@bongos/core 1.19.331 → 1.19.333

package/src/bongos/auth.js

@@ -54,1107 +54,12 @@ const seams = require('../module-seams');
 const ic = require('../instance-config');
 const { branding, userAgent } = require('../branding');
 
-const SCOPE = 'read:user';
+const { SCOPE, authConfigured, grantedScopeCoversRepos, idpConfigured, idpEnabled, loadIdpConfig, scopeForWebFlow } = require('./auth-config.js');
+const { firstAdminLogin, firstTimeAdmissionBlocked, maybeSeatFirstAdmin, membershipKind, openEnrollmentEnabled, webAdmissionStatus } = require('./auth-admission.js');
+const { buildAuthorizeUrl, completeWebFlow, pollDeviceFlow, startDeviceFlow } = require('./auth-github.js');
+const { buildIdpAuthorizeUrl, completeDeviceExchange, completeIdpFlow, idpAuthorizeUrl, loadHubPublicKey, logoutTokenJtiSeenAndRecord, verifyHubAssertion, verifyHubLogoutToken } = require('./auth-idp.js');
+const { addDiscordGuildMember, buildDiscordAuthorizeUrl, discordAuthorizeUrl, discordBotConfigured, discordConfigured, exchangeDiscordCode, fetchDiscordUser, isValidDiscordUserId, loadDiscordBotToken, loadDiscordCreds, removeDiscordGuildMember } = require('./auth-discord.js');
 
-// The repo-acting scope the onboarding wizard opts into. `repo`, NOT `public_repo`.
-//
-// ADR 0143 §1 originally chose `public_repo` precisely to avoid the all-or-nothing
-// `repo`, and named its own reversal path: "revisit to `repo` only if private
-// support is needed". It is needed. `public_repo` grants write to PUBLIC repos
-// only, so ADOPTING an existing PRIVATE repo dies at the provisioner's scaffold
-// push with GitHub 403 "Write access to repository not granted" — observed live on
-// a private repo of the owner's. ADR 0155 takes the reversal at the owner's
-// explicit call, accepting the cost it names: a token we persist can now write to
-// EVERY repo the user owns, not just their public ones.
-const REPO_SCOPE = 'repo';
-
-// Web-flow OAuth scope. Identity (`read:user`) is all the builders'-hall sign-in
-// and the CLI Device Flow ever need. The onboarding wizard
-// (public-landing/create.html), however, lists + creates + is pushed to by the
-// provisioner on the signed-in user's own GitHub repos (task 1002099) — which
-// `read:user` cannot do — so it OPTS IN to REPO_SCOPE. Only the wizard passes
-// { repos:true }; every other sign-in stays identity-only. Pure + exported so the
-// exact scope string (a security-critical value) is unit-testable.
-function scopeForWebFlow({ repos = false } = {}) {
-  return repos ? `${SCOPE} ${REPO_SCOPE}` : SCOPE;
-}
-
-// Does a scope string GitHub ACTUALLY GRANTED still satisfy the repo surfaces?
-//
-// WHY THIS EXISTS. Widening scopeForWebFlow does NOT upgrade tokens already in
-// `github_oauth_tokens` — a row minted before ADR 0155 carries `public_repo`, which
-// is enough to list and create PUBLIC repos. So every wizard call would still 200
-// while silently omitting the user's PRIVATE repos from the picker, and the failure
-// would resurface far downstream at the provisioner's push. Callers check this and
-// re-prompt (repo_scope_required) instead of degrading quietly.
-//
-// GitHub returns granted scopes comma-separated in its own order (e.g.
-// "public_repo,read:user"), so parse rather than substring-match — `public_repo`
-// CONTAINS "repo" and a naive match would accept exactly the stale token this
-// guards against. `repo` implies `public_repo`, so `repo` alone is sufficient.
-function grantedScopeCoversRepos(granted) {
-  return String(granted || '')
-    .split(/[,\s]+/)
-    .map((s) => s.trim())
-    .includes(REPO_SCOPE);
-}
-
-// In-memory map of device_code → { interval, expires_at, last_polled_at, github_creds }
-// Device flow is ephemeral; restart of the Node process invalidates pending flows
-// (the user just re-runs the setup skill). Acceptable for V1 — scaling up means
-// moving this to Redis or a tiny `device_flows` table.
-const deviceFlows = new Map();
-
-function loadGithubCreds() {
-  // Resolve the configured instance prefix first (CLOUDBONGOS_ on a fresh
-  // instance, OTB_ on this one), then the legacy GDS_/PMS_ names — so the
-  // droplet's EnvironmentFile rename can lag the code deploy without breaking
-  // auth (R61 / task 1200).
-  const clientId = ic.resolveEnv('GITHUB_CLIENT_ID');
-  const clientSecret = ic.resolveEnv('GITHUB_CLIENT_SECRET');
-  if (clientId && clientSecret) {
-    return { client_id: clientId, client_secret: clientSecret };
-  }
-  // Local-dev fallback: try the new filename first, then the legacy one — each
-  // across the configured config dir and the legacy ~/.config/otb dir.
-  for (const name of ['gds-github.json', 'pms-github.json']) {
-    try {
-      const raw = ic.readConfigFileSync(name);
-      if (raw) {
-        const creds = JSON.parse(raw);
-        if (creds.client_id && creds.client_secret) return creds;
-      }
-    } catch (_) {
-      /* try next */
-    }
-  }
-  return null;
-}
-
-function authConfigured() {
-  return !!loadGithubCreds();
-}
-
-// -------------------------------------------------------------------------
-// Platform IdP federation (ADR 0141 §1) — when enabled, the instance's web +
-// CLI sign-in federate through the Cloud Bongos hub instead of talking to GitHub
-// directly. Identity is federated; authority is NOT — the instance still runs its
-// OWN admission gate + upsertBuilder + createSession, so the hub only answers
-// "who is this GitHub user" (ADR 0016). Direct-GitHub (auth.idp unset) stays the
-// unchanged fallback for self-hosted instances.
-// -------------------------------------------------------------------------
-
-// The switch is the branding auth.idp flag (committed, non-secret). Fail-soft to
-// false so a branding hiccup degrades to the direct-GitHub path rather than
-// breaking sign-in.
-function idpEnabled() {
-  try { return branding().auth?.idp === true; } catch { return false; }
-}
-
-// Resolve the hub federation config. The switch is the flag above; the hub origin
-// + client credentials come from ENV (<PREFIX>_HUB_ORIGIN / _HUB_CLIENT_ID /
-// _HUB_CLIENT_SECRET) — never a committed file, so the secret stays out of the
-// branding pack (mirrors loadGithubCreds's env-first posture). Provisioning
-// (ADR 0141 §4) writes these into the instance web.env. Returns null unless the
-// flag is on AND all three resolve → callers fall back to direct GitHub.
-function loadIdpConfig() {
-  if (!idpEnabled()) return null;
-  const origin = ic.resolveEnv('HUB_ORIGIN');
-  const clientId = ic.resolveEnv('HUB_CLIENT_ID');
-  const clientSecret = ic.resolveEnv('HUB_CLIENT_SECRET');
-  if (origin && clientId && clientSecret) {
-    return { origin: String(origin).replace(/\/+$/, ''), clientId, clientSecret };
-  }
-  return null;
-}
-
-function idpConfigured() {
-  return !!loadIdpConfig();
-}
-
-// The COARSE membership role to report to the hub (ADR 0141 §3) — owner if this
-// builder is the instance's configured firstAdmin, else a plain member. NEVER a rank.
-//
-// 'member', not 'builder' (task 1003090, ADR 0177 §"the fifth use"): ADR 0174 reserves
-// `role` — and the craft name 'Builder' — for Artist / Ideator / Builder, so the coarse
-// project membership says what it means. The legacy spelling still goes on the wire for
-// the cross-version window; see reportMembershipCheckIn.
-function membershipKind({ githubLogin } = {}) {
-  const fa = firstAdminLogin();
-  if (fa && String(githubLogin || '').toLowerCase() === fa.toLowerCase()) return 'owner';
-  return 'member';
-}
-
-// Best-effort server-to-server membership check-in to the hub (ADR 0141 §3): "this
-// github_id builds on project <client_id>, coarse membership <membership_kind>".
-//
-// BOTH SPELLINGS GO ON THE WIRE FOR THE WINDOW (task 1003090). The receiver is the
-// HUB, a different instance on its own upgrade schedule: send only the new field and
-// an un-upgraded hub silently defaults every membership to non-owner (it would drop
-// the owner flag); send only the legacy field and an upgraded hub keeps translating
-// forever. Sending both is what makes the two ends independent — the removal task
-// drops `role` once the hub is past the window. Runs on every
-// FEDERATED sign-in (the only sign-ins a federated instance has) so a CLI-only
-// project still appears in the builder's My Projects with no hub browser session.
-// Fire-and-forget + fully swallowed: a hub outage must NEVER fail a sign-in (mirrors
-// the onboarding stage tick). No-op on a self-hosted instance (idp unset).
-async function reportMembershipCheckIn({ githubId, githubLogin, displayName, avatarUrl }) {
-  const idp = loadIdpConfig();
-  if (!idp) return;
-  const kind = membershipKind({ githubLogin });
-  try {
-    await fetch(`${idp.origin}/api/gds/sso/membership/check-in`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
-      body: JSON.stringify({
-        client_id: idp.clientId,
-        client_secret: idp.clientSecret,
-        github_id: githubId,
-        github_login: githubLogin,
-        display_name: displayName ?? null,
-        avatar_url: avatarUrl ?? null,
-        membership_kind: kind,
-        // LEGACY (cross-version window): 'member' → 'builder' for an un-upgraded hub.
-        role: kind === 'member' ? 'builder' : kind,
-      }),
-    });
-  } catch (err) {
-    console.log('[auth] hub membership check-in failed (non-blocking):', err.message);
-  }
-}
-
-// Best-effort cross-project activity rollup to the hub (ADR 0141 §4): report this
-// builder's descriptive talent snapshot (credits, ships, karma, rank, disciplines)
-// for the internal scouting directory. Fires on every federated sign-in ("on key
-// events"); true periodic reporting is a follow-up. Fully swallowed + no-op when
-// not federated — never fails a sign-in.
-async function reportActivityRollup({ builderId, githubId }) {
-  const idp = loadIdpConfig();
-  if (!idp) return;
-  try {
-    // Snapshot the builder's talent signals directly from the DB (auth.js is a
-    // kernel file — it uses pool, never a non-kernel domain module like metrics.js).
-    const b = await pool.query(
-      'SELECT total_credits, karma, rank, preferred_disciplines FROM builders WHERE id = $1',
-      [builderId],
-    );
-    if (!b.rows[0]) return;
-    const shipped = await pool.query('SELECT count(*)::int AS n FROM tasks WHERE shipped_by = $1', [builderId]);
-    const row = b.rows[0];
-    await fetch(`${idp.origin}/api/gds/sso/activity/rollup`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
-      body: JSON.stringify({
-        client_id: idp.clientId,
-        client_secret: idp.clientSecret,
-        github_id: githubId,
-        credits: Number(row.total_credits) || 0,
-        tasks_shipped: shipped.rows[0] ? shipped.rows[0].n : 0,
-        karma: Number(row.karma) || 0,
-        rank: row.rank || null,
-        disciplines: Array.isArray(row.preferred_disciplines) ? row.preferred_disciplines : [],
-      }),
-    });
-  } catch (err) {
-    console.log('[auth] hub activity rollup failed (non-blocking):', err.message);
-  }
-}
-
-// Admission posture (SR-19 / task #1000). BOTH enrollment paths — the web hall
-// sign-in (completeWebFlow) and the CLI device flow (pollDeviceFlow) — are
-// "invite-gated by default": a FIRST-TIME GitHub account is admitted only if an
-// Archon marked their access_request 'invited'. An EXISTING builder (a row
-// already exists for their github_id) ALWAYS passes — the gate never locks out
-// someone already enrolled.
-//
-// OTB_OPEN_XENOS_ENROLLMENT is the escape-hatch: set it truthy ('1' or 'true')
-// to restore fully-open self-enrollment (anyone with a GitHub account becomes a
-// Xenos) WITHOUT a code change, for an owner who deliberately wants open
-// enrollment. Default (unset/anything-else) = invite required. See ADR 0050.
-function openEnrollmentEnabled() {
-  const v = ic.resolveEnv('OPEN_XENOS_ENROLLMENT');
-  return v === '1' || v === 'true';
-}
-
-// PURE admission decision shared by both flows so they CANNOT drift (SR-19).
-// Returns true when a first-time account must be blocked. `existing` is the
-// builder row (or null) from getBuilderByGithubId; `approved` is the result of
-// hasInvitedAccessRequest. Blocks only when: not already a builder AND open
-// enrollment is off AND not invite-approved. Exported for direct unit testing.
-function firstTimeAdmissionBlocked({ existing, approved, login }) {
-  if (existing || openEnrollmentEnabled() || approved) return false;
-  // The configured firstAdmin is always admitted on a fresh instance so the
-  // bootstrap (maybeSeatFirstAdmin) can seat them as the first Archon — the owner
-  // must not be gated out of their own new instance when no Archon exists yet to
-  // approve them (the chicken-and-egg R62 / ADR 0062 §6 left open).
-  // seatFirstAdminIfUnclaimed is race-safe and only fires while NO Archon exists,
-  // so this never escalates an account on an established instance; it only lets
-  // the configured owner login through admission.
-  const fa = firstAdminLogin();
-  if (fa && String(login || '').toLowerCase() === fa.toLowerCase()) return false;
-  return true;
-}
-
-// webAdmissionStatus — "would this login get in RIGHT NOW, and is it worth
-// waiting?" (task 1002097). Backs the waiting page that replaced the red
-// "not approved" dead-end a firstAdmin hits during the bootstrap window.
-//
-// `admitted` deliberately mirrors firstTimeAdmissionBlocked's own terms —
-// member OR open-enrollment OR invited OR configured-firstAdmin — so the probe
-// can never say "come in" while the real gate says otherwise. It reads state;
-// it decides nothing. firstTimeAdmissionBlocked remains the one gate both flows
-// call (SR-19); if that logic changes, this must change with it.
-// tests/web_admission_status.mjs sweeps the input space asserting the two agree.
-//
-// `expectedSoon` is the broader "keep polling" signal: admitted, or waiting on
-// an Archon (pending), or the configured firstAdmin whose instance is still
-// booting. A visitor who is none of these is a genuine stranger and gets the
-// existing request-access page rather than a spinner that never resolves.
-//
-// NB the onboarding module's public GET /access-requests/status (used by the
-// CLI) reports member|invited|pending|none but knows nothing about the
-// firstAdmin bypass or open enrollment — so it reports the OWNER as 'none'
-// forever. That is exactly why this auth-domain probe exists.
-async function webAdmissionStatus(login) {
-  const name = String(login || '').trim();
-  if (!name) return { admitted: false, expectedSoon: false };
-
-  const fa = firstAdminLogin();
-  const isFirstAdmin = !!fa && name.toLowerCase() === fa.toLowerCase();
-
-  let state = { member: false, invited: false, pending: false };
-  try {
-    state = await accessStateByLogin(name);
-  } catch (err) {
-    // A DB hiccup must not turn the waiting page into a false "you're in".
-    // Fail closed on `admitted`; still let a firstAdmin keep polling, since
-    // that is the bootstrap window this page exists for.
-    console.error('[auth] webAdmissionStatus', err);
-    return { admitted: false, expectedSoon: isFirstAdmin };
-  }
-
-  const admitted = state.member || openEnrollmentEnabled() || state.invited || isFirstAdmin;
-  return { admitted, expectedSoon: admitted || state.pending || isFirstAdmin };
-}
-
-// First-admin bootstrap (R62 / task 1201, ADR 0062). The configured firstAdmin
-// login — an install-time env override (<PREFIX>_FIRST_ADMIN, incl. legacy) wins,
-// else branding.firstAdmin. Empty/unset (the vanilla starter) means "no one is
-// auto-seated"; the owner sets it when scaffolding the instance. Trimmed; '' → null.
-function firstAdminLogin() {
-  let login = ic.resolveEnv('FIRST_ADMIN');
-  if (login === undefined) {
-    try { login = branding().firstAdmin; } catch { login = undefined; }
-  }
-  login = (login || '').trim();
-  return login || null;
-}
-
-// Seat the configured firstAdmin as Archon at their first enrollment, but only
-// while NO Archon exists yet (the db guard is atomic + race-safe, so this can
-// never escalate an account once an owner exists). Best-effort: a bootstrap
-// hiccup must never fail the sign-in. Returns the builder, with rank updated to
-// 'archon' on the returned object if this call seated it.
-async function maybeSeatFirstAdmin(builder) {
-  const configured = firstAdminLogin();
-  if (!configured || !builder || builder.rank === 'archon') return builder;
-  if (String(builder.github_login || '').toLowerCase() !== configured.toLowerCase()) return builder;
-  try {
-    const seated = await seatFirstAdminIfUnclaimed(builder.id, builder.github_login);
-    if (seated) {
-      console.log(`[auth] first-admin bootstrap: seated ${builder.github_login} as Archon (configured firstAdmin, no prior Archon).`);
-      return { ...builder, rank: 'archon' };
-    }
-  } catch (err) {
-    console.error('[auth] first-admin bootstrap failed (non-fatal):', err.message);
-  }
-  return builder;
-}
-
-// safeSyncRankRole — give a builder the seeded rank-role matching their rank at
-// REGISTRATION (BV1.R95b, ADR 0151). governance_002's builder→role backfill is
-// run-once, so before this every builder admitted after that migration had no role
-// row at all and resolved to the EMPTY permission set — denied on every gated route.
-//
-// Called at each sign-in rather than only on first insert, and deliberately so: the
-// call is idempotent (two SELECTs and no write once the role already matches), it
-// also covers the rank write maybeSeatFirstAdmin just made (the firstAdmin bootstrap
-// flips xenos→archon outside any transaction), and it quietly repairs a builder whose
-// assignment drifted for any other reason.
-//
-// Resolved through the `government.rankSync` kernel port — auth.js is a KERNEL_FILE
-// and may not require a module (ADR 0083 / ADR 0091 §1). Runs on the pool: there is
-// no surrounding transaction here, unlike the two rank-change paths, which pass their
-// own client so the rotation is atomic with the rank write.
-//
-// BEST-EFFORT: a governance hiccup must never fail a sign-in, and the failure mode is
-// fail-closed anyway — no role means zero permissions, never extra ones.
-async function safeSyncRankRole(builder) {
-  if (!builder || builder.id == null) return;
-  try {
-    await seams.resolveOptional('government.rankSync')
-      ?.syncRank(null, { builderId: builder.id, rank: builder.rank });
-  } catch (err) {
-    console.error('[auth] rank-role sync failed (non-fatal):', err.message);
-  }
-}
-
-function newSessionToken() {
-  return crypto.randomBytes(32).toString('hex');
-}
-
-// -------------------------------------------------------------------------
-// GitHub helpers
-// -------------------------------------------------------------------------
-
-async function fetchGithubUser(accessToken) {
-  const res = await fetch('https://api.github.com/user', {
-    headers: {
-      Authorization: `Bearer ${accessToken}`,
-      'User-Agent': userAgent(),
-      Accept: 'application/vnd.github+json',
-    },
-  });
-  if (!res.ok) {
-    const text = await res.text();
-    throw new Error(`GitHub /user failed (${res.status}): ${text}`);
-  }
-  return res.json();
-}
-
-async function exchangeCodeForToken(code, redirectUri) {
-  const creds = loadGithubCreds();
-  if (!creds) throw new Error('GitHub OAuth credentials not configured');
-  const res = await fetch('https://github.com/login/oauth/access_token', {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/x-www-form-urlencoded',
-      Accept: 'application/json',
-    },
-    body: new URLSearchParams({
-      client_id: creds.client_id,
-      client_secret: creds.client_secret,
-      code,
-      redirect_uri: redirectUri,
-    }).toString(),
-  });
-  const data = await res.json();
-  if (data.error) throw new Error(`GitHub token exchange: ${data.error_description || data.error}`);
-  // Return the GRANTED scope alongside the token. GitHub echoes back the scopes
-  // the user actually consented to (space/comma-separated) — the caller checks it
-  // before persisting a repo-capable token, so a user who declined the broader
-  // consent never has one stored (task 1002099 / ADR 0143).
-  return { accessToken: data.access_token, scope: data.scope || '' };
-}
-
-// -------------------------------------------------------------------------
-// Device Flow (CLI)
-// -------------------------------------------------------------------------
-
-async function startDeviceFlow() {
-  const creds = loadGithubCreds();
-  if (!creds) throw new Error('GitHub OAuth credentials not configured');
-  const res = await fetch('https://github.com/login/device/code', {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/x-www-form-urlencoded',
-      Accept: 'application/json',
-    },
-    body: new URLSearchParams({ client_id: creds.client_id, scope: SCOPE }).toString(),
-  });
-  if (!res.ok) {
-    const text = await res.text();
-    throw new Error(`device/code failed (${res.status}): ${text}`);
-  }
-  const data = await res.json();
-  // GitHub returns HTTP 200 with an { error, error_description } body for OAuth-App
-  // misconfig — most often device_flow_disabled (Device Flow not enabled on the App)
-  // or incorrect_client_credentials. res.ok is TRUE there, so without this the missing
-  // device_code silently produced a broken flow / an opaque 500 (the 2026-07-08 demo
-  // login failure). Mirror the token-exchange guard (data.error, above); task 2126.
-  if (data.error) {
-    // device_flow_disabled is self-inflicted + common: GitHub defaults Device Flow OFF on new
-    // Apps and the one-click manifest can't enable it (task 2129). Make the CLI error self-
-    // service by naming the right settings surface. We hold only client_id here (not the app
-    // slug — that lives on the control plane), so we can't build /settings/apps/<slug>; but the
-    // id PREFIX distinguishes a GitHub App (Iv*) from an OAuth App (Ov*), which picks the right
-    // listing to open.
-    let hint = '';
-    if (data.error === 'device_flow_disabled') {
-      const where = /^Iv/i.test(creds.client_id || '')
-        ? 'https://github.com/settings/apps (org-owned apps: https://github.com/organizations/<org>/settings/apps)'
-        : 'https://github.com/settings/developers';
-      hint = ` — terminal sign-in needs Device Flow enabled on the app: open ${where}, open your app, check "Enable Device Flow", and save. Web sign-in is unaffected.`;
-    }
-    throw new Error(`GitHub rejected device-flow start: ${data.error}${data.error_description ? ` — ${data.error_description}` : ''}${hint}`);
-  }
-  if (!data.device_code) {
-    throw new Error('GitHub device/code returned no device_code (unexpected response shape).');
-  }
-  // data: { device_code, user_code, verification_uri, expires_in, interval }
-  deviceFlows.set(data.device_code, {
-    interval: data.interval || 5,
-    expires_at: Date.now() + data.expires_in * 1000,
-    last_polled_at: 0,
-  });
-  // Reap expired flows (cheap)
-  for (const [k, v] of deviceFlows) {
-    if (v.expires_at < Date.now()) deviceFlows.delete(k);
-  }
-  return {
-    device_code: data.device_code,
-    user_code: data.user_code,
-    verification_uri: data.verification_uri,
-    expires_in: data.expires_in,
-    interval: data.interval || 5,
-  };
-}
-
-async function pollDeviceFlow(deviceCode, userAgent) {
-  const flow = deviceFlows.get(deviceCode);
-  if (!flow) return { state: 'expired' };
-  if (flow.expires_at < Date.now()) {
-    deviceFlows.delete(deviceCode);
-    return { state: 'expired' };
-  }
-  // Server-side throttling: GitHub returns slow_down if we hammer; we
-  // also enforce the interval client-to-server.
-  const now = Date.now();
-  if (now - flow.last_polled_at < flow.interval * 1000) {
-    return { state: 'slow_down', interval: flow.interval };
-  }
-  flow.last_polled_at = now;
-
-  const creds = loadGithubCreds();
-  const res = await fetch('https://github.com/login/oauth/access_token', {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/x-www-form-urlencoded',
-      Accept: 'application/json',
-    },
-    body: new URLSearchParams({
-      client_id: creds.client_id,
-      device_code: deviceCode,
-      grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
-    }).toString(),
-  });
-  const data = await res.json();
-  if (data.error === 'authorization_pending') return { state: 'pending' };
-  if (data.error === 'slow_down') {
-    flow.interval = (flow.interval || 5) + 5;
-    return { state: 'slow_down', interval: flow.interval };
-  }
-  if (data.error === 'expired_token') {
-    deviceFlows.delete(deviceCode);
-    return { state: 'expired' };
-  }
-  if (data.error === 'access_denied') {
-    deviceFlows.delete(deviceCode);
-    return { state: 'denied' };
-  }
-  if (data.access_token) {
-    deviceFlows.delete(deviceCode);
-    const ghUser = await fetchGithubUser(data.access_token);
-    // Admission gate (SR-19 / task #1000): mirror completeWebFlow EXACTLY. The
-    // CLI device flow used to call upsertBuilder unconditionally, so any GitHub
-    // account could self-enroll as a Xenos + mint a CLI session with no Archon
-    // approval — contradicting the "Archon admission is the only gate" rule. Now
-    // a FIRST-TIME account (no existing builder row for this github_id) is
-    // admitted only if open enrollment is on OR an Archon marked their
-    // access_request 'invited'. An EXISTING builder ALWAYS passes, so an approved
-    // builder can never be locked out of CLI enrollment. See ADR 0050.
-    const existing = await getBuilderByGithubId(ghUser.id);
-    // Only consult the access_request table for a genuine first-timer (and only
-    // when open enrollment is off) — an existing builder short-circuits to
-    // ALWAYS-pass, matching completeWebFlow's `if (!existing)` lookup.
-    if (!existing && !openEnrollmentEnabled()) {
-      const approved = await hasInvitedAccessRequest(ghUser.login);
-      if (firstTimeAdmissionBlocked({ existing, approved, login: ghUser.login })) {
-        const err = new Error('not_approved');
-        err.code = 'NOT_APPROVED';
-        throw err;
-      }
-    }
-    let builder = await upsertBuilder({
-      githubId: ghUser.id,
-      githubLogin: ghUser.login,
-      displayName: ghUser.name || ghUser.login,
-      avatarUrl: ghUser.avatar_url,
-    });
-    builder = await maybeSeatFirstAdmin(builder);
-    await safeSyncRankRole(builder); // BV1.R95b — the seeded rank-role must exist from the first sign-in
-    const token = newSessionToken();
-    await createSession({
-      builderId: builder.id,
-      token,
-      source: 'cli',
-      userAgent: userAgent ?? null,
-      // CLI tokens have no expiry (manually revocable). Web tokens expire.
-      expiresAt: null,
-    });
-    // V3.R75 (#294): tick the onboarding state machine. Best-effort — auth
-    // success must NOT fail because the onboarding plumbing tripped.
-    await seams.resolveOptional('onboarding')?.safeMarkStage(pool, builder.id, 'auth_complete', builder);
-    return { state: 'ok', token, builder };
-  }
-  return { state: 'pending' };
-}
-
-// -------------------------------------------------------------------------
-// Web Flow (browser)
-// -------------------------------------------------------------------------
-
-function buildAuthorizeUrl(state, redirectUri, { repos = false } = {}) {
-  const creds = loadGithubCreds();
-  if (!creds) throw new Error('GitHub OAuth credentials not configured');
-  const u = new URL('https://github.com/login/oauth/authorize');
-  u.searchParams.set('client_id', creds.client_id);
-  u.searchParams.set('redirect_uri', redirectUri);
-  // `repos:true` (the onboarding wizard only) requests the broader repo scope; every
-  // other caller gets identity-only. scopeForWebFlow keeps that decision in one place.
-  u.searchParams.set('scope', scopeForWebFlow({ repos }));
-  u.searchParams.set('state', state);
-  return u.toString();
-}
-
-async function completeWebFlow({ code, redirectUri, userAgent, captureRepoToken = false }) {
-  const { accessToken, scope: grantedScope } = await exchangeCodeForToken(code, redirectUri);
-  const ghUser = await fetchGithubUser(accessToken);
-  // Approval gate (2026-05-30): the web hall sign-in no longer admits anyone
-  // with a GitHub account. A first-time visitor must have been approved by an
-  // Archon (their access_request marked 'invited') before a builder row is
-  // created. This Archon approval is the ONLY gate — newcomers build on hosted
-  // dev boxes, so there is no GitHub repo-access / collaborator check anywhere
-  // (2026-06-07). Established builders (a row already exists for this github_id)
-  // always pass — this only blocks NEW first-time entries.
-  //
-  // SR-19 / task #1000 (2026-06-13): the CLI device flow (pollDeviceFlow,
-  // /builder-setup) is now gated the SAME way — it previously called
-  // upsertBuilder unconditionally, letting any GitHub account self-enroll as a
-  // Xenos with no Archon approval. Both paths share firstTimeAdmissionBlocked()
-  // so they cannot drift. An owner who wants fully-open self-enrollment sets
-  // OTB_OPEN_XENOS_ENROLLMENT truthy (no code change); default = invite required.
-  // See ADR 0050.
-  const existing = await getBuilderByGithubId(ghUser.id);
-  if (!existing && !openEnrollmentEnabled()) {
-    const approved = await hasInvitedAccessRequest(ghUser.login);
-    // Pass `login` so the configured-firstAdmin bypass (firstTimeAdmissionBlocked
-    // L124-125) fires on WEB sign-in too — without it the founding owner is gated
-    // out of their own fresh instance at "The Gate is Closed", a chicken-and-egg
-    // since no Archon exists yet to approve them. The device flow (pollDeviceFlow,
-    // ~L305) already passes login; this keeps the two paths from drifting (SR-19).
-    if (firstTimeAdmissionBlocked({ existing, approved, login: ghUser.login })) {
-      const err = new Error('not_approved');
-      err.code = 'NOT_APPROVED';
-      // Carry the login so the route can tell an imminent admission (the
-      // configured firstAdmin mid-bootstrap, or someone with a pending request)
-      // from a genuine stranger, and show the "confirming access" waiting page
-      // instead of a red dead-end (task 1002097). Attaching it here — rather
-      // than re-deriving it in the route — keeps the login the gate actually
-      // judged. It is NOT a decision: the route re-checks via webAdmissionStatus.
-      err.login = ghUser.login;
-      throw err;
-    }
-  }
-  let builder = await upsertBuilder({
-    githubId: ghUser.id,
-    githubLogin: ghUser.login,
-    displayName: ghUser.name || ghUser.login,
-    avatarUrl: ghUser.avatar_url,
-  });
-  builder = await maybeSeatFirstAdmin(builder);
-  await safeSyncRankRole(builder); // BV1.R95b — the seeded rank-role must exist from the first sign-in
-  const token = newSessionToken();
-  // Web sessions expire after 30 days; the user re-auths on the page
-  // when the cookie expires.
-  const expiresAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
-  await createSession({
-    builderId: builder.id,
-    token,
-    source: 'web',
-    userAgent: userAgent ?? null,
-    expiresAt,
-  });
-  // V3.R75 (#294): tick the onboarding state machine. Best-effort.
-  await seams.resolveOptional('onboarding')?.safeMarkStage(pool, builder.id, 'auth_complete', builder);
-  // Wizard opt-in only (task 1002099 / ADR 0143): when the caller asked to capture
-  // repo access, hand the GitHub access token + granted scope back so the web
-  // callback can persist it (encrypted, short-TTL) for the repo picker/creator.
-  // auth.js stays kernel-clean — it never writes the token to the DB itself; the
-  // token is surfaced ONLY on this opt-in path, so an ordinary hall sign-in never
-  // even returns it.
-  const captured = captureRepoToken ? { githubToken: accessToken, githubScope: grantedScope } : {};
-  return { token, builder, expiresAt, ...captured };
-}
-
-// -------------------------------------------------------------------------
-// Platform IdP web flow (ADR 0141 §1) — the instance as an OAuth client of the hub
-// -------------------------------------------------------------------------
-
-// Build the hub's authorize URL. The instance redirects the browser here (instead
-// of github.com) at /auth/web/start when idpConfigured(). redirectUri is the
-// instance's OWN /auth/web/callback (registered in the hub's sso_clients allow-list
-// by provisioning); state is the same CSRF nonce the callback validates.
-// PURE — construct the hub authorize URL (testable without branding/env). Trailing
-// slashes on origin are trimmed so `https://hub/` and `https://hub` behave alike.
-function idpAuthorizeUrl(origin, clientId, state, redirectUri) {
-  const u = new URL(`${String(origin).replace(/\/+$/, '')}/api/gds/sso/authorize`);
-  u.searchParams.set('client_id', clientId);
-  u.searchParams.set('redirect_uri', redirectUri);
-  u.searchParams.set('state', state);
-  return u.toString();
-}
-
-function buildIdpAuthorizeUrl(state, redirectUri) {
-  const idp = loadIdpConfig();
-  if (!idp) throw new Error('platform IdP not configured');
-  return idpAuthorizeUrl(idp.origin, idp.clientId, state, redirectUri);
-}
-
-// Server-to-server: redeem the hub authorization code for identity. Authenticates
-// with the instance's client_id + client_secret; the hub returns IDENTITY ONLY
-// (github_id, github_login, display_name, avatar_url) — never a rank (ADR 0141 §2).
-async function exchangeIdpCode({ code, redirectUri, idp }) {
-  const res = await fetch(`${idp.origin}/api/gds/sso/token`, {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/json',
-      Accept: 'application/json',
-      'User-Agent': userAgent(),
-    },
-    body: JSON.stringify({
-      client_id: idp.clientId,
-      client_secret: idp.clientSecret,
-      code,
-      redirect_uri: redirectUri,
-    }),
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => '');
-    throw new Error(`hub /sso/token failed (${res.status}): ${text.slice(0, 200)}`);
-  }
-  const data = await res.json();
-  if (!data || data.github_id == null) {
-    throw new Error('hub /sso/token returned no identity');
-  }
-  return data;
-}
-
-// Complete the instance web sign-in via the hub. Sources identity from the hub's
-// /sso/token, then runs the EXACT SAME admission gate + upsertBuilder +
-// maybeSeatFirstAdmin + createSession(source='web') as completeWebFlow — only the
-// identity SOURCE differs (the hub, not github.com). The shared PURE gate
-// (firstTimeAdmissionBlocked) is what keeps this path from drifting from the direct
-// path (SR-19). Returns the same { token, builder, expiresAt } shape.
-async function completeIdpFlow({ code, redirectUri, userAgent: ua }) {
-  const idp = loadIdpConfig();
-  if (!idp) throw new Error('platform IdP not configured');
-  const identity = await exchangeIdpCode({ code, redirectUri, idp });
-  const ghId = identity.github_id;
-  const ghLogin = identity.github_login;
-  const existing = await getBuilderByGithubId(ghId);
-  if (!existing && !openEnrollmentEnabled()) {
-    const approved = await hasInvitedAccessRequest(ghLogin);
-    if (firstTimeAdmissionBlocked({ existing, approved, login: ghLogin })) {
-      const err = new Error('not_approved');
-      err.code = 'NOT_APPROVED';
-      throw err;
-    }
-  }
-  let builder = await upsertBuilder({
-    githubId: ghId,
-    githubLogin: ghLogin,
-    displayName: identity.display_name || ghLogin,
-    avatarUrl: identity.avatar_url,
-  });
-  builder = await maybeSeatFirstAdmin(builder);
-  await safeSyncRankRole(builder); // BV1.R95b — the seeded rank-role must exist from the first sign-in
-  const token = newSessionToken();
-  const expiresAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
-  await createSession({
-    builderId: builder.id,
-    token,
-    source: 'web',
-    userAgent: ua ?? null,
-    expiresAt,
-  });
-  await seams.resolveOptional('onboarding')?.safeMarkStage(pool, builder.id, 'auth_complete', builder);
-  // Fire-and-forget hub membership check-in + activity rollup (ADR 0141 §3/§4) —
-  // federated web sign-in. The rollup is CHAINED after the check-in (ADR 0171 D7):
-  // the hub now requires a membership row before accepting activity, so a first
-  // sign-in's rollup must not race its own check-in. Both swallow all errors, so
-  // the chain never rejects and the sign-in never waits on it.
-  // Both helpers are async (always return a promise) and swallow their own
-  // errors; the .catch is belt-and-braces so this floating chain can never
-  // surface an unhandledRejection even if a future edit lets one throw.
-  reportMembershipCheckIn({ githubId: ghId, githubLogin: ghLogin, displayName: identity.display_name, avatarUrl: identity.avatar_url })
-    .then(() => reportActivityRollup({ builderId: builder.id, githubId: ghId }))
-    .catch(() => {});
-  return { token, builder, expiresAt };
-}
-
-// -------------------------------------------------------------------------
-// Platform IdP CLI/device flow (ADR 0141 §1) — the instance verifies a hub-signed
-// assertion OFFLINE and mints its own cli session. The CLI runs the device flow
-// against the HUB (GitHub device codes can't cross apps), the hub signs an
-// audience-scoped Ed25519 assertion, and the instance verifies it here with the
-// hub's PUBLIC key (provisioned into env) — no instance->hub call at exchange time.
-// -------------------------------------------------------------------------
-
-const HUB_ASSERTION_ISSUER = 'cloudbongos-hub';
-
-// The hub's Ed25519 PUBLIC key (base64 of the SPKI DER), provisioned into the
-// instance env (<PREFIX>_HUB_PUBLIC_KEY). Returns a KeyObject or null.
-function loadHubPublicKey() {
-  const b64 = ic.resolveEnv('HUB_PUBLIC_KEY');
-  if (!b64) return null;
-  try {
-    return crypto.createPublicKey({ key: Buffer.from(String(b64), 'base64'), format: 'der', type: 'spki' });
-  } catch (err) {
-    console.error('[auth] HUB_PUBLIC_KEY is set but unreadable:', err.message);
-    return null;
-  }
-}
-
-// Verify a hub-signed assertion (the compact-JWT format minted by the hub's
-// platform-identity/hub-keys.js — kept in lockstep across the core<->module
-// boundary, ADR 0091 §2). Verifies the Ed25519 signature FIRST (against the given
-// public key), then the issuer, audience (must equal THIS instance's client_id),
-// and expiry. The verify algorithm is HARDCODED to Ed25519 (`crypto.verify(null,…)`)
-// regardless of the header's `alg` field, so there is no algorithm-confusion attack.
-// Returns the validated payload, or throws. Pure over its inputs (testable).
-function verifyHubAssertion(token, { publicKey, clientId, nowMs = Date.now() } = {}) {
-  if (!publicKey) throw new Error('hub public key not configured');
-  const parts = String(token || '').split('.');
-  if (parts.length !== 3) throw new Error('malformed assertion');
-  const [h, p, s] = parts;
-  let header;
-  try { header = JSON.parse(Buffer.from(h, 'base64url').toString('utf8')); }
-  catch { throw new Error('malformed assertion header'); }
-  if (!header || header.alg !== 'EdDSA') throw new Error('unexpected assertion alg');
-  // Signature over the exact `header.payload` bytes — verify BEFORE trusting claims.
-  const ok = crypto.verify(null, Buffer.from(`${h}.${p}`, 'utf8'), publicKey, Buffer.from(s, 'base64url'));
-  if (!ok) throw new Error('assertion signature invalid');
-  let payload;
-  try { payload = JSON.parse(Buffer.from(p, 'base64url').toString('utf8')); }
-  catch { throw new Error('malformed assertion payload'); }
-  if (payload.iss !== HUB_ASSERTION_ISSUER) throw new Error('unexpected assertion issuer');
-  if (clientId != null && String(payload.aud) !== String(clientId)) throw new Error('assertion audience mismatch');
-  if (typeof payload.exp !== 'number' || payload.exp < Math.floor(nowMs / 1000)) throw new Error('assertion expired');
-  if (payload.sub == null || !payload.github_login) throw new Error('assertion missing identity');
-  return payload;
-}
-
-// The purpose marker on a hub back-channel logout token — kept in lockstep with
-// the hub minter (platform-identity/hub-keys.js LOGOUT_PURPOSE) across the
-// boundary (ADR 0091 §2). Task 1002238.
-const HUB_LOGOUT_PURPOSE = 'backchannel-logout';
-
-// Verify a hub-signed BACK-CHANNEL LOGOUT token (ADR 0144, task 1002238) — the
-// logout sibling of verifyHubAssertion, same compact-EdDSA-JWT envelope, kept in
-// lockstep with the hub minter (hub-keys.js mintHubLogoutToken). Verifies the
-// Ed25519 signature FIRST (alg HARDCODED to Ed25519 regardless of the header, so
-// no algorithm-confusion), then issuer, audience (must equal THIS instance's
-// client_id, so a token minted for another project can't be replayed here),
-// expiry, and that purpose === 'backchannel-logout'. Requiring `purpose` is what
-// makes login assertions and logout tokens mutually non-interchangeable: a login
-// assertion has no purpose (rejected here), and a logout token has no
-// github_login (rejected by verifyHubAssertion). Returns the validated payload
-// ({ sub: github_id, ... }) or throws. Pure over its inputs (testable, no I/O).
-function verifyHubLogoutToken(token, { publicKey, clientId, nowMs = Date.now() } = {}) {
-  if (!publicKey) throw new Error('hub public key not configured');
-  const parts = String(token || '').split('.');
-  if (parts.length !== 3) throw new Error('malformed logout token');
-  const [h, p, s] = parts;
-  let header;
-  try { header = JSON.parse(Buffer.from(h, 'base64url').toString('utf8')); }
-  catch { throw new Error('malformed logout token header'); }
-  if (!header || header.alg !== 'EdDSA') throw new Error('unexpected logout token alg');
-  // Signature over the exact `header.payload` bytes — verify BEFORE trusting claims.
-  const ok = crypto.verify(null, Buffer.from(`${h}.${p}`, 'utf8'), publicKey, Buffer.from(s, 'base64url'));
-  if (!ok) throw new Error('logout token signature invalid');
-  let payload;
-  try { payload = JSON.parse(Buffer.from(p, 'base64url').toString('utf8')); }
-  catch { throw new Error('malformed logout token payload'); }
-  if (payload.iss !== HUB_ASSERTION_ISSUER) throw new Error('unexpected logout token issuer');
-  if (clientId != null && String(payload.aud) !== String(clientId)) throw new Error('logout token audience mismatch');
-  if (typeof payload.exp !== 'number' || payload.exp < Math.floor(nowMs / 1000)) throw new Error('logout token expired');
-  if (payload.purpose !== HUB_LOGOUT_PURPOSE) throw new Error('not a back-channel logout token');
-  if (payload.sub == null) throw new Error('logout token missing subject');
-  return payload;
-}
-
-// Anti-replay for CLI assertions (ADR 0141 §1, defense-in-depth on top of the
-// aud-scoping fix): a jti may be exchanged ONCE. In-memory per process, TTL = the
-// assertion's own expiry, so a captured assertion can't be replayed into multiple
-// sessions even inside its ~120s life. A restart clears it — acceptable given the
-// short window and that the aud binding is the primary control.
-const _seenAssertionJti = new Map(); // jti -> expiry ms
-function _assertionJtiSeenAndRecord(jti, expSeconds, nowMs = Date.now()) {
-  for (const [k, exp] of _seenAssertionJti) if (exp < nowMs) _seenAssertionJti.delete(k);
-  if (!jti) return false; // no jti → cannot dedupe (aud + TTL remain the guards)
-  if (_seenAssertionJti.has(jti)) return true;
-  _seenAssertionJti.set(jti, expSeconds ? expSeconds * 1000 : nowMs + 120000);
-  return false;
-}
-
-// Anti-replay for back-channel LOGOUT tokens (task 1002238, symmetric with the CLI
-// assertion path above). Honor a logout token's jti ONCE: the FIRST use revokes,
-// a replay within the ~120s TTL is a no-op. Without this, a captured token stays a
-// repeatable "log this builder out" primitive for its whole life — it would keep
-// killing sessions the builder legitimately creates AFTER the token was minted
-// (the one non-idempotent replay effect; revoking already-dead sessions is
-// otherwise harmless). Separate map from assertions so the two token types never
-// share dedupe state. In-memory per process; a restart clears it (acceptable — the
-// window is short and the aud binding is the primary control). Exported for the
-// route (routes/auth.js) since the DB revoke lives there, not in the kernel.
-const _seenLogoutJti = new Map(); // jti -> expiry ms
-function logoutTokenJtiSeenAndRecord(jti, expSeconds, nowMs = Date.now()) {
-  for (const [k, exp] of _seenLogoutJti) if (exp < nowMs) _seenLogoutJti.delete(k);
-  if (!jti) return false; // no jti → cannot dedupe (aud + TTL remain the guards)
-  if (_seenLogoutJti.has(jti)) return true;
-  _seenLogoutJti.set(jti, expSeconds ? expSeconds * 1000 : nowMs + 120000);
-  return false;
-}
-
-// Complete a CLI federation exchange: verify the hub assertion, then run the SAME
-// admission gate + upsertBuilder + createSession(source='cli') as the direct device
-// flow (pollDeviceFlow). Only the identity SOURCE differs. Returns { token, builder }.
-async function completeDeviceExchange({ assertion, userAgent: ua }) {
-  const idp = loadIdpConfig();
-  if (!idp) throw new Error('platform IdP not configured');
-  const publicKey = loadHubPublicKey();
-  if (!publicKey) throw new Error('hub public key not configured');
-  const payload = verifyHubAssertion(assertion, { publicKey, clientId: idp.clientId });
-  // Reject a replayed assertion (same jti) within its window.
-  if (_assertionJtiSeenAndRecord(payload.jti, payload.exp)) {
-    throw new Error('assertion already used');
-  }
-  const ghId = payload.sub;
-  const ghLogin = payload.github_login;
-  const existing = await getBuilderByGithubId(ghId);
-  if (!existing && !openEnrollmentEnabled()) {
-    const approved = await hasInvitedAccessRequest(ghLogin);
-    if (firstTimeAdmissionBlocked({ existing, approved, login: ghLogin })) {
-      const err = new Error('not_approved');
-      err.code = 'NOT_APPROVED';
-      throw err;
-    }
-  }
-  let builder = await upsertBuilder({
-    githubId: ghId,
-    githubLogin: ghLogin,
-    displayName: payload.display_name || ghLogin,
-    avatarUrl: payload.avatar_url,
-  });
-  builder = await maybeSeatFirstAdmin(builder);
-  await safeSyncRankRole(builder); // BV1.R95b — the seeded rank-role must exist from the first sign-in
-  const token = newSessionToken();
-  await createSession({
-    builderId: builder.id,
-    token,
-    source: 'cli',
-    userAgent: ua ?? null,
-    expiresAt: null,
-  });
-  await seams.resolveOptional('onboarding')?.safeMarkStage(pool, builder.id, 'auth_complete', builder);
-  // Fire-and-forget hub membership check-in + activity rollup (ADR 0141 §3/§4) —
-  // federated CLI sign-in. Rollup chained after check-in (ADR 0171 D7): the hub's
-  // membership requirement must not race a first sign-in; both swallow errors.
-  // Async + self-swallowing helpers; .catch is belt-and-braces (see web flow).
-  reportMembershipCheckIn({ githubId: ghId, githubLogin: ghLogin, displayName: payload.display_name, avatarUrl: payload.avatar_url })
-    .then(() => reportActivityRollup({ builderId: builder.id, githubId: ghId }))
-    .catch(() => {});
-  return { token, builder };
-}
-
-// -------------------------------------------------------------------------
-// Discord OAuth (account-linking — Phase 3 F2, ADR 0033 §2)
-// -------------------------------------------------------------------------
-// Links a Discord account to an ALREADY-AUTHENTICATED builder. Client creds
-// come from env (DISCORD_CLIENT_ID / DISCORD_CLIENT_SECRET) or, for local dev,
-// ~/.config/otb/discord-bot.json — same env-first-then-file shape as GitHub.
-// scope=identify (the Discord user id, for the link) + guilds.join (so the
-// server can drop the just-linked builder straight into the guild — the
-// "link-first auto-join" onboarding gate, F7/ADR 0033: a builder approves the
-// link BEFORE entering, so their rank role is already correct on arrival; there
-// is no invite link to share or leak). guilds.join is only USABLE alongside the
-// bot adding the member, and only if the bot holds CREATE_INSTANT_INVITE — see
-// addDiscordGuildMember + docs/discord/role-sync.md. The pure helpers
-// (discordAuthorizeUrl, isValidDiscordUserId) are exported for unit testing
-// without creds or network.
-const DISCORD_SCOPE = 'identify guilds.join';
-
-function loadDiscordCreds() {
-  const clientId = process.env.DISCORD_CLIENT_ID;
-  const clientSecret = process.env.DISCORD_CLIENT_SECRET;
-  if (clientId && clientSecret) return { client_id: clientId, client_secret: clientSecret };
-  try {
-    const raw = ic.readConfigFileSync('discord-bot.json');
-    if (raw) {
-      const creds = JSON.parse(raw);
-      if (creds.client_id && creds.client_secret) {
-        return { client_id: creds.client_id, client_secret: creds.client_secret };
-      }
-    }
-  } catch (_) { /* not configured */ }
-  return null;
-}
-
-function discordConfigured() {
-  return !!loadDiscordCreds();
-}
-
-// Bot token loader (Phase 3 F3, ADR 0033 §F3). The bot authenticates to the
-// Discord GATEWAY with a bot token — distinct from the OAuth client_id/secret
-// used for account-linking (F2). Same env-first-then-file shape as everything
-// else: env DISCORD_BOT_TOKEN wins (the systemd path ADR 0022 prefers for the
-// always-on droplet process), else the bot_token field of the local
-// ~/.config/otb/discord-bot.json file (already on the droplet, mode 600). The
-// token is a secret — never log it, never return it anywhere user-facing.
-function loadDiscordBotToken() {
-  const envToken = process.env.DISCORD_BOT_TOKEN;
-  if (envToken) return envToken;
-  try {
-    const raw = ic.readConfigFileSync('discord-bot.json');
-    if (raw) {
-      const creds = JSON.parse(raw);
-      if (creds.bot_token) return creds.bot_token;
-    }
-  } catch (_) { /* not configured */ }
-  return null;
-}
-
-function discordBotConfigured() {
-  return !!loadDiscordBotToken();
-}
-
-// PURE — build the Discord authorize URL (testable without creds/network).
-function discordAuthorizeUrl(clientId, state, redirectUri) {
-  const u = new URL('https://discord.com/api/oauth2/authorize');
-  u.searchParams.set('client_id', clientId);
-  u.searchParams.set('redirect_uri', redirectUri);
-  u.searchParams.set('response_type', 'code');
-  u.searchParams.set('scope', DISCORD_SCOPE);
-  u.searchParams.set('state', state);
-  return u.toString();
-}
-
-function buildDiscordAuthorizeUrl(state, redirectUri) {
-  const creds = loadDiscordCreds();
-  if (!creds) throw new Error('Discord OAuth credentials not configured');
-  return discordAuthorizeUrl(creds.client_id, state, redirectUri);
-}
-
-async function exchangeDiscordCode(code, redirectUri) {
-  const creds = loadDiscordCreds();
-  if (!creds) throw new Error('Discord OAuth credentials not configured');
-  const res = await fetch('https://discord.com/api/oauth2/token', {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-    body: new URLSearchParams({
-      client_id: creds.client_id,
-      client_secret: creds.client_secret,
-      grant_type: 'authorization_code',
-      code,
-      redirect_uri: redirectUri,
-    }).toString(),
-  });
-  if (!res.ok) {
-    const text = await res.text();
-    throw new Error(`Discord token exchange failed (${res.status}): ${text}`);
-  }
-  const data = await res.json();
-  return data.access_token;
-}
-
-async function fetchDiscordUser(accessToken) {
-  const res = await fetch('https://discord.com/api/users/@me', {
-    headers: { Authorization: `Bearer ${accessToken}` },
-  });
-  if (!res.ok) {
-    const text = await res.text();
-    throw new Error(`Discord /users/@me failed (${res.status}): ${text}`);
-  }
-  return res.json(); // { id, username, ... }
-}
-
-// Kick a member from the guild when they unlink their Discord account (F7
-// follow-up). Uses the bot token only — no user OAuth needed for a kick.
-// Requires the bot to hold Kick Members. Returns { removed: true } on 204
-// (success) or { removed: false, reason } when the member wasn't in the guild
-// (404) or the bot lacks permission (403) — both non-fatal for an unlink.
-// Throws on unexpected errors so the caller can log; unlink itself must still
-// succeed even if the kick can't.
-async function removeDiscordGuildMember({ guildId, discordUserId }) {
-  const botToken = loadDiscordBotToken();
-  if (!botToken) throw new Error('Discord bot token not configured');
-  if (!guildId) throw new Error('Discord guild id not configured');
-  const res = await fetch(`https://discord.com/api/guilds/${guildId}/members/${discordUserId}`, {
-    method: 'DELETE',
-    headers: { Authorization: `Bot ${botToken}` },
-  });
-  if (res.status === 204) return { removed: true };
-  if (res.status === 404) return { removed: false, reason: 'not_in_guild' };
-  if (res.status === 403) return { removed: false, reason: 'missing_permission' };
-  const text = await res.text();
-  throw new Error(`Discord guild remove failed (${res.status}): ${text}`);
-}
-
-// PURE — a Discord user id is a numeric snowflake (17–20 digits). Reject
-// anything else BEFORE it reaches db.linkDiscord (F1 Hacker advisory).
-function isValidDiscordUserId(id) {
-  return typeof id === 'string' && /^\d{17,20}$/.test(id);
-}
-
-// Add the just-linked builder straight into the guild (F7, ADR 0033 — the
-// "link-first auto-join" gate). Uses the user's own OAuth access token (granted
-// via the guilds.join scope) together with the BOT token — Discord's add-member
-// endpoint requires both: the user consent (access_token) and a bot with the
-// CREATE_INSTANT_INVITE permission. `roleIds` are applied at add-time so the
-// member's rank badge is present the instant they arrive (Discord only honors
-// the roles array when CREATING the membership — for an already-present member
-// it 204s and ignores them, which is why the callback also runs syncBuilderRole
-// belt-and-braces). Returns { added } — 201 = newly added, 204 = already a
-// member. Throws on any other status so the caller can log; auto-join is
-// best-effort and must never break the link itself.
-async function addDiscordGuildMember({ guildId, discordUserId, accessToken, roleIds }) {
-  const botToken = loadDiscordBotToken();
-  if (!botToken) throw new Error('Discord bot token not configured');
-  if (!guildId) throw new Error('Discord guild id not configured');
-  const res = await fetch(`https://discord.com/api/guilds/${guildId}/members/${discordUserId}`, {
-    method: 'PUT',
-    headers: { Authorization: `Bot ${botToken}`, 'Content-Type': 'application/json' },
-    body: JSON.stringify({ access_token: accessToken, roles: Array.isArray(roleIds) ? roleIds : [] }),
-  });
-  if (res.status === 201 || res.status === 204) return { added: res.status === 201 };
-  const text = await res.text();
-  throw new Error(`Discord guild add failed (${res.status}): ${text}`);
-}
-
-// -------------------------------------------------------------------------
-// Express middleware: authenticate by Bearer token (CLI) or gds_session cookie
-// (web). Legacy pms_session cookie still accepted on read so a builder mid-
-// session at the V3.R01 rollout doesn't have to re-auth.
-// -------------------------------------------------------------------------
-
-// Collect EVERY candidate auth token on the request, in priority order, with
-// duplicates removed. A browser can legitimately carry MORE THAN ONE
-// gds_session cookie: a host-only one (set on amazonprimea.com before the
-// #726/#734 apex-scoping rollout) AND the current apex-scoped one
-// (.amazonprimea.com). The browser sends both in the Cookie header. We must try
-// them ALL — picking only the first (as the old single-value extractToken did)
-// meant a stale/expired duplicate could shadow the live session and 401 the
-// builder (hit on the Discord link callback for builder 25). Order: Bearer
-// (CLI) first, then every gds_session value in header order, then legacy
-// pms_session — so a valid current session always wins over a stale one.
-// SECURITY (#871): cap the number of distinct candidate tokens we will try per
-// request. resolveSession does ONE DB lookup per candidate, so an attacker who
-// stuffs the Cookie header with dozens of gds_session=<junk> values could force
-// dozens of DB round-trips per request (amplification / DoS) even while
-// unauthenticated. A legitimate browser carries at most a Bearer + a couple of
-// gds_session cookies (host-only + apex during the #734 rollout) + one legacy
-// pms_session, so a small cap never hurts a real client.
 const MAX_AUTH_TOKEN_CANDIDATES = 6;
 
 function extractTokens(req) {