@proteinjs/user-server 1.7.0 → 1.8.0

package/dist/src/services/AccountDeletion.js

@@ -0,0 +1,426 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccountDeletion = void 0;
+var moment_1 = __importDefault(require("moment"));
+var db_1 = require("@proteinjs/db");
+var logger_1 = require("@proteinjs/logger");
+var user_1 = require("@proteinjs/user");
+var DefaultAdminCredentials_1 = require("../authentication/DefaultAdminCredentials");
+var PasswordHasher_1 = require("../authentication/PasswordHasher");
+var AccountDeletionEmails_1 = require("../emails/AccountDeletionEmails");
+var SetUserStatus_1 = require("./SetUserStatus");
+/** IN-list chunk size for grant enumeration/revocation (the Db.ts IN-chunk precedent). */
+var GRANT_CHUNK_SIZE = 100;
+/**
+ * Deactivation ("gone right away") + cancel-by-login — the synchronous half of archive-then-purge.
+ * The purge walker (flow-server) owns erasure after the grace window; this service owns entering
+ * and leaving the deactivated state, driven by the `account_deletion` manifest row.
+ *
+ * Deliberately NOT deactivation's job: the user's own content_reference/content_seen/pins/
+ * notifications — all scoped to the locked-out user, invisible behind the auth gate, purged by
+ * the walker. Leaving them preserves watermarks and pins exactly for cancel-restore.
+ */
+var AccountDeletion = /** @class */ (function () {
+    function AccountDeletion() {
+        /** Any authenticated user — the call acts only on the session user (re-auth inside). */
+        this.serviceMetadata = {
+            auth: {
+                allUsers: true,
+            },
+        };
+        this.logger = new logger_1.Logger({ name: this.constructor.name });
+    }
+    /**
+     * §3.3 — seven steps, each idempotent; a re-call after a partial failure resumes from the
+     * stored manifest. The caller's sessions die last, so the response is the last authenticated
+     * exchange.
+     */
+    AccountDeletion.prototype.requestDeletion = function (password) {
+        return __awaiter(this, void 0, void 0, function () {
+            var user, db, deletion, error_1;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.reauthenticateSessionUser(password)];
+                    case 1:
+                        user = _a.sent();
+                        db = (0, db_1.getDbAsSystem)();
+                        return [4 /*yield*/, db.get(user_1.tables.AccountDeletion, { userId: user.id })];
+                    case 2:
+                        deletion = _a.sent();
+                        if (!!deletion) return [3 /*break*/, 4];
+                        return [4 /*yield*/, this.createDeletionManifest(db, user)];
+                    case 3:
+                        deletion = _a.sent();
+                        _a.label = 4;
+                    case 4: 
+                    // 4. Revoke. Watchers fire per Db.delete: the grant watcher removes grantee-side cards for
+                    // my content AND my cards for others' content — the synchronous "gone right away" contract.
+                    // Already-deleted ids no-op (resume-safe).
+                    return [4 /*yield*/, this.deleteGrantsById(db, deletion.manifestGrants.map(function (grant) { return grant.id; }))];
+                    case 5:
+                        // 4. Revoke. Watchers fire per Db.delete: the grant watcher removes grantee-side cards for
+                        // my content AND my cards for others' content — the synchronous "gone right away" contract.
+                        // Already-deleted ids no-op (resume-safe).
+                        _a.sent();
+                        // 5. Flip the user row through the ONE standing write path (audited), then stamp the
+                        // deletion columns. deleteRequestedAt = the manifest row's own creation time, so a resumed
+                        // call re-writes identical values.
+                        return [4 /*yield*/, new SetUserStatus_1.SetUserStatus().setUserStatus(user.id, 'deactivated')];
+                    case 6:
+                        // 5. Flip the user row through the ONE standing write path (audited), then stamp the
+                        // deletion columns. deleteRequestedAt = the manifest row's own creation time, so a resumed
+                        // call re-writes identical values.
+                        _a.sent();
+                        return [4 /*yield*/, db.update(user_1.tables.User, {
+                                id: user.id,
+                                deleteRequestedAt: deletion.created,
+                                purgeAfter: deletion.purgeAfter,
+                            })];
+                    case 7:
+                        _a.sent();
+                        _a.label = 8;
+                    case 8:
+                        _a.trys.push([8, 10, , 11]);
+                        return [4 /*yield*/, new AccountDeletionEmails_1.AccountDeletionEmails().sendDeletionRequested(user.email, deletion.purgeAfter)];
+                    case 9:
+                        _a.sent();
+                        return [3 /*break*/, 11];
+                    case 10:
+                        error_1 = _a.sent();
+                        this.logger.error({
+                            message: 'Failed to send the deletion-requested email',
+                            obj: { userId: user.id },
+                            error: error_1,
+                        });
+                        return [3 /*break*/, 11];
+                    case 11: 
+                    // 6. Kill sessions last — SocketIOSessionWatcher disconnects every live socket, including
+                    // the caller's own.
+                    return [4 /*yield*/, db.delete(user_1.tables.Session, { userEmail: user.email })];
+                    case 12:
+                        // 6. Kill sessions last — SocketIOSessionWatcher disconnects every live socket, including
+                        // the caller's own.
+                        _a.sent();
+                        // 7. The UI's confirmation copy renders from this.
+                        return [2 /*return*/, { purgeAfter: deletion.purgeAfter }];
+                }
+            });
+        });
+    };
+    /**
+     * §3.4 — logging back in IS the cancel (called by the login route after `authenticate`
+     * passes, BEFORE `request.login`). Not RPC-reachable: it is deliberately absent from the
+     * AccountDeletionService interface, so the service router never exposes it.
+     */
+    AccountDeletion.prototype.cancelPendingDeletion = function (email) {
+        var _a, _b;
+        return __awaiter(this, void 0, void 0, function () {
+            var db, deletion, claimSeq, claimQb, claimed, current;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0:
+                        db = (0, db_1.getDbAsSystem)();
+                        return [4 /*yield*/, db.get(user_1.tables.AccountDeletion, { userEmail: email.toLowerCase() })];
+                    case 1:
+                        deletion = _c.sent();
+                        if (!deletion) {
+                            return [2 /*return*/, 'not-pending'];
+                        }
+                        claimSeq = ((_a = deletion.leaseSeq) !== null && _a !== void 0 ? _a : 0) + 1;
+                        claimQb = new db_1.QueryBuilderFactory()
+                            .createQueryBuilder(user_1.tables.AccountDeletion)
+                            .condition({ field: 'userId', operator: '=', value: deletion.userId })
+                            .condition({ field: 'phase', operator: 'IN', value: ['grace', 'restoring'] })
+                            .condition({ field: 'leaseSeq', operator: '=', value: (_b = deletion.leaseSeq) !== null && _b !== void 0 ? _b : 0 });
+                        return [4 /*yield*/, db.update(user_1.tables.AccountDeletion, { phase: 'restoring', leaseSeq: claimSeq }, claimQb)];
+                    case 2:
+                        claimed = _c.sent();
+                        if (!(claimed !== 1)) return [3 /*break*/, 4];
+                        return [4 /*yield*/, db.get(user_1.tables.AccountDeletion, { userId: deletion.userId })];
+                    case 3:
+                        current = _c.sent();
+                        if (!current) {
+                            return [2 /*return*/, 'not-pending']; // a concurrent cancel finished the restore — normal login proceeds
+                        }
+                        if (current.phase === 'purging' || current.phase === 'purged') {
+                            return [2 /*return*/, 'purging']; // the walker won — no longer restorable
+                        }
+                        throw new Error("A concurrent restore is in flight for account ".concat(deletion.userId, " \u2014 retry login."));
+                    case 4: 
+                    // Re-insert manifest grants idempotently (fresh ids). The grant watcher's afterInsert
+                    // rebuilds content_reference cards through the normal path — grantees' cards for my content
+                    // AND my cards for inbound shares — synchronously, before the login response.
+                    return [4 /*yield*/, this.restoreManifestGrants(db, deletion.manifestGrants)];
+                    case 5:
+                        // Re-insert manifest grants idempotently (fresh ids). The grant watcher's afterInsert
+                        // rebuilds content_reference cards through the normal path — grantees' cards for my content
+                        // AND my cards for inbound shares — synchronously, before the login response.
+                        _c.sent();
+                        // User row back to standing through the audited path; deletion stamps nulled.
+                        return [4 /*yield*/, new SetUserStatus_1.SetUserStatus().setUserStatus(deletion.userId, 'active')];
+                    case 6:
+                        // User row back to standing through the audited path; deletion stamps nulled.
+                        _c.sent();
+                        return [4 /*yield*/, db.update(user_1.tables.User, { id: deletion.userId, deleteRequestedAt: null, purgeAfter: null })];
+                    case 7:
+                        _c.sent();
+                        return [4 /*yield*/, db.delete(user_1.tables.AccountDeletion, { id: deletion.id })];
+                    case 8:
+                        _c.sent();
+                        return [2 /*return*/, 'restored'];
+                }
+            });
+        });
+    };
+    /** Verify the caller's password against their own account row; throws with nothing written. */
+    AccountDeletion.prototype.reauthenticateSessionUser = function (password) {
+        return __awaiter(this, void 0, void 0, function () {
+            var sessionUser, adminCredentials, user, _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        sessionUser = new user_1.UserRepo().getUser();
+                        adminCredentials = DefaultAdminCredentials_1.DefaultAdminCredentials.getCredentials();
+                        if (adminCredentials && sessionUser.email === adminCredentials.username) {
+                            throw new Error('The default admin session has no account row to delete.');
+                        }
+                        if (!sessionUser.id || !sessionUser.email) {
+                            throw new Error('Account deletion requires a signed-in account.');
+                        }
+                        return [4 /*yield*/, (0, db_1.getDbAsSystem)().get(user_1.tables.User, { email: sessionUser.email.toLowerCase() })];
+                    case 1:
+                        user = _b.sent();
+                        _a = !user;
+                        if (_a) return [3 /*break*/, 3];
+                        return [4 /*yield*/, new PasswordHasher_1.PasswordHasher().verify(user.password, password)];
+                    case 2:
+                        _a = !(_b.sent());
+                        _b.label = 3;
+                    case 3:
+                        if (_a) {
+                            throw new Error('Password incorrect');
+                        }
+                        return [2 /*return*/, user];
+                }
+            });
+        });
+    };
+    /**
+     * §3.3 step 3: enumerate grants in both directions and persist the manifest row — phase
+     * 'grace', full grant set, owned-resource snapshot — before any mutation.
+     */
+    AccountDeletion.prototype.createDeletionManifest = function (db, user) {
+        return __awaiter(this, void 0, void 0, function () {
+            var qbf, ownerQb, ownerGrants, ownedResourceIds, inboundQb, inbound, outbound, _i, _a, idsChunk, outboundQb, grants, graceDays;
+            var _this = this;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        qbf = new db_1.QueryBuilderFactory();
+                        ownerQb = qbf
+                            .createQueryBuilder(user_1.tables.AccessGrant)
+                            .condition({ field: 'principal', operator: '=', value: user.id })
+                            .condition({ field: 'accessLevel', operator: '=', value: 'owner' });
+                        return [4 /*yield*/, db.query(user_1.tables.AccessGrant, ownerQb)];
+                    case 1:
+                        ownerGrants = _b.sent();
+                        ownedResourceIds = Array.from(new Set(ownerGrants.map(function (grant) { return _this.referenceId(grant.resource, grant.id); })));
+                        inboundQb = qbf
+                            .createQueryBuilder(user_1.tables.AccessGrant)
+                            .condition({ field: 'principal', operator: '=', value: user.id })
+                            .condition({ field: 'accessLevel', operator: 'IN', value: ['read', 'write', 'admin'] });
+                        return [4 /*yield*/, db.query(user_1.tables.AccessGrant, inboundQb)];
+                    case 2:
+                        inbound = _b.sent();
+                        outbound = [];
+                        _i = 0, _a = this.chunk(ownedResourceIds, GRANT_CHUNK_SIZE);
+                        _b.label = 3;
+                    case 3:
+                        if (!(_i < _a.length)) return [3 /*break*/, 6];
+                        idsChunk = _a[_i];
+                        outboundQb = qbf
+                            .createQueryBuilder(user_1.tables.AccessGrant)
+                            .condition({ field: 'resource', operator: 'IN', value: idsChunk });
+                        return [4 /*yield*/, db.query(user_1.tables.AccessGrant, outboundQb)];
+                    case 4:
+                        grants = _b.sent();
+                        outbound.push.apply(outbound, grants.filter(function (grant) { return _this.referenceId(grant.principal, grant.id) !== user.id; }));
+                        _b.label = 5;
+                    case 5:
+                        _i++;
+                        return [3 /*break*/, 3];
+                    case 6:
+                        graceDays = this.gracePeriodDays();
+                        return [4 /*yield*/, db.insert(user_1.tables.AccountDeletion, {
+                                userId: user.id,
+                                userEmail: user.email,
+                                phase: 'grace',
+                                purgeAfter: (0, moment_1.default)().add(Math.round(graceDays * 24 * 60 * 60 * 1000), 'milliseconds'),
+                                manifestGrants: __spreadArray(__spreadArray([], inbound, true), outbound, true).map(function (grant) { return _this.toManifestGrant(grant); }),
+                                ownedResourceIds: ownedResourceIds,
+                                leaseSeq: 0,
+                            })];
+                    case 7: return [2 /*return*/, _b.sent()];
+                }
+            });
+        });
+    };
+    /** Revoke grants by manifest id, in chunks of 100. Already-deleted ids no-op. */
+    AccountDeletion.prototype.deleteGrantsById = function (db, grantIds) {
+        return __awaiter(this, void 0, void 0, function () {
+            var _i, _a, idsChunk, qb;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        _i = 0, _a = this.chunk(grantIds, GRANT_CHUNK_SIZE);
+                        _b.label = 1;
+                    case 1:
+                        if (!(_i < _a.length)) return [3 /*break*/, 4];
+                        idsChunk = _a[_i];
+                        qb = new db_1.QueryBuilderFactory()
+                            .createQueryBuilder(user_1.tables.AccessGrant)
+                            .condition({ field: 'id', operator: 'IN', value: idsChunk });
+                        return [4 /*yield*/, db.delete(user_1.tables.AccessGrant, qb)];
+                    case 2:
+                        _b.sent();
+                        _b.label = 3;
+                    case 3:
+                        _i++;
+                        return [3 /*break*/, 1];
+                    case 4: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /** §3.4 step 3: per entry, get by (principal, resource, accessLevel) → insert if missing. */
+    AccountDeletion.prototype.restoreManifestGrants = function (db, manifestGrants) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function () {
+            var _i, manifestGrants_1, grant, existingQb, existing;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        _i = 0, manifestGrants_1 = manifestGrants;
+                        _b.label = 1;
+                    case 1:
+                        if (!(_i < manifestGrants_1.length)) return [3 /*break*/, 5];
+                        grant = manifestGrants_1[_i];
+                        existingQb = new db_1.QueryBuilderFactory()
+                            .createQueryBuilder(user_1.tables.AccessGrant)
+                            .condition({ field: 'principal', operator: '=', value: grant.principal })
+                            .condition({ field: 'resource', operator: '=', value: grant.resource })
+                            .condition({ field: 'accessLevel', operator: '=', value: grant.accessLevel });
+                        return [4 /*yield*/, db.query(user_1.tables.AccessGrant, existingQb)];
+                    case 2:
+                        existing = _b.sent();
+                        if (existing.length > 0) {
+                            return [3 /*break*/, 4];
+                        }
+                        return [4 /*yield*/, db.insert(user_1.tables.AccessGrant, {
+                                principal: new db_1.Reference(user_1.tables.User.name, grant.principal),
+                                // Serialization fails loudly on a missing table name — a table-less grant is corrupt.
+                                resource: new db_1.Reference((_a = grant.resourceTable) !== null && _a !== void 0 ? _a : '', grant.resource),
+                                resourceTable: grant.resourceTable,
+                                accessLevel: grant.accessLevel,
+                            })];
+                    case 3:
+                        _b.sent();
+                        _b.label = 4;
+                    case 4:
+                        _i++;
+                        return [3 /*break*/, 1];
+                    case 5: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    AccountDeletion.prototype.toManifestGrant = function (grant) {
+        return {
+            id: grant.id,
+            principal: this.referenceId(grant.principal, grant.id),
+            resource: this.referenceId(grant.resource, grant.id),
+            resourceTable: grant.resourceTable,
+            accessLevel: grant.accessLevel,
+        };
+    };
+    /** A grant reference's id, loudly — the manifest must never be built from corrupt grants. */
+    AccountDeletion.prototype.referenceId = function (reference, grantId) {
+        if (!(reference === null || reference === void 0 ? void 0 : reference._id)) {
+            throw new Error("access_grant ".concat(grantId, " has a reference with no id \u2014 refusing to build a deletion manifest."));
+        }
+        return reference._id;
+    };
+    /**
+     * Grace window in days (ACCOUNT_DELETION_GRACE_DAYS, default 30). Fractional values are
+     * honored so dev verification can shorten the window to minutes.
+     */
+    AccountDeletion.prototype.gracePeriodDays = function () {
+        var raw = process.env.ACCOUNT_DELETION_GRACE_DAYS;
+        if (raw === undefined || raw === '') {
+            return 30;
+        }
+        var days = Number(raw);
+        if (!Number.isFinite(days) || days < 0) {
+            throw new Error("ACCOUNT_DELETION_GRACE_DAYS must be a non-negative number of days, got '".concat(raw, "'"));
+        }
+        return days;
+    };
+    AccountDeletion.prototype.chunk = function (items, size) {
+        var chunks = [];
+        for (var i = 0; i < items.length; i += size) {
+            chunks.push(items.slice(i, i + size));
+        }
+        return chunks;
+    };
+    return AccountDeletion;
+}());
+exports.AccountDeletion = AccountDeletion;
+//# sourceMappingURL=AccountDeletion.js.map

package/dist/src/services/AccountDeletion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountDeletion.js","sourceRoot":"","sources":["../../../src/services/AccountDeletion.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kDAAwC;AACxC,oCAAkF;AAClF,4CAA2C;AAE3C,wCAQyB;AACzB,qFAAoF;AACpF,mEAAkE;AAClE,yEAAwE;AACxE,iDAAgD;AAEhD,0FAA0F;AAC1F,IAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;;;;;;GAQG;AACH;IAAA;QACE,wFAAwF;QACjF,oBAAe,GAA+B;YACnD,IAAI,EAAE;gBACJ,QAAQ,EAAE,IAAI;aACf;SACF,CAAC;QACM,WAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IA6P/D,CAAC;IA3PC;;;;OAIG;IACG,yCAAe,GAArB,UAAsB,QAAgB;;;;;4BAEvB,qBAAM,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,EAAA;;wBAArD,IAAI,GAAG,SAA8C;wBACrD,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBAKZ,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAAA;;wBAApE,QAAQ,GAAG,SAAyD;6BAGpE,CAAC,QAAQ,EAAT,wBAAS;wBACA,qBAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAA;;wBAAtD,QAAQ,GAAG,SAA2C,CAAC;;;oBAGzD,2FAA2F;oBAC3F,4FAA4F;oBAC5F,2CAA2C;oBAC3C,qBAAM,IAAI,CAAC,gBAAgB,CACzB,EAAE,EACF,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,UAAC,KAAK,IAAK,OAAA,KAAK,CAAC,EAAE,EAAR,CAAQ,CAAC,CACjD,EAAA;;wBAND,2FAA2F;wBAC3F,4FAA4F;wBAC5F,2CAA2C;wBAC3C,SAGC,CAAC;wBAEF,qFAAqF;wBACrF,2FAA2F;wBAC3F,mCAAmC;wBACnC,qBAAM,IAAI,6BAAa,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC,EAAA;;wBAH/D,qFAAqF;wBACrF,2FAA2F;wBAC3F,mCAAmC;wBACnC,SAA+D,CAAC;wBAChE,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE;gCAC3B,EAAE,EAAE,IAAI,CAAC,EAAE;gCACX,iBAAiB,EAAE,QAAQ,CAAC,OAAO;gCACnC,UAAU,EAAE,QAAQ,CAAC,UAAU;6BAChC,CAAC,EAAA;;wBAJF,SAIE,CAAC;;;;wBAMD,qBAAM,IAAI,6CAAqB,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAA;;wBAAxF,SAAwF,CAAC;;;;wBAEzF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;4BAChB,OAAO,EAAE,6CAA6C;4BACtD,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;4BACxB,KAAK,SAAA;yBACN,CAAC,CAAC;;;oBAGL,0FAA0F;oBAC1F,oBAAoB;oBACpB,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,EAAA;;wBAF1D,0FAA0F;wBAC1F,oBAAoB;wBACpB,SAA0D,CAAC;wBAE3D,mDAAmD;wBACnD,sBAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,EAAC;;;;KAC5C;IAED;;;;OAIG;IACG,+CAAqB,GAA3B,UAA4B,KAAa;;;;;;;wBACjC,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACV,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;wBAAnF,QAAQ,GAAG,SAAwE;wBACzF,IAAI,CAAC,QAAQ,EAAE;4BACb,sBAAO,aAAa,EAAC;yBACtB;wBAMK,QAAQ,GAAG,CAAC,MAAA,QAAQ,CAAC,QAAQ,mCAAI,CAAC,CAAC,GAAG,CAAC,CAAC;wBACxC,OAAO,GAAG,IAAI,wBAAmB,EAAE;6BACtC,kBAAkB,CAAC,aAAM,CAAC,eAAe,CAAC;6BAC1C,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;6BACrE,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;6BAC5E,SAAS,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,MAAA,QAAQ,CAAC,QAAQ,mCAAI,CAAC,EAAE,CAAC,CAAC;wBAClE,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,OAAO,CAAC,EAAA;;wBAAtG,OAAO,GAAG,SAA4F;6BACxG,CAAA,OAAO,KAAK,CAAC,CAAA,EAAb,wBAAa;wBACC,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAA;;wBAA3E,OAAO,GAAG,SAAiE;wBACjF,IAAI,CAAC,OAAO,EAAE;4BACZ,sBAAO,aAAa,EAAC,CAAC,mEAAmE;yBAC1F;wBACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE;4BAC7D,sBAAO,SAAS,EAAC,CAAC,wCAAwC;yBAC3D;wBACD,MAAM,IAAI,KAAK,CAAC,wDAAiD,QAAQ,CAAC,MAAM,yBAAiB,CAAC,CAAC;;oBAGrG,sFAAsF;oBACtF,4FAA4F;oBAC5F,8EAA8E;oBAC9E,qBAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAA;;wBAH7D,sFAAsF;wBACtF,4FAA4F;wBAC5F,8EAA8E;wBAC9E,SAA6D,CAAC;wBAE9D,8EAA8E;wBAC9E,qBAAM,IAAI,6BAAa,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAA;;wBADlE,8EAA8E;wBAC9E,SAAkE,CAAC;wBACnE,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAA;;wBAAhG,SAAgG,CAAC;wBAEjG,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAA;;wBAA5D,SAA4D,CAAC;wBAC7D,sBAAO,UAAU,EAAC;;;;KACnB;IAED,+FAA+F;IACjF,mDAAyB,GAAvC,UAAwC,QAAgB;;;;;;wBAChD,WAAW,GAAG,IAAI,eAAQ,EAAE,CAAC,OAAO,EAAE,CAAC;wBACvC,gBAAgB,GAAG,iDAAuB,CAAC,cAAc,EAAE,CAAC;wBAClE,IAAI,gBAAgB,IAAI,WAAW,CAAC,KAAK,KAAK,gBAAgB,CAAC,QAAQ,EAAE;4BACvE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;yBAC5E;wBACD,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE;4BACzC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;yBACnE;wBAIY,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;wBAAzF,IAAI,GAAG,SAAkF;wBAC3F,KAAA,CAAC,IAAI,CAAA;gCAAL,wBAAK;wBAAM,qBAAM,IAAI,+BAAc,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAA;;wBAA5D,KAAA,CAAC,CAAC,SAA0D,CAAC,CAAA;;;wBAA1E,QAA4E;4BAC1E,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;yBACvC;wBAED,sBAAO,IAAI,EAAC;;;;KACb;IAED;;;OAGG;IACW,gDAAsB,GAApC,UAAqC,EAAM,EAAE,IAAU;;;;;;;wBAC/C,GAAG,GAAG,IAAI,wBAAmB,EAAE,CAAC;wBAKhC,OAAO,GAAG,GAAG;6BAChB,kBAAkB,CAAC,aAAM,CAAC,WAAW,CAAC;6BACtC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;6BAChE,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;wBAClD,qBAAM,EAAE,CAAC,KAAK,CAAC,aAAM,CAAC,WAAW,EAAE,OAAO,CAAC,EAAA;;wBAAzD,WAAW,GAAG,SAA2C;wBACzD,gBAAgB,GAAG,KAAK,CAAC,IAAI,CACjC,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,UAAC,KAAK,IAAK,OAAA,KAAI,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,EAA1C,CAA0C,CAAC,CAAC,CAChF,CAAC;wBAGI,SAAS,GAAG,GAAG;6BAClB,kBAAkB,CAAC,aAAM,CAAC,WAAW,CAAC;6BACtC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;6BAChE,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;wBAC1E,qBAAM,EAAE,CAAC,KAAK,CAAC,aAAM,CAAC,WAAW,EAAE,SAAS,CAAC,EAAA;;wBAAvD,OAAO,GAAG,SAA6C;wBAIvD,QAAQ,GAAkB,EAAE,CAAC;8BACkC,EAA9C,KAAA,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;;;6BAA9C,CAAA,cAA8C,CAAA;wBAA1D,QAAQ;wBACX,UAAU,GAAG,GAAG;6BACnB,kBAAkB,CAAC,aAAM,CAAC,WAAW,CAAC;6BACtC,SAAS,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;wBACtD,qBAAM,EAAE,CAAC,KAAK,CAAC,aAAM,CAAC,WAAW,EAAE,UAAU,CAAC,EAAA;;wBAAvD,MAAM,GAAG,SAA8C;wBAC7D,QAAQ,CAAC,IAAI,OAAb,QAAQ,EAAS,MAAM,CAAC,MAAM,CAAC,UAAC,KAAK,IAAK,OAAA,KAAI,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,EAAE,EAAvD,CAAuD,CAAC,EAAE;;;wBAL/E,IAA8C,CAAA;;;wBAQ/D,SAAS,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;wBAClC,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,eAAe,EAAE;gCAC7C,MAAM,EAAE,IAAI,CAAC,EAAE;gCACf,SAAS,EAAE,IAAI,CAAC,KAAK;gCACrB,KAAK,EAAE,OAAO;gCACd,UAAU,EAAE,IAAA,gBAAM,GAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,cAAc,CAAC;gCACrF,cAAc,EAAE,gCAAI,OAAO,SAAK,QAAQ,QAAE,GAAG,CAAC,UAAC,KAAK,IAAK,OAAA,KAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAA3B,CAA2B,CAAC;gCACrF,gBAAgB,kBAAA;gCAChB,QAAQ,EAAE,CAAC;6BACZ,CAAC,EAAA;4BARF,sBAAO,SAQL,EAAC;;;;KACJ;IAED,iFAAiF;IACnE,0CAAgB,GAA9B,UAA+B,EAAM,EAAE,QAAkB;;;;;;8BACM,EAAtC,KAAA,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,gBAAgB,CAAC;;;6BAAtC,CAAA,cAAsC,CAAA;wBAAlD,QAAQ;wBACX,EAAE,GAAG,IAAI,wBAAmB,EAAE;6BACjC,kBAAkB,CAAC,aAAM,CAAC,WAAW,CAAC;6BACtC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;wBAC/D,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;wBAAvC,SAAuC,CAAC;;;wBAJnB,IAAsC,CAAA;;;;;;KAM9D;IAED,6FAA6F;IAC/E,+CAAqB,GAAnC,UAAoC,EAAM,EAAE,cAA+B;;;;;;;8BACvC,EAAd,iCAAc;;;6BAAd,CAAA,4BAAc,CAAA;wBAAvB,KAAK;wBACR,UAAU,GAAG,IAAI,wBAAmB,EAAE;6BACzC,kBAAkB,CAAC,aAAM,CAAC,WAAW,CAAC;6BACtC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;6BACxE,SAAS,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;6BACtE,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;wBAC/D,qBAAM,EAAE,CAAC,KAAK,CAAC,aAAM,CAAC,WAAW,EAAE,UAAU,CAAC,EAAA;;wBAAzD,QAAQ,GAAG,SAA8C;wBAC/D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;4BACvB,wBAAS;yBACV;wBAED,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,WAAW,EAAE;gCAClC,SAAS,EAAE,IAAI,cAAS,CAAC,aAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC;gCAC3D,sFAAsF;gCACtF,QAAQ,EAAE,IAAI,cAAS,CAAC,MAAA,KAAK,CAAC,aAAa,mCAAI,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC;gCAClE,aAAa,EAAE,KAAK,CAAC,aAAa;gCAClC,WAAW,EAAE,KAAK,CAAC,WAAW;6BAC/B,CAAC,EAAA;;wBANF,SAME,CAAC;;;wBAjBe,IAAc,CAAA;;;;;;KAmBnC;IAEO,yCAAe,GAAvB,UAAwB,KAAkB;QACxC,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;YACtD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;YACpD,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC;IACJ,CAAC;IAED,6FAA6F;IACrF,qCAAW,GAAnB,UAAoB,SAAyB,EAAE,OAAe;QAC5D,IAAI,CAAC,CAAA,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,GAAG,CAAA,EAAE;YACnB,MAAM,IAAI,KAAK,CAAC,uBAAgB,OAAO,8EAAsE,CAAC,CAAC;SAChH;QACD,OAAO,SAAS,CAAC,GAAG,CAAC;IACvB,CAAC;IAED;;;OAGG;IACK,yCAAe,GAAvB;QACE,IAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;QACpD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE;YACnC,OAAO,EAAE,CAAC;SACX;QAED,IAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE;YACtC,MAAM,IAAI,KAAK,CAAC,kFAA2E,GAAG,MAAG,CAAC,CAAC;SACpG;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,+BAAK,GAAb,UAAiB,KAAU,EAAE,IAAY;QACvC,IAAM,MAAM,GAAU,EAAE,CAAC;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,IAAI,EAAE;YAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;SACvC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACH,sBAAC;AAAD,CAAC,AApQD,IAoQC;AApQY,0CAAe"}

package/dist/src/services/MachineCredentials.d.ts

@@ -0,0 +1,21 @@
+import { MachineAccountView, MachineCredentialsService, MintedMachineCredential } from '@proteinjs/user';
+import { Service } from '@proteinjs/service';
+/**
+ * Credential minting for code-declared machine accounts — the ONLY manual step in a machine
+ * account's life (identity and grants come from the `MachineAccount` declaration at boot).
+ *
+ * Generates a strong random password (never human-chosen), stores its hash on the account row
+ * via PasswordHasher's machine mode — sha256, deliberately not the argon2id human KDF: a
+ * generated 256-bit secret gains nothing from key stretching, and the bridge logs in fresh per
+ * poll, so verifies stay cheap. (The plaintext is never persisted or logged.) Kills the
+ * account's existing sessions (the old
+ * credential dies with them), and returns the plaintext ONCE for pasting into the declaration's
+ * Secret Manager secret. The same call rotates. Machine rows only (`is_loaded_from_source`);
+ * human credentials go through the password-reset flow.
+ */
+export declare class MachineCredentials implements MachineCredentialsService {
+    serviceMetadata: Service['serviceMetadata'];
+    listMachineAccounts(): Promise<MachineAccountView[]>;
+    mintCredential(email: string): Promise<MintedMachineCredential>;
+}
+//# sourceMappingURL=MachineCredentials.d.ts.map

package/dist/src/services/MachineCredentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MachineCredentials.d.ts","sourceRoot":"","sources":["../../../src/services/MachineCredentials.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EAIxB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAG7C;;;;;;;;;;;;GAYG;AACH,qBAAa,kBAAmB,YAAW,yBAAyB;IAC3D,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAIhD;IAEI,mBAAmB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAmBpD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;CAwCtE"}

package/dist/src/services/MachineCredentials.js

@@ -0,0 +1,164 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MachineCredentials = void 0;
+var crypto_1 = require("crypto");
+var db_1 = require("@proteinjs/db");
+var user_1 = require("@proteinjs/user");
+var logger_1 = require("@proteinjs/logger");
+var PasswordHasher_1 = require("../authentication/PasswordHasher");
+/**
+ * Credential minting for code-declared machine accounts — the ONLY manual step in a machine
+ * account's life (identity and grants come from the `MachineAccount` declaration at boot).
+ *
+ * Generates a strong random password (never human-chosen), stores its hash on the account row
+ * via PasswordHasher's machine mode — sha256, deliberately not the argon2id human KDF: a
+ * generated 256-bit secret gains nothing from key stretching, and the bridge logs in fresh per
+ * poll, so verifies stay cheap. (The plaintext is never persisted or logged.) Kills the
+ * account's existing sessions (the old
+ * credential dies with them), and returns the plaintext ONCE for pasting into the declaration's
+ * Secret Manager secret. The same call rotates. Machine rows only (`is_loaded_from_source`);
+ * human credentials go through the password-reset flow.
+ */
+var MachineCredentials = /** @class */ (function () {
+    function MachineCredentials() {
+        this.serviceMetadata = {
+            auth: {
+                permission: user_1.USER_PERMISSIONS.users,
+            },
+        };
+    }
+    MachineCredentials.prototype.listMachineAccounts = function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var db, views, _i, _a, declaration, row, booted;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        db = (0, db_1.getDbAsSystem)();
+                        views = [];
+                        _i = 0, _a = (0, user_1.getMachineAccounts)();
+                        _b.label = 1;
+                    case 1:
+                        if (!(_i < _a.length)) return [3 /*break*/, 4];
+                        declaration = _a[_i];
+                        return [4 /*yield*/, db.get(user_1.tables.User, { email: declaration.email })];
+                    case 2:
+                        row = _b.sent();
+                        booted = !!row && row.isLoadedFromSource === true;
+                        views.push({
+                            email: declaration.email,
+                            accountName: declaration.accountName,
+                            roles: __spreadArray([], declaration.roles, true),
+                            secretName: declaration.secretName,
+                            status: booted ? (row.status === 'deactivated' ? 'deactivated' : 'active') : 'pending first boot',
+                            hasCredential: booted && !!row.password,
+                        });
+                        _b.label = 3;
+                    case 3:
+                        _i++;
+                        return [3 /*break*/, 1];
+                    case 4: return [2 /*return*/, views];
+                }
+            });
+        });
+    };
+    MachineCredentials.prototype.mintCredential = function (email) {
+        return __awaiter(this, void 0, void 0, function () {
+            var logger, normalizedEmail, declaration, db, user, password, _a, _b, _c;
+            var _d;
+            return __generator(this, function (_e) {
+                switch (_e.label) {
+                    case 0:
+                        logger = new logger_1.Logger({ name: 'MachineCredentials.mintCredential' });
+                        normalizedEmail = email === null || email === void 0 ? void 0 : email.toLowerCase();
+                        declaration = (0, user_1.getMachineAccounts)().find(function (machineAccount) { return machineAccount.email === normalizedEmail; });
+                        if (!declaration) {
+                            throw new Error("No machine account is declared for '".concat(email, "'. Credentials can only be minted for ") +
+                                "code-declared machine accounts (MachineAccount declarations).");
+                        }
+                        db = (0, db_1.getDbAsSystem)();
+                        return [4 /*yield*/, db.get(user_1.tables.User, { email: normalizedEmail })];
+                    case 1:
+                        user = _e.sent();
+                        if (!user || user.isLoadedFromSource !== true) {
+                            throw new Error("The machine account row for '".concat(normalizedEmail, "' has not been loaded from source yet \u2014 ") +
+                                "the boot sync creates (or adopts) it. Boot the server with the declaration, then mint.");
+                        }
+                        password = (0, crypto_1.randomBytes)(32).toString('hex');
+                        _b = (_a = db).update;
+                        _c = [user_1.tables.User];
+                        _d = { id: user.id };
+                        return [4 /*yield*/, new PasswordHasher_1.PasswordHasher().hash(password, 'machine')];
+                    case 2: return [4 /*yield*/, _b.apply(_a, _c.concat([(_d.password = _e.sent(), _d)]))];
+                    case 3:
+                        _e.sent();
+                        // Rotation kills the old credential's sessions immediately (the bridge logs in fresh per
+                        // poll, so this is cheap for it — the mechanism is the categorical one).
+                        return [4 /*yield*/, db.delete(user_1.tables.Session, { userEmail: normalizedEmail })];
+                    case 4:
+                        // Rotation kills the old credential's sessions immediately (the bridge logs in fresh per
+                        // poll, so this is cheap for it — the mechanism is the categorical one).
+                        _e.sent();
+                        logger.info({
+                            message: "Minted machine credential",
+                            obj: { email: normalizedEmail, secretName: declaration.secretName },
+                        });
+                        return [2 /*return*/, {
+                                email: normalizedEmail,
+                                password: password,
+                                secretName: declaration.secretName,
+                                note: "Shown once. Paste this password into the '".concat(declaration.secretName, "' Secret Manager ") +
+                                    "secret, then restart the service that reads it \u2014 the previous credential is already invalid.",
+                            }];
+                }
+            });
+        });
+    };
+    return MachineCredentials;
+}());
+exports.MachineCredentials = MachineCredentials;
+//# sourceMappingURL=MachineCredentials.js.map

package/dist/src/services/MachineCredentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MachineCredentials.js","sourceRoot":"","sources":["../../../src/services/MachineCredentials.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iCAAqC;AACrC,oCAA8C;AAC9C,wCAOyB;AACzB,4CAA2C;AAE3C,mEAAkE;AAElE;;;;;;;;;;;;GAYG;AACH;IAAA;QACS,oBAAe,GAA+B;YACnD,IAAI,EAAE;gBACJ,UAAU,EAAE,uBAAgB,CAAC,KAAK;aACnC;SACF,CAAC;IA6DJ,CAAC;IA3DO,gDAAmB,GAAzB;;;;;;wBACQ,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACrB,KAAK,GAAyB,EAAE,CAAC;8BACO,EAApB,SAAA,yBAAkB,GAAE;;;6BAApB,CAAA,cAAoB,CAAA;wBAAnC,WAAW;wBACR,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,EAAA;;wBAA7D,GAAG,GAAG,SAAuD;wBAC7D,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,KAAK,IAAI,CAAC;wBACxD,KAAK,CAAC,IAAI,CAAC;4BACT,KAAK,EAAE,WAAW,CAAC,KAAK;4BACxB,WAAW,EAAE,WAAW,CAAC,WAAW;4BACpC,KAAK,oBAAM,WAAW,CAAC,KAAK,OAAC;4BAC7B,UAAU,EAAE,WAAW,CAAC,UAAU;4BAClC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,oBAAoB;4BACjG,aAAa,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ;yBACxC,CAAC,CAAC;;;wBAVqB,IAAoB,CAAA;;4BAa9C,sBAAO,KAAK,EAAC;;;;KACd;IAEK,2CAAc,GAApB,UAAqB,KAAa;;;;;;;wBAC1B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,CAAC,CAAC;wBACnE,eAAe,GAAG,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,WAAW,EAAE,CAAC;wBACvC,WAAW,GAAG,IAAA,yBAAkB,GAAE,CAAC,IAAI,CAAC,UAAC,cAAc,IAAK,OAAA,cAAc,CAAC,KAAK,KAAK,eAAe,EAAxC,CAAwC,CAAC,CAAC;wBAC5G,IAAI,CAAC,WAAW,EAAE;4BAChB,MAAM,IAAI,KAAK,CACb,8CAAuC,KAAK,2CAAwC;gCAClF,+DAA+D,CAClE,CAAC;yBACH;wBAEK,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAA;;wBAA5D,IAAI,GAAG,SAAqD;wBAClE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,EAAE;4BAC7C,MAAM,IAAI,KAAK,CACb,uCAAgC,eAAe,kDAA0C;gCACvF,wFAAwF,CAC3F,CAAC;yBACH;wBAGK,QAAQ,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;wBAC3C,KAAA,CAAA,KAAA,EAAE,CAAA,CAAC,MAAM,CAAA;8BAAC,aAAM,CAAC,IAAI;+BAAI,EAAE,EAAE,IAAI,CAAC,EAAE;wBAAY,qBAAM,IAAI,+BAAc,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAA;4BAA1G,qBAAM,yBAAsC,WAAQ,GAAE,SAAoD,QAAG,EAAA;;wBAA7G,SAA6G,CAAC;wBAC9G,yFAAyF;wBACzF,yEAAyE;wBACzE,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,EAAA;;wBAF/D,yFAAyF;wBACzF,yEAAyE;wBACzE,SAA+D,CAAC;wBAChE,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,2BAA2B;4BACpC,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE;yBACpE,CAAC,CAAC;wBAEH,sBAAO;gCACL,KAAK,EAAE,eAAe;gCACtB,QAAQ,UAAA;gCACR,UAAU,EAAE,WAAW,CAAC,UAAU;gCAClC,IAAI,EACF,oDAA6C,WAAW,CAAC,UAAU,sBAAmB;oCACtF,mGAA8F;6BACjG,EAAC;;;;KACH;IACH,yBAAC;AAAD,CAAC,AAlED,IAkEC;AAlEY,gDAAkB"}

package/dist/src/services/Roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Roles.d.ts","sourceRoot":"","sources":["../../../src/services/Roles.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAoD,MAAM,iBAAiB,CAAC;AAEjG,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C;;;;;GAKG;AACH,qBAAa,KAAM,YAAW,YAAY;IACjC,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAIhD;IAEI,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAI/C,UAAU;CAkCzB"}
+{"version":3,"file":"Roles.d.ts","sourceRoot":"","sources":["../../../src/services/Roles.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAoD,MAAM,iBAAiB,CAAC;AAEjG,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C;;;;;GAKG;AACH,qBAAa,KAAM,YAAW,YAAY;IACjC,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAIhD;IAEI,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAI/C,UAAU;CA4CzB"}