,6CAA4C;AAC5C,yDAAwD;AAExD,IAAM,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAEhD;kFACkF;AAClF,IAAM,WAAW,GAAG,UAAC,OAAe,IAAK,OAAA,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAzD,CAAyD,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACU,QAAA,QAAQ,GAAU;IAC7B,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,KAAK;IACb,SAAS,EAAE,UAAO,OAAY,EAAE,QAAQ;;;;;;oBAChC,QAAQ,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,oBAAoB,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBACjE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE;wBACzC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;wBAC5B,sBAAO;qBACR;oBAEG,KAAK,GAAG,QAAQ,CAAC;oBACf,UAAU,GAAG,MAAA,OAAO,CAAC,KAAK,0CAAE,KAAK,CAAC;oBACxC,IAAI,UAAU,KAAK,SAAS,EAAE;wBACtB,SAAS,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC1E,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,WAAW,CAAC,QAAQ,CAAC,EAAE;4BACpD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mDAA4C,WAAW,CAAC,QAAQ,CAAC,YAAS,CAAC,CAAC;4BACtG,sBAAO;yBACR;wBACD,IAAI,CAAC,iBAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;4BAC/B,QAAQ;iCACL,MAAM,CAAC,GAAG,CAAC;iCACX,IAAI,CACH,wBAAgB,SAAS,4EAAiE;gCACxF,uEAAgE,WAAW,CAAC,QAAQ,CAAC,MAAG,CAC3F,CAAC;4BACJ,sBAAO;yBACR;wBACD,KAAK,GAAG,SAAS,CAAC;qBACnB;oBACD,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;oBAEX,qBAAM,IAAI,eAAM,EAAE,CAAC,aAAa,CAAC;4BAChD,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;4BACxC,KAAK,OAAA;4BACL,QAAQ,EAAE,MAAM;4BAChB,aAAa,EAAE,KAAK;4BACpB,SAAS,EAAE,IAAI;yBAChB,CAAC,EAAA;;oBANI,QAAQ,GAAG,SAMf;oBACF,IAAI,QAAQ,KAAK,SAAS,EAAE;wBAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;qBACzF;oBAEK,cAAc,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,yBAAyB,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;yBACtF,CAAA,cAAc,IAAI,KAAK,KAAK,cAAc,CAAA,EAA1C,wBAA0C;oBAC5B,qBAAM,IAAI,aAAK,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,EAAA;;oBAAjD,OAAO,GAAG,SAAuC;oBACvD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oCAA6B,OAAO,CAAE,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;;;oBAG7E,cAAc,GAAG,qCAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;yBACrD,CAAA,cAAc,CAAC,MAAM,GAAG,CAAC,CAAA,EAAzB,wBAAyB;oBACX,qBAAM,IAAI,aAAK,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,EAAA;;oBAAjE,OAAO,GAAG,SAAuD;oBACvE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,qCAAiB,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;;;gBAGzE,2FAA2F;gBAC3F,8FAA8F;gBAC9F,qBAAM,IAAA,mCAAgB,EAAC,OAAO,EAAE,KAAK,CAAC,EAAA;;oBAFtC,2FAA2F;oBAC3F,8FAA8F;oBAC9F,SAAsC,CAAC;oBACvC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;oBAC/E,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;;;;SACxB;CACF,CAAC"}

package/dist/src/services/Roles.d.ts

@@ -8,12 +8,22 @@ import { Service } from '@proteinjs/service';
  *
  * Break-glass roles are never granted through the service door — see `changeRole`; revoking one
  * stays allowed. The ONE break-glass grant in code is `bootstrapAdmin`, the dev first-admin door
- * (server-internal; reachable only through `/dev/login`'s gates, never over RPC).
+ * (server-internal; reachable only through `/dev/login`'s gates, never over RPC). Its sibling
+ * `bootstrapRoles` is the dev role-bootstrap door's grant — never break-glass, catalog-checked.
  *
  * Nobody edits their OWN roles: separating 'roles' from 'users' means nothing if the holder can
  * simply grant themselves more, and a self-revoke is the mirror hazard (the last holder locking
  * themselves out). Both directions are refused — see `changeRole`; ask another user manager.
  */
+/** What one `bootstrapRoles` call did, per role: written now, already on the row, or refused with the reason. */
+export type BootstrapRolesOutcome = {
+    granted: string[];
+    held: string[];
+    refused: {
+        role: string;
+        why: string;
+    }[];
+};
 export declare class Roles implements RolesService {
     serviceMetadata: Service['serviceMetadata'];
     grantRole(userId: string, role: string): Promise<void>;
@@ -33,6 +43,24 @@ export declare class Roles implements RolesService {
      * in, and test/prod never set the variable.
      */
     bootstrapAdmin(email: string): Promise<'granted' | 'admin-exists' | 'no-account'>;
+    /**
+     * The dev role-bootstrap door's grant — `/dev/login` honoring `DEV_BOOTSTRAP_ROLES`
+     * (routes/devLogin.ts, the grammar in routes/DevBootstrapRoles.ts). A fresh development
+     * database has one admin at most (the first-admin door) and every other account role-less, and
+     * a consumer's `adminGrantOnly` roles can be handed out by an admin only — a manual act on
+     * every fresh database. So this grants `roles` to `email`'s account, each
+     * once: a role the account holds is `held` (no write, no audit row — idempotent); nothing is
+     * ever revoked; a role the catalog does not know or a break-glass role is `refused` and named
+     * (`bootstrapAdmin` is the ONE break-glass path, with its own rail). Admin-grant-only roles ARE
+     * granted here — that is the door's point. Every grant is audited like any grant, actor = the
+     * account itself (the door acts for nobody else), the role update and its rows in one
+     * transaction.
+     *
+     * Server-internal, like `bootstrapAdmin`: absent from `RolesService`, never RPC-reachable; the
+     * caller's two gates (DEVELOPMENT + DEV_AUTO_LOGIN_EMAIL) are the only way in, and a deployment
+     * outside development never sets the variable.
+     */
+    bootstrapRoles(email: string, roles: string[]): Promise<BootstrapRolesOutcome>;
     private changeRole;
     /** Whether any account carries the break-glass role — `UserAuth.hasRole`'s membership test, over every row. */
     private adminExists;

package/dist/src/services/Roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Roles.d.ts","sourceRoot":"","sources":["../../../src/services/Roles.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAA8D,MAAM,iBAAiB,CAAC;AAE3G,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,qBAAa,KAAM,YAAW,YAAY;IACjC,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAIhD;IAEI,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7D;;;;;;;;;;;;;OAaG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,cAAc,GAAG,YAAY,CAAC;YAqBzE,UAAU;IA8ExB,+GAA+G;YACjG,WAAW;CAK1B"}
+{"version":3,"file":"Roles.d.ts","sourceRoot":"","sources":["../../../src/services/Roles.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAA8D,MAAM,iBAAiB,CAAC;AAE3G,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C;;;;;;;;;;;;;;GAcG;AACH,iHAAiH;AACjH,MAAM,MAAM,qBAAqB,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,CAAC;AAEpH,qBAAa,KAAM,YAAW,YAAY;IACjC,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAIhD;IAEI,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7D;;;;;;;;;;;;;OAaG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,cAAc,GAAG,YAAY,CAAC;IAqBvF;;;;;;;;;;;;;;;;OAgBG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC;YAuCtE,UAAU;IA8ExB,+GAA+G;YACjG,WAAW;CAK1B"}

package/dist/src/services/Roles.js

@@ -49,20 +49,6 @@ exports.Roles = void 0;
 var db_1 = require("@proteinjs/db");
 var user_1 = require("@proteinjs/user");
 var logger_1 = require("@proteinjs/logger");
-/**
- * The ONE write path for user roles (the `user.roles` column is service-protected — generic
- * record writes cannot touch it). Grants and revokes are validated against the roles catalog and
- * audited: the role update and its `role_grant_event` row (actor, target, role, action; `created`
- * is the timestamp) commit in one transaction, so the trail cannot diverge from the grants.
- *
- * Break-glass roles are never granted through the service door — see `changeRole`; revoking one
- * stays allowed. The ONE break-glass grant in code is `bootstrapAdmin`, the dev first-admin door
- * (server-internal; reachable only through `/dev/login`'s gates, never over RPC).
- *
- * Nobody edits their OWN roles: separating 'roles' from 'users' means nothing if the holder can
- * simply grant themselves more, and a self-revoke is the mirror hazard (the last holder locking
- * themselves out). Both directions are refused — see `changeRole`; ask another user manager.
- */
 var Roles = /** @class */ (function () {
     function Roles() {
         this.serviceMetadata = {
@@ -152,6 +138,94 @@ var Roles = /** @class */ (function () {
             });
         });
     };
+    /**
+     * The dev role-bootstrap door's grant — `/dev/login` honoring `DEV_BOOTSTRAP_ROLES`
+     * (routes/devLogin.ts, the grammar in routes/DevBootstrapRoles.ts). A fresh development
+     * database has one admin at most (the first-admin door) and every other account role-less, and
+     * a consumer's `adminGrantOnly` roles can be handed out by an admin only — a manual act on
+     * every fresh database. So this grants `roles` to `email`'s account, each
+     * once: a role the account holds is `held` (no write, no audit row — idempotent); nothing is
+     * ever revoked; a role the catalog does not know or a break-glass role is `refused` and named
+     * (`bootstrapAdmin` is the ONE break-glass path, with its own rail). Admin-grant-only roles ARE
+     * granted here — that is the door's point. Every grant is audited like any grant, actor = the
+     * account itself (the door acts for nobody else), the role update and its rows in one
+     * transaction.
+     *
+     * Server-internal, like `bootstrapAdmin`: absent from `RolesService`, never RPC-reachable; the
+     * caller's two gates (DEVELOPMENT + DEV_AUTO_LOGIN_EMAIL) are the only way in, and a deployment
+     * outside development never sets the variable.
+     */
+    Roles.prototype.bootstrapRoles = function (email, roles) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function () {
+            var logger, db, user, held, outcome, _i, _b, role, entry;
+            var _this = this;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0:
+                        logger = new logger_1.Logger({ name: 'Roles.bootstrapRoles' });
+                        db = (0, db_1.getDbAsSystem)();
+                        return [4 /*yield*/, db.get(user_1.tables.User, { email: email.toLowerCase() })];
+                    case 1:
+                        user = _c.sent();
+                        if (!user) {
+                            throw new Error("bootstrapRoles: no account for ".concat(email, " \u2014 the door creates the account before it grants"));
+                        }
+                        held = (_a = user.roles) !== null && _a !== void 0 ? _a : [];
+                        outcome = { granted: [], held: [], refused: [] };
+                        for (_i = 0, _b = Array.from(new Set(roles)); _i < _b.length; _i++) {
+                            role = _b[_i];
+                            entry = user_1.RolesCatalog.getEntry(role);
+                            if (!entry) {
+                                outcome.refused.push({ role: role, why: 'unknown role' });
+                            }
+                            else if (entry.breakGlass) {
+                                outcome.refused.push({ role: role, why: 'break-glass' });
+                            }
+                            else if (held.includes(role)) {
+                                outcome.held.push(role);
+                            }
+                            else {
+                                outcome.granted.push(role);
+                            }
+                        }
+                        if (outcome.granted.length === 0) {
+                            return [2 /*return*/, outcome];
+                        }
+                        return [4 /*yield*/, db.runTransaction(function () { return __awaiter(_this, void 0, void 0, function () {
+                                var _i, _a, role;
+                                return __generator(this, function (_b) {
+                                    switch (_b.label) {
+                                        case 0: return [4 /*yield*/, db.update(user_1.tables.User, { id: user.id, roles: __spreadArray(__spreadArray([], held, true), outcome.granted, true) })];
+                                        case 1:
+                                            _b.sent();
+                                            _i = 0, _a = outcome.granted;
+                                            _b.label = 2;
+                                        case 2:
+                                            if (!(_i < _a.length)) return [3 /*break*/, 5];
+                                            role = _a[_i];
+                                            return [4 /*yield*/, db.insert(user_1.tables.RoleGrantEvent, { actor: user.id, target: user.id, role: role, action: 'grant' })];
+                                        case 3:
+                                            _b.sent();
+                                            _b.label = 4;
+                                        case 4:
+                                            _i++;
+                                            return [3 /*break*/, 2];
+                                        case 5: return [2 /*return*/];
+                                    }
+                                });
+                            }); })];
+                    case 2:
+                        _c.sent();
+                        logger.info({
+                            message: 'Roles granted by the dev role-bootstrap door',
+                            obj: { target: user.id, email: email, granted: outcome.granted },
+                        });
+                        return [2 /*return*/, outcome];
+                }
+            });
+        });
+    };
     Roles.prototype.changeRole = function (userId, role, action) {
         var _a;
         return __awaiter(this, void 0, void 0, function () {

package/dist/src/services/Roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"Roles.js","sourceRoot":"","sources":["../../../src/services/Roles.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAAmE;AACnE,wCAA2G;AAC3G,4CAA2C;AAG3C;;;;;;;;;;;;;GAaG;AACH;IAAA;QACS,oBAAe,GAA+B;YACnD,IAAI,EAAE;gBACJ,UAAU,EAAE,uBAAgB,CAAC,KAAK;aACnC;SACF,CAAC;IAiIJ,CAAC;IA/HO,yBAAS,GAAf,UAAgB,MAAc,EAAE,IAAY;;;;4BAC1C,qBAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,EAAA;;wBAA5C,SAA4C,CAAC;;;;;KAC9C;IAEK,0BAAU,GAAhB,UAAiB,MAAc,EAAE,IAAY;;;;4BAC3C,qBAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAA;;wBAA7C,SAA6C,CAAC;;;;;KAC/C;IAED;;;;;;;;;;;;;OAaG;IACG,8BAAc,GAApB,UAAqB,KAAa;;;;;;;;wBAC1B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;wBACtD,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACvB,qBAAM,IAAI,CAAC,WAAW,EAAE,EAAA;;wBAA5B,IAAI,SAAwB,EAAE;4BAC5B,sBAAO,cAAc,EAAC;yBACvB;wBAEY,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;wBAAhE,IAAI,GAAG,SAAyD;wBACtE,IAAI,CAAC,IAAI,EAAE;4BACT,sBAAO,YAAY,EAAC;yBACrB;wBAEK,KAAK,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC;wBAC/B,qBAAM,EAAE,CAAC,cAAc,CAAC;;;gDACtB,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,kCAAM,KAAK,UAAE,OAAO,SAAC,EAAE,CAAC,EAAA;;4CAAzE,SAAyE,CAAC;4CAC1E,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAA;;4CAA3G,SAA2G,CAAC;;;;iCAC7G,CAAC,EAAA;;wBAHF,SAGE,CAAC;wBACH,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uDAAuD,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBACnH,sBAAO,SAAS,EAAC;;;;KAClB;IAEa,0BAAU,GAAxB,UAAyB,MAAc,EAAE,IAAY,EAAE,MAA0B;;;;;;;;wBACzE,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,gBAAS,MAAM,SAAM,EAAE,CAAC,CAAC;wBACrD,KAAK,GAAG,mBAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;wBAC1C,IAAI,CAAC,KAAK,EAAE;4BACV,MAAM,IAAI,KAAK,CAAC,WAAI,IAAI,4DAAyD,CAAC,CAAC;yBACpF;wBAED,sFAAsF;wBACtF,yFAAyF;wBACzF,6FAA6F;wBAC7F,yFAAyF;wBACzF,6DAA6D;wBAC7D,IAAI,KAAK,CAAC,UAAU,IAAI,MAAM,KAAK,OAAO,EAAE;4BAC1C,MAAM,IAAI,KAAK,CACb,WAAI,IAAI,uFAA+E;gCACrF,sFAAsF;gCACtF,iBAAiB,CACpB,CAAC;yBACH;wBAED,2FAA2F;wBAC3F,6FAA6F;wBAC7F,yFAAyF;wBACzF,2FAA2F;wBAC3F,IAAI,KAAK,CAAC,cAAc,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,eAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;4BAC5E,MAAM,IAAI,KAAK,CACb,WAAI,IAAI,mFAA2E;gCACjF,mCAAmC,CACtC,CAAC;yBACH;wBAEK,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAA;;wBAAhD,IAAI,GAAG,SAAyC;wBACtD,IAAI,CAAC,IAAI,EAAE;4BACT,MAAM,IAAI,KAAK,CAAC,gCAAyB,MAAM,CAAE,CAAC,CAAC;yBACpD;wBAED,4FAA4F;wBAC5F,4FAA4F;wBAC5F,iFAAiF;wBACjF,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,EAAE;4BACpC,MAAM,IAAI,KAAK,CACb,WAAI,IAAI,CAAC,KAAK,gFAA6E;gCACzF,6FAA6F,CAChG,CAAC;yBACH;wBAEK,KAAK,GAAG,IAAI,eAAQ,EAAE,CAAC,OAAO,EAAE,CAAC;wBACvC,wFAAwF;wBACxF,0FAA0F;wBAC1F,2EAA2E;wBAC3E,IAAI,MAAM,KAAK,KAAK,CAAC,EAAE,EAAE;4BACvB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,EAAE,CAAC,CAAC;4BACxG,MAAM,IAAI,KAAK,CAAC,oBAAa,MAAM,qDAA6C,CAAC,CAAC;yBACnF;wBAEK,KAAK,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC;wBAC/B,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;4BACrE,mFAAmF;4BACnF,sBAAO;yBACR;wBAEK,QAAQ,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,iCAAK,KAAK,UAAE,IAAI,UAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAC,QAAQ,IAAK,OAAA,QAAQ,KAAK,IAAI,EAAjB,CAAiB,CAAC,CAAC;wBACvG,qBAAM,EAAE,CAAC,cAAc,CAAC;;;gDACtB,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAA;;4CAA7D,SAA6D,CAAC;4CAC9D,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,cAAc,EAAE;oDACrC,KAAK,EAAE,KAAK,CAAC,EAAE;oDACf,MAAM,EAAE,MAAM;oDACd,IAAI,MAAA;oDACJ,MAAM,QAAA;iDACP,CAAC,EAAA;;4CALF,SAKE,CAAC;;;;iCACJ,CAAC,EAAA;;wBARF,SAQE,CAAC;wBACH,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,eAAQ,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAE;4BAC7D,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,MAAA,EAAE;yBAC/C,CAAC,CAAC;;;;;KACJ;IAED,+GAA+G;IACjG,2BAAW,GAAzB;;;;;;wBACQ,EAAE,GAAG,IAAI,wBAAmB,EAAE,CAAC,eAAe,CAAC,aAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;wBACxF,qBAAM,IAAA,kBAAa,GAAE,CAAC,KAAK,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,CAAC,EAAA;;wBAApD,KAAK,GAAG,SAA4C;wBAC1D,sBAAO,KAAK,CAAC,IAAI,CAAC,UAAC,IAAI,YAAK,OAAA,CAAC,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA,EAAA,CAAC,EAAC;;;;KACnE;IACH,YAAC;AAAD,CAAC,AAtID,IAsIC;AAtIY,sBAAK"}
+{"version":3,"file":"Roles.js","sourceRoot":"","sources":["../../../src/services/Roles.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAAmE;AACnE,wCAA2G;AAC3G,4CAA2C;AAqB3C;IAAA;QACS,oBAAe,GAA+B;YACnD,IAAI,EAAE;gBACJ,UAAU,EAAE,uBAAgB,CAAC,KAAK;aACnC;SACF,CAAC;IAyLJ,CAAC;IAvLO,yBAAS,GAAf,UAAgB,MAAc,EAAE,IAAY;;;;4BAC1C,qBAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,EAAA;;wBAA5C,SAA4C,CAAC;;;;;KAC9C;IAEK,0BAAU,GAAhB,UAAiB,MAAc,EAAE,IAAY;;;;4BAC3C,qBAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAA;;wBAA7C,SAA6C,CAAC;;;;;KAC/C;IAED;;;;;;;;;;;;;OAaG;IACG,8BAAc,GAApB,UAAqB,KAAa;;;;;;;;wBAC1B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;wBACtD,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACvB,qBAAM,IAAI,CAAC,WAAW,EAAE,EAAA;;wBAA5B,IAAI,SAAwB,EAAE;4BAC5B,sBAAO,cAAc,EAAC;yBACvB;wBAEY,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;wBAAhE,IAAI,GAAG,SAAyD;wBACtE,IAAI,CAAC,IAAI,EAAE;4BACT,sBAAO,YAAY,EAAC;yBACrB;wBAEK,KAAK,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC;wBAC/B,qBAAM,EAAE,CAAC,cAAc,CAAC;;;gDACtB,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,kCAAM,KAAK,UAAE,OAAO,SAAC,EAAE,CAAC,EAAA;;4CAAzE,SAAyE,CAAC;4CAC1E,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAA;;4CAA3G,SAA2G,CAAC;;;;iCAC7G,CAAC,EAAA;;wBAHF,SAGE,CAAC;wBACH,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uDAAuD,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBACnH,sBAAO,SAAS,EAAC;;;;KAClB;IAED;;;;;;;;;;;;;;;;OAgBG;IACG,8BAAc,GAApB,UAAqB,KAAa,EAAE,KAAe;;;;;;;;wBAC3C,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;wBACtD,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;wBAAhE,IAAI,GAAG,SAAyD;wBACtE,IAAI,CAAC,IAAI,EAAE;4BACT,MAAM,IAAI,KAAK,CAAC,yCAAkC,KAAK,0DAAkD,CAAC,CAAC;yBAC5G;wBAEK,IAAI,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC;wBACxB,OAAO,GAA0B,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;wBAC9E,WAA6C,EAA1B,KAAA,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAA1B,cAA0B,EAA1B,IAA0B,EAAE;4BAApC,IAAI;4BACP,KAAK,GAAG,mBAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;4BAC1C,IAAI,CAAC,KAAK,EAAE;gCACV,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,MAAA,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;6BACrD;iCAAM,IAAI,KAAK,CAAC,UAAU,EAAE;gCAC3B,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,MAAA,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;6BACpD;iCAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;gCAC9B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;6BACzB;iCAAM;gCACL,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;6BAC5B;yBACF;wBACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;4BAChC,sBAAO,OAAO,EAAC;yBAChB;wBAED,qBAAM,EAAE,CAAC,cAAc,CAAC;;;;gDACtB,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,kCAAM,IAAI,SAAK,OAAO,CAAC,OAAO,OAAC,EAAE,CAAC,EAAA;;4CAAnF,SAAmF,CAAC;kDAClD,EAAf,KAAA,OAAO,CAAC,OAAO;;;iDAAf,CAAA,cAAe,CAAA;4CAAvB,IAAI;4CACb,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,MAAA,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAA;;4CAAlG,SAAkG,CAAC;;;4CADlF,IAAe,CAAA;;;;;iCAGnC,CAAC,EAAA;;wBALF,SAKE,CAAC;wBACH,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,8CAA8C;4BACvD,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,OAAA,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;yBAC1D,CAAC,CAAC;wBACH,sBAAO,OAAO,EAAC;;;;KAChB;IAEa,0BAAU,GAAxB,UAAyB,MAAc,EAAE,IAAY,EAAE,MAA0B;;;;;;;;wBACzE,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,gBAAS,MAAM,SAAM,EAAE,CAAC,CAAC;wBACrD,KAAK,GAAG,mBAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;wBAC1C,IAAI,CAAC,KAAK,EAAE;4BACV,MAAM,IAAI,KAAK,CAAC,WAAI,IAAI,4DAAyD,CAAC,CAAC;yBACpF;wBAED,sFAAsF;wBACtF,yFAAyF;wBACzF,6FAA6F;wBAC7F,yFAAyF;wBACzF,6DAA6D;wBAC7D,IAAI,KAAK,CAAC,UAAU,IAAI,MAAM,KAAK,OAAO,EAAE;4BAC1C,MAAM,IAAI,KAAK,CACb,WAAI,IAAI,uFAA+E;gCACrF,sFAAsF;gCACtF,iBAAiB,CACpB,CAAC;yBACH;wBAED,2FAA2F;wBAC3F,6FAA6F;wBAC7F,yFAAyF;wBACzF,2FAA2F;wBAC3F,IAAI,KAAK,CAAC,cAAc,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,eAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;4BAC5E,MAAM,IAAI,KAAK,CACb,WAAI,IAAI,mFAA2E;gCACjF,mCAAmC,CACtC,CAAC;yBACH;wBAEK,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAA;;wBAAhD,IAAI,GAAG,SAAyC;wBACtD,IAAI,CAAC,IAAI,EAAE;4BACT,MAAM,IAAI,KAAK,CAAC,gCAAyB,MAAM,CAAE,CAAC,CAAC;yBACpD;wBAED,4FAA4F;wBAC5F,4FAA4F;wBAC5F,iFAAiF;wBACjF,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,EAAE;4BACpC,MAAM,IAAI,KAAK,CACb,WAAI,IAAI,CAAC,KAAK,gFAA6E;gCACzF,6FAA6F,CAChG,CAAC;yBACH;wBAEK,KAAK,GAAG,IAAI,eAAQ,EAAE,CAAC,OAAO,EAAE,CAAC;wBACvC,wFAAwF;wBACxF,0FAA0F;wBAC1F,2EAA2E;wBAC3E,IAAI,MAAM,KAAK,KAAK,CAAC,EAAE,EAAE;4BACvB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,EAAE,CAAC,CAAC;4BACxG,MAAM,IAAI,KAAK,CAAC,oBAAa,MAAM,qDAA6C,CAAC,CAAC;yBACnF;wBAEK,KAAK,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC;wBAC/B,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;4BACrE,mFAAmF;4BACnF,sBAAO;yBACR;wBAEK,QAAQ,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,iCAAK,KAAK,UAAE,IAAI,UAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAC,QAAQ,IAAK,OAAA,QAAQ,KAAK,IAAI,EAAjB,CAAiB,CAAC,CAAC;wBACvG,qBAAM,EAAE,CAAC,cAAc,CAAC;;;gDACtB,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAA;;4CAA7D,SAA6D,CAAC;4CAC9D,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,cAAc,EAAE;oDACrC,KAAK,EAAE,KAAK,CAAC,EAAE;oDACf,MAAM,EAAE,MAAM;oDACd,IAAI,MAAA;oDACJ,MAAM,QAAA;iDACP,CAAC,EAAA;;4CALF,SAKE,CAAC;;;;iCACJ,CAAC,EAAA;;wBARF,SAQE,CAAC;wBACH,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,eAAQ,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAE;4BAC7D,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,MAAA,EAAE;yBAC/C,CAAC,CAAC;;;;;KACJ;IAED,+GAA+G;IACjG,2BAAW,GAAzB;;;;;;wBACQ,EAAE,GAAG,IAAI,wBAAmB,EAAE,CAAC,eAAe,CAAC,aAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;wBACxF,qBAAM,IAAA,kBAAa,GAAE,CAAC,KAAK,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,CAAC,EAAA;;wBAApD,KAAK,GAAG,SAA4C;wBAC1D,sBAAO,KAAK,CAAC,IAAI,CAAC,UAAC,IAAI,YAAK,OAAA,CAAC,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA,EAAA,CAAC,EAAC;;;;KACnE;IACH,YAAC;AAAD,CAAC,AA9LD,IA8LC;AA9LY,sBAAK"}

package/dist/src/services/UserPresence.d.ts

@@ -0,0 +1,16 @@
+import { Service } from '@proteinjs/service';
+import { UserPresenceService } from '@proteinjs/user';
+/**
+ * The server end of the human-input presence door (UserActivityTable's contract): the page
+ * reports "a person interacted just now" and this writes the `user_activity` stamp for the
+ * CALLING user — the one write path onto presence. Any signed-in user may report their own
+ * presence and nobody else's (the user is the session's, never an argument); the guest identity
+ * and machine accounts are refused inside the stamp. `doNotAwait`: the page never waits on its
+ * own stamp, and a lost stamp is minutes of staleness at day grain, never a failed call.
+ */
+export declare class UserPresence implements UserPresenceService {
+    serviceMetadata: Service['serviceMetadata'];
+    private stamp;
+    recordPresence(): Promise<void>;
+}
+//# sourceMappingURL=UserPresence.d.ts.map

package/dist/src/services/UserPresence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserPresence.d.ts","sourceRoot":"","sources":["../../../src/services/UserPresence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAuB,MAAM,iBAAiB,CAAC;AAG3E;;;;;;;GAOG;AACH,qBAAa,YAAa,YAAW,mBAAmB;IAC/C,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAKhD;IAEF,OAAO,CAAC,KAAK,CAA2B;IAElC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;CAGtC"}