Require administrator-requested host credential rotation (Refs #97)

src/lib/server/hosts/index.ts

@@ -879,11 +879,26 @@ export function rotateCredential(hostId: string, nextCredential?: string): strin
             if (existing) {
                 if (existing.host_id !== hostId || existing.revoked_at)
                     throw new Error('This credential cannot be reused.');
+                // A lost rotation response is retried with the persisted replacement.
+                // This acknowledges an active credential without authorizing another rotation.
                 return nextCredential;
             }
         }
+        const operation = database()
+            .prepare(
+                `SELECT id FROM ec_host_operations WHERE host_id=? AND kind='credentials.rotate'
+                AND state IN ('pending','accepted','running','unknown') ORDER BY created_at,rowid LIMIT 1`
+            )
+            .get(hostId) as { id: string } | undefined;
+        if (!operation)
+            throw new Error('Credential rotation requires an open administrator request.');
         revokeCredentials(hostId);
-        return issueCredential(hostId, nextCredential);
+        const credential = issueCredential(hostId, nextCredential);
+        reportHostOperationStatus(hostId, operation.id, {
+            state: 'completed',
+            result: { rotated: true }
+        });
+        return credential;
     })();
 }
 export function heartbeat(hostId: string, value: unknown): Host {