@proteinjs/user-server 1.7.0 → 1.9.0

package/dist/src/services/MachineCredentials.js

@@ -0,0 +1,164 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MachineCredentials = void 0;
+var crypto_1 = require("crypto");
+var db_1 = require("@proteinjs/db");
+var user_1 = require("@proteinjs/user");
+var logger_1 = require("@proteinjs/logger");
+var PasswordHasher_1 = require("../authentication/PasswordHasher");
+/**
+ * Credential minting for code-declared machine accounts — the ONLY manual step in a machine
+ * account's life (identity and grants come from the `MachineAccount` declaration at boot).
+ *
+ * Generates a strong random password (never human-chosen), stores its hash on the account row
+ * via PasswordHasher's machine mode — sha256, deliberately not the argon2id human KDF: a
+ * generated 256-bit secret gains nothing from key stretching, and the bridge logs in fresh per
+ * poll, so verifies stay cheap. (The plaintext is never persisted or logged.) Kills the
+ * account's existing sessions (the old
+ * credential dies with them), and returns the plaintext ONCE for pasting into the declaration's
+ * Secret Manager secret. The same call rotates. Machine rows only (`is_loaded_from_source`);
+ * human credentials go through the password-reset flow.
+ */
+var MachineCredentials = /** @class */ (function () {
+    function MachineCredentials() {
+        this.serviceMetadata = {
+            auth: {
+                permission: user_1.USER_PERMISSIONS.users,
+            },
+        };
+    }
+    MachineCredentials.prototype.listMachineAccounts = function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var db, views, _i, _a, declaration, row, booted;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        db = (0, db_1.getDbAsSystem)();
+                        views = [];
+                        _i = 0, _a = (0, user_1.getMachineAccounts)();
+                        _b.label = 1;
+                    case 1:
+                        if (!(_i < _a.length)) return [3 /*break*/, 4];
+                        declaration = _a[_i];
+                        return [4 /*yield*/, db.get(user_1.tables.User, { email: declaration.email })];
+                    case 2:
+                        row = _b.sent();
+                        booted = !!row && row.isLoadedFromSource === true;
+                        views.push({
+                            email: declaration.email,
+                            accountName: declaration.accountName,
+                            roles: __spreadArray([], declaration.roles, true),
+                            secretName: declaration.secretName,
+                            status: booted ? (row.status === 'deactivated' ? 'deactivated' : 'active') : 'pending first boot',
+                            hasCredential: booted && !!row.password,
+                        });
+                        _b.label = 3;
+                    case 3:
+                        _i++;
+                        return [3 /*break*/, 1];
+                    case 4: return [2 /*return*/, views];
+                }
+            });
+        });
+    };
+    MachineCredentials.prototype.mintCredential = function (email) {
+        return __awaiter(this, void 0, void 0, function () {
+            var logger, normalizedEmail, declaration, db, user, password, _a, _b, _c;
+            var _d;
+            return __generator(this, function (_e) {
+                switch (_e.label) {
+                    case 0:
+                        logger = new logger_1.Logger({ name: 'MachineCredentials.mintCredential' });
+                        normalizedEmail = email === null || email === void 0 ? void 0 : email.toLowerCase();
+                        declaration = (0, user_1.getMachineAccounts)().find(function (machineAccount) { return machineAccount.email === normalizedEmail; });
+                        if (!declaration) {
+                            throw new Error("No machine account is declared for '".concat(email, "'. Credentials can only be minted for ") +
+                                "code-declared machine accounts (MachineAccount declarations).");
+                        }
+                        db = (0, db_1.getDbAsSystem)();
+                        return [4 /*yield*/, db.get(user_1.tables.User, { email: normalizedEmail })];
+                    case 1:
+                        user = _e.sent();
+                        if (!user || user.isLoadedFromSource !== true) {
+                            throw new Error("The machine account row for '".concat(normalizedEmail, "' has not been loaded from source yet \u2014 ") +
+                                "the boot sync creates (or adopts) it. Boot the server with the declaration, then mint.");
+                        }
+                        password = (0, crypto_1.randomBytes)(32).toString('hex');
+                        _b = (_a = db).update;
+                        _c = [user_1.tables.User];
+                        _d = { id: user.id };
+                        return [4 /*yield*/, new PasswordHasher_1.PasswordHasher().hash(password, 'machine')];
+                    case 2: return [4 /*yield*/, _b.apply(_a, _c.concat([(_d.password = _e.sent(), _d)]))];
+                    case 3:
+                        _e.sent();
+                        // Rotation kills the old credential's sessions immediately (the bridge logs in fresh per
+                        // poll, so this is cheap for it — the mechanism is the categorical one).
+                        return [4 /*yield*/, db.delete(user_1.tables.Session, { userEmail: normalizedEmail })];
+                    case 4:
+                        // Rotation kills the old credential's sessions immediately (the bridge logs in fresh per
+                        // poll, so this is cheap for it — the mechanism is the categorical one).
+                        _e.sent();
+                        logger.info({
+                            message: "Minted machine credential",
+                            obj: { email: normalizedEmail, secretName: declaration.secretName },
+                        });
+                        return [2 /*return*/, {
+                                email: normalizedEmail,
+                                password: password,
+                                secretName: declaration.secretName,
+                                note: "Shown once. Paste this password into the '".concat(declaration.secretName, "' Secret Manager ") +
+                                    "secret, then restart the service that reads it \u2014 the previous credential is already invalid.",
+                            }];
+                }
+            });
+        });
+    };
+    return MachineCredentials;
+}());
+exports.MachineCredentials = MachineCredentials;
+//# sourceMappingURL=MachineCredentials.js.map

package/dist/src/services/MachineCredentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MachineCredentials.js","sourceRoot":"","sources":["../../../src/services/MachineCredentials.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iCAAqC;AACrC,oCAA8C;AAC9C,wCAOyB;AACzB,4CAA2C;AAE3C,mEAAkE;AAElE;;;;;;;;;;;;GAYG;AACH;IAAA;QACS,oBAAe,GAA+B;YACnD,IAAI,EAAE;gBACJ,UAAU,EAAE,uBAAgB,CAAC,KAAK;aACnC;SACF,CAAC;IA6DJ,CAAC;IA3DO,gDAAmB,GAAzB;;;;;;wBACQ,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACrB,KAAK,GAAyB,EAAE,CAAC;8BACO,EAApB,SAAA,yBAAkB,GAAE;;;6BAApB,CAAA,cAAoB,CAAA;wBAAnC,WAAW;wBACR,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,EAAA;;wBAA7D,GAAG,GAAG,SAAuD;wBAC7D,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,KAAK,IAAI,CAAC;wBACxD,KAAK,CAAC,IAAI,CAAC;4BACT,KAAK,EAAE,WAAW,CAAC,KAAK;4BACxB,WAAW,EAAE,WAAW,CAAC,WAAW;4BACpC,KAAK,oBAAM,WAAW,CAAC,KAAK,OAAC;4BAC7B,UAAU,EAAE,WAAW,CAAC,UAAU;4BAClC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,oBAAoB;4BACjG,aAAa,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ;yBACxC,CAAC,CAAC;;;wBAVqB,IAAoB,CAAA;;4BAa9C,sBAAO,KAAK,EAAC;;;;KACd;IAEK,2CAAc,GAApB,UAAqB,KAAa;;;;;;;wBAC1B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,CAAC,CAAC;wBACnE,eAAe,GAAG,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,WAAW,EAAE,CAAC;wBACvC,WAAW,GAAG,IAAA,yBAAkB,GAAE,CAAC,IAAI,CAAC,UAAC,cAAc,IAAK,OAAA,cAAc,CAAC,KAAK,KAAK,eAAe,EAAxC,CAAwC,CAAC,CAAC;wBAC5G,IAAI,CAAC,WAAW,EAAE;4BAChB,MAAM,IAAI,KAAK,CACb,8CAAuC,KAAK,2CAAwC;gCAClF,+DAA+D,CAClE,CAAC;yBACH;wBAEK,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAA;;wBAA5D,IAAI,GAAG,SAAqD;wBAClE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,EAAE;4BAC7C,MAAM,IAAI,KAAK,CACb,uCAAgC,eAAe,kDAA0C;gCACvF,wFAAwF,CAC3F,CAAC;yBACH;wBAGK,QAAQ,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;wBAC3C,KAAA,CAAA,KAAA,EAAE,CAAA,CAAC,MAAM,CAAA;8BAAC,aAAM,CAAC,IAAI;+BAAI,EAAE,EAAE,IAAI,CAAC,EAAE;wBAAY,qBAAM,IAAI,+BAAc,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAA;4BAA1G,qBAAM,yBAAsC,WAAQ,GAAE,SAAoD,QAAG,EAAA;;wBAA7G,SAA6G,CAAC;wBAC9G,yFAAyF;wBACzF,yEAAyE;wBACzE,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,EAAA;;wBAF/D,yFAAyF;wBACzF,yEAAyE;wBACzE,SAA+D,CAAC;wBAChE,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,2BAA2B;4BACpC,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE;yBACpE,CAAC,CAAC;wBAEH,sBAAO;gCACL,KAAK,EAAE,eAAe;gCACtB,QAAQ,UAAA;gCACR,UAAU,EAAE,WAAW,CAAC,UAAU;gCAClC,IAAI,EACF,oDAA6C,WAAW,CAAC,UAAU,sBAAmB;oCACtF,mGAA8F;6BACjG,EAAC;;;;KACH;IACH,yBAAC;AAAD,CAAC,AAlED,IAkEC;AAlEY,gDAAkB"}

package/dist/src/services/Roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Roles.d.ts","sourceRoot":"","sources":["../../../src/services/Roles.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAoD,MAAM,iBAAiB,CAAC;AAEjG,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C;;;;;GAKG;AACH,qBAAa,KAAM,YAAW,YAAY;IACjC,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAIhD;IAEI,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAI/C,UAAU;CAkCzB"}
+{"version":3,"file":"Roles.d.ts","sourceRoot":"","sources":["../../../src/services/Roles.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAoD,MAAM,iBAAiB,CAAC;AAEjG,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C;;;;;GAKG;AACH,qBAAa,KAAM,YAAW,YAAY;IACjC,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAIhD;IAEI,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAI/C,UAAU;CA4CzB"}

package/dist/src/services/Roles.js

@@ -106,6 +106,13 @@ var Roles = /** @class */ (function () {
                         if (!user) {
                             throw new Error("No user found for id: ".concat(userId));
                         }
+                        // Machine grants live in the MachineAccount declaration and reconcile at boot — git history
+                        // is their audit ledger, role_grant_event is the HUMAN ledger, and the two never interleave
+                        // on one row. A runtime grant here would also just be reverted by the next boot.
+                        if (user.isLoadedFromSource === true) {
+                            throw new Error("'".concat(user.email, "' is a machine account: its roles are declared in code (its MachineAccount ") +
+                                "declaration) and reverted to the declaration on every boot. Change the declaration instead.");
+                        }
                         roles = (_a = user.roles) !== null && _a !== void 0 ? _a : [];
                         if (action === 'grant' ? roles.includes(role) : !roles.includes(role)) {
                             // No change, no audit row: the trail records what happened, not what was re-asked.

package/dist/src/services/Roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"Roles.js","sourceRoot":"","sources":["../../../src/services/Roles.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAA8C;AAC9C,wCAAiG;AACjG,4CAA2C;AAG3C;;;;;GAKG;AACH;IAAA;QACS,oBAAe,GAA+B;YACnD,IAAI,EAAE;gBACJ,UAAU,EAAE,uBAAgB,CAAC,KAAK;aACnC;SACF,CAAC;IA4CJ,CAAC;IA1CO,yBAAS,GAAf,UAAgB,MAAc,EAAE,IAAY;;;;4BAC1C,qBAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,EAAA;;wBAA5C,SAA4C,CAAC;;;;;KAC9C;IAEK,0BAAU,GAAhB,UAAiB,MAAc,EAAE,IAAY;;;;4BAC3C,qBAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAA;;wBAA7C,SAA6C,CAAC;;;;;KAC/C;IAEa,0BAAU,GAAxB,UAAyB,MAAc,EAAE,IAAY,EAAE,MAA0B;;;;;;;;wBACzE,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,gBAAS,MAAM,SAAM,EAAE,CAAC,CAAC;wBAC3D,IAAI,CAAC,mBAAY,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE;4BACnC,MAAM,IAAI,KAAK,CAAC,WAAI,IAAI,4DAAyD,CAAC,CAAC;yBACpF;wBAEK,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAA;;wBAAhD,IAAI,GAAG,SAAyC;wBACtD,IAAI,CAAC,IAAI,EAAE;4BACT,MAAM,IAAI,KAAK,CAAC,gCAAyB,MAAM,CAAE,CAAC,CAAC;yBACpD;wBAEK,KAAK,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC;wBAC/B,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;4BACrE,mFAAmF;4BACnF,sBAAO;yBACR;wBAEK,QAAQ,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,iCAAK,KAAK,UAAE,IAAI,UAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAC,QAAQ,IAAK,OAAA,QAAQ,KAAK,IAAI,EAAjB,CAAiB,CAAC,CAAC;wBACjG,KAAK,GAAG,IAAI,eAAQ,EAAE,CAAC,OAAO,EAAE,CAAC;wBACvC,qBAAM,EAAE,CAAC,cAAc,CAAC;;;gDACtB,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAA;;4CAA7D,SAA6D,CAAC;4CAC9D,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,cAAc,EAAE;oDACrC,KAAK,EAAE,KAAK,CAAC,EAAE;oDACf,MAAM,EAAE,MAAM;oDACd,IAAI,MAAA;oDACJ,MAAM,QAAA;iDACP,CAAC,EAAA;;4CALF,SAKE,CAAC;;;;iCACJ,CAAC,EAAA;;wBARF,SAQE,CAAC;wBACH,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,eAAQ,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAE;4BAC7D,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,MAAA,EAAE;yBAC/C,CAAC,CAAC;;;;;KACJ;IACH,YAAC;AAAD,CAAC,AAjDD,IAiDC;AAjDY,sBAAK"}
+{"version":3,"file":"Roles.js","sourceRoot":"","sources":["../../../src/services/Roles.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAA8C;AAC9C,wCAAiG;AACjG,4CAA2C;AAG3C;;;;;GAKG;AACH;IAAA;QACS,oBAAe,GAA+B;YACnD,IAAI,EAAE;gBACJ,UAAU,EAAE,uBAAgB,CAAC,KAAK;aACnC;SACF,CAAC;IAsDJ,CAAC;IApDO,yBAAS,GAAf,UAAgB,MAAc,EAAE,IAAY;;;;4BAC1C,qBAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,EAAA;;wBAA5C,SAA4C,CAAC;;;;;KAC9C;IAEK,0BAAU,GAAhB,UAAiB,MAAc,EAAE,IAAY;;;;4BAC3C,qBAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAA;;wBAA7C,SAA6C,CAAC;;;;;KAC/C;IAEa,0BAAU,GAAxB,UAAyB,MAAc,EAAE,IAAY,EAAE,MAA0B;;;;;;;;wBACzE,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,gBAAS,MAAM,SAAM,EAAE,CAAC,CAAC;wBAC3D,IAAI,CAAC,mBAAY,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE;4BACnC,MAAM,IAAI,KAAK,CAAC,WAAI,IAAI,4DAAyD,CAAC,CAAC;yBACpF;wBAEK,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAA;;wBAAhD,IAAI,GAAG,SAAyC;wBACtD,IAAI,CAAC,IAAI,EAAE;4BACT,MAAM,IAAI,KAAK,CAAC,gCAAyB,MAAM,CAAE,CAAC,CAAC;yBACpD;wBAED,4FAA4F;wBAC5F,4FAA4F;wBAC5F,iFAAiF;wBACjF,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,EAAE;4BACpC,MAAM,IAAI,KAAK,CACb,WAAI,IAAI,CAAC,KAAK,gFAA6E;gCACzF,6FAA6F,CAChG,CAAC;yBACH;wBAEK,KAAK,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC;wBAC/B,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;4BACrE,mFAAmF;4BACnF,sBAAO;yBACR;wBAEK,QAAQ,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,iCAAK,KAAK,UAAE,IAAI,UAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAC,QAAQ,IAAK,OAAA,QAAQ,KAAK,IAAI,EAAjB,CAAiB,CAAC,CAAC;wBACjG,KAAK,GAAG,IAAI,eAAQ,EAAE,CAAC,OAAO,EAAE,CAAC;wBACvC,qBAAM,EAAE,CAAC,cAAc,CAAC;;;gDACtB,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAA;;4CAA7D,SAA6D,CAAC;4CAC9D,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,cAAc,EAAE;oDACrC,KAAK,EAAE,KAAK,CAAC,EAAE;oDACf,MAAM,EAAE,MAAM;oDACd,IAAI,MAAA;oDACJ,MAAM,QAAA;iDACP,CAAC,EAAA;;4CALF,SAKE,CAAC;;;;iCACJ,CAAC,EAAA;;wBARF,SAQE,CAAC;wBACH,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,eAAQ,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAE;4BAC7D,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,MAAA,EAAE;yBAC/C,CAAC,CAAC;;;;;KACJ;IACH,YAAC;AAAD,CAAC,AA3DD,IA2DC;AA3DY,sBAAK"}

package/dist/src/services/SetUserStatus.d.ts

@@ -0,0 +1,18 @@
+import { SetUserStatusService, UserStatus } from '@proteinjs/user';
+import { Service } from '@proteinjs/service';
+/**
+ * The ONE write path for a user's account standing (the `user.status` column is
+ * service-protected — generic record writes cannot touch it). The status update and its
+ * `user_status_event` audit row (actor, target, status; `created` is the timestamp) commit in
+ * one transaction, so the trail cannot diverge from the standing.
+ *
+ * Admin-only by explicit scope: deactivation locks the target out of the product (login refused,
+ * live sessions stop resolving via userCache), so the door is the break-glass role, not a mapped
+ * permission. This method only flips standing — `deleteRequestedAt`/`purgeAfter` belong to the
+ * account-deletion flow.
+ */
+export declare class SetUserStatus implements SetUserStatusService {
+    serviceMetadata: Service['serviceMetadata'];
+    setUserStatus(userId: string, status: UserStatus): Promise<void>;
+}
+//# sourceMappingURL=SetUserStatus.d.ts.map

package/dist/src/services/SetUserStatus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SetUserStatus.d.ts","sourceRoot":"","sources":["../../../src/services/SetUserStatus.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAA2B,UAAU,EAAU,MAAM,iBAAiB,CAAC;AAEpG,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C;;;;;;;;;;GAUG;AACH,qBAAa,aAAc,YAAW,oBAAoB;IACjD,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAIhD;IAEI,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAgCvE"}

package/dist/src/services/SetUserStatus.js

@@ -0,0 +1,118 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SetUserStatus = void 0;
+var db_1 = require("@proteinjs/db");
+var user_1 = require("@proteinjs/user");
+var logger_1 = require("@proteinjs/logger");
+/**
+ * The ONE write path for a user's account standing (the `user.status` column is
+ * service-protected — generic record writes cannot touch it). The status update and its
+ * `user_status_event` audit row (actor, target, status; `created` is the timestamp) commit in
+ * one transaction, so the trail cannot diverge from the standing.
+ *
+ * Admin-only by explicit scope: deactivation locks the target out of the product (login refused,
+ * live sessions stop resolving via userCache), so the door is the break-glass role, not a mapped
+ * permission. This method only flips standing — `deleteRequestedAt`/`purgeAfter` belong to the
+ * account-deletion flow.
+ */
+var SetUserStatus = /** @class */ (function () {
+    function SetUserStatus() {
+        this.serviceMetadata = {
+            auth: {
+                roles: ['admin'],
+            },
+        };
+    }
+    SetUserStatus.prototype.setUserStatus = function (userId, status) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function () {
+            var logger, db, user, actor;
+            var _this = this;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        logger = new logger_1.Logger({ name: 'SetUserStatus.setUserStatus' });
+                        if (!user_1.USER_STATUSES.includes(status)) {
+                            throw new Error("'".concat(status, "' is not a known user status. Pick one of: ").concat(user_1.USER_STATUSES.join(', '), "."));
+                        }
+                        db = (0, db_1.getDbAsSystem)();
+                        return [4 /*yield*/, db.get(user_1.tables.User, { id: userId })];
+                    case 1:
+                        user = _b.sent();
+                        if (!user) {
+                            throw new Error("No user found for id: ".concat(userId));
+                        }
+                        // Rows predating the status column read null, which every gate treats as active.
+                        if (((_a = user.status) !== null && _a !== void 0 ? _a : 'active') === status) {
+                            // No change, no audit row: the trail records what happened, not what was re-asked.
+                            return [2 /*return*/];
+                        }
+                        actor = new user_1.UserRepo().getUser();
+                        return [4 /*yield*/, db.runTransaction(function () { return __awaiter(_this, void 0, void 0, function () {
+                                return __generator(this, function (_a) {
+                                    switch (_a.label) {
+                                        case 0: return [4 /*yield*/, db.update(user_1.tables.User, { id: userId, status: status })];
+                                        case 1:
+                                            _a.sent();
+                                            return [4 /*yield*/, db.insert(user_1.tables.UserStatusEvent, {
+                                                    actor: actor.id,
+                                                    target: userId,
+                                                    status: status,
+                                                })];
+                                        case 2:
+                                            _a.sent();
+                                            return [2 /*return*/];
+                                    }
+                                });
+                            }); })];
+                    case 2:
+                        _b.sent();
+                        logger.info({
+                            message: "User status set to ".concat(status),
+                            obj: { actor: actor.id, target: userId, status: status },
+                        });
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
+    return SetUserStatus;
+}());
+exports.SetUserStatus = SetUserStatus;
+//# sourceMappingURL=SetUserStatus.js.map

package/dist/src/services/SetUserStatus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SetUserStatus.js","sourceRoot":"","sources":["../../../src/services/SetUserStatus.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAA8C;AAC9C,wCAAoG;AACpG,4CAA2C;AAG3C;;;;;;;;;;GAUG;AACH;IAAA;QACS,oBAAe,GAA+B;YACnD,IAAI,EAAE;gBACJ,KAAK,EAAE,CAAC,OAAO,CAAC;aACjB;SACF,CAAC;IAkCJ,CAAC;IAhCO,qCAAa,GAAnB,UAAoB,MAAc,EAAE,MAAkB;;;;;;;;wBAC9C,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;wBACnE,IAAI,CAAC,oBAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;4BACnC,MAAM,IAAI,KAAK,CAAC,WAAI,MAAM,wDAA8C,oBAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAG,CAAC,CAAC;yBACtG;wBAEK,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAA;;wBAAhD,IAAI,GAAG,SAAyC;wBACtD,IAAI,CAAC,IAAI,EAAE;4BACT,MAAM,IAAI,KAAK,CAAC,gCAAyB,MAAM,CAAE,CAAC,CAAC;yBACpD;wBAED,iFAAiF;wBACjF,IAAI,CAAC,MAAA,IAAI,CAAC,MAAM,mCAAI,QAAQ,CAAC,KAAK,MAAM,EAAE;4BACxC,mFAAmF;4BACnF,sBAAO;yBACR;wBAEK,KAAK,GAAG,IAAI,eAAQ,EAAE,CAAC,OAAO,EAAE,CAAC;wBACvC,qBAAM,EAAE,CAAC,cAAc,CAAC;;;gDACtB,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAA,EAAE,CAAC,EAAA;;4CAApD,SAAoD,CAAC;4CACrD,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,eAAe,EAAE;oDACtC,KAAK,EAAE,KAAK,CAAC,EAAE;oDACf,MAAM,EAAE,MAAM;oDACd,MAAM,QAAA;iDACP,CAAC,EAAA;;4CAJF,SAIE,CAAC;;;;iCACJ,CAAC,EAAA;;wBAPF,SAOE,CAAC;wBACH,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,6BAAsB,MAAM,CAAE;4BACvC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAA,EAAE;yBACjD,CAAC,CAAC;;;;;KACJ;IACH,oBAAC;AAAD,CAAC,AAvCD,IAuCC;AAvCY,sCAAa"}

package/dist/src/services/Signup.d.ts

@@ -25,13 +25,30 @@ export interface DefaultInviteConfigFactory extends Loadable {
     getConfig(): InviteConfig;
 }
 export declare const getDefaultInviteConfigFactory: () => DefaultInviteConfigFactory;
+/**
+ * `createUser`'s outcome, for the signup route's eyes only (it never crosses the wire): the
+ * route establishes a session on 'created' and must NOT on 'exists' — auto-login must never
+ * hand out a session for an account the caller didn't just create. The response body stays
+ * identical either way (existence is reported to the mailbox owner by email, not the caller).
+ */
+export type CreateUserResult = {
+    outcome: 'created' | 'exists';
+    /** The account email, lowercased — resolved from the invite when a token was provided. */
+    email: string;
+};
 export declare class Signup implements SignupService {
     serviceMetadata: {
         auth: {
             canAccess: (methodName: string, args: any[]) => boolean;
         };
     };
-    createUser(user: UserSignup, token?: string): Promise<void>;
+    /**
+     * The signup flow's account creation + notification emails. Not RPC-reachable (deliberately
+     * absent from the SignupService interface): its caller is the `routes.signup` ROUTE, which
+     * establishes the session (auto-login) from this result — a request-level concern services
+     * never see.
+     */
+    createUser(user: UserSignup, token?: string): Promise<CreateUserResult>;
     sendInvite(email: string): Promise<SendInviteResponse>;
     revokeInvite(email: string): Promise<void>;
     /**
@@ -40,8 +57,8 @@ export declare class Signup implements SignupService {
      */
     initializeSignup(inviteToken: string | undefined): Promise<InitializeSignupResponse>;
     /**
-     * Single owner of account-record creation: case-normalized existence check + sha256-hashed
-     * insert. Both doors into a user row go through here — the signup flow (`createUser`, which
+     * Single owner of account-record creation: case-normalized existence check + argon2id-hashed
+     * insert (PasswordHasher). Both doors into a user row go through here — the signup flow (`createUser`, which
      * layers invite validation and confirmation emails on top) and the dev-login bootstrap
      * (`devLogin`, which auto-creates missing same-domain test accounts). Not exposed as an RPC:
      * the service surface is the `SignupService` INTERFACE (ServiceRouter walks its declared

package/dist/src/services/Signup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Signup.d.ts","sourceRoot":"","sources":["../../../src/services/Signup.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAIlB,aAAa,EACb,wBAAwB,EAExB,MAAM,EACN,IAAI,EACJ,UAAU,EAEX,MAAM,iBAAiB,CAAC;AAUzB,OAAO,EAAE,QAAQ,EAAoB,MAAM,uBAAuB,CAAC;AAEnE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC;AAEhH,MAAM,WAAW,0BAA2B,SAAQ,QAAQ;IAC1D,SAAS,IAAI,YAAY,CAAC;CAC3B;AAED,eAAO,MAAM,6BAA6B,QAAO,0BAShD,CAAC;AAEF,qBAAa,MAAO,YAAW,aAAa;IACnC,eAAe;;oCAEM,MAAM,QAAQ,GAAG,EAAE;;MAY7C;IAEI,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0D3D,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA0DtD,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhD;;;OAGG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAoD1F;;;;;;;OAOG;IACG,aAAa,CAAC,OAAO,EAAE;QAC3B,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,OAAO,CAAC;QACvB,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;KAC9B,GAAG,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC;IAmBjC,iGAAiG;YACnF,YAAY;CAc3B"}
+{"version":3,"file":"Signup.d.ts","sourceRoot":"","sources":["../../../src/services/Signup.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAIlB,aAAa,EACb,wBAAwB,EAExB,MAAM,EACN,IAAI,EACJ,UAAU,EAEX,MAAM,iBAAiB,CAAC;AASzB,OAAO,EAAE,QAAQ,EAAoB,MAAM,uBAAuB,CAAC;AAGnE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC;AAEhH,MAAM,WAAW,0BAA2B,SAAQ,QAAQ;IAC1D,SAAS,IAAI,YAAY,CAAC;CAC3B;AAED,eAAO,MAAM,6BAA6B,QAAO,0BAShD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC9B,0FAA0F;IAC1F,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,qBAAa,MAAO,YAAW,aAAa;IACnC,eAAe;;oCAEM,MAAM,QAAQ,GAAG,EAAE;;MAY7C;IAEF;;;;;OAKG;IACG,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA2DvE,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA0DtD,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhD;;;OAGG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAoD1F;;;;;;;OAOG;IACG,aAAa,CAAC,OAAO,EAAE;QAC3B,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,OAAO,CAAC;QACvB,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;KAC9B,GAAG,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC;IAmBjC,iGAAiG;YACnF,YAAY;CAc3B"}

package/dist/src/services/Signup.js

@@ -57,8 +57,8 @@ var moment_1 = __importDefault(require("moment"));
 var crypto_js_1 = require("crypto-js");
 var logger_1 = require("@proteinjs/logger");
 var email_server_1 = require("@proteinjs/email-server");
-var sha256_1 = __importDefault(require("crypto-js/sha256"));
 var reflection_1 = require("@proteinjs/reflection");
+var PasswordHasher_1 = require("../authentication/PasswordHasher");
 /**
  * How long an invite link stays usable. Deliberately generous: a legitimate invite that gets
  * clicked late should still work, and revocation (surfaced in the admin UI) is the real control.
@@ -90,6 +90,12 @@ var Signup = /** @class */ (function () {
             },
         };
     }
+    /**
+     * The signup flow's account creation + notification emails. Not RPC-reachable (deliberately
+     * absent from the SignupService interface): its caller is the `routes.signup` ROUTE, which
+     * establishes the session (auto-login) from this result — a request-level concern services
+     * never see.
+     */
     Signup.prototype.createUser = function (user, token) {
         var _a, _b, _c, _d;
         return __awaiter(this, void 0, void 0, function () {
@@ -136,14 +142,14 @@ var Signup = /** @class */ (function () {
                     case 5:
                         _g.sent();
                         _g.label = 6;
-                    case 6: return [2 /*return*/];
+                    case 6: return [2 /*return*/, { outcome: 'exists', email: email }];
                     case 7:
                         _f = config.getNewUserEmailContent(), text = _f.text, html = _f.html;
                         return [4 /*yield*/, emailSender.sendEmail(__assign({ to: email, subject: config.newUserSubject || ((_d = config.options) === null || _d === void 0 ? void 0 : _d.subject) || 'Welcome!', text: text, html: html }, config.options))];
                     case 8:
                         _g.sent();
                         logger.info({ message: "Created user", obj: { email: email } });
-                        return [2 /*return*/];
+                        return [2 /*return*/, { outcome: 'created', email: email }];
                 }
             });
         });
@@ -291,8 +297,8 @@ var Signup = /** @class */ (function () {
         });
     };
     /**
-     * Single owner of account-record creation: case-normalized existence check + sha256-hashed
-     * insert. Both doors into a user row go through here — the signup flow (`createUser`, which
+     * Single owner of account-record creation: case-normalized existence check + argon2id-hashed
+     * insert (PasswordHasher). Both doors into a user row go through here — the signup flow (`createUser`, which
      * layers invite validation and confirmation emails on top) and the dev-login bootstrap
      * (`devLogin`, which auto-creates missing same-domain test accounts). Not exposed as an RPC:
      * the service surface is the `SignupService` INTERFACE (ServiceRouter walks its declared
@@ -300,28 +306,33 @@ var Signup = /** @class */ (function () {
      */
     Signup.prototype.createAccount = function (account) {
         return __awaiter(this, void 0, void 0, function () {
-            var db, email, existingUser;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
+            var db, email, existingUser, _a, _b, _c;
+            var _d;
+            return __generator(this, function (_e) {
+                switch (_e.label) {
                     case 0:
                         db = (0, db_1.getDbAsSystem)();
                         email = account.email.toLowerCase();
                         return [4 /*yield*/, db.get(user_1.tables.User, { email: email })];
                     case 1:
-                        existingUser = _a.sent();
+                        existingUser = _e.sent();
                         if (existingUser) {
                             return [2 /*return*/, 'exists'];
                         }
-                        return [4 /*yield*/, db.insert(user_1.tables.User, {
-                                name: account.name,
-                                email: email,
-                                password: (0, sha256_1.default)(account.password).toString(),
-                                emailVerified: account.emailVerified,
-                                roles: [],
-                                invitedBy: account.invitedBy,
-                            })];
-                    case 2:
-                        _a.sent();
+                        _b = (_a = db).insert;
+                        _c = [user_1.tables.User];
+                        _d = {
+                            name: account.name,
+                            email: email
+                        };
+                        return [4 /*yield*/, new PasswordHasher_1.PasswordHasher().hash(account.password)];
+                    case 2: return [4 /*yield*/, _b.apply(_a, _c.concat([(_d.password = _e.sent(),
+                                _d.emailVerified = account.emailVerified,
+                                _d.roles = [],
+                                _d.invitedBy = account.invitedBy,
+                                _d)]))];
+                    case 3:
+                        _e.sent();
                         return [2 /*return*/, 'created'];
                 }
             });

package/dist/src/services/Signup.js.map

@@ -1 +1 @@
-{"version":3,"file":"Signup.js","sourceRoot":"","sources":["../../../src/services/Signup.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAA8C;AAC9C,wCAYyB;AACzB,kDAA4B;AAC5B,uCAAgC;AAChC,4CAA2C;AAC3C,wDAIiC;AACjC,4DAAsC;AACtC,oDAAmE;AAEnE;;;;GAIG;AACU,QAAA,qBAAqB,GAAG,EAAE,CAAC;AAgBjC,IAAM,6BAA6B,GAAG;IAC3C,IAAM,cAAc,GAA+B;QACjD,SAAS,EAAE,cAAoB,OAAA,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAzB,CAAyB;KACzD,CAAC;IAEF,IAAM,OAAO,GAAG,6BAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,CAC3C,mDAAmD,CACpD,CAAC;IACF,OAAO,OAAO,IAAI,cAAc,CAAC;AACnC,CAAC,CAAC;AATW,QAAA,6BAA6B,iCASxC;AAEF;IAAA;QACS,oBAAe,GAAG;YACvB,IAAI,EAAE;gBACJ,SAAS,EAAE,UAAC,UAAkB,EAAE,IAAW;oBACzC,sFAAsF;oBACtF,0FAA0F;oBAC1F,yFAAyF;oBACzF,uCAAuC;oBACvC,IAAI,UAAU,KAAK,YAAY,IAAI,UAAU,KAAK,cAAc,EAAE;wBAChE,OAAO,eAAQ,CAAC,aAAa,CAAC,uBAAgB,CAAC,KAAK,CAAC,CAAC;qBACvD;oBAED,OAAO,IAAI,CAAC;gBACd,CAAC;aACF;SACF,CAAC;IAyOJ,CAAC;IAvOO,2BAAU,GAAhB,UAAiB,IAAgB,EAAE,KAAc;;;;;;;wBACzC,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBACnD,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBAEA,qBAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAA;;wBAAvD,kBAAkB,GAAG,SAAkC;wBAC7D,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE;4BAC/B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;yBAC3C;wBAIK,MAAM,GAAG,MAAA,kBAAkB,CAAC,MAAM,mCAAI,IAAI,CAAC;6BAC7C,KAAK,EAAL,wBAAK;wBACP,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,MAAM,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;wBAAzC,SAAyC,CAAC;;;wBAGtC,KAAK,GAAG,MAAA,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,0CAAE,WAAW,EAAE,CAAC;wBAClE,IAAI,CAAC,KAAK,EAAE;4BACV,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;yBAC9D;wBAEK,yBAAyB,GAAG,IAAA,6DAA8C,GAAE,CAAC;wBAC7E,MAAM,GAAG,yBAAyB,CAAC,SAAS,EAAE,CAAC;wBAC/C,WAAW,GAAG,IAAI,0BAAW,EAAE,CAAC;wBAErB,qBAAM,IAAI,CAAC,aAAa,CAAC;gCACxC,IAAI,EAAE,IAAI,CAAC,IAAI;gCACf,KAAK,OAAA;gCACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;gCACvB,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;gCACpC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;6BAC5C,CAAC,EAAA;;wBANI,QAAQ,GAAG,SAMf;6BACE,CAAA,QAAQ,KAAK,QAAQ,CAAA,EAArB,wBAAqB;wBACvB,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;6BAC7E,MAAM,CAAC,2BAA2B,EAAlC,wBAAkC;wBAC9B,KAAiB,MAAM,CAAC,2BAA2B,EAAE,EAAnD,gBAAI,EAAE,gBAAI,CAA0C;wBAC5D,qBAAM,WAAW,CAAC,SAAS,YACzB,EAAE,EAAE,KAAK,EACT,OAAO,EAAE,MAAM,CAAC,mBAAmB,KAAI,MAAA,MAAM,CAAC,OAAO,0CAAE,OAAO,CAAA,IAAI,wBAAwB,EAC1F,IAAI,QAAA,EACJ,IAAI,QAAA,IACD,MAAM,CAAC,OAAO,EACjB,EAAA;;wBANF,SAME,CAAC;;4BAEL,sBAAO;;wBAGH,KAAiB,MAAM,CAAC,sBAAsB,EAAE,EAA9C,IAAI,UAAA,EAAE,IAAI,UAAA,CAAqC;wBACvD,qBAAM,WAAW,CAAC,SAAS,YACzB,EAAE,EAAE,KAAK,EACT,OAAO,EAAE,MAAM,CAAC,cAAc,KAAI,MAAA,MAAM,CAAC,OAAO,0CAAE,OAAO,CAAA,IAAI,UAAU,EACvE,IAAI,MAAA,EACJ,IAAI,MAAA,IACD,MAAM,CAAC,OAAO,EACjB,EAAA;;wBANF,SAME,CAAC;wBACH,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;;;;;KAC1D;IAEK,2BAAU,GAAhB,UAAiB,KAAa;;;;;;;wBACtB,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBACnD,oBAAoB,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;;;;wBAEzC,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACR,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAA;;wBAAvE,UAAU,GAAG,SAA0D;wBAC7E,IAAI,UAAU,EAAE;4BACd,sBAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,EAAC;yBACvE;wBAEK,WAAW,GAAG,IAAI,0BAAW,EAAE,CAAC;wBAChC,oBAAoB,GAAG,IAAA,iDAAkC,GAAE,CAAC;wBAClE,IAAI,CAAC,oBAAoB,EAAE;4BACzB,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;yBACH;wBACK,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC;wBAE1C,KAAK,GAAG,eAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;wBAC5C,cAAc,GAAG,IAAA,gBAAM,GAAE,CAAC,GAAG,CAAC,6BAAqB,EAAE,MAAM,CAAC,CAAC;wBACtD,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAA;;wBAArE,MAAM,GAAG,SAA4D;6BACrE,MAAM,EAAN,wBAAM;wBACR,MAAM,yBACD,MAAM,KACT,KAAK,OAAA,EACL,cAAc,gBAAA,GACf,CAAC;wBACF,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAA;;wBAAtC,SAAsC,CAAC;;;wBAEjC,MAAM,GAAG,IAAI,eAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;wBAClC,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,MAAM,EAAE;gCACtC,KAAK,EAAE,oBAAoB;gCAC3B,KAAK,OAAA;gCACL,cAAc,gBAAA;gCACd,SAAS,EAAE,MAAM;6BAClB,CAAC,EAAA;;wBALF,MAAM,GAAG,SAKP,CAAC;;;wBAGC,KAAiB,MAAM,CAAC,eAAe,CAAC,UAAG,eAAQ,CAAC,IAAI,CAAC,MAAM,oBAAU,KAAK,CAAE,CAAC,EAA/E,IAAI,UAAA,EAAE,IAAI,UAAA,CAAsE;wBACxF,qBAAM,WAAW,CAAC,SAAS,YACzB,EAAE,EAAE,oBAAoB,EACxB,OAAO,EAAE,CAAA,MAAA,MAAM,CAAC,OAAO,0CAAE,OAAO,KAAI,gBAAgB,EACpD,IAAI,MAAA,EACJ,IAAI,MAAA,IACD,MAAM,CAAC,OAAO,EACjB,EAAA;;wBANF,SAME,CAAC;wBAEH,sBAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAC;;;wBAEtB,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,KAAK,SAAA,EAAE,CAAC,CAAC;wBAC/F,sBAAO;gCACL,IAAI,EAAE,KAAK;gCACX,KAAK,EAAE,iBAAiB;6BACzB,EAAC;;;;;KAEL;IAEK,6BAAY,GAAlB,UAAmB,KAAa;;;;;;wBAC9B,IAAI,CAAC,KAAK,EAAE;4BACV,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;yBAC3C;wBAIK,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBAC3B,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;wBAA9D,SAA8D,CAAC;;;;;KAChE;IAED;;;OAGG;IACG,iCAAgB,GAAtB,UAAuB,WAA+B;;;;;;;wBAE5C,MAAM,GAAG,IAAA,qCAA6B,GAAE,CAAC,SAAS,EAAE,CAAC;wBACnD,YAAY,GAAK,MAAM,aAAX,CAAY;6BAK5B,WAAW,EAAX,wBAAW;wBACE,qBAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAA;;wBAA7C,MAAM,GAAG,SAAoC;wBACnD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE;4BAC/B,sBAAO;oCACL,OAAO,EAAE,KAAK;oCACd,KAAK,EAAE,qEAAqE;oCAC5E,YAAY,cAAA;iCACb,EAAC;yBACH;wBACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE;4BAChC,sBAAO;oCACL,OAAO,EAAE,KAAK;oCACd,KAAK,EAAE,iFAAiF;oCACxF,YAAY,cAAA;iCACb,EAAC;yBACH;wBAED,sBAAO;gCACL,OAAO,EAAE,IAAI;gCACb,YAAY,cAAA;gCACZ,MAAM,EAAE,MAAM,CAAC,MAAM;6BACtB,EAAC;;wBAGJ,IAAI,YAAY,EAAE;4BAChB,sBAAO;oCACL,OAAO,EAAE,KAAK;oCACd,KAAK,EAAE,mCAAmC;oCAC1C,YAAY,cAAA;iCACb,EAAC;yBACH;wBAED,sBAAO;gCACL,OAAO,EAAE,IAAI;gCACb,YAAY,cAAA;6BACb,EAAC;;;wBAEF,sBAAO;gCACL,OAAO,EAAE,KAAK;gCACd,KAAK,EAAE,8BAA8B;6BACtC,EAAC;;;;;KAEL;IAED;;;;;;;OAOG;IACG,8BAAa,GAAnB,UAAoB,OAMnB;;;;;;wBACO,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACrB,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;wBACrB,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;wBAAnD,YAAY,GAAG,SAAoC;wBACzD,IAAI,YAAY,EAAE;4BAChB,sBAAO,QAAQ,EAAC;yBACjB;wBAED,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE;gCAC3B,IAAI,EAAE,OAAO,CAAC,IAAI;gCAClB,KAAK,OAAA;gCACL,QAAQ,EAAE,IAAA,gBAAM,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE;gCAC7C,aAAa,EAAE,OAAO,CAAC,aAAa;gCACpC,KAAK,EAAE,EAAE;gCACT,SAAS,EAAE,OAAO,CAAC,SAAS;6BAC7B,CAAC,EAAA;;wBAPF,SAOE,CAAC;wBACH,sBAAO,SAAS,EAAC;;;;KAClB;IAED,iGAAiG;IACnF,6BAAY,GAA1B,UAA2B,KAAa;;;;;;wBAChC,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACZ,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,MAAM,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;wBAA/C,MAAM,GAAG,SAAsC;wBAErD,IAAI,CAAC,MAAM,EAAE;4BACX,sBAAO,EAAE,MAAM,EAAE,UAAU,EAAE,EAAC;yBAC/B;wBAED,IAAI,MAAM,CAAC,cAAc,IAAI,IAAA,gBAAM,EAAC,MAAM,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,IAAA,gBAAM,GAAE,CAAC,EAAE;4BAC7E,sBAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAC;yBAC9B;wBAED,sBAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,QAAA,EAAE,EAAC;;;;KACpC;IACH,aAAC;AAAD,CAAC,AAxPD,IAwPC;AAxPY,wBAAM"}
+{"version":3,"file":"Signup.js","sourceRoot":"","sources":["../../../src/services/Signup.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAA8C;AAC9C,wCAYyB;AACzB,kDAA4B;AAC5B,uCAAgC;AAChC,4CAA2C;AAC3C,wDAIiC;AACjC,oDAAmE;AACnE,mEAAkE;AAElE;;;;GAIG;AACU,QAAA,qBAAqB,GAAG,EAAE,CAAC;AAgBjC,IAAM,6BAA6B,GAAG;IAC3C,IAAM,cAAc,GAA+B;QACjD,SAAS,EAAE,cAAoB,OAAA,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAzB,CAAyB;KACzD,CAAC;IAEF,IAAM,OAAO,GAAG,6BAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,CAC3C,mDAAmD,CACpD,CAAC;IACF,OAAO,OAAO,IAAI,cAAc,CAAC;AACnC,CAAC,CAAC;AATW,QAAA,6BAA6B,iCASxC;AAcF;IAAA;QACS,oBAAe,GAAG;YACvB,IAAI,EAAE;gBACJ,SAAS,EAAE,UAAC,UAAkB,EAAE,IAAW;oBACzC,sFAAsF;oBACtF,0FAA0F;oBAC1F,yFAAyF;oBACzF,uCAAuC;oBACvC,IAAI,UAAU,KAAK,YAAY,IAAI,UAAU,KAAK,cAAc,EAAE;wBAChE,OAAO,eAAQ,CAAC,aAAa,CAAC,uBAAgB,CAAC,KAAK,CAAC,CAAC;qBACvD;oBAED,OAAO,IAAI,CAAC;gBACd,CAAC;aACF;SACF,CAAC;IAgPJ,CAAC;IA9OC;;;;;OAKG;IACG,2BAAU,GAAhB,UAAiB,IAAgB,EAAE,KAAc;;;;;;;wBACzC,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBACnD,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBAEA,qBAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAA;;wBAAvD,kBAAkB,GAAG,SAAkC;wBAC7D,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE;4BAC/B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;yBAC3C;wBAIK,MAAM,GAAG,MAAA,kBAAkB,CAAC,MAAM,mCAAI,IAAI,CAAC;6BAC7C,KAAK,EAAL,wBAAK;wBACP,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,MAAM,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;wBAAzC,SAAyC,CAAC;;;wBAGtC,KAAK,GAAG,MAAA,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,0CAAE,WAAW,EAAE,CAAC;wBAClE,IAAI,CAAC,KAAK,EAAE;4BACV,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;yBAC9D;wBAEK,yBAAyB,GAAG,IAAA,6DAA8C,GAAE,CAAC;wBAC7E,MAAM,GAAG,yBAAyB,CAAC,SAAS,EAAE,CAAC;wBAC/C,WAAW,GAAG,IAAI,0BAAW,EAAE,CAAC;wBAErB,qBAAM,IAAI,CAAC,aAAa,CAAC;gCACxC,IAAI,EAAE,IAAI,CAAC,IAAI;gCACf,KAAK,OAAA;gCACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;gCACvB,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;gCACpC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;6BAC5C,CAAC,EAAA;;wBANI,QAAQ,GAAG,SAMf;6BACE,CAAA,QAAQ,KAAK,QAAQ,CAAA,EAArB,wBAAqB;wBACvB,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;6BAC7E,MAAM,CAAC,2BAA2B,EAAlC,wBAAkC;wBAC9B,KAAiB,MAAM,CAAC,2BAA2B,EAAE,EAAnD,gBAAI,EAAE,gBAAI,CAA0C;wBAC5D,qBAAM,WAAW,CAAC,SAAS,YACzB,EAAE,EAAE,KAAK,EACT,OAAO,EAAE,MAAM,CAAC,mBAAmB,KAAI,MAAA,MAAM,CAAC,OAAO,0CAAE,OAAO,CAAA,IAAI,wBAAwB,EAC1F,IAAI,QAAA,EACJ,IAAI,QAAA,IACD,MAAM,CAAC,OAAO,EACjB,EAAA;;wBANF,SAME,CAAC;;4BAEL,sBAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,OAAA,EAAE,EAAC;;wBAGhC,KAAiB,MAAM,CAAC,sBAAsB,EAAE,EAA9C,IAAI,UAAA,EAAE,IAAI,UAAA,CAAqC;wBACvD,qBAAM,WAAW,CAAC,SAAS,YACzB,EAAE,EAAE,KAAK,EACT,OAAO,EAAE,MAAM,CAAC,cAAc,KAAI,MAAA,MAAM,CAAC,OAAO,0CAAE,OAAO,CAAA,IAAI,UAAU,EACvE,IAAI,MAAA,EACJ,IAAI,MAAA,IACD,MAAM,CAAC,OAAO,EACjB,EAAA;;wBANF,SAME,CAAC;wBACH,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBACzD,sBAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,OAAA,EAAE,EAAC;;;;KACtC;IAEK,2BAAU,GAAhB,UAAiB,KAAa;;;;;;;wBACtB,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBACnD,oBAAoB,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;;;;wBAEzC,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACR,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAA;;wBAAvE,UAAU,GAAG,SAA0D;wBAC7E,IAAI,UAAU,EAAE;4BACd,sBAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,EAAC;yBACvE;wBAEK,WAAW,GAAG,IAAI,0BAAW,EAAE,CAAC;wBAChC,oBAAoB,GAAG,IAAA,iDAAkC,GAAE,CAAC;wBAClE,IAAI,CAAC,oBAAoB,EAAE;4BACzB,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;yBACH;wBACK,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC;wBAE1C,KAAK,GAAG,eAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;wBAC5C,cAAc,GAAG,IAAA,gBAAM,GAAE,CAAC,GAAG,CAAC,6BAAqB,EAAE,MAAM,CAAC,CAAC;wBACtD,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAA;;wBAArE,MAAM,GAAG,SAA4D;6BACrE,MAAM,EAAN,wBAAM;wBACR,MAAM,yBACD,MAAM,KACT,KAAK,OAAA,EACL,cAAc,gBAAA,GACf,CAAC;wBACF,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAA;;wBAAtC,SAAsC,CAAC;;;wBAEjC,MAAM,GAAG,IAAI,eAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;wBAClC,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,MAAM,EAAE;gCACtC,KAAK,EAAE,oBAAoB;gCAC3B,KAAK,OAAA;gCACL,cAAc,gBAAA;gCACd,SAAS,EAAE,MAAM;6BAClB,CAAC,EAAA;;wBALF,MAAM,GAAG,SAKP,CAAC;;;wBAGC,KAAiB,MAAM,CAAC,eAAe,CAAC,UAAG,eAAQ,CAAC,IAAI,CAAC,MAAM,oBAAU,KAAK,CAAE,CAAC,EAA/E,IAAI,UAAA,EAAE,IAAI,UAAA,CAAsE;wBACxF,qBAAM,WAAW,CAAC,SAAS,YACzB,EAAE,EAAE,oBAAoB,EACxB,OAAO,EAAE,CAAA,MAAA,MAAM,CAAC,OAAO,0CAAE,OAAO,KAAI,gBAAgB,EACpD,IAAI,MAAA,EACJ,IAAI,MAAA,IACD,MAAM,CAAC,OAAO,EACjB,EAAA;;wBANF,SAME,CAAC;wBAEH,sBAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAC;;;wBAEtB,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,KAAK,SAAA,EAAE,CAAC,CAAC;wBAC/F,sBAAO;gCACL,IAAI,EAAE,KAAK;gCACX,KAAK,EAAE,iBAAiB;6BACzB,EAAC;;;;;KAEL;IAEK,6BAAY,GAAlB,UAAmB,KAAa;;;;;;wBAC9B,IAAI,CAAC,KAAK,EAAE;4BACV,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;yBAC3C;wBAIK,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBAC3B,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;wBAA9D,SAA8D,CAAC;;;;;KAChE;IAED;;;OAGG;IACG,iCAAgB,GAAtB,UAAuB,WAA+B;;;;;;;wBAE5C,MAAM,GAAG,IAAA,qCAA6B,GAAE,CAAC,SAAS,EAAE,CAAC;wBACnD,YAAY,GAAK,MAAM,aAAX,CAAY;6BAK5B,WAAW,EAAX,wBAAW;wBACE,qBAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAA;;wBAA7C,MAAM,GAAG,SAAoC;wBACnD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE;4BAC/B,sBAAO;oCACL,OAAO,EAAE,KAAK;oCACd,KAAK,EAAE,qEAAqE;oCAC5E,YAAY,cAAA;iCACb,EAAC;yBACH;wBACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE;4BAChC,sBAAO;oCACL,OAAO,EAAE,KAAK;oCACd,KAAK,EAAE,iFAAiF;oCACxF,YAAY,cAAA;iCACb,EAAC;yBACH;wBAED,sBAAO;gCACL,OAAO,EAAE,IAAI;gCACb,YAAY,cAAA;gCACZ,MAAM,EAAE,MAAM,CAAC,MAAM;6BACtB,EAAC;;wBAGJ,IAAI,YAAY,EAAE;4BAChB,sBAAO;oCACL,OAAO,EAAE,KAAK;oCACd,KAAK,EAAE,mCAAmC;oCAC1C,YAAY,cAAA;iCACb,EAAC;yBACH;wBAED,sBAAO;gCACL,OAAO,EAAE,IAAI;gCACb,YAAY,cAAA;6BACb,EAAC;;;wBAEF,sBAAO;gCACL,OAAO,EAAE,KAAK;gCACd,KAAK,EAAE,8BAA8B;6BACtC,EAAC;;;;;KAEL;IAED;;;;;;;OAOG;IACG,8BAAa,GAAnB,UAAoB,OAMnB;;;;;;;wBACO,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACrB,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;wBACrB,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;wBAAnD,YAAY,GAAG,SAAoC;wBACzD,IAAI,YAAY,EAAE;4BAChB,sBAAO,QAAQ,EAAC;yBACjB;wBAEK,KAAA,CAAA,KAAA,EAAE,CAAA,CAAC,MAAM,CAAA;8BAAC,aAAM,CAAC,IAAI;;4BACzB,IAAI,EAAE,OAAO,CAAC,IAAI;4BAClB,KAAK,OAAA;;wBACK,qBAAM,IAAI,+BAAc,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAA;4BAH7D,qBAAM,yBAGJ,WAAQ,GAAE,SAAiD;gCAC3D,gBAAa,GAAE,OAAO,CAAC,aAAa;gCACpC,QAAK,GAAE,EAAE;gCACT,YAAS,GAAE,OAAO,CAAC,SAAS;sCAC5B,EAAA;;wBAPF,SAOE,CAAC;wBACH,sBAAO,SAAS,EAAC;;;;KAClB;IAED,iGAAiG;IACnF,6BAAY,GAA1B,UAA2B,KAAa;;;;;;wBAChC,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACZ,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,MAAM,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;wBAA/C,MAAM,GAAG,SAAsC;wBAErD,IAAI,CAAC,MAAM,EAAE;4BACX,sBAAO,EAAE,MAAM,EAAE,UAAU,EAAE,EAAC;yBAC/B;wBAED,IAAI,MAAM,CAAC,cAAc,IAAI,IAAA,gBAAM,EAAC,MAAM,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,IAAA,gBAAM,GAAE,CAAC,EAAE;4BAC7E,sBAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAC;yBAC9B;wBAED,sBAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,QAAA,EAAE,EAAC;;;;KACpC;IACH,aAAC;AAAD,CAAC,AA/PD,IA+PC;AA/PY,wBAAM"}

package/dist/src/services/UpdateUserInfo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateUserInfo.d.ts","sourceRoot":"","sources":["../../../src/services/UpdateUserInfo.ts"],"names":[],"mappings":"AAKA,OAAO,EAA0B,sBAAsB,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAGrH,qBAAa,cAAe,YAAW,qBAAqB;IAC1D,wEAAwE;IACxE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAO;IAC1C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAM;IACjD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAoB;IAClE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,0BAA0B,CAMhD;IACF,mGAAmG;IACnG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAM;IACrD,mGAAmG;IACnG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAiF;IAE/G,eAAe;;;;MAIpB;IAEI,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAI9C,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAmD7F,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAoB3E,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IActD,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC;IAIzC;;;;;OAKG;YACW,SAAS;IAWvB;;;;;;;OAOG;YACW,YAAY;IAW1B;;;;;;;OAOG;YACW,YAAY;YAWZ,UAAU;CAMzB"}
+{"version":3,"file":"UpdateUserInfo.d.ts","sourceRoot":"","sources":["../../../src/services/UpdateUserInfo.ts"],"names":[],"mappings":"AAIA,OAAO,EAA0B,sBAAsB,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAIrH,qBAAa,cAAe,YAAW,qBAAqB;IAC1D,wEAAwE;IACxE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAO;IAC1C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAM;IACjD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAoB;IAClE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,0BAA0B,CAMhD;IACF,mGAAmG;IACnG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAM;IACrD,mGAAmG;IACnG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAiF;IAE/G,eAAe;;;;MAIpB;IAEI,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAI9C,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAkD7F,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAoB3E,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IActD,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC;IAIzC;;;;;OAKG;YACW,SAAS;IAWvB;;;;;;;OAOG;YACW,YAAY;IAW1B;;;;;;;OAOG;YACW,YAAY;YAWZ,UAAU;CAMzB"}