@proteinjs/user-server 1.22.1 → 1.22.3

package/dist/src/routes/initiatePasswordReset.js

@@ -54,9 +54,17 @@ exports.initiatePasswordReset = void 0;
 var db_1 = require("@proteinjs/db");
 var user_1 = require("@proteinjs/user");
 var logger_1 = require("@proteinjs/logger");
+var util_node_1 = require("@proteinjs/util-node");
 var moment_1 = __importDefault(require("moment"));
 var email_server_1 = require("@proteinjs/email-server");
 var PasswordResetToken_1 = require("../authentication/PasswordResetToken");
+var ClientAddress_1 = require("../throttle/ClientAddress");
+var PasswordResetThrottle_1 = require("../throttle/PasswordResetThrottle");
+/**
+ * The door's one answer: the same words for an address with an account or without, inside or
+ * past a window, mailed or not — the page shows exactly this sentence.
+ */
+var ONE_ANSWER = { message: 'If that address has an account, a reset link is on its way.' };
 /**
  * Route for initiating a password reset process.
  *
@@ -64,6 +72,13 @@ var PasswordResetToken_1 = require("../authentication/PasswordResetToken");
  * its expiry on the user row — and mails the token to the account as a reset link. The token is
  * withdrawn again when the mail fails to send.
  *
+ * ONE ANSWER: every request with an address is answered `ONE_ANSWER` — BEFORE the address is
+ * looked up — whether it has an account, is throttled (`PasswordResetThrottle`: per client and
+ * per address), is inside the account's five-minute gap, or its mail fails; so neither the
+ * words, the status nor the timing say whether an address has an account. The work runs after
+ * the answer. Every request is one outcome line carrying the account digest and the coarse IP
+ * hash (`RequestDigests`) — never the address.
+ *
  * Requires an implementation of `DefaultPasswordResetEmailConfigFactory` to build the password reset email with.
  *
  * @bodyParam {string} email - The email address of the user requesting a password reset.
@@ -75,7 +90,7 @@ exports.initiatePasswordReset = {
     path: user_1.routes.initiatePasswordReset.path,
     method: user_1.routes.initiatePasswordReset.method,
     onRequest: function (request, response) { return __awaiter(void 0, void 0, void 0, function () {
-        var logger, requestedEmail, email, db, genericResponse, user, resetToken, mintedAt, emailSender, defaultConfigFactory, passwordResetToken, config, _a, text, html, error_1;
+        var logger, requestedEmail, digests, fields, window, email, db, user, resetToken, mintedAt, emailSender, defaultConfigFactory, passwordResetToken, config, _a, text, html, error_1;
         var _b, _c;
         return __generator(this, function (_d) {
             switch (_d.label) {
@@ -86,23 +101,27 @@ exports.initiatePasswordReset = {
                         response.status(400).send({ error: 'Email cannot be blank' });
                         return [2 /*return*/];
                     }
+                    digests = new util_node_1.RequestDigests();
+                    fields = { account: digests.account(requestedEmail), ip: digests.coarseIp(new ClientAddress_1.ClientAddress().of(request)) };
+                    window = PasswordResetThrottle_1.passwordResetThrottle.admit(fields.ip, fields.account);
+                    response.send(ONE_ANSWER);
+                    if (window) {
+                        logger.warn({ message: "Password reset throttled", obj: __assign(__assign({}, fields), { window: window }) });
+                        return [2 /*return*/];
+                    }
                     email = requestedEmail.toLowerCase();
                     db = (0, db_1.getDbAsSystem)();
-                    genericResponse = { message: 'If an account with that email exists, we have sent a password reset link.' };
                     return [4 /*yield*/, db.get(user_1.tables.User, { email: email })];
                 case 1:
                     user = _d.sent();
                     if (!user) {
-                        logger.info({ message: "Password reset requested for non-existent user", obj: { email: email } });
-                        // Don't reveal that the user doesn't exist
-                        response.send(genericResponse);
+                        logger.info({ message: "Password reset requested for non-existent user", obj: fields });
                         return [2 /*return*/];
                     }
                     resetToken = new PasswordResetToken_1.PasswordResetToken();
                     mintedAt = resetToken.mintedAt(user);
                     if (mintedAt && (0, moment_1.default)().diff(mintedAt, 'minutes') < 5) {
-                        logger.info({ message: "Password reset requested too soon for user", obj: { email: email } });
-                        response.send(genericResponse);
+                        logger.info({ message: "Password reset requested too soon for user", obj: fields });
                         return [2 /*return*/];
                     }
                     emailSender = new email_server_1.EmailSender();
@@ -123,17 +142,16 @@ exports.initiatePasswordReset = {
                 case 4:
                     // Send email containing a reset link
                     _d.sent();
-                    response.send(genericResponse);
+                    logger.info({ message: "Password reset link mailed", obj: fields });
                     return [3 /*break*/, 7];
                 case 5:
                     error_1 = _d.sent();
-                    logger.error({ message: "Failed to send password reset email", obj: { email: email }, error: error_1 });
+                    logger.error({ message: "Failed to send password reset email", obj: fields, error: error_1 });
                     // The link never reached the account: withdraw the token so asking again is not throttled
                     return [4 /*yield*/, resetToken.revoke(user, passwordResetToken)];
                 case 6:
                     // The link never reached the account: withdraw the token so asking again is not throttled
                     _d.sent();
-                    response.status(500).send({ error: 'Failed to send password reset email. Please try again later.' });
                     return [3 /*break*/, 7];
                 case 7: return [2 /*return*/];
             }

package/dist/src/routes/initiatePasswordReset.js.map

@@ -1 +1 @@
-{"version":3,"file":"initiatePasswordReset.js","sourceRoot":"","sources":["../../../src/routes/initiatePasswordReset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oCAA8C;AAC9C,wCAA2D;AAC3D,4CAA2C;AAC3C,kDAA4B;AAC5B,wDAGiC;AACjC,2EAA0E;AAE1E;;;;;;;;;;;;;GAaG;AACU,QAAA,qBAAqB,GAAU;IAC1C,IAAI,EAAE,aAAM,CAAC,qBAAqB,CAAC,IAAI;IACvC,MAAM,EAAE,aAAM,CAAC,qBAAqB,CAAC,MAAM;IAC3C,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;oBAC9C,cAAc,GAAK,CAAA,MAAA,OAAO,CAAC,IAAI,mCAAI,EAAE,CAAA,MAAvB,CAAwB;oBACrD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE;wBACrE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;wBAC9D,sBAAO;qBACR;oBAEK,KAAK,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;oBACrC,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBAErB,eAAe,GAAG,EAAE,OAAO,EAAE,2EAA2E,EAAE,CAAC;oBAEpG,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;oBAA3C,IAAI,GAAG,SAAoC;oBACjD,IAAI,CAAC,IAAI,EAAE;wBACT,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBAC3F,2CAA2C;wBAC3C,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;wBAC/B,sBAAO;qBACR;oBAGK,UAAU,GAAG,IAAI,uCAAkB,EAAE,CAAC;oBACtC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAC3C,IAAI,QAAQ,IAAI,IAAA,gBAAM,GAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE;wBACtD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBACvF,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;wBAC/B,sBAAO;qBACR;oBAEK,WAAW,GAAG,IAAI,0BAAW,EAAE,CAAC;oBAEhC,oBAAoB,GAAG,IAAA,wDAAuB,GAAE,CAAC;oBACvD,IAAI,CAAC,oBAAoB,EAAE;wBACzB,MAAM,IAAI,KAAK,CACb,gIAAgI,CACjI,CAAC;qBACH;oBAG0B,qBAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAA;;oBAAhD,kBAAkB,GAAG,SAA2B;;;;oBAG9C,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC;oBAC1C,KAAiB,MAAM,CAAC,eAAe,CAAC,UAAG,eAAQ,CAAC,IAAI,CAAC,aAAa,oBAAU,kBAAkB,CAAE,CAAC,EAAnG,IAAI,UAAA,EAAE,IAAI,UAAA,CAA0F;oBAE5G,qCAAqC;oBACrC,qBAAM,WAAW,CAAC,SAAS,YACzB,EAAE,EAAE,IAAI,CAAC,KAAK,EACd,OAAO,EAAE,CAAA,MAAA,MAAM,CAAC,OAAO,0CAAE,OAAO,KAAI,gBAAgB,EACpD,IAAI,MAAA,EACJ,IAAI,MAAA,IACD,MAAM,CAAC,OAAO,EACjB,EAAA;;oBAPF,qCAAqC;oBACrC,SAME,CAAC;oBAEH,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;;;;oBAE/B,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,KAAK,SAAA,EAAE,CAAC,CAAC;oBACxF,0FAA0F;oBAC1F,qBAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAA;;oBADjD,0FAA0F;oBAC1F,SAAiD,CAAC;oBAClD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8DAA8D,EAAE,CAAC,CAAC;;;;;SAExG;CACF,CAAC"}
+{"version":3,"file":"initiatePasswordReset.js","sourceRoot":"","sources":["../../../src/routes/initiatePasswordReset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oCAA8C;AAC9C,wCAA2D;AAC3D,4CAA2C;AAC3C,kDAAsD;AACtD,kDAA4B;AAC5B,wDAGiC;AACjC,2EAA0E;AAC1E,2DAA0D;AAC1D,2EAA0E;AAE1E;;;GAGG;AACH,IAAM,UAAU,GAAG,EAAE,OAAO,EAAE,6DAA6D,EAAE,CAAC;AAE9F;;;;;;;;;;;;;;;;;;;;GAoBG;AACU,QAAA,qBAAqB,GAAU;IAC1C,IAAI,EAAE,aAAM,CAAC,qBAAqB,CAAC,IAAI;IACvC,MAAM,EAAE,aAAM,CAAC,qBAAqB,CAAC,MAAM;IAC3C,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;oBAC9C,cAAc,GAAK,CAAA,MAAA,OAAO,CAAC,IAAI,mCAAI,EAAE,CAAA,MAAvB,CAAwB;oBACrD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE;wBACrE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;wBAC9D,sBAAO;qBACR;oBAEK,OAAO,GAAG,IAAI,0BAAc,EAAE,CAAC;oBAC/B,MAAM,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,6BAAa,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;oBAC7G,MAAM,GAAG,6CAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;oBACtE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAC1B,IAAI,MAAM,EAAE;wBACV,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,wBAAO,MAAM,KAAE,MAAM,QAAA,GAAE,EAAE,CAAC,CAAC;wBACjF,sBAAO;qBACR;oBAEK,KAAK,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;oBACrC,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBACd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;oBAA3C,IAAI,GAAG,SAAoC;oBACjD,IAAI,CAAC,IAAI,EAAE;wBACT,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;wBACxF,sBAAO;qBACR;oBAGK,UAAU,GAAG,IAAI,uCAAkB,EAAE,CAAC;oBACtC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAC3C,IAAI,QAAQ,IAAI,IAAA,gBAAM,GAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE;wBACtD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;wBACpF,sBAAO;qBACR;oBAEK,WAAW,GAAG,IAAI,0BAAW,EAAE,CAAC;oBAEhC,oBAAoB,GAAG,IAAA,wDAAuB,GAAE,CAAC;oBACvD,IAAI,CAAC,oBAAoB,EAAE;wBACzB,MAAM,IAAI,KAAK,CACb,gIAAgI,CACjI,CAAC;qBACH;oBAG0B,qBAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAA;;oBAAhD,kBAAkB,GAAG,SAA2B;;;;oBAG9C,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC;oBAC1C,KAAiB,MAAM,CAAC,eAAe,CAAC,UAAG,eAAQ,CAAC,IAAI,CAAC,aAAa,oBAAU,kBAAkB,CAAE,CAAC,EAAnG,IAAI,UAAA,EAAE,IAAI,UAAA,CAA0F;oBAE5G,qCAAqC;oBACrC,qBAAM,WAAW,CAAC,SAAS,YACzB,EAAE,EAAE,IAAI,CAAC,KAAK,EACd,OAAO,EAAE,CAAA,MAAA,MAAM,CAAC,OAAO,0CAAE,OAAO,KAAI,gBAAgB,EACpD,IAAI,MAAA,EACJ,IAAI,MAAA,IACD,MAAM,CAAC,OAAO,EACjB,EAAA;;oBAPF,qCAAqC;oBACrC,SAME,CAAC;oBAEH,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;;;;oBAEpE,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,SAAA,EAAE,CAAC,CAAC;oBACrF,0FAA0F;oBAC1F,qBAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAA;;oBADjD,0FAA0F;oBAC1F,SAAiD,CAAC;;;;;SAErD;CACF,CAAC"}

package/dist/src/routes/login.d.ts

@@ -1,3 +1,11 @@
 import { Route } from '@proteinjs/server-api';
+/**
+ * `POST /user/login`. Throttled per client and per account (`SignInThrottle`): a throttled try
+ * is told "Too many attempts. Try again in a few minutes." whether or not the address has an
+ * account, after the same password check a refusal runs (verdict discarded), so neither the
+ * words nor the timing tell. Every refusal is a "Sign-in refused" line and every throttled try
+ * its own "Sign-in throttled" line, carrying the account digest and the coarse IP hash
+ * (`RequestDigests`) — never the address.
+ */
 export declare const login: Route;
 //# sourceMappingURL=login.d.ts.map

package/dist/src/routes/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/routes/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAM9C,eAAO,MAAM,KAAK,EAAE,KA4CnB,CAAC"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/routes/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAU9C;;;;;;;GAOG;AACH,eAAO,MAAM,KAAK,EAAE,KA+DnB,CAAC"}

package/dist/src/routes/login.js

@@ -1,4 +1,15 @@
 "use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -38,41 +49,71 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.login = void 0;
 var user_1 = require("@proteinjs/user");
+var logger_1 = require("@proteinjs/logger");
 var authenticate_1 = require("../authentication/authenticate");
 var establishSession_1 = require("../authentication/establishSession");
 var AccountDeletion_1 = require("../services/AccountDeletion");
+var ClientAddress_1 = require("../throttle/ClientAddress");
+var RequestDigests_1 = require("../throttle/RequestDigests");
+var SignInThrottle_1 = require("../throttle/SignInThrottle");
+/**
+ * `POST /user/login`. Throttled per client and per account (`SignInThrottle`): a throttled try
+ * is told "Too many attempts. Try again in a few minutes." whether or not the address has an
+ * account, after the same password check a refusal runs (verdict discarded), so neither the
+ * words nor the timing tell. Every refusal is a "Sign-in refused" line and every throttled try
+ * its own "Sign-in throttled" line, carrying the account digest and the coarse IP hash
+ * (`RequestDigests`) — never the address.
+ */
 exports.login = {
     path: user_1.routes.login.path,
     method: user_1.routes.login.method,
     onRequest: function (request, response) { return __awaiter(void 0, void 0, void 0, function () {
-        var credentials, error, result, outcome, error_1, error;
-        return __generator(this, function (_a) {
-            switch (_a.label) {
+        var logger, credentials, email, password, digests, ip, account, fields, window, error, result, outcome, error_1, error;
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
                 case 0:
-                    credentials = request.body;
-                    if (!credentials.email || !credentials.password) {
+                    logger = new logger_1.Logger({ name: 'login' });
+                    credentials = (_a = request.body) !== null && _a !== void 0 ? _a : {};
+                    email = typeof credentials.email === 'string' ? credentials.email : '';
+                    password = typeof credentials.password === 'string' ? credentials.password : '';
+                    digests = new RequestDigests_1.RequestDigests();
+                    ip = digests.coarseIp(new ClientAddress_1.ClientAddress().of(request));
+                    account = email ? digests.account(email) : undefined;
+                    fields = account ? { account: account, ip: ip } : { ip: ip };
+                    window = SignInThrottle_1.signInThrottle.admit(ip, password ? account : undefined);
+                    if (!window) return [3 /*break*/, 2];
+                    return [4 /*yield*/, (0, authenticate_1.checkPassword)(email, password)];
+                case 1:
+                    _b.sent();
+                    logger.warn({ message: 'Sign-in throttled', obj: __assign(__assign({}, fields), { window: window }) });
+                    response.send({ error: SignInThrottle_1.SignInThrottle.ANSWER });
+                    return [2 /*return*/];
+                case 2:
+                    if (!email || !password || !account) {
                         error = "Email and password cannot be blank";
-                        console.error(error);
+                        logger.info({ message: 'Sign-in refused', obj: __assign(__assign({}, fields), { reason: error }) });
                         response.send({ error: error });
                         return [2 /*return*/];
                     }
-                    return [4 /*yield*/, (0, authenticate_1.authenticate)(credentials.email, credentials.password)];
-                case 1:
-                    result = _a.sent();
+                    return [4 /*yield*/, (0, authenticate_1.authenticate)(email, password)];
+                case 3:
+                    result = _b.sent();
                     if (result !== true) {
-                        console.error(result);
+                        logger.info({ message: 'Sign-in refused', obj: __assign(__assign({}, fields), { reason: result }) });
                         response.send({ error: result });
                         return [2 /*return*/];
                     }
-                    _a.label = 2;
-                case 2:
-                    _a.trys.push([2, 4, , 5]);
-                    return [4 /*yield*/, new AccountDeletion_1.AccountDeletion().cancelPendingDeletion(credentials.email)];
-                case 3:
-                    outcome = _a.sent();
-                    return [3 /*break*/, 5];
+                    SignInThrottle_1.signInThrottle.recordSuccess(account, ip);
+                    _b.label = 4;
                 case 4:
-                    error_1 = _a.sent();
+                    _b.trys.push([4, 6, , 7]);
+                    return [4 /*yield*/, new AccountDeletion_1.AccountDeletion().cancelPendingDeletion(email)];
+                case 5:
+                    outcome = _b.sent();
+                    return [3 /*break*/, 7];
+                case 6:
+                    error_1 = _b.sent();
                     // Security boundary: the login response never carries internal error detail — an
                     // attacker probing emails must learn nothing from failure shapes (founder ruling
                     // 2026-08-18 after a watcher error surfaced verbatim in the login form). The real
@@ -80,16 +121,16 @@ exports.login = {
                     console.error('cancelPendingDeletion failed during login', error_1);
                     response.send({ error: 'Unable to log in right now. Please try again.' });
                     return [2 /*return*/];
-                case 5:
+                case 7:
                     if (outcome === 'purging') {
                         error = 'This account is being deleted and can no longer be restored.';
                         console.error(error);
                         response.send({ error: error });
                         return [2 /*return*/];
                     }
-                    return [4 /*yield*/, (0, establishSession_1.establishSession)(request, credentials.email)];
-                case 6:
-                    _a.sent();
+                    return [4 /*yield*/, (0, establishSession_1.establishSession)(request, email)];
+                case 8:
+                    _b.sent();
                     response.send({});
                     return [2 /*return*/];
             }

package/dist/src/routes/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/routes/login.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wCAAyC;AACzC,+DAA8D;AAC9D,uEAAsE;AACtE,+DAA8D;AAEjD,QAAA,KAAK,GAAU;IAC1B,IAAI,EAAE,aAAM,CAAC,KAAK,CAAC,IAAI;IACvB,MAAM,EAAE,aAAM,CAAC,KAAK,CAAC,MAAM;IAC3B,SAAS,EAAE,UAAO,OAAY,EAAE,QAAQ;;;;;oBAChC,WAAW,GAAwC,OAAO,CAAC,IAAI,CAAC;oBACtE,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE;wBACzC,KAAK,GAAG,oCAAoC,CAAC;wBACnD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,CAAC,CAAC;wBACzB,sBAAO;qBACR;oBAEc,qBAAM,IAAA,2BAAY,EAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAA;;oBAApE,MAAM,GAAG,SAA2D;oBAC1E,IAAI,MAAM,KAAK,IAAI,EAAE;wBACnB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;wBACjC,sBAAO;qBACR;;;;oBAOW,qBAAM,IAAI,iCAAe,EAAE,CAAC,qBAAqB,CAAC,WAAW,CAAC,KAAK,CAAC,EAAA;;oBAA9E,OAAO,GAAG,SAAoE,CAAC;;;;oBAE/E,iFAAiF;oBACjF,iFAAiF;oBACjF,kFAAkF;oBAClF,sCAAsC;oBACtC,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,OAAK,CAAC,CAAC;oBAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;oBAC1E,sBAAO;;oBAET,IAAI,OAAO,KAAK,SAAS,EAAE;wBACnB,KAAK,GAAG,8DAA8D,CAAC;wBAC7E,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,CAAC,CAAC;wBACzB,sBAAO;qBACR;oBAED,qBAAM,IAAA,mCAAgB,EAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,EAAA;;oBAAlD,SAAkD,CAAC;oBACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;;;;SACnB;CACF,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/routes/login.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wCAAyC;AACzC,4CAA2C;AAC3C,+DAA6E;AAC7E,uEAAsE;AACtE,+DAA8D;AAC9D,2DAA0D;AAC1D,6DAA4D;AAC5D,6DAA4E;AAE5E;;;;;;;GAOG;AACU,QAAA,KAAK,GAAU;IAC1B,IAAI,EAAE,aAAM,CAAC,KAAK,CAAC,IAAI;IACvB,MAAM,EAAE,aAAM,CAAC,KAAK,CAAC,MAAM;IAC3B,SAAS,EAAE,UAAO,OAAY,EAAE,QAAQ;;;;;;oBAChC,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;oBACvC,WAAW,GAAG,MAAA,OAAO,CAAC,IAAI,mCAAI,EAAE,CAAC;oBAEjC,KAAK,GAAW,OAAO,WAAW,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/E,QAAQ,GAAW,OAAO,WAAW,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxF,OAAO,GAAG,IAAI,+BAAc,EAAE,CAAC;oBAC/B,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,6BAAa,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;oBACvD,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBACrD,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,SAAA,EAAE,EAAE,IAAA,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAA,EAAE,CAAC;oBAG5C,MAAM,GAAG,+BAAc,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;yBACpE,MAAM,EAAN,wBAAM;oBACR,qBAAM,IAAA,4BAAa,EAAC,KAAK,EAAE,QAAQ,CAAC,EAAA;;oBAApC,SAAoC,CAAC;oBACrC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,wBAAO,MAAM,KAAE,MAAM,QAAA,GAAE,EAAE,CAAC,CAAC;oBAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAAc,CAAC,MAAM,EAAE,CAAC,CAAC;oBAChD,sBAAO;;oBAGT,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE;wBAC7B,KAAK,GAAG,oCAAoC,CAAC;wBACnD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,wBAAO,MAAM,KAAE,MAAM,EAAE,KAAK,GAAE,EAAE,CAAC,CAAC;wBAC/E,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,CAAC,CAAC;wBACzB,sBAAO;qBACR;oBAEc,qBAAM,IAAA,2BAAY,EAAC,KAAK,EAAE,QAAQ,CAAC,EAAA;;oBAA5C,MAAM,GAAG,SAAmC;oBAClD,IAAI,MAAM,KAAK,IAAI,EAAE;wBACnB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,wBAAO,MAAM,KAAE,MAAM,EAAE,MAAM,GAAE,EAAE,CAAC,CAAC;wBAChF,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;wBACjC,sBAAO;qBACR;oBACD,+BAAc,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;;;;oBAO9B,qBAAM,IAAI,iCAAe,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAA;;oBAAlE,OAAO,GAAG,SAAwD,CAAC;;;;oBAEnE,iFAAiF;oBACjF,iFAAiF;oBACjF,kFAAkF;oBAClF,sCAAsC;oBACtC,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,OAAK,CAAC,CAAC;oBAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;oBAC1E,sBAAO;;oBAET,IAAI,OAAO,KAAK,SAAS,EAAE;wBACnB,KAAK,GAAG,8DAA8D,CAAC;wBAC7E,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,CAAC,CAAC;wBACzB,sBAAO;qBACR;oBAED,qBAAM,IAAA,mCAAgB,EAAC,OAAO,EAAE,KAAK,CAAC,EAAA;;oBAAtC,SAAsC,CAAC;oBACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;;;;SACnB;CACF,CAAC"}

package/dist/src/routes/signup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signup.d.ts","sourceRoot":"","sources":["../../../src/routes/signup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAQ9C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,MAAM,EAAE,KA8BpB,CAAC"}
+{"version":3,"file":"signup.d.ts","sourceRoot":"","sources":["../../../src/routes/signup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAS9C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,MAAM,EAAE,KAgCpB,CAAC"}

package/dist/src/routes/signup.js

@@ -38,6 +38,7 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.signup = void 0;
 var logger_1 = require("@proteinjs/logger");
+var util_node_1 = require("@proteinjs/util-node");
 var user_1 = require("@proteinjs/user");
 var establishSession_1 = require("../authentication/establishSession");
 var Signup_1 = require("../services/Signup");
@@ -82,8 +83,10 @@ exports.signup = {
                 case 3:
                     error_1 = _b.sent();
                     // createUser throws plain-words errors deliberately (invite expired / invite required /
-                    // email missing); the message is the user-facing contract, same as the RPC layer's.
-                    logger.error({ message: 'Signup failed', error: error_1 });
+                    // email missing); the message is the user-facing contract, same as the RPC layer's. The log
+                    // gets the error through the digest door: a concurrent double sign-up's unique-index refusal
+                    // names the address in the database's own words.
+                    logger.error({ message: 'Signup failed', error: new util_node_1.RequestDigests().redactError(error_1) });
                     response.send({ error: error_1 instanceof Error ? error_1.message : 'Sign up failed.' });
                     return [2 /*return*/];
                 case 4:

package/dist/src/routes/signup.js.map

@@ -1 +1 @@
-{"version":3,"file":"signup.js","sourceRoot":"","sources":["../../../src/routes/signup.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,4CAA2C;AAC3C,wCAAqD;AACrD,uEAAsE;AACtE,6CAA4C;AAE5C,IAAM,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;AAE9C;;;;;;;;;;;;;;;GAeG;AACU,QAAA,MAAM,GAAU;IAC3B,IAAI,EAAE,aAAM,CAAC,MAAM,CAAC,IAAI;IACxB,MAAM,EAAE,aAAM,CAAC,MAAM,CAAC,MAAM;IAC5B,SAAS,EAAE,UAAO,OAAY,EAAE,QAAQ;;;;;;oBAChC,IAAI,GAA6C,MAAA,OAAO,CAAC,IAAI,mCAAI,EAAE,CAAC;oBAC1E,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;wBAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;wBAC9D,sBAAO;qBACR;;;;oBAIU,qBAAM,IAAI,eAAM,EAAE,CAAC,UAAU,CACpC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAC/D,IAAI,CAAC,KAAK,CACX,EAAA;;oBAHD,MAAM,GAAG,SAGR,CAAC;;;;oBAEF,wFAAwF;oBACxF,oFAAoF;oBACpF,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,SAAA,EAAE,CAAC,CAAC;oBAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAK,YAAY,KAAK,CAAC,CAAC,CAAC,OAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC;oBACrF,sBAAO;;yBAGL,CAAA,MAAM,CAAC,OAAO,KAAK,SAAS,CAAA,EAA5B,wBAA4B;oBAC9B,qBAAM,IAAA,mCAAgB,EAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAA;;oBAA7C,SAA6C,CAAC;;;oBAGhD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;;;;SACnB;CACF,CAAC"}
+{"version":3,"file":"signup.js","sourceRoot":"","sources":["../../../src/routes/signup.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,4CAA2C;AAC3C,kDAAsD;AACtD,wCAAqD;AACrD,uEAAsE;AACtE,6CAA4C;AAE5C,IAAM,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;AAE9C;;;;;;;;;;;;;;;GAeG;AACU,QAAA,MAAM,GAAU;IAC3B,IAAI,EAAE,aAAM,CAAC,MAAM,CAAC,IAAI;IACxB,MAAM,EAAE,aAAM,CAAC,MAAM,CAAC,MAAM;IAC5B,SAAS,EAAE,UAAO,OAAY,EAAE,QAAQ;;;;;;oBAChC,IAAI,GAA6C,MAAA,OAAO,CAAC,IAAI,mCAAI,EAAE,CAAC;oBAC1E,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;wBAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;wBAC9D,sBAAO;qBACR;;;;oBAIU,qBAAM,IAAI,eAAM,EAAE,CAAC,UAAU,CACpC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAC/D,IAAI,CAAC,KAAK,CACX,EAAA;;oBAHD,MAAM,GAAG,SAGR,CAAC;;;;oBAEF,wFAAwF;oBACxF,4FAA4F;oBAC5F,6FAA6F;oBAC7F,iDAAiD;oBACjD,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,IAAI,0BAAc,EAAE,CAAC,WAAW,CAAC,OAAK,CAAC,EAAE,CAAC,CAAC;oBAC3F,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAK,YAAY,KAAK,CAAC,CAAC,CAAC,OAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC;oBACrF,sBAAO;;yBAGL,CAAA,MAAM,CAAC,OAAO,KAAK,SAAS,CAAA,EAA5B,wBAA4B;oBAC9B,qBAAM,IAAA,mCAAgB,EAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAA;;oBAA7C,SAA6C,CAAC;;;oBAGhD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;;;;SACnB;CACF,CAAC"}

package/dist/src/routes/validateResetPasswordToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateResetPasswordToken.d.ts","sourceRoot":"","sources":["../../../src/routes/validateResetPasswordToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAK9C,eAAO,MAAM,0BAA0B,EAAE,KAkCxC,CAAC"}
+{"version":3,"file":"validateResetPasswordToken.d.ts","sourceRoot":"","sources":["../../../src/routes/validateResetPasswordToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAM9C,eAAO,MAAM,0BAA0B,EAAE,KAqCxC,CAAC"}

package/dist/src/routes/validateResetPasswordToken.js

@@ -39,6 +39,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateResetPasswordToken = void 0;
 var user_1 = require("@proteinjs/user");
 var logger_1 = require("@proteinjs/logger");
+var util_node_1 = require("@proteinjs/util-node");
 var PasswordResetToken_1 = require("../authentication/PasswordResetToken");
 exports.validateResetPasswordToken = {
     path: user_1.routes.validateResetToken.path,
@@ -67,7 +68,10 @@ exports.validateResetPasswordToken = {
                         return [2 /*return*/];
                     }
                     if (resolution.status === 'expired') {
-                        logger.info({ message: "Expired reset token used", obj: { email: resolution.user.email } });
+                        logger.info({
+                            message: "Expired reset token used",
+                            obj: { account: new util_node_1.RequestDigests().account(resolution.user.email) },
+                        });
                         response.status(200).send({ isValid: false, message: 'Token has expired' });
                         return [2 /*return*/];
                     }

package/dist/src/routes/validateResetPasswordToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"validateResetPasswordToken.js","sourceRoot":"","sources":["../../../src/routes/validateResetPasswordToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wCAAyC;AACzC,4CAA2C;AAC3C,2EAA0E;AAE7D,QAAA,0BAA0B,GAAU;IAC/C,IAAI,EAAE,aAAM,CAAC,kBAAkB,CAAC,IAAI;IACpC,MAAM,EAAE,aAAM,CAAC,kBAAkB,CAAC,MAAM;IACxC,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;oBAClD,KAAK,GAAK,OAAO,CAAC,KAAK,MAAlB,CAAmB;oBAChC,IAAI,CAAC,KAAK,EAAE;wBACV,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBAC5E,sBAAO;qBACR;oBAEK,UAAU,GAAG,IAAI,uCAAkB,EAAE,CAAC;oBACzB,qBAAM,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAA;;oBAA5C,UAAU,GAAG,SAA+B;oBAClD,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACxE,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,0BAA0B;4BACnC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;yBACzE,CAAC,CAAC;wBACH,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;wBACxE,sBAAO;qBACR;oBAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACnC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBAC5F,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBAC5E,sBAAO;qBACR;oBAED,oFAAoF;oBACpF,uFAAuF;oBACvF,wFAAwF;oBACxF,mFAAmF;oBACnF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;;;;SAC5E;CACF,CAAC"}
+{"version":3,"file":"validateResetPasswordToken.js","sourceRoot":"","sources":["../../../src/routes/validateResetPasswordToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wCAAyC;AACzC,4CAA2C;AAC3C,kDAAsD;AACtD,2EAA0E;AAE7D,QAAA,0BAA0B,GAAU;IAC/C,IAAI,EAAE,aAAM,CAAC,kBAAkB,CAAC,IAAI;IACpC,MAAM,EAAE,aAAM,CAAC,kBAAkB,CAAC,MAAM;IACxC,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;oBAClD,KAAK,GAAK,OAAO,CAAC,KAAK,MAAlB,CAAmB;oBAChC,IAAI,CAAC,KAAK,EAAE;wBACV,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBAC5E,sBAAO;qBACR;oBAEK,UAAU,GAAG,IAAI,uCAAkB,EAAE,CAAC;oBACzB,qBAAM,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAA;;oBAA5C,UAAU,GAAG,SAA+B;oBAClD,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACxE,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,0BAA0B;4BACnC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;yBACzE,CAAC,CAAC;wBACH,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;wBACxE,sBAAO;qBACR;oBAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACnC,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,0BAA0B;4BACnC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,0BAAc,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;yBACtE,CAAC,CAAC;wBACH,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBAC5E,sBAAO;qBACR;oBAED,oFAAoF;oBACpF,uFAAuF;oBACvF,wFAAwF;oBACxF,mFAAmF;oBACnF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;;;;SAC5E;CACF,CAAC"}

package/dist/src/services/MachineCredentials.d.ts

@@ -11,11 +11,20 @@ import { Service } from '@proteinjs/service';
  * account's existing sessions (the old
  * credential dies with them), and returns the plaintext ONCE for pasting into the declaration's
  * Secret Manager secret. The same call rotates. Machine rows only (`is_loaded_from_source`);
- * human credentials go through the password-reset flow.
+ * human credentials go through the password-reset flow. A declared address held by a row the
+ * boot sync does not own (a person's signup, a hand-made row) has no machine account at all —
+ * the sync refused the declaration — and both the list and the mint say so.
  */
 export declare class MachineCredentials implements MachineCredentialsService {
     serviceMetadata: Service['serviceMetadata'];
     listMachineAccounts(): Promise<MachineAccountView[]>;
     mintCredential(email: string): Promise<MintedMachineCredential>;
+    /**
+     * Why the boot sync refused a declaration whose address this row holds — undefined for the
+     * account's own row. The sync owns a row only when it created it (`isLoadedFromSource`); any
+     * other row under a declared address is never taken over (@proteinjs/db's natural-key refusal),
+     * and the one machine marker says whose row it is.
+     */
+    private refusal;
 }
 //# sourceMappingURL=MachineCredentials.d.ts.map

package/dist/src/services/MachineCredentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MachineCredentials.d.ts","sourceRoot":"","sources":["../../../src/services/MachineCredentials.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EAIxB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAG7C;;;;;;;;;;;;GAYG;AACH,qBAAa,kBAAmB,YAAW,yBAAyB;IAC3D,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAIhD;IAEI,mBAAmB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAmBpD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;CAwCtE"}
+{"version":3,"file":"MachineCredentials.d.ts","sourceRoot":"","sources":["../../../src/services/MachineCredentials.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EAKxB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAG7C;;;;;;;;;;;;;;GAcG;AACH,qBAAa,kBAAmB,YAAW,yBAAyB;IAC3D,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAIhD;IAEI,mBAAmB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IA0BpD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAkDrE;;;;;OAKG;IACH,OAAO,CAAC,OAAO;CAOhB"}

package/dist/src/services/MachineCredentials.js

@@ -1,4 +1,15 @@
 "use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -50,6 +61,7 @@ var crypto_1 = require("crypto");
 var db_1 = require("@proteinjs/db");
 var user_1 = require("@proteinjs/user");
 var logger_1 = require("@proteinjs/logger");
+var util_node_1 = require("@proteinjs/util-node");
 var PasswordHasher_1 = require("../authentication/PasswordHasher");
 /**
  * Credential minting for code-declared machine accounts — the ONLY manual step in a machine
@@ -62,7 +74,9 @@ var PasswordHasher_1 = require("../authentication/PasswordHasher");
  * account's existing sessions (the old
  * credential dies with them), and returns the plaintext ONCE for pasting into the declaration's
  * Secret Manager secret. The same call rotates. Machine rows only (`is_loaded_from_source`);
- * human credentials go through the password-reset flow.
+ * human credentials go through the password-reset flow. A declared address held by a row the
+ * boot sync does not own (a person's signup, a hand-made row) has no machine account at all —
+ * the sync refused the declaration — and both the list and the mint say so.
  */
 var MachineCredentials = /** @class */ (function () {
     function MachineCredentials() {
@@ -74,7 +88,7 @@ var MachineCredentials = /** @class */ (function () {
     }
     MachineCredentials.prototype.listMachineAccounts = function () {
         return __awaiter(this, void 0, void 0, function () {
-            var db, views, _i, _a, declaration, row, booted;
+            var db, views, _i, _a, declaration, row, refusal;
             return __generator(this, function (_b) {
                 switch (_b.label) {
                     case 0:
@@ -88,15 +102,14 @@ var MachineCredentials = /** @class */ (function () {
                         return [4 /*yield*/, db.get(user_1.tables.User, { email: declaration.email })];
                     case 2:
                         row = _b.sent();
-                        booted = !!row && row.isLoadedFromSource === true;
-                        views.push({
-                            email: declaration.email,
-                            accountName: declaration.accountName,
-                            roles: __spreadArray([], declaration.roles, true),
-                            secretName: declaration.secretName,
-                            status: booted ? (row.status === 'deactivated' ? 'deactivated' : 'active') : 'pending first boot',
-                            hasCredential: booted && !!row.password,
-                        });
+                        refusal = row && this.refusal(row);
+                        views.push(__assign(__assign({ email: declaration.email, accountName: declaration.accountName, roles: __spreadArray([], declaration.roles, true), secretName: declaration.secretName, status: !row
+                                ? 'pending first boot'
+                                : refusal
+                                    ? 'declaration refused'
+                                    : row.status === 'deactivated'
+                                        ? 'deactivated'
+                                        : 'active' }, (refusal ? { refusal: refusal } : {})), { hasCredential: !!row && !refusal && !!row.password }));
                         _b.label = 3;
                     case 3:
                         _i++;
@@ -108,7 +121,7 @@ var MachineCredentials = /** @class */ (function () {
     };
     MachineCredentials.prototype.mintCredential = function (email) {
         return __awaiter(this, void 0, void 0, function () {
-            var logger, normalizedEmail, declaration, db, user, password, _a, _b, _c;
+            var logger, normalizedEmail, declaration, db, user, refusal, password, _a, _b, _c;
             var _d;
             return __generator(this, function (_e) {
                 switch (_e.label) {
@@ -124,9 +137,15 @@ var MachineCredentials = /** @class */ (function () {
                         return [4 /*yield*/, db.get(user_1.tables.User, { email: normalizedEmail })];
                     case 1:
                         user = _e.sent();
-                        if (!user || user.isLoadedFromSource !== true) {
+                        if (!user) {
                             throw new Error("The machine account row for '".concat(normalizedEmail, "' has not been loaded from source yet \u2014 ") +
-                                "the boot sync creates (or adopts) it. Boot the server with the declaration, then mint.");
+                                "the boot sync creates it. Boot the server with the declaration, then mint.");
+                        }
+                        refusal = this.refusal(user);
+                        if (refusal) {
+                            throw new Error("The declaration for '".concat(normalizedEmail, "' was refused at boot: ").concat(refusal, " \u2014 the boot sync ") +
+                                "never takes over a row it does not own, so there is no machine account to mint for. The " +
+                                "first boot after that row is gone creates it.");
                         }
                         password = (0, crypto_1.randomBytes)(32).toString('hex');
                         _b = (_a = db).update;
@@ -145,7 +164,7 @@ var MachineCredentials = /** @class */ (function () {
                         _e.sent();
                         logger.info({
                             message: "Minted machine credential",
-                            obj: { email: normalizedEmail, secretName: declaration.secretName },
+                            obj: { account: new util_node_1.RequestDigests().account(normalizedEmail), secretName: declaration.secretName },
                         });
                         return [2 /*return*/, {
                                 email: normalizedEmail,
@@ -158,6 +177,18 @@ var MachineCredentials = /** @class */ (function () {
             });
         });
     };
+    /**
+     * Why the boot sync refused a declaration whose address this row holds — undefined for the
+     * account's own row. The sync owns a row only when it created it (`isLoadedFromSource`); any
+     * other row under a declared address is never taken over (@proteinjs/db's natural-key refusal),
+     * and the one machine marker says whose row it is.
+     */
+    MachineCredentials.prototype.refusal = function (row) {
+        if (row.isLoadedFromSource === true) {
+            return undefined;
+        }
+        return row.machine === true ? 'a hand-made machine row holds this address' : 'a person holds this address';
+    };
     return MachineCredentials;
 }());
 exports.MachineCredentials = MachineCredentials;

package/dist/src/services/MachineCredentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"MachineCredentials.js","sourceRoot":"","sources":["../../../src/services/MachineCredentials.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iCAAqC;AACrC,oCAA8C;AAC9C,wCAOyB;AACzB,4CAA2C;AAE3C,mEAAkE;AAElE;;;;;;;;;;;;GAYG;AACH;IAAA;QACS,oBAAe,GAA+B;YACnD,IAAI,EAAE;gBACJ,UAAU,EAAE,uBAAgB,CAAC,KAAK;aACnC;SACF,CAAC;IA6DJ,CAAC;IA3DO,gDAAmB,GAAzB;;;;;;wBACQ,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACrB,KAAK,GAAyB,EAAE,CAAC;8BACO,EAApB,SAAA,yBAAkB,GAAE;;;6BAApB,CAAA,cAAoB,CAAA;wBAAnC,WAAW;wBACR,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,EAAA;;wBAA7D,GAAG,GAAG,SAAuD;wBAC7D,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,KAAK,IAAI,CAAC;wBACxD,KAAK,CAAC,IAAI,CAAC;4BACT,KAAK,EAAE,WAAW,CAAC,KAAK;4BACxB,WAAW,EAAE,WAAW,CAAC,WAAW;4BACpC,KAAK,oBAAM,WAAW,CAAC,KAAK,OAAC;4BAC7B,UAAU,EAAE,WAAW,CAAC,UAAU;4BAClC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,oBAAoB;4BACjG,aAAa,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ;yBACxC,CAAC,CAAC;;;wBAVqB,IAAoB,CAAA;;4BAa9C,sBAAO,KAAK,EAAC;;;;KACd;IAEK,2CAAc,GAApB,UAAqB,KAAa;;;;;;;wBAC1B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,CAAC,CAAC;wBACnE,eAAe,GAAG,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,WAAW,EAAE,CAAC;wBACvC,WAAW,GAAG,IAAA,yBAAkB,GAAE,CAAC,IAAI,CAAC,UAAC,cAAc,IAAK,OAAA,cAAc,CAAC,KAAK,KAAK,eAAe,EAAxC,CAAwC,CAAC,CAAC;wBAC5G,IAAI,CAAC,WAAW,EAAE;4BAChB,MAAM,IAAI,KAAK,CACb,8CAAuC,KAAK,2CAAwC;gCAClF,+DAA+D,CAClE,CAAC;yBACH;wBAEK,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAA;;wBAA5D,IAAI,GAAG,SAAqD;wBAClE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,EAAE;4BAC7C,MAAM,IAAI,KAAK,CACb,uCAAgC,eAAe,kDAA0C;gCACvF,wFAAwF,CAC3F,CAAC;yBACH;wBAGK,QAAQ,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;wBAC3C,KAAA,CAAA,KAAA,EAAE,CAAA,CAAC,MAAM,CAAA;8BAAC,aAAM,CAAC,IAAI;+BAAI,EAAE,EAAE,IAAI,CAAC,EAAE;wBAAY,qBAAM,IAAI,+BAAc,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAA;4BAA1G,qBAAM,yBAAsC,WAAQ,GAAE,SAAoD,QAAG,EAAA;;wBAA7G,SAA6G,CAAC;wBAC9G,yFAAyF;wBACzF,yEAAyE;wBACzE,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,EAAA;;wBAF/D,yFAAyF;wBACzF,yEAAyE;wBACzE,SAA+D,CAAC;wBAChE,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,2BAA2B;4BACpC,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE;yBACpE,CAAC,CAAC;wBAEH,sBAAO;gCACL,KAAK,EAAE,eAAe;gCACtB,QAAQ,UAAA;gCACR,UAAU,EAAE,WAAW,CAAC,UAAU;gCAClC,IAAI,EACF,oDAA6C,WAAW,CAAC,UAAU,sBAAmB;oCACtF,mGAA8F;6BACjG,EAAC;;;;KACH;IACH,yBAAC;AAAD,CAAC,AAlED,IAkEC;AAlEY,gDAAkB"}
+{"version":3,"file":"MachineCredentials.js","sourceRoot":"","sources":["../../../src/services/MachineCredentials.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iCAAqC;AACrC,oCAA8C;AAC9C,wCASyB;AACzB,4CAA2C;AAC3C,kDAAsD;AAEtD,mEAAkE;AAElE;;;;;;;;;;;;;;GAcG;AACH;IAAA;QACS,oBAAe,GAA+B;YACnD,IAAI,EAAE;gBACJ,UAAU,EAAE,uBAAgB,CAAC,KAAK;aACnC;SACF,CAAC;IA2FJ,CAAC;IAzFO,gDAAmB,GAAzB;;;;;;wBACQ,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACrB,KAAK,GAAyB,EAAE,CAAC;8BACO,EAApB,SAAA,yBAAkB,GAAE;;;6BAApB,CAAA,cAAoB,CAAA;wBAAnC,WAAW;wBACU,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,EAAA;;wBAA/E,GAAG,GAAqB,SAAuD;wBAC/E,OAAO,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;wBACzC,KAAK,CAAC,IAAI,qBACR,KAAK,EAAE,WAAW,CAAC,KAAK,EACxB,WAAW,EAAE,WAAW,CAAC,WAAW,EACpC,KAAK,oBAAM,WAAW,CAAC,KAAK,SAC5B,UAAU,EAAE,WAAW,CAAC,UAAU,EAClC,MAAM,EAAE,CAAC,GAAG;gCACV,CAAC,CAAC,oBAAoB;gCACtB,CAAC,CAAC,OAAO;oCACP,CAAC,CAAC,qBAAqB;oCACvB,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,aAAa;wCAC5B,CAAC,CAAC,aAAa;wCACf,CAAC,CAAC,QAAQ,IACb,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,SAAA,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC/B,aAAa,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,IAClD,CAAC;;;wBAjBqB,IAAoB,CAAA;;4BAoB9C,sBAAO,KAAK,EAAC;;;;KACd;IAEK,2CAAc,GAApB,UAAqB,KAAa;;;;;;;wBAC1B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,CAAC,CAAC;wBACnE,eAAe,GAAG,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,WAAW,EAAE,CAAC;wBACvC,WAAW,GAAG,IAAA,yBAAkB,GAAE,CAAC,IAAI,CAAC,UAAC,cAAc,IAAK,OAAA,cAAc,CAAC,KAAK,KAAK,eAAe,EAAxC,CAAwC,CAAC,CAAC;wBAC5G,IAAI,CAAC,WAAW,EAAE;4BAChB,MAAM,IAAI,KAAK,CACb,8CAAuC,KAAK,2CAAwC;gCAClF,+DAA+D,CAClE,CAAC;yBACH;wBAEK,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACI,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAA;;wBAA9E,IAAI,GAAqB,SAAqD;wBACpF,IAAI,CAAC,IAAI,EAAE;4BACT,MAAM,IAAI,KAAK,CACb,uCAAgC,eAAe,kDAA0C;gCACvF,4EAA4E,CAC/E,CAAC;yBACH;wBAEK,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;wBACnC,IAAI,OAAO,EAAE;4BACX,MAAM,IAAI,KAAK,CACb,+BAAwB,eAAe,oCAA0B,OAAO,2BAAmB;gCACzF,0FAA0F;gCAC1F,+CAA+C,CAClD,CAAC;yBACH;wBAGK,QAAQ,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;wBAC3C,KAAA,CAAA,KAAA,EAAE,CAAA,CAAC,MAAM,CAAA;8BAAC,aAAM,CAAC,IAAI;+BAAI,EAAE,EAAE,IAAI,CAAC,EAAE;wBAAY,qBAAM,IAAI,+BAAc,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAA;4BAA1G,qBAAM,yBAAsC,WAAQ,GAAE,SAAoD,QAAG,EAAA;;wBAA7G,SAA6G,CAAC;wBAC9G,yFAAyF;wBACzF,yEAAyE;wBACzE,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,EAAA;;wBAF/D,yFAAyF;wBACzF,yEAAyE;wBACzE,SAA+D,CAAC;wBAChE,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,2BAA2B;4BACpC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,0BAAc,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE;yBACpG,CAAC,CAAC;wBAEH,sBAAO;gCACL,KAAK,EAAE,eAAe;gCACtB,QAAQ,UAAA;gCACR,UAAU,EAAE,WAAW,CAAC,UAAU;gCAClC,IAAI,EACF,oDAA6C,WAAW,CAAC,UAAU,sBAAmB;oCACtF,mGAA8F;6BACjG,EAAC;;;;KACH;IAED;;;;;OAKG;IACK,oCAAO,GAAf,UAAgB,GAAS;QACvB,IAAI,GAAG,CAAC,kBAAkB,KAAK,IAAI,EAAE;YACnC,OAAO,SAAS,CAAC;SAClB;QAED,OAAO,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,6BAA6B,CAAC;IAC7G,CAAC;IACH,yBAAC;AAAD,CAAC,AAhGD,IAgGC;AAhGY,gDAAkB"}

package/dist/src/services/Roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Roles.d.ts","sourceRoot":"","sources":["../../../src/services/Roles.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAA8D,MAAM,iBAAiB,CAAC;AAE3G,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C;;;;;;;;;;;;;;GAcG;AACH,iHAAiH;AACjH,MAAM,MAAM,qBAAqB,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,CAAC;AAEpH,qBAAa,KAAM,YAAW,YAAY;IACjC,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAIhD;IAEI,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7D;;;;;;;;;;;;;OAaG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,cAAc,GAAG,YAAY,CAAC;IAqBvF;;;;;;;;;;;;;;;;OAgBG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC;YAuCtE,UAAU;IA8ExB,+GAA+G;YACjG,WAAW;CAK1B"}
+{"version":3,"file":"Roles.d.ts","sourceRoot":"","sources":["../../../src/services/Roles.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAA8D,MAAM,iBAAiB,CAAC;AAG3G,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C;;;;;;;;;;;;;;GAcG;AACH,iHAAiH;AACjH,MAAM,MAAM,qBAAqB,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,CAAC;AAEpH,qBAAa,KAAM,YAAW,YAAY;IACjC,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAIhD;IAEI,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7D;;;;;;;;;;;;;OAaG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,cAAc,GAAG,YAAY,CAAC;IAwBvF;;;;;;;;;;;;;;;;OAgBG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC;YAuCtE,UAAU;IA8ExB,+GAA+G;YACjG,WAAW;CAK1B"}

package/dist/src/services/Roles.js

@@ -49,6 +49,7 @@ exports.Roles = void 0;
 var db_1 = require("@proteinjs/db");
 var user_1 = require("@proteinjs/user");
 var logger_1 = require("@proteinjs/logger");
+var util_node_1 = require("@proteinjs/util-node");
 var Roles = /** @class */ (function () {
     function Roles() {
         this.serviceMetadata = {
@@ -132,7 +133,10 @@ var Roles = /** @class */ (function () {
                             }); })];
                     case 3:
                         _b.sent();
-                        logger.info({ message: 'Break-glass admin granted by the dev first-admin door', obj: { target: user.id, email: email } });
+                        logger.info({
+                            message: 'Break-glass admin granted by the dev first-admin door',
+                            obj: { target: user.id, account: new util_node_1.RequestDigests().account(email) },
+                        });
                         return [2 /*return*/, 'granted'];
                 }
             });
@@ -219,7 +223,7 @@ var Roles = /** @class */ (function () {
                         _c.sent();
                         logger.info({
                             message: 'Roles granted by the dev role-bootstrap door',
-                            obj: { target: user.id, email: email, granted: outcome.granted },
+                            obj: { target: user.id, account: new util_node_1.RequestDigests().account(email), granted: outcome.granted },
                         });
                         return [2 /*return*/, outcome];
                 }

package/dist/src/services/Roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"Roles.js","sourceRoot":"","sources":["../../../src/services/Roles.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAAmE;AACnE,wCAA2G;AAC3G,4CAA2C;AAqB3C;IAAA;QACS,oBAAe,GAA+B;YACnD,IAAI,EAAE;gBACJ,UAAU,EAAE,uBAAgB,CAAC,KAAK;aACnC;SACF,CAAC;IAyLJ,CAAC;IAvLO,yBAAS,GAAf,UAAgB,MAAc,EAAE,IAAY;;;;4BAC1C,qBAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,EAAA;;wBAA5C,SAA4C,CAAC;;;;;KAC9C;IAEK,0BAAU,GAAhB,UAAiB,MAAc,EAAE,IAAY;;;;4BAC3C,qBAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAA;;wBAA7C,SAA6C,CAAC;;;;;KAC/C;IAED;;;;;;;;;;;;;OAaG;IACG,8BAAc,GAApB,UAAqB,KAAa;;;;;;;;wBAC1B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;wBACtD,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACvB,qBAAM,IAAI,CAAC,WAAW,EAAE,EAAA;;wBAA5B,IAAI,SAAwB,EAAE;4BAC5B,sBAAO,cAAc,EAAC;yBACvB;wBAEY,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;wBAAhE,IAAI,GAAG,SAAyD;wBACtE,IAAI,CAAC,IAAI,EAAE;4BACT,sBAAO,YAAY,EAAC;yBACrB;wBAEK,KAAK,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC;wBAC/B,qBAAM,EAAE,CAAC,cAAc,CAAC;;;gDACtB,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,kCAAM,KAAK,UAAE,OAAO,SAAC,EAAE,CAAC,EAAA;;4CAAzE,SAAyE,CAAC;4CAC1E,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAA;;4CAA3G,SAA2G,CAAC;;;;iCAC7G,CAAC,EAAA;;wBAHF,SAGE,CAAC;wBACH,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uDAAuD,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBACnH,sBAAO,SAAS,EAAC;;;;KAClB;IAED;;;;;;;;;;;;;;;;OAgBG;IACG,8BAAc,GAApB,UAAqB,KAAa,EAAE,KAAe;;;;;;;;wBAC3C,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;wBACtD,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;wBAAhE,IAAI,GAAG,SAAyD;wBACtE,IAAI,CAAC,IAAI,EAAE;4BACT,MAAM,IAAI,KAAK,CAAC,yCAAkC,KAAK,0DAAkD,CAAC,CAAC;yBAC5G;wBAEK,IAAI,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC;wBACxB,OAAO,GAA0B,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;wBAC9E,WAA6C,EAA1B,KAAA,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAA1B,cAA0B,EAA1B,IAA0B,EAAE;4BAApC,IAAI;4BACP,KAAK,GAAG,mBAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;4BAC1C,IAAI,CAAC,KAAK,EAAE;gCACV,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,MAAA,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;6BACrD;iCAAM,IAAI,KAAK,CAAC,UAAU,EAAE;gCAC3B,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,MAAA,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;6BACpD;iCAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;gCAC9B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;6BACzB;iCAAM;gCACL,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;6BAC5B;yBACF;wBACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;4BAChC,sBAAO,OAAO,EAAC;yBAChB;wBAED,qBAAM,EAAE,CAAC,cAAc,CAAC;;;;gDACtB,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,kCAAM,IAAI,SAAK,OAAO,CAAC,OAAO,OAAC,EAAE,CAAC,EAAA;;4CAAnF,SAAmF,CAAC;kDAClD,EAAf,KAAA,OAAO,CAAC,OAAO;;;iDAAf,CAAA,cAAe,CAAA;4CAAvB,IAAI;4CACb,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,MAAA,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAA;;4CAAlG,SAAkG,CAAC;;;4CADlF,IAAe,CAAA;;;;;iCAGnC,CAAC,EAAA;;wBALF,SAKE,CAAC;wBACH,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,8CAA8C;4BACvD,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,OAAA,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;yBAC1D,CAAC,CAAC;wBACH,sBAAO,OAAO,EAAC;;;;KAChB;IAEa,0BAAU,GAAxB,UAAyB,MAAc,EAAE,IAAY,EAAE,MAA0B;;;;;;;;wBACzE,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,gBAAS,MAAM,SAAM,EAAE,CAAC,CAAC;wBACrD,KAAK,GAAG,mBAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;wBAC1C,IAAI,CAAC,KAAK,EAAE;4BACV,MAAM,IAAI,KAAK,CAAC,WAAI,IAAI,4DAAyD,CAAC,CAAC;yBACpF;wBAED,sFAAsF;wBACtF,yFAAyF;wBACzF,6FAA6F;wBAC7F,yFAAyF;wBACzF,6DAA6D;wBAC7D,IAAI,KAAK,CAAC,UAAU,IAAI,MAAM,KAAK,OAAO,EAAE;4BAC1C,MAAM,IAAI,KAAK,CACb,WAAI,IAAI,uFAA+E;gCACrF,sFAAsF;gCACtF,iBAAiB,CACpB,CAAC;yBACH;wBAED,2FAA2F;wBAC3F,6FAA6F;wBAC7F,yFAAyF;wBACzF,2FAA2F;wBAC3F,IAAI,KAAK,CAAC,cAAc,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,eAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;4BAC5E,MAAM,IAAI,KAAK,CACb,WAAI,IAAI,mFAA2E;gCACjF,mCAAmC,CACtC,CAAC;yBACH;wBAEK,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAA;;wBAAhD,IAAI,GAAG,SAAyC;wBACtD,IAAI,CAAC,IAAI,EAAE;4BACT,MAAM,IAAI,KAAK,CAAC,gCAAyB,MAAM,CAAE,CAAC,CAAC;yBACpD;wBAED,4FAA4F;wBAC5F,4FAA4F;wBAC5F,iFAAiF;wBACjF,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,EAAE;4BACpC,MAAM,IAAI,KAAK,CACb,WAAI,IAAI,CAAC,KAAK,gFAA6E;gCACzF,6FAA6F,CAChG,CAAC;yBACH;wBAEK,KAAK,GAAG,IAAI,eAAQ,EAAE,CAAC,OAAO,EAAE,CAAC;wBACvC,wFAAwF;wBACxF,0FAA0F;wBAC1F,2EAA2E;wBAC3E,IAAI,MAAM,KAAK,KAAK,CAAC,EAAE,EAAE;4BACvB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,EAAE,CAAC,CAAC;4BACxG,MAAM,IAAI,KAAK,CAAC,oBAAa,MAAM,qDAA6C,CAAC,CAAC;yBACnF;wBAEK,KAAK,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC;wBAC/B,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;4BACrE,mFAAmF;4BACnF,sBAAO;yBACR;wBAEK,QAAQ,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,iCAAK,KAAK,UAAE,IAAI,UAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAC,QAAQ,IAAK,OAAA,QAAQ,KAAK,IAAI,EAAjB,CAAiB,CAAC,CAAC;wBACvG,qBAAM,EAAE,CAAC,cAAc,CAAC;;;gDACtB,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAA;;4CAA7D,SAA6D,CAAC;4CAC9D,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,cAAc,EAAE;oDACrC,KAAK,EAAE,KAAK,CAAC,EAAE;oDACf,MAAM,EAAE,MAAM;oDACd,IAAI,MAAA;oDACJ,MAAM,QAAA;iDACP,CAAC,EAAA;;4CALF,SAKE,CAAC;;;;iCACJ,CAAC,EAAA;;wBARF,SAQE,CAAC;wBACH,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,eAAQ,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAE;4BAC7D,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,MAAA,EAAE;yBAC/C,CAAC,CAAC;;;;;KACJ;IAED,+GAA+G;IACjG,2BAAW,GAAzB;;;;;;wBACQ,EAAE,GAAG,IAAI,wBAAmB,EAAE,CAAC,eAAe,CAAC,aAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;wBACxF,qBAAM,IAAA,kBAAa,GAAE,CAAC,KAAK,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,CAAC,EAAA;;wBAApD,KAAK,GAAG,SAA4C;wBAC1D,sBAAO,KAAK,CAAC,IAAI,CAAC,UAAC,IAAI,YAAK,OAAA,CAAC,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA,EAAA,CAAC,EAAC;;;;KACnE;IACH,YAAC;AAAD,CAAC,AA9LD,IA8LC;AA9LY,sBAAK"}
+{"version":3,"file":"Roles.js","sourceRoot":"","sources":["../../../src/services/Roles.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAAmE;AACnE,wCAA2G;AAC3G,4CAA2C;AAC3C,kDAAsD;AAqBtD;IAAA;QACS,oBAAe,GAA+B;YACnD,IAAI,EAAE;gBACJ,UAAU,EAAE,uBAAgB,CAAC,KAAK;aACnC;SACF,CAAC;IA4LJ,CAAC;IA1LO,yBAAS,GAAf,UAAgB,MAAc,EAAE,IAAY;;;;4BAC1C,qBAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,EAAA;;wBAA5C,SAA4C,CAAC;;;;;KAC9C;IAEK,0BAAU,GAAhB,UAAiB,MAAc,EAAE,IAAY;;;;4BAC3C,qBAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAA;;wBAA7C,SAA6C,CAAC;;;;;KAC/C;IAED;;;;;;;;;;;;;OAaG;IACG,8BAAc,GAApB,UAAqB,KAAa;;;;;;;;wBAC1B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;wBACtD,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACvB,qBAAM,IAAI,CAAC,WAAW,EAAE,EAAA;;wBAA5B,IAAI,SAAwB,EAAE;4BAC5B,sBAAO,cAAc,EAAC;yBACvB;wBAEY,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;wBAAhE,IAAI,GAAG,SAAyD;wBACtE,IAAI,CAAC,IAAI,EAAE;4BACT,sBAAO,YAAY,EAAC;yBACrB;wBAEK,KAAK,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC;wBAC/B,qBAAM,EAAE,CAAC,cAAc,CAAC;;;gDACtB,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,kCAAM,KAAK,UAAE,OAAO,SAAC,EAAE,CAAC,EAAA;;4CAAzE,SAAyE,CAAC;4CAC1E,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAA;;4CAA3G,SAA2G,CAAC;;;;iCAC7G,CAAC,EAAA;;wBAHF,SAGE,CAAC;wBACH,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,uDAAuD;4BAChE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,0BAAc,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;yBACvE,CAAC,CAAC;wBACH,sBAAO,SAAS,EAAC;;;;KAClB;IAED;;;;;;;;;;;;;;;;OAgBG;IACG,8BAAc,GAApB,UAAqB,KAAa,EAAE,KAAe;;;;;;;;wBAC3C,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;wBACtD,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;wBAAhE,IAAI,GAAG,SAAyD;wBACtE,IAAI,CAAC,IAAI,EAAE;4BACT,MAAM,IAAI,KAAK,CAAC,yCAAkC,KAAK,0DAAkD,CAAC,CAAC;yBAC5G;wBAEK,IAAI,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC;wBACxB,OAAO,GAA0B,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;wBAC9E,WAA6C,EAA1B,KAAA,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAA1B,cAA0B,EAA1B,IAA0B,EAAE;4BAApC,IAAI;4BACP,KAAK,GAAG,mBAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;4BAC1C,IAAI,CAAC,KAAK,EAAE;gCACV,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,MAAA,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;6BACrD;iCAAM,IAAI,KAAK,CAAC,UAAU,EAAE;gCAC3B,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,MAAA,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;6BACpD;iCAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;gCAC9B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;6BACzB;iCAAM;gCACL,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;6BAC5B;yBACF;wBACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;4BAChC,sBAAO,OAAO,EAAC;yBAChB;wBAED,qBAAM,EAAE,CAAC,cAAc,CAAC;;;;gDACtB,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,kCAAM,IAAI,SAAK,OAAO,CAAC,OAAO,OAAC,EAAE,CAAC,EAAA;;4CAAnF,SAAmF,CAAC;kDAClD,EAAf,KAAA,OAAO,CAAC,OAAO;;;iDAAf,CAAA,cAAe,CAAA;4CAAvB,IAAI;4CACb,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,MAAA,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAA;;4CAAlG,SAAkG,CAAC;;;4CADlF,IAAe,CAAA;;;;;iCAGnC,CAAC,EAAA;;wBALF,SAKE,CAAC;wBACH,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,8CAA8C;4BACvD,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,0BAAc,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;yBACjG,CAAC,CAAC;wBACH,sBAAO,OAAO,EAAC;;;;KAChB;IAEa,0BAAU,GAAxB,UAAyB,MAAc,EAAE,IAAY,EAAE,MAA0B;;;;;;;;wBACzE,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,gBAAS,MAAM,SAAM,EAAE,CAAC,CAAC;wBACrD,KAAK,GAAG,mBAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;wBAC1C,IAAI,CAAC,KAAK,EAAE;4BACV,MAAM,IAAI,KAAK,CAAC,WAAI,IAAI,4DAAyD,CAAC,CAAC;yBACpF;wBAED,sFAAsF;wBACtF,yFAAyF;wBACzF,6FAA6F;wBAC7F,yFAAyF;wBACzF,6DAA6D;wBAC7D,IAAI,KAAK,CAAC,UAAU,IAAI,MAAM,KAAK,OAAO,EAAE;4BAC1C,MAAM,IAAI,KAAK,CACb,WAAI,IAAI,uFAA+E;gCACrF,sFAAsF;gCACtF,iBAAiB,CACpB,CAAC;yBACH;wBAED,2FAA2F;wBAC3F,6FAA6F;wBAC7F,yFAAyF;wBACzF,2FAA2F;wBAC3F,IAAI,KAAK,CAAC,cAAc,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,eAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;4BAC5E,MAAM,IAAI,KAAK,CACb,WAAI,IAAI,mFAA2E;gCACjF,mCAAmC,CACtC,CAAC;yBACH;wBAEK,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAA;;wBAAhD,IAAI,GAAG,SAAyC;wBACtD,IAAI,CAAC,IAAI,EAAE;4BACT,MAAM,IAAI,KAAK,CAAC,gCAAyB,MAAM,CAAE,CAAC,CAAC;yBACpD;wBAED,4FAA4F;wBAC5F,4FAA4F;wBAC5F,iFAAiF;wBACjF,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,EAAE;4BACpC,MAAM,IAAI,KAAK,CACb,WAAI,IAAI,CAAC,KAAK,gFAA6E;gCACzF,6FAA6F,CAChG,CAAC;yBACH;wBAEK,KAAK,GAAG,IAAI,eAAQ,EAAE,CAAC,OAAO,EAAE,CAAC;wBACvC,wFAAwF;wBACxF,0FAA0F;wBAC1F,2EAA2E;wBAC3E,IAAI,MAAM,KAAK,KAAK,CAAC,EAAE,EAAE;4BACvB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,EAAE,CAAC,CAAC;4BACxG,MAAM,IAAI,KAAK,CAAC,oBAAa,MAAM,qDAA6C,CAAC,CAAC;yBACnF;wBAEK,KAAK,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC;wBAC/B,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;4BACrE,mFAAmF;4BACnF,sBAAO;yBACR;wBAEK,QAAQ,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,iCAAK,KAAK,UAAE,IAAI,UAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAC,QAAQ,IAAK,OAAA,QAAQ,KAAK,IAAI,EAAjB,CAAiB,CAAC,CAAC;wBACvG,qBAAM,EAAE,CAAC,cAAc,CAAC;;;gDACtB,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAA;;4CAA7D,SAA6D,CAAC;4CAC9D,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,cAAc,EAAE;oDACrC,KAAK,EAAE,KAAK,CAAC,EAAE;oDACf,MAAM,EAAE,MAAM;oDACd,IAAI,MAAA;oDACJ,MAAM,QAAA;iDACP,CAAC,EAAA;;4CALF,SAKE,CAAC;;;;iCACJ,CAAC,EAAA;;wBARF,SAQE,CAAC;wBACH,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,eAAQ,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAE;4BAC7D,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,MAAA,EAAE;yBAC/C,CAAC,CAAC;;;;;KACJ;IAED,+GAA+G;IACjG,2BAAW,GAAzB;;;;;;wBACQ,EAAE,GAAG,IAAI,wBAAmB,EAAE,CAAC,eAAe,CAAC,aAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;wBACxF,qBAAM,IAAA,kBAAa,GAAE,CAAC,KAAK,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,CAAC,EAAA;;wBAApD,KAAK,GAAG,SAA4C;wBAC1D,sBAAO,KAAK,CAAC,IAAI,CAAC,UAAC,IAAI,YAAK,OAAA,CAAC,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA,EAAA,CAAC,EAAC;;;;KACnE;IACH,YAAC;AAAD,CAAC,AAjMD,IAiMC;AAjMY,sBAAK"}

package/dist/src/services/Signup.d.ts

@@ -71,6 +71,11 @@ export declare class Signup implements SignupService {
      * (`devLogin`, which auto-creates missing same-domain test accounts). Not exposed as an RPC:
      * the service surface is the `SignupService` INTERFACE (ServiceRouter walks its declared
      * methods), so extra class methods stay server-internal.
+     *
+     * An address a `MachineAccount` declaration owns is never registered, whatever its row state:
+     * a person's row under it would make the boot sync refuse the declaration (it never takes over
+     * a row it does not own), so the address is refused here in plain words — the declared machine
+     * accounts of this build are the list, nothing else.
      */
     createAccount(account: {
         name: string;

package/dist/src/services/Signup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Signup.d.ts","sourceRoot":"","sources":["../../../src/services/Signup.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAIlB,aAAa,EACb,wBAAwB,EAExB,MAAM,EACN,IAAI,EACJ,UAAU,EAEX,MAAM,iBAAiB,CAAC;AAUzB,OAAO,EAAE,QAAQ,EAAoB,MAAM,uBAAuB,CAAC;AAGnE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC;AAEhH,MAAM,WAAW,0BAA2B,SAAQ,QAAQ;IAC1D,SAAS,IAAI,YAAY,CAAC;CAC3B;AAED,eAAO,MAAM,6BAA6B,QAAO,0BAShD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC9B,0FAA0F;IAC1F,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,qBAAa,MAAO,YAAW,aAAa;IACnC,eAAe;;oCAEM,MAAM,QAAQ,GAAG,EAAE;;MAY7C;IAEF;;;;;OAKG;IACG,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA2DvE,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAyC5D;;;;;;OAMG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA4BxD,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhD;;;OAGG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAoD1F;;;;;;;OAOG;IACG,aAAa,CAAC,OAAO,EAAE;QAC3B,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,OAAO,CAAC;QACvB,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;KAC9B,GAAG,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC;IAmBjC,iGAAiG;YACnF,YAAY;IAe1B,8GAA8G;IAC9G,OAAO,CAAC,iBAAiB;IAUzB,8GAA8G;IAC9G,OAAO,CAAC,eAAe;IAOvB,qGAAqG;YACvF,WAAW;CAU1B"}
+{"version":3,"file":"Signup.d.ts","sourceRoot":"","sources":["../../../src/services/Signup.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAIlB,aAAa,EACb,wBAAwB,EAExB,MAAM,EACN,IAAI,EACJ,UAAU,EAGX,MAAM,iBAAiB,CAAC;AAWzB,OAAO,EAAE,QAAQ,EAAoB,MAAM,uBAAuB,CAAC;AAGnE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC;AAEhH,MAAM,WAAW,0BAA2B,SAAQ,QAAQ;IAC1D,SAAS,IAAI,YAAY,CAAC;CAC3B;AAED,eAAO,MAAM,6BAA6B,QAAO,0BAShD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC9B,0FAA0F;IAC1F,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,qBAAa,MAAO,YAAW,aAAa;IACnC,eAAe;;oCAEM,MAAM,QAAQ,GAAG,EAAE;;MAY7C;IAEF;;;;;OAKG;IACG,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA8DvE,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAgD5D;;;;;;OAMG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiCxD,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhD;;;OAGG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAoD1F;;;;;;;;;;;;OAYG;IACG,aAAa,CAAC,OAAO,EAAE;QAC3B,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,OAAO,CAAC;QACvB,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;KAC9B,GAAG,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC;IAuBjC,iGAAiG;YACnF,YAAY;IAe1B,8GAA8G;IAC9G,OAAO,CAAC,iBAAiB;IAUzB,8GAA8G;IAC9G,OAAO,CAAC,eAAe;IAOvB,qGAAqG;YACvF,WAAW;CAU1B"}