handoff-app 2.0.0-2 → 2.0.0-3

package/dist/registry/auth/installation.js

@@ -0,0 +1,105 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installRegistry = exports.getRegistryInstallationState = exports.getRegistryInstallation = exports.REGISTRY_INSTALLATION_ID = exports.REGISTRY_AUTH_SCHEMA_VERSION = void 0;
+const drizzle_orm_1 = require("drizzle-orm");
+const node_crypto_1 = require("node:crypto");
+const schema_1 = require("../db/schema");
+const database_1 = require("./database");
+const password_1 = require("./password");
+const user_record_1 = require("./user-record");
+const validation_1 = require("./validation");
+/** Migration number that introduced the registry authentication schema. */
+exports.REGISTRY_AUTH_SCHEMA_VERSION = 5;
+exports.REGISTRY_INSTALLATION_ID = 'default';
+const getRegistryInstallation = (db) => __awaiter(void 0, void 0, void 0, function* () {
+    const [installation] = yield db
+        .select()
+        .from(schema_1.registryInstallations)
+        .where((0, drizzle_orm_1.eq)(schema_1.registryInstallations.id, exports.REGISTRY_INSTALLATION_ID))
+        .limit(1);
+    return installation !== null && installation !== void 0 ? installation : null;
+});
+exports.getRegistryInstallation = getRegistryInstallation;
+const getRegistryInstallationState = (db) => __awaiter(void 0, void 0, void 0, function* () {
+    const installation = yield (0, exports.getRegistryInstallation)(db);
+    const [{ value }] = yield db.select({ value: (0, drizzle_orm_1.count)() }).from(schema_1.registryUsers);
+    const userCount = Number(value);
+    if (installation)
+        return { status: 'installed', installation, userCount };
+    return userCount === 0
+        ? { status: 'ready', installation: null, userCount: 0 }
+        : { status: 'inconsistent', installation: null, userCount };
+});
+exports.getRegistryInstallationState = getRegistryInstallationState;
+/**
+ * Complete first-visitor installation under a transaction-scoped advisory lock. Password hashing is
+ * intentionally performed before taking the lock; all state checks are repeated inside it.
+ */
+const installRegistry = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const email = (0, validation_1.validateRegistryEmail)(input.email);
+    if (!email)
+        return { ok: false, reason: 'invalid_email' };
+    const name = (0, validation_1.validateRegistryDisplayName)(input.name);
+    if (!name)
+        return { ok: false, reason: 'invalid_name' };
+    const passwordValidation = (0, password_1.validatePassword)(input.password);
+    if ('error' in passwordValidation) {
+        return { ok: false, reason: 'invalid_password', error: passwordValidation.error };
+    }
+    const passwordHash = yield (0, password_1.hashPassword)(input.password);
+    const now = (_a = input.now) !== null && _a !== void 0 ? _a : new Date();
+    return (0, database_1.withRegistryTransaction)(db, (tx) => __awaiter(void 0, void 0, void 0, function* () {
+        yield (0, database_1.acquireRegistryAdvisoryLock)(tx, database_1.REGISTRY_INSTALL_LOCK_ID);
+        const [installation] = yield tx
+            .select()
+            .from(schema_1.registryInstallations)
+            .where((0, drizzle_orm_1.eq)(schema_1.registryInstallations.id, exports.REGISTRY_INSTALLATION_ID))
+            .limit(1);
+        if (installation)
+            return { ok: false, reason: 'already_installed' };
+        const [{ value }] = yield tx.select({ value: (0, drizzle_orm_1.count)() }).from(schema_1.registryUsers);
+        if (Number(value) > 0)
+            return { ok: false, reason: 'users_exist' };
+        const userId = (0, node_crypto_1.randomUUID)();
+        const [userRow] = yield tx
+            .insert(schema_1.registryUsers)
+            .values({
+            id: userId,
+            email,
+            name,
+            role: 'admin',
+            status: 'active',
+            passwordHash,
+            emailVerifiedAt: now,
+            createdAt: now,
+            updatedAt: now,
+        })
+            .returning();
+        const [createdInstallation] = yield tx
+            .insert(schema_1.registryInstallations)
+            .values({
+            id: exports.REGISTRY_INSTALLATION_ID,
+            status: 'installed',
+            schemaVersion: exports.REGISTRY_AUTH_SCHEMA_VERSION,
+            initialAdminUserId: userId,
+            installedAt: now,
+        })
+            .returning();
+        return {
+            ok: true,
+            user: (0, user_record_1.toRegistryUser)(userRow),
+            installation: createdInstallation,
+        };
+    }));
+});
+exports.installRegistry = installRegistry;

package/dist/registry/auth/password.d.ts

@@ -0,0 +1,12 @@
+export declare const MINIMUM_PASSWORD_LENGTH = 12;
+export declare const MAXIMUM_PASSWORD_LENGTH = 1024;
+export type PasswordValidationResult = {
+    valid: true;
+} | {
+    valid: false;
+    error: string;
+};
+export declare const validatePassword: (password: string) => PasswordValidationResult;
+/** Versioned scrypt encoding: `scrypt-v1:<base64url salt>:<base64url derived key>`. */
+export declare const hashPassword: (password: string) => Promise<string>;
+export declare const verifyPassword: (password: string, encoded: string | null | undefined) => Promise<boolean>;

package/dist/registry/auth/password.js

@@ -0,0 +1,58 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyPassword = exports.hashPassword = exports.validatePassword = exports.MAXIMUM_PASSWORD_LENGTH = exports.MINIMUM_PASSWORD_LENGTH = void 0;
+const node_crypto_1 = require("node:crypto");
+const node_util_1 = require("node:util");
+const scryptAsync = (0, node_util_1.promisify)(node_crypto_1.scrypt);
+const PASSWORD_HASH_VERSION = 'scrypt-v1';
+const PASSWORD_KEY_LENGTH = 64;
+exports.MINIMUM_PASSWORD_LENGTH = 12;
+exports.MAXIMUM_PASSWORD_LENGTH = 1024;
+const validatePassword = (password) => {
+    if (password.length < exports.MINIMUM_PASSWORD_LENGTH) {
+        return { valid: false, error: `Password must be at least ${exports.MINIMUM_PASSWORD_LENGTH} characters.` };
+    }
+    if (password.length > exports.MAXIMUM_PASSWORD_LENGTH) {
+        return { valid: false, error: `Password must be at most ${exports.MAXIMUM_PASSWORD_LENGTH} characters.` };
+    }
+    return { valid: true };
+};
+exports.validatePassword = validatePassword;
+/** Versioned scrypt encoding: `scrypt-v1:<base64url salt>:<base64url derived key>`. */
+const hashPassword = (password) => __awaiter(void 0, void 0, void 0, function* () {
+    const validation = (0, exports.validatePassword)(password);
+    if ('error' in validation)
+        throw new Error(validation.error);
+    const salt = (0, node_crypto_1.randomBytes)(16);
+    const derived = (yield scryptAsync(password, salt, PASSWORD_KEY_LENGTH));
+    return `${PASSWORD_HASH_VERSION}:${salt.toString('base64url')}:${derived.toString('base64url')}`;
+});
+exports.hashPassword = hashPassword;
+const verifyPassword = (password, encoded) => __awaiter(void 0, void 0, void 0, function* () {
+    if (!encoded || password.length > exports.MAXIMUM_PASSWORD_LENGTH)
+        return false;
+    const [version, saltText, hashText, ...rest] = encoded.split(':');
+    if (version !== PASSWORD_HASH_VERSION || !saltText || !hashText || rest.length)
+        return false;
+    try {
+        const salt = Buffer.from(saltText, 'base64url');
+        const expected = Buffer.from(hashText, 'base64url');
+        if (salt.length !== 16 || expected.length !== PASSWORD_KEY_LENGTH)
+            return false;
+        const actual = (yield scryptAsync(password, salt, PASSWORD_KEY_LENGTH));
+        return actual.length === expected.length && (0, node_crypto_1.timingSafeEqual)(actual, expected);
+    }
+    catch (_a) {
+        return false;
+    }
+});
+exports.verifyPassword = verifyPassword;

package/dist/registry/auth/rate-limits.d.ts

@@ -0,0 +1,22 @@
+import type { RegistryDatabase } from '../db/client';
+import { type RegistryRateLimitBucket } from '../db/schema';
+export interface ConsumeAuthRateLimitInput {
+    bucket: RegistryRateLimitBucket;
+    identifier: string;
+    limit: number;
+    windowMs: number;
+    now?: Date;
+}
+export interface AuthRateLimitResult {
+    allowed: boolean;
+    attempts: number;
+    limit: number;
+    remaining: number;
+    resetsAt: Date;
+    retryAfterSeconds: number;
+}
+export declare const hashRateLimitIdentifier: (bucket: RegistryRateLimitBucket, identifier: string) => string;
+/** Atomic fixed-window counter shared by all registry instances. */
+export declare const consumeAuthRateLimit: (db: RegistryDatabase, input: ConsumeAuthRateLimitInput) => Promise<AuthRateLimitResult>;
+export declare const clearAuthRateLimit: (db: RegistryDatabase, bucket: RegistryRateLimitBucket, identifier: string) => Promise<number>;
+export declare const purgeExpiredAuthRateLimits: (db: RegistryDatabase, now?: Date) => Promise<number>;

package/dist/registry/auth/rate-limits.js

@@ -0,0 +1,75 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.purgeExpiredAuthRateLimits = exports.clearAuthRateLimit = exports.consumeAuthRateLimit = exports.hashRateLimitIdentifier = void 0;
+const drizzle_orm_1 = require("drizzle-orm");
+const schema_1 = require("../db/schema");
+const crypto_1 = require("./crypto");
+const hashRateLimitIdentifier = (bucket, identifier) => (0, crypto_1.hashSecret)(`${bucket}:${identifier.trim().toLowerCase()}`);
+exports.hashRateLimitIdentifier = hashRateLimitIdentifier;
+/** Atomic fixed-window counter shared by all registry instances. */
+const consumeAuthRateLimit = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    if (!Number.isInteger(input.limit) || input.limit < 1)
+        throw new Error('Rate-limit limit must be a positive integer.');
+    if (!Number.isInteger(input.windowMs) || input.windowMs < 1) {
+        throw new Error('Rate-limit windowMs must be a positive integer.');
+    }
+    const now = (_a = input.now) !== null && _a !== void 0 ? _a : new Date();
+    const windowStartedAt = new Date(Math.floor(now.getTime() / input.windowMs) * input.windowMs);
+    const resetsAt = new Date(windowStartedAt.getTime() + input.windowMs);
+    const identifierHash = (0, exports.hashRateLimitIdentifier)(input.bucket, input.identifier);
+    const [counter] = yield db
+        .insert(schema_1.registryAuthRateLimits)
+        .values({
+        bucket: input.bucket,
+        identifierHash,
+        windowStartedAt,
+        attempts: 1,
+        expiresAt: resetsAt,
+        updatedAt: now,
+    })
+        .onConflictDoUpdate({
+        target: [schema_1.registryAuthRateLimits.bucket, schema_1.registryAuthRateLimits.identifierHash, schema_1.registryAuthRateLimits.windowStartedAt],
+        set: {
+            attempts: (0, drizzle_orm_1.sql) `${schema_1.registryAuthRateLimits.attempts} + 1`,
+            expiresAt: resetsAt,
+            updatedAt: now,
+        },
+    })
+        .returning({ attempts: schema_1.registryAuthRateLimits.attempts });
+    const attempts = counter.attempts;
+    return {
+        allowed: attempts <= input.limit,
+        attempts,
+        limit: input.limit,
+        remaining: Math.max(0, input.limit - attempts),
+        resetsAt,
+        retryAfterSeconds: attempts > input.limit ? Math.max(1, Math.ceil((resetsAt.getTime() - now.getTime()) / 1000)) : 0,
+    };
+});
+exports.consumeAuthRateLimit = consumeAuthRateLimit;
+const clearAuthRateLimit = (db, bucket, identifier) => __awaiter(void 0, void 0, void 0, function* () {
+    const rows = yield db
+        .delete(schema_1.registryAuthRateLimits)
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryAuthRateLimits.bucket, bucket), (0, drizzle_orm_1.eq)(schema_1.registryAuthRateLimits.identifierHash, (0, exports.hashRateLimitIdentifier)(bucket, identifier))))
+        .returning({ identifierHash: schema_1.registryAuthRateLimits.identifierHash });
+    return rows.length;
+});
+exports.clearAuthRateLimit = clearAuthRateLimit;
+const purgeExpiredAuthRateLimits = (db_1, ...args_1) => __awaiter(void 0, [db_1, ...args_1], void 0, function* (db, now = new Date()) {
+    const rows = yield db
+        .delete(schema_1.registryAuthRateLimits)
+        .where((0, drizzle_orm_1.lt)(schema_1.registryAuthRateLimits.expiresAt, now))
+        .returning({ identifierHash: schema_1.registryAuthRateLimits.identifierHash });
+    return rows.length;
+});
+exports.purgeExpiredAuthRateLimits = purgeExpiredAuthRateLimits;

package/dist/registry/auth/types.d.ts

@@ -0,0 +1,26 @@
+import type { RegistryAccessScope, RegistryUserRole, RegistryUserStatus } from '../db/schema';
+export type { RegistryAccessScope, RegistryUserRole, RegistryUserStatus };
+export declare const REGISTRY_READ_SCOPE: "registry:read";
+export declare const REGISTRY_WRITE_SCOPE: "registry:write";
+export interface RegistryUser {
+    id: string;
+    email: string;
+    name: string | null;
+    image: string | null;
+    role: RegistryUserRole;
+    status: RegistryUserStatus;
+    emailVerifiedAt: Date | null;
+    authVersion: number;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface RegistryPrincipal {
+    tokenId: string;
+    userId: string;
+    email: string;
+    name: string | null;
+    role: RegistryUserRole;
+    scopes: RegistryAccessScope[];
+}
+export declare const scopesForRegistryRole: (role: RegistryUserRole) => RegistryAccessScope[];
+export declare const registryPrincipalHasScope: (principal: RegistryPrincipal, scope: RegistryAccessScope) => boolean;

package/dist/registry/auth/types.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registryPrincipalHasScope = exports.scopesForRegistryRole = exports.REGISTRY_WRITE_SCOPE = exports.REGISTRY_READ_SCOPE = void 0;
+exports.REGISTRY_READ_SCOPE = 'registry:read';
+exports.REGISTRY_WRITE_SCOPE = 'registry:write';
+const scopesForRegistryRole = (role) => role === 'admin' ? [exports.REGISTRY_READ_SCOPE, exports.REGISTRY_WRITE_SCOPE] : [exports.REGISTRY_READ_SCOPE];
+exports.scopesForRegistryRole = scopesForRegistryRole;
+const registryPrincipalHasScope = (principal, scope) => principal.scopes.includes(scope);
+exports.registryPrincipalHasScope = registryPrincipalHasScope;

package/dist/registry/auth/user-record.d.ts

@@ -0,0 +1,13 @@
+import type { RegistryUser } from './types';
+export declare const toRegistryUser: (row: {
+    id: string;
+    email: string;
+    name: string | null;
+    image: string | null;
+    role: RegistryUser["role"];
+    status: RegistryUser["status"];
+    emailVerifiedAt: Date | null;
+    authVersion: number;
+    createdAt: Date;
+    updatedAt: Date;
+}) => RegistryUser;

package/dist/registry/auth/user-record.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toRegistryUser = void 0;
+const toRegistryUser = (row) => ({
+    id: row.id,
+    email: row.email,
+    name: row.name,
+    image: row.image,
+    role: row.role,
+    status: row.status,
+    emailVerifiedAt: row.emailVerifiedAt,
+    authVersion: row.authVersion,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+});
+exports.toRegistryUser = toRegistryUser;

package/dist/registry/auth/users.d.ts

@@ -0,0 +1,31 @@
+import type { RegistryDatabase } from '../db/client';
+import { type RegistryUserRole } from '../db/schema';
+import type { RegistryUser, RegistryUserStatus } from './types';
+export type RegistryUserMutationResult = {
+    ok: true;
+    user: RegistryUser;
+} | {
+    ok: false;
+    reason: 'not_found' | 'invalid_name' | 'invalid_image' | 'invalid_role' | 'last_admin' | 'self_deactivation' | 'invalid_status';
+};
+export declare const getRegistryUserById: (db: RegistryDatabase, userId: string) => Promise<RegistryUser | null>;
+export declare const listRegistryUsers: (db: RegistryDatabase) => Promise<RegistryUser[]>;
+/** Credentials authentication is intentionally enumeration-safe: all failures return null. */
+export declare const authenticateRegistryCredentials: (db: RegistryDatabase, email: string, password: string) => Promise<RegistryUser | null>;
+export declare const updateRegistryUserProfile: (db: RegistryDatabase, input: {
+    userId: string;
+    name: string;
+    image?: string | null;
+    now?: Date;
+}) => Promise<RegistryUserMutationResult>;
+export declare const updateRegistryUserRole: (db: RegistryDatabase, input: {
+    userId: string;
+    role: RegistryUserRole;
+    now?: Date;
+}) => Promise<RegistryUserMutationResult>;
+export declare const setRegistryUserStatus: (db: RegistryDatabase, input: {
+    userId: string;
+    status: Extract<RegistryUserStatus, "active" | "deactivated">;
+    actorUserId?: string;
+    now?: Date;
+}) => Promise<RegistryUserMutationResult>;

package/dist/registry/auth/users.js

@@ -0,0 +1,135 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setRegistryUserStatus = exports.updateRegistryUserRole = exports.updateRegistryUserProfile = exports.authenticateRegistryCredentials = exports.listRegistryUsers = exports.getRegistryUserById = void 0;
+const drizzle_orm_1 = require("drizzle-orm");
+const schema_1 = require("../db/schema");
+const access_tokens_1 = require("./access-tokens");
+const database_1 = require("./database");
+const crypto_1 = require("./crypto");
+const password_1 = require("./password");
+const user_record_1 = require("./user-record");
+const validation_1 = require("./validation");
+const DUMMY_PASSWORD_HASH = 'scrypt-v1:AAAAAAAAAAAAAAAAAAAAAA:yK99vlYIaV57oeErq8gHqx18DxRfiUoHwETrTFUjt5JasWeMsu62stPgY-fO0TUeUc6uAu1hge_vuSQY15vvuQ';
+const getRegistryUserById = (db, userId) => __awaiter(void 0, void 0, void 0, function* () {
+    const [row] = yield db.select().from(schema_1.registryUsers).where((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, userId)).limit(1);
+    return row ? (0, user_record_1.toRegistryUser)(row) : null;
+});
+exports.getRegistryUserById = getRegistryUserById;
+const listRegistryUsers = (db) => __awaiter(void 0, void 0, void 0, function* () {
+    const rows = yield db.select().from(schema_1.registryUsers).orderBy(schema_1.registryUsers.createdAt);
+    return rows.map(user_record_1.toRegistryUser);
+});
+exports.listRegistryUsers = listRegistryUsers;
+/** Credentials authentication is intentionally enumeration-safe: all failures return null. */
+const authenticateRegistryCredentials = (db, email, password) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const normalizedEmail = (0, crypto_1.normalizeEmail)(email);
+    const [row] = yield db.select().from(schema_1.registryUsers).where((0, drizzle_orm_1.eq)(schema_1.registryUsers.email, normalizedEmail)).limit(1);
+    const passwordMatches = yield (0, password_1.verifyPassword)(password, (_a = row === null || row === void 0 ? void 0 : row.passwordHash) !== null && _a !== void 0 ? _a : DUMMY_PASSWORD_HASH);
+    return row && row.status === 'active' && row.passwordHash && passwordMatches ? (0, user_record_1.toRegistryUser)(row) : null;
+});
+exports.authenticateRegistryCredentials = authenticateRegistryCredentials;
+const updateRegistryUserProfile = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const name = (0, validation_1.validateRegistryDisplayName)(input.name);
+    if (!name)
+        return { ok: false, reason: 'invalid_name' };
+    const image = (0, validation_1.validateRegistryImageUrl)(input.image);
+    if (image === false)
+        return { ok: false, reason: 'invalid_image' };
+    const [row] = yield db
+        .update(schema_1.registryUsers)
+        .set({ name, image, updatedAt: (_a = input.now) !== null && _a !== void 0 ? _a : new Date() })
+        .where((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, input.userId))
+        .returning();
+    return row ? { ok: true, user: (0, user_record_1.toRegistryUser)(row) } : { ok: false, reason: 'not_found' };
+});
+exports.updateRegistryUserProfile = updateRegistryUserProfile;
+const updateRegistryUserRole = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    if (input.role !== 'admin' && input.role !== 'member')
+        return { ok: false, reason: 'invalid_role' };
+    return (0, database_1.withRegistryTransaction)(db, (tx) => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        yield (0, database_1.acquireRegistryAdvisoryLock)(tx, database_1.REGISTRY_ADMIN_LOCK_ID);
+        const [target] = yield tx.select().from(schema_1.registryUsers).where((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, input.userId)).limit(1);
+        if (!target)
+            return { ok: false, reason: 'not_found' };
+        if (target.role === input.role)
+            return { ok: true, user: (0, user_record_1.toRegistryUser)(target) };
+        if (target.role === 'admin' && target.status === 'active' && input.role === 'member') {
+            const [{ value }] = yield tx
+                .select({ value: (0, drizzle_orm_1.count)() })
+                .from(schema_1.registryUsers)
+                .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryUsers.role, 'admin'), (0, drizzle_orm_1.eq)(schema_1.registryUsers.status, 'active')));
+            if (Number(value) <= 1)
+                return { ok: false, reason: 'last_admin' };
+        }
+        const now = (_a = input.now) !== null && _a !== void 0 ? _a : new Date();
+        const [row] = yield tx
+            .update(schema_1.registryUsers)
+            .set({
+            role: input.role,
+            authVersion: (0, drizzle_orm_1.sql) `${schema_1.registryUsers.authVersion} + 1`,
+            updatedAt: now,
+        })
+            .where((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, input.userId))
+            .returning();
+        if (target.role === 'admin' && input.role === 'member') {
+            yield (0, access_tokens_1.revokeAllRegistryAccessTokens)(tx, input.userId, now);
+        }
+        return { ok: true, user: (0, user_record_1.toRegistryUser)(row) };
+    }));
+});
+exports.updateRegistryUserRole = updateRegistryUserRole;
+const setRegistryUserStatus = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    if (input.status !== 'active' && input.status !== 'deactivated') {
+        return { ok: false, reason: 'invalid_status' };
+    }
+    if (input.status === 'deactivated' && input.actorUserId === input.userId) {
+        return { ok: false, reason: 'self_deactivation' };
+    }
+    return (0, database_1.withRegistryTransaction)(db, (tx) => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        yield (0, database_1.acquireRegistryAdvisoryLock)(tx, database_1.REGISTRY_ADMIN_LOCK_ID);
+        const [target] = yield tx.select().from(schema_1.registryUsers).where((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, input.userId)).limit(1);
+        if (!target)
+            return { ok: false, reason: 'not_found' };
+        if (target.status === input.status)
+            return { ok: true, user: (0, user_record_1.toRegistryUser)(target) };
+        if (input.status === 'active' && target.status === 'invited') {
+            return { ok: false, reason: 'invalid_status' };
+        }
+        if (target.role === 'admin' && target.status === 'active' && input.status === 'deactivated') {
+            const [{ value }] = yield tx
+                .select({ value: (0, drizzle_orm_1.count)() })
+                .from(schema_1.registryUsers)
+                .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryUsers.role, 'admin'), (0, drizzle_orm_1.eq)(schema_1.registryUsers.status, 'active')));
+            if (Number(value) <= 1)
+                return { ok: false, reason: 'last_admin' };
+        }
+        const now = (_a = input.now) !== null && _a !== void 0 ? _a : new Date();
+        const [row] = yield tx
+            .update(schema_1.registryUsers)
+            .set({
+            status: input.status,
+            authVersion: (0, drizzle_orm_1.sql) `${schema_1.registryUsers.authVersion} + 1`,
+            updatedAt: now,
+        })
+            .where((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, input.userId))
+            .returning();
+        if (input.status === 'deactivated') {
+            yield (0, access_tokens_1.revokeAllRegistryAccessTokens)(tx, input.userId, now);
+        }
+        return { ok: true, user: (0, user_record_1.toRegistryUser)(row) };
+    }));
+});
+exports.setRegistryUserStatus = setRegistryUserStatus;

package/dist/registry/auth/validation.d.ts

@@ -0,0 +1,3 @@
+export declare const validateRegistryEmail: (email: string) => string | null;
+export declare const validateRegistryDisplayName: (name: string) => string | null;
+export declare const validateRegistryImageUrl: (image: string | null | undefined) => string | null | false;

package/dist/registry/auth/validation.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateRegistryImageUrl = exports.validateRegistryDisplayName = exports.validateRegistryEmail = void 0;
+const crypto_1 = require("./crypto");
+const SIMPLE_EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const validateRegistryEmail = (email) => {
+    const normalized = (0, crypto_1.normalizeEmail)(email);
+    return normalized.length <= 320 && SIMPLE_EMAIL_PATTERN.test(normalized) ? normalized : null;
+};
+exports.validateRegistryEmail = validateRegistryEmail;
+const validateRegistryDisplayName = (name) => {
+    const normalized = name.trim();
+    return normalized && normalized.length <= 120 ? normalized : null;
+};
+exports.validateRegistryDisplayName = validateRegistryDisplayName;
+const validateRegistryImageUrl = (image) => {
+    const normalized = image === null || image === void 0 ? void 0 : image.trim();
+    if (!normalized)
+        return null;
+    try {
+        const parsed = new URL(normalized);
+        return parsed.protocol === 'https:' && normalized.length <= 2048 ? normalized : false;
+    }
+    catch (_a) {
+        return false;
+    }
+};
+exports.validateRegistryImageUrl = validateRegistryImageUrl;

package/dist/registry/checkout/assets.js

@@ -62,7 +62,9 @@ const describeFetchFailure = (error, target, registryUrl) => {
         case 'runtime_mode_conflict':
             return `The registry at ${registryUrl} is not running in registry mode, so it cannot serve a checkout: ${error.message}`;
         case 'unauthorized':
-            return `The registry rejected the access token (401). Check the configured access token matches the registry's token.`;
+            return `The registry rejected the access token (401). Run \`handoff-app login --url ${registryUrl}\` again, or replace the user-issued CI token.`;
+        case 'forbidden':
+            return `The registry token does not have permission to checkout assets (403). Authorize a token with registry:read access.`;
         default:
             return error.message;
     }
@@ -83,7 +85,7 @@ const wouldChange = (absolutePath, bytes) => {
  * Recreates workspace asset files; prompts before overwriting changed local files unless `--force`.
  */
 const checkoutAssets = (handoff, collection) => __awaiter(void 0, void 0, void 0, function* () {
-    const connection = (0, index_1.resolveConnectionOrThrow)(handoff);
+    const connection = yield (0, index_1.resolveConnectionOrThrow)(handoff);
     if (collection && !(0, sets_1.isAssetCollection)(collection)) {
         throw new index_1.CheckoutError(`Unknown asset collection "${collection}". Supported collections: ${sets_1.ASSET_COLLECTIONS.join(', ')}.`);
     }

package/dist/registry/checkout/index.d.ts

@@ -23,7 +23,7 @@ export declare class CheckoutError extends Error {
  * host has no local workspace to write into) and a resolved registry URL + access token. Throws an
  * actionable {@link CheckoutError} naming the exact misconfiguration.
  */
-export declare const resolveConnectionOrThrow: (handoff: Handoff) => import("../connection").ResolvedRegistryConnection;
+export declare const resolveConnectionOrThrow: (handoff: Handoff) => Promise<import("../connection").ResolvedRegistryConnection>;
 /**
  * Checkout a single component, pattern, or page from the connected registry into this workspace.
  * Overwriting existing local files requires `--force` or an interactive confirmation.