@proteinjs/user-server 1.22.2 → 1.22.3

package/src/routes/devLogin.ts

@@ -1,5 +1,6 @@
 import { Route } from '@proteinjs/server-api';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import { emailRegex } from '@proteinjs/util';
 import { establishSession } from '../authentication/establishSession';
 import { Roles } from '../services/Roles';
@@ -88,22 +89,33 @@ export const devLogin: Route = {
       email = requested;
     }
     email = email.toLowerCase();
+    const digests = new RequestDigests();
 
-    const creation = await new Signup().createAccount({
-      name: email.slice(0, email.indexOf('@')),
-      email,
-      password: 'test',
-      emailVerified: false, // same shape an inviteless signup produces
-      invitedBy: null,
-    });
+    let creation: 'created' | 'exists';
+    try {
+      creation = await new Signup().createAccount({
+        name: email.slice(0, email.indexOf('@')),
+        email,
+        password: 'test',
+        emailVerified: false, // same shape an inviteless signup produces
+        invitedBy: null,
+      });
+    } catch (error) {
+      // createAccount refuses in plain words (an address a machine-account declaration owns); the
+      // dev door answers the way its other refusals do — the words, no session, no row.
+      response
+        .status(400)
+        .send(`/dev/login: ${error instanceof Error ? error.message : 'the account could not be created'}`);
+      return;
+    }
     if (creation === 'created') {
-      logger.info({ message: 'Dev auto-login created missing test account', obj: { email } });
+      logger.info({ message: 'Dev auto-login created missing test account', obj: { account: digests.account(email) } });
     }
 
     const bootstrapEmail = (process.env.DEV_BOOTSTRAP_ADMIN_EMAIL ?? '').trim().toLowerCase();
     if (bootstrapEmail && email === bootstrapEmail) {
       const outcome = await new Roles().bootstrapAdmin(email);
-      logger.info({ message: `Dev bootstrap admin door: ${outcome}`, obj: { email } });
+      logger.info({ message: `Dev bootstrap admin door: ${outcome}`, obj: { account: digests.account(email) } });
     }
 
     const bootstrapRoles = DevBootstrapRoles.rolesFor(email);
@@ -115,7 +127,7 @@ export const devLogin: Route = {
     // establishSession commits the session row before the redirect — the redirected GET / must
     // never read the store ahead of the write (observed: first /dev/login load landed on /login).
     await establishSession(request, email);
-    logger.info({ message: 'Dev auto-login session established', obj: { email } });
+    logger.info({ message: 'Dev auto-login session established', obj: { account: digests.account(email) } });
     response.redirect('/');
   },
 };

package/src/routes/executePasswordReset.ts

@@ -1,9 +1,9 @@
 import { Route } from '@proteinjs/server-api';
 import { routes } from '@proteinjs/user';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import { PasswordHasher } from '../authentication/PasswordHasher';
 import { PasswordResetToken } from '../authentication/PasswordResetToken';
-import { RequestDigests } from '../throttle/RequestDigests';
 import { signInThrottle } from '../throttle/SignInThrottle';
 
 /**
@@ -27,6 +27,7 @@ export const executePasswordReset: Route = {
   method: routes.executePasswordReset.method,
   onRequest: async (request, response): Promise<void> => {
     const logger = new Logger({ name: 'executePasswordReset' });
+    const digests = new RequestDigests();
     const { token, newPassword } = request.body ?? {};
     if (typeof newPassword !== 'string' || newPassword.length === 0) {
       response.status(400).send({ error: 'New password cannot be blank' });
@@ -45,7 +46,7 @@ export const executePasswordReset: Route = {
     }
 
     if (resolution.status === 'expired') {
-      logger.info({ message: `Expired reset token used`, obj: { email: resolution.user.email } });
+      logger.info({ message: `Expired reset token used`, obj: { account: digests.account(resolution.user.email) } });
       response.status(400).send({ error: 'Reset token has expired' });
       return;
     }
@@ -53,13 +54,13 @@ export const executePasswordReset: Route = {
     const { user } = resolution;
     const hashedPassword = await new PasswordHasher().hash(newPassword);
     if (!(await resetToken.redeem(user, resolution.token, hashedPassword))) {
-      logger.info({ message: `Reset token already redeemed`, obj: { email: user.email } });
+      logger.info({ message: `Reset token already redeemed`, obj: { account: digests.account(user.email) } });
       response.status(400).send({ error: 'Invalid or expired reset token' });
       return;
     }
 
-    signInThrottle.recordSuccess(new RequestDigests().account(user.email));
-    logger.info({ message: `Password successfully reset`, obj: { email: user.email } });
+    signInThrottle.recordSuccess(digests.account(user.email));
+    logger.info({ message: `Password successfully reset`, obj: { account: digests.account(user.email) } });
     response.send({ message: 'Password has been successfully reset' });
   },
 };

package/src/routes/initiatePasswordReset.ts

@@ -2,6 +2,7 @@ import { Route } from '@proteinjs/server-api';
 import { getDbAsSystem } from '@proteinjs/db';
 import { routes, tables, uiRoutes } from '@proteinjs/user';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import moment from 'moment';
 import {
   EmailSender,
@@ -9,7 +10,6 @@ import {
 } from '@proteinjs/email-server';
 import { PasswordResetToken } from '../authentication/PasswordResetToken';
 import { ClientAddress } from '../throttle/ClientAddress';
-import { RequestDigests } from '../throttle/RequestDigests';
 import { passwordResetThrottle } from '../throttle/PasswordResetThrottle';
 
 /**

package/src/routes/signup.ts

@@ -1,5 +1,6 @@
 import { Route } from '@proteinjs/server-api';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import { UserSignup, routes } from '@proteinjs/user';
 import { establishSession } from '../authentication/establishSession';
 import { Signup } from '../services/Signup';
@@ -40,8 +41,10 @@ export const signup: Route = {
       );
     } catch (error: any) {
       // createUser throws plain-words errors deliberately (invite expired / invite required /
-      // email missing); the message is the user-facing contract, same as the RPC layer's.
-      logger.error({ message: 'Signup failed', error });
+      // email missing); the message is the user-facing contract, same as the RPC layer's. The log
+      // gets the error through the digest door: a concurrent double sign-up's unique-index refusal
+      // names the address in the database's own words.
+      logger.error({ message: 'Signup failed', error: new RequestDigests().redactError(error) });
       response.send({ error: error instanceof Error ? error.message : 'Sign up failed.' });
       return;
     }

package/src/routes/validateResetPasswordToken.ts

@@ -1,6 +1,7 @@
 import { Route } from '@proteinjs/server-api';
 import { routes } from '@proteinjs/user';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import { PasswordResetToken } from '../authentication/PasswordResetToken';
 
 export const validateResetPasswordToken: Route = {
@@ -26,7 +27,10 @@ export const validateResetPasswordToken: Route = {
     }
 
     if (resolution.status === 'expired') {
-      logger.info({ message: `Expired reset token used`, obj: { email: resolution.user.email } });
+      logger.info({
+        message: `Expired reset token used`,
+        obj: { account: new RequestDigests().account(resolution.user.email) },
+      });
       response.status(200).send({ isValid: false, message: 'Token has expired' });
       return;
     }

package/src/services/MachineCredentials.ts

@@ -1,14 +1,17 @@
 import { randomBytes } from 'crypto';
 import { getDbAsSystem } from '@proteinjs/db';
 import {
+  MachineAccountRefusal,
   MachineAccountView,
   MachineCredentialsService,
   MintedMachineCredential,
   USER_PERMISSIONS,
+  User,
   getMachineAccounts,
   tables,
 } from '@proteinjs/user';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import { Service } from '@proteinjs/service';
 import { PasswordHasher } from '../authentication/PasswordHasher';
 
@@ -23,7 +26,9 @@ import { PasswordHasher } from '../authentication/PasswordHasher';
  * account's existing sessions (the old
  * credential dies with them), and returns the plaintext ONCE for pasting into the declaration's
  * Secret Manager secret. The same call rotates. Machine rows only (`is_loaded_from_source`);
- * human credentials go through the password-reset flow.
+ * human credentials go through the password-reset flow. A declared address held by a row the
+ * boot sync does not own (a person's signup, a hand-made row) has no machine account at all —
+ * the sync refused the declaration — and both the list and the mint say so.
  */
 export class MachineCredentials implements MachineCredentialsService {
   public serviceMetadata: Service['serviceMetadata'] = {
@@ -36,15 +41,22 @@ export class MachineCredentials implements MachineCredentialsService {
     const db = getDbAsSystem();
     const views: MachineAccountView[] = [];
     for (const declaration of getMachineAccounts()) {
-      const row = await db.get(tables.User, { email: declaration.email });
-      const booted = !!row && row.isLoadedFromSource === true;
+      const row: User | undefined = await db.get(tables.User, { email: declaration.email });
+      const refusal = row && this.refusal(row);
       views.push({
         email: declaration.email,
         accountName: declaration.accountName,
         roles: [...declaration.roles],
         secretName: declaration.secretName,
-        status: booted ? (row.status === 'deactivated' ? 'deactivated' : 'active') : 'pending first boot',
-        hasCredential: booted && !!row.password,
+        status: !row
+          ? 'pending first boot'
+          : refusal
+            ? 'declaration refused'
+            : row.status === 'deactivated'
+              ? 'deactivated'
+              : 'active',
+        ...(refusal ? { refusal } : {}),
+        hasCredential: !!row && !refusal && !!row.password,
       });
     }
 
@@ -63,11 +75,20 @@ export class MachineCredentials implements MachineCredentialsService {
     }
 
     const db = getDbAsSystem();
-    const user = await db.get(tables.User, { email: normalizedEmail });
-    if (!user || user.isLoadedFromSource !== true) {
+    const user: User | undefined = await db.get(tables.User, { email: normalizedEmail });
+    if (!user) {
       throw new Error(
         `The machine account row for '${normalizedEmail}' has not been loaded from source yet — ` +
-          `the boot sync creates (or adopts) it. Boot the server with the declaration, then mint.`
+          `the boot sync creates it. Boot the server with the declaration, then mint.`
+      );
+    }
+
+    const refusal = this.refusal(user);
+    if (refusal) {
+      throw new Error(
+        `The declaration for '${normalizedEmail}' was refused at boot: ${refusal} — the boot sync ` +
+          `never takes over a row it does not own, so there is no machine account to mint for. The ` +
+          `first boot after that row is gone creates it.`
       );
     }
 
@@ -79,7 +100,7 @@ export class MachineCredentials implements MachineCredentialsService {
     await db.delete(tables.Session, { userEmail: normalizedEmail });
     logger.info({
       message: `Minted machine credential`,
-      obj: { email: normalizedEmail, secretName: declaration.secretName },
+      obj: { account: new RequestDigests().account(normalizedEmail), secretName: declaration.secretName },
     });
 
     return {
@@ -91,4 +112,18 @@ export class MachineCredentials implements MachineCredentialsService {
         `secret, then restart the service that reads it — the previous credential is already invalid.`,
     };
   }
+
+  /**
+   * Why the boot sync refused a declaration whose address this row holds — undefined for the
+   * account's own row. The sync owns a row only when it created it (`isLoadedFromSource`); any
+   * other row under a declared address is never taken over (@proteinjs/db's natural-key refusal),
+   * and the one machine marker says whose row it is.
+   */
+  private refusal(row: User): MachineAccountRefusal | undefined {
+    if (row.isLoadedFromSource === true) {
+      return undefined;
+    }
+
+    return row.machine === true ? 'a hand-made machine row holds this address' : 'a person holds this address';
+  }
 }

package/src/services/Roles.ts

@@ -1,6 +1,7 @@
 import { getDbAsSystem, QueryBuilderFactory } from '@proteinjs/db';
 import { RolesService, RolesCatalog, UserAuth, UserRepo, tables, USER_PERMISSIONS } from '@proteinjs/user';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import { Service } from '@proteinjs/service';
 
 /**
@@ -67,7 +68,10 @@ export class Roles implements RolesService {
       await db.update(tables.User, { id: user.id, roles: [...roles, 'admin'] });
       await db.insert(tables.RoleGrantEvent, { actor: user.id, target: user.id, role: 'admin', action: 'grant' });
     });
-    logger.info({ message: 'Break-glass admin granted by the dev first-admin door', obj: { target: user.id, email } });
+    logger.info({
+      message: 'Break-glass admin granted by the dev first-admin door',
+      obj: { target: user.id, account: new RequestDigests().account(email) },
+    });
     return 'granted';
   }
 
@@ -122,7 +126,7 @@ export class Roles implements RolesService {
     });
     logger.info({
       message: 'Roles granted by the dev role-bootstrap door',
-      obj: { target: user.id, email, granted: outcome.granted },
+      obj: { target: user.id, account: new RequestDigests().account(email), granted: outcome.granted },
     });
     return outcome;
   }

package/src/services/Signup.ts

@@ -11,10 +11,12 @@ import {
   User,
   UserSignup,
   USER_PERMISSIONS,
+  getMachineAccounts,
 } from '@proteinjs/user';
 import moment from 'moment';
 import { lib } from 'crypto-js';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import {
   EmailSender,
   getDefaultInviteEmailConfigFactory,
@@ -124,7 +126,10 @@ export class Signup implements SignupService {
       invitedBy: invite ? invite.invitedBy : null,
     });
     if (creation === 'exists') {
-      logger.error({ message: `User with this email already exists`, obj: { email } });
+      logger.error({
+        message: `User with this email already exists`,
+        obj: { account: new RequestDigests().account(email) },
+      });
       if (config.getExistingUserEmailContent) {
         const { text, html } = config.getExistingUserEmailContent();
         await emailSender.sendEmail({
@@ -146,7 +151,7 @@ export class Signup implements SignupService {
       html,
       ...config.options,
     });
-    logger.info({ message: `Created user`, obj: { email } });
+    logger.info({ message: `Created user`, obj: { account: new RequestDigests().account(email) } });
     return { outcome: 'created', email };
   }
 
@@ -183,7 +188,14 @@ export class Signup implements SignupService {
       await this.emailInvite(caseInsensitiveEmail, token, config);
       return { sent: true };
     } catch (error: any) {
-      logger.error({ message: 'Error sending invite', obj: { email: caseInsensitiveEmail }, error });
+      // The try block covers the Invite row's write and the mail: a refusal's own words may name
+      // the address, so the error reaches the log through the digest door too.
+      const digests = new RequestDigests();
+      logger.error({
+        message: 'Error sending invite',
+        obj: { invitee: digests.address(caseInsensitiveEmail) },
+        error: digests.redactError(error),
+      });
       return {
         sent: false,
         error: 'Error occurred.',
@@ -218,7 +230,12 @@ export class Signup implements SignupService {
       await this.emailInvite(caseInsensitiveEmail, token, config);
       return { sent: true };
     } catch (error: any) {
-      logger.error({ message: 'Error re-sending invite', obj: { email: caseInsensitiveEmail }, error });
+      const digests = new RequestDigests();
+      logger.error({
+        message: 'Error re-sending invite',
+        obj: { invitee: digests.address(caseInsensitiveEmail) },
+        error: digests.redactError(error),
+      });
       return {
         sent: false,
         error: 'Error occurred.',
@@ -300,6 +317,11 @@ export class Signup implements SignupService {
    * (`devLogin`, which auto-creates missing same-domain test accounts). Not exposed as an RPC:
    * the service surface is the `SignupService` INTERFACE (ServiceRouter walks its declared
    * methods), so extra class methods stay server-internal.
+   *
+   * An address a `MachineAccount` declaration owns is never registered, whatever its row state:
+   * a person's row under it would make the boot sync refuse the declaration (it never takes over
+   * a row it does not own), so the address is refused here in plain words — the declared machine
+   * accounts of this build are the list, nothing else.
    */
   async createAccount(account: {
     name: string;
@@ -310,6 +332,10 @@ export class Signup implements SignupService {
   }): Promise<'created' | 'exists'> {
     const db = getDbAsSystem();
     const email = account.email.toLowerCase();
+    if (getMachineAccounts().some((machineAccount) => machineAccount.email === email)) {
+      throw new Error(`This address can't be registered.`);
+    }
+
     const existingUser = await db.get(tables.User, { email });
     if (existingUser) {
       return 'exists';

package/test/DevLogin.test.ts

@@ -1,5 +1,6 @@
 import { getDbAsSystem } from '@proteinjs/db';
-import { tables } from '@proteinjs/user';
+import { SourceRepository } from '@proteinjs/reflection';
+import { MachineAccount, tables } from '@proteinjs/user';
 import { PasswordHasher } from '../src/authentication/PasswordHasher';
 import { invokeDevLogin } from './devLoginHarness';
 import { UserServerTestEnvironment } from './UserServerTestEnvironment';
@@ -107,6 +108,39 @@ describe('devLogin route', () => {
     expect(await getUserRow('intruder@evil.example')).toBeUndefined();
   });
 
+  it('refuses a ?email a machine-account declaration owns with 400 in plain words — no session, no row', async () => {
+    // The declared machine accounts of the build are the list signup refuses from; the dev door
+    // creates missing accounts through the same function and must answer the way its other
+    // refusals do — in words, not as an unhandled throw.
+    class DeclaredMachineAccount extends MachineAccount {
+      id = 'declared-machine';
+      email = 'declared.machine@test.local';
+      accountName = 'Declared machine';
+      roles = [];
+      secretName = 'declared-machine-secret';
+    }
+    const repo = SourceRepository.get() as unknown as { namedObjectCache: Record<string, unknown[]> };
+    repo.namedObjectCache['@proteinjs/db/SourceRecordLoader'] = [
+      {
+        qualifiedName: '@proteinjs/user-server-test/DeclaredMachineAccount',
+        packageName: '@test/declarer',
+        object: new DeclaredMachineAccount(),
+      },
+    ];
+    try {
+      const outcome = await invokeDevLogin({ email: 'declared.machine@test.local' });
+
+      expect(outcome.status).toBe(400);
+      expect(String(outcome.body)).toContain(`This address can't be registered.`);
+      expect(outcome.loggedInAs).toBeUndefined();
+      expect(outcome.sessionSaved).toBe(false);
+      expect(outcome.redirect).toBeUndefined();
+      expect(await getUserRow('declared.machine@test.local')).toBeUndefined();
+    } finally {
+      delete repo.namedObjectCache['@proteinjs/db/SourceRecordLoader'];
+    }
+  });
+
   it('rejects a malformed same-domain ?email with 400 — no session, no stray account', async () => {
     // The observed shape: an unencoded `+` in the query decodes to a space, so
     // `?email=brent+shareproof-a@...` arrived as `brent shareproof-a@...` and minted a stray

package/test/LogCapture.test.ts

@@ -0,0 +1,29 @@
+import { LogCapture } from './LogCapture';
+
+/**
+ * The log capture's address reader — what `expect(log.addresses).toEqual([])` stands on. It reads
+ * an address in every spelling a log line can carry: bare, inside a name-and-address form, and
+ * URL-encoded (`%40` for the `@`, `%2B` for a `+`) as a logged request path carries it. A digest
+ * or a bare domain is not an address.
+ */
+describe('LogCapture.addresses', () => {
+  it('reads an address bare, in a name-and-address form, and URL-encoded in a logged path', async () => {
+    const log = await LogCapture.during(async () => {
+      console.log('Email sent successfully to ada@example.com');
+      console.info('Invite from "Grace" <grace.hopper@example.org>');
+      console.info('Started /dev/login?email=ada%2Blane%40example.com');
+      console.warn('Sign-in refused', { account: '0123456789abcdef', domain: 'example.com' });
+    });
+
+    expect(log.addresses).toEqual(['ada@example.com', 'grace.hopper@example.org', 'ada%2Blane%40example.com']);
+  });
+
+  it('reads nothing from a log that names people by digest and domain only', async () => {
+    const log = await LogCapture.during(async () => {
+      console.info('Email sent — 1 recipient (example.com)', { recipients: ['0123456789abcdef'] });
+      console.info('Finished /user/login 200');
+    });
+
+    expect(log.addresses).toEqual([]);
+  });
+});

package/test/LogCapture.ts

@@ -9,6 +9,12 @@ import { createHash } from 'crypto';
 export class LogCapture {
   /** How many leading characters of a token count as the token showing up in a log. */
   private static readonly TOKEN_PREFIX_LENGTH = 12;
+  /**
+   * An e-mail address, as the house's log check reads one: bare, or URL-encoded (`%40` for the `@`)
+   * as a logged request path carries it — a check that read only the bare spelling missed the one
+   * place an address is known to reach a log, the request log's URL.
+   */
+  private static readonly ADDRESS_SHAPE = /[A-Za-z0-9._%+-]+(?:@|%40)[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
 
   private constructor(readonly lines: string[]) {}
 
@@ -38,6 +44,16 @@ export class LogCapture {
     return this.lines.join('\n');
   }
 
+  /** Every e-mail address the log holds, in order of appearance — a log names people by their digests, never by address. */
+  get addresses(): string[] {
+    return this.text.match(LogCapture.ADDRESS_SHAPE) ?? [];
+  }
+
+  /** The capture narrowed to the writes that contain `text` — one door's lines, read with the same readers. */
+  linesContaining(text: string): LogCapture {
+    return new LogCapture(this.lines.filter((line) => line.includes(text)));
+  }
+
   /**
    * Fails unless the log is free of `token` in every form that would let a log reader act on it
    * or tie a line to a row: the token, the SHA-256 digest a row stores for it, and the token's

package/test/MachineAccounts.integration.test.ts

@@ -6,6 +6,7 @@ import { SourceRepository } from '@proteinjs/reflection';
 import { ServiceAuth } from '@proteinjs/service/dist/src/ServiceAuth';
 import { MachineAccount, RoleCatalogEntry, User, UserRepo, tables } from '@proteinjs/user';
 import { authenticate } from '../src/authentication/authenticate';
+import { SocketIOSessionWatcher } from '../src/authentication/SocketIOSessionWatcher';
 import { UserStatusTableWatcher } from '../src/authentication/UserStatusTableWatcher';
 import { MachineCredentials } from '../src/services/MachineCredentials';
 import { Roles } from '../src/services/Roles';
@@ -48,10 +49,12 @@ const resetTableWatcherMap = () => {
 
 /**
  * Machine accounts as source records, at the user layer: declare-only on the REAL mixed user
- * table, adopt-in-place by email (id + password survive — the old credential still logs in),
- * removed-from-source auto-deactivation with session kill through the categorical
- * UserStatusTableWatcher, the machine/human ledger split (Roles refuses machine targets),
- * declaration validation, and credential minting (hash-only at rest, plaintext shown once).
+ * table, a declared address held by a row the sync does not own (a person's signup, a hand-made
+ * row) REFUSED — never taken over, its credential and sessions never inherited — and said so on
+ * the admin list and the mint; removed-from-source auto-deactivation with session kill through
+ * the categorical UserStatusTableWatcher, completing at boot before any socket server exists;
+ * the machine/human ledger split (Roles refuses machine targets), declaration validation, and
+ * credential minting (hash-only at rest, plaintext shown once).
  */
 describe('Machine accounts as source records', () => {
   const objectCache = () => (SourceRepository.get() as unknown as SourceRepositoryInternals).objectCache;
@@ -90,8 +93,10 @@ describe('Machine accounts as source records', () => {
       '@proteinjs/user-auth/AuthenticatedUserRepo'
     ] = [new UserRepo()];
     objectCache()['@proteinjs/user/RoleCatalogEntry'] = [new OpsRole()];
-    // Exactly the deactivation watcher observes this run, rebuilt from the seeded cache.
-    objectCache()['@proteinjs/db/TableWatcher'] = [new UserStatusTableWatcher()];
+    // The two session watchers a real server registers, rebuilt from the seeded cache — and no
+    // socket server exists in this process: the shape of a boot's sync (and of a migration Job,
+    // which never starts one), where deactivations delete sessions before the server is up.
+    objectCache()['@proteinjs/db/TableWatcher'] = [new UserStatusTableWatcher(), new SocketIOSessionWatcher()];
     resetTableWatcherMap();
   }, 120000);
 
@@ -139,32 +144,102 @@ describe('Machine accounts as source records', () => {
     expect(humanAfter).toMatchObject({ name: 'A human', roles: ['ops'] });
   });
 
-  it('adopt-in-place by email: the hand-made row keeps its id and password; declared fields revert', async () => {
-    // The deployed-env shape: a hand-made machine row with an env-random id, a provisioned
-    // credential, and runtime-granted roles that have drifted from the declaration.
+  it(`a person's row holding a declared address refuses the declaration: no roles, no machine flag, their password and sessions stand; the list and the mint say so`, async () => {
+    // A person registered the address before the declaration shipped (inviteless signup): their
+    // own row, their own password, a live session — never a machine.
+    const person = await testEnv.createUser({ name: 'A person', email: 'machine-ops@test.local' });
+    await insertSession('person-session', 'machine-ops@test.local');
+    class Sibling extends TestOpsMachineAccount {
+      id = 'machine-sibling';
+      email = 'machine-sibling@test.local';
+      accountName = 'Sibling machine';
+      secretName = 'sibling-secret';
+    }
+
+    // The boot completes and the rest of the declarations land.
+    await boot([new TestOpsMachineAccount(), new Sibling()]);
+    expect(await getDbAsSystem().get(tables.User, { email: 'machine-sibling@test.local' })).toMatchObject({
+      roles: ['ops'],
+      isLoadedFromSource: true,
+      machine: true,
+    });
+
+    // The person's row is untouched: none of the declared roles, not a machine, not source-owned.
+    const row = await machineRow();
+    expect(row.id).toBe(person.id);
+    expect(row).toMatchObject({ name: 'A person', roles: [], emailVerified: true });
+    expect(row.machine).toBeFalsy();
+    expect(row.isLoadedFromSource).toBeFalsy();
+    expect(row.password).toBe(person.password);
+    expect(row.updated.valueOf()).toBe(person.updated.valueOf());
+    expect(await sessionEmails()).toEqual(['machine-ops@test.local']);
+
+    // The admin list names the refusal; the mint refuses in the same words and changes nothing.
+    const view = (await new MachineCredentials().listMachineAccounts()).find(
+      (account) => account.email === 'machine-ops@test.local'
+    );
+    expect(view).toMatchObject({
+      status: 'declaration refused',
+      refusal: 'a person holds this address',
+      hasCredential: false,
+    });
+    await expect(new MachineCredentials().mintCredential('machine-ops@test.local')).rejects.toThrow(
+      /declaration for 'machine-ops@test\.local' was refused at boot: a person holds this address/
+    );
+    expect((await machineRow()).password).toBe(person.password);
+    expect(await sessionEmails()).toEqual(['machine-ops@test.local']);
+
+    // Idempotent: the next boot refuses again and still grants nothing.
+    await boot([new TestOpsMachineAccount(), new Sibling()]);
+    const again = await machineRow();
+    expect(again).toMatchObject({ roles: [] });
+    expect(again.isLoadedFromSource).toBeFalsy();
+  });
+
+  it('a hand-made machine row the sync never owned is refused too — no row is taken over by a declaration any more', async () => {
+    // The pre-declaration provisioning shape: a row made by hand and marked machine, with a
+    // provisioned credential and runtime-granted roles.
     const handMade = await testEnv.createUser({
       name: 'Hand-made bridge',
       email: 'machine-ops@test.local',
       roles: ['ops', 'stale-role'],
     });
+    await getDbAsSystem().update(tables.User, { id: handMade.id, machine: true });
 
     await boot([new TestOpsMachineAccount()]);
 
-    const adopted = await machineRow();
-    expect(adopted.id).toBe(handMade.id);
-    expect(adopted).toMatchObject({
-      name: 'Test ops machine',
-      roles: ['ops'],
-      status: 'active',
-      isLoadedFromSource: true,
-      // Adoption stamps the explicit machine column onto the hand-made row (the deployed-env
-      // provisioning shape — e.g. a hand-provisioned deploy account becomes honest on boot).
+    const row = await machineRow();
+    expect(row).toMatchObject({
+      id: handMade.id,
+      name: 'Hand-made bridge',
+      roles: ['ops', 'stale-role'],
       machine: true,
     });
-    // The credential survived adoption: the account still authenticates with its old password
-    // (createUser stores sha256('test')... it stores the raw string; assert equality instead).
-    expect(adopted.password).toBe(handMade.password);
-    expect((await getDbAsSystem().query(tables.User, { email: 'machine-ops@test.local' })).length).toBe(1);
+    expect(row.isLoadedFromSource).toBeFalsy();
+    expect(row.password).toBe(handMade.password);
+    const [view] = await new MachineCredentials().listMachineAccounts();
+    expect(view).toMatchObject({
+      status: 'declaration refused',
+      refusal: 'a hand-made machine row holds this address',
+      hasCredential: false,
+    });
+  });
+
+  it('withdrawing a declaration while its account holds a live session: the boot completes before any socket server exists — the row deactivated, the session gone', async () => {
+    class Keeper extends TestOpsMachineAccount {
+      id = 'machine-keeper';
+      email = 'machine-keeper@test.local';
+      accountName = 'Keeper machine';
+      secretName = 'keeper-secret';
+    }
+    await boot([new TestOpsMachineAccount(), new Keeper()]);
+    await insertSession('machine-live-session', 'machine-ops@test.local');
+
+    // The declaration is withdrawn; the package still boots with its other declaration.
+    await boot([new Keeper()]);
+
+    expect((await machineRow()).status).toBe('deactivated');
+    expect(await sessionEmails()).toEqual([]);
   });
 
   it('removed from source: deactivated (never deleted), sessions killed, login refused; re-declaring reactivates', async () => {