@cat-factory/app 0.153.3 → 0.154.0

package/app/components/settings/WorkspaceSettingsPanel.vue

@@ -149,6 +149,7 @@ const draft = reactive({
   taskLimitShared: 5 as number,
   perType: {} as Record<LimitTaskType, number>,
   storeAgentContext: true,
+  publishPrVerificationReport: true,
   artifactRetentionDays: 14,
   kaizenEnabled: true,
   reviewFrictionMode: 'off' as ReviewFrictionMode,
@@ -167,6 +168,7 @@ function hydrate() {
   const pt = s.taskLimitPerType ?? {}
   for (const t of TASK_TYPES) draft.perType[t] = pt[t] ?? 3
   draft.storeAgentContext = s.storeAgentContext
+  draft.publishPrVerificationReport = s.publishPrVerificationReport
   draft.artifactRetentionDays = s.artifactRetentionDays
   draft.kaizenEnabled = s.kaizenEnabled
   draft.reviewFrictionMode = s.reviewFrictionMode
@@ -222,6 +224,7 @@ async function save() {
             )
           : null,
       storeAgentContext: draft.storeAgentContext,
+      publishPrVerificationReport: draft.publishPrVerificationReport,
       artifactRetentionDays: draft.artifactRetentionDays,
       kaizenEnabled: draft.kaizenEnabled,
       reviewFrictionMode: draft.reviewFrictionMode,
@@ -421,6 +424,22 @@ async function save() {
               </label>
             </section>
 
+            <!-- Engine-maintained PR verification report -->
+            <section class="space-y-2">
+              <h3 class="text-sm font-semibold text-slate-200">
+                {{ t('settings.workspaceSettings.prReport.heading') }}
+              </h3>
+              <p class="text-[11px] text-slate-400">
+                {{ t('settings.workspaceSettings.prReport.body') }}
+              </p>
+              <label class="flex items-center gap-2">
+                <USwitch v-model="draft.publishPrVerificationReport" size="sm" />
+                <span class="text-sm text-slate-200">{{
+                  t('settings.workspaceSettings.prReport.toggle')
+                }}</span>
+              </label>
+            </section>
+
             <!-- Visual-confirmation artifact retention -->
             <section class="space-y-2">
               <h3 class="text-sm font-semibold text-slate-200">

package/app/composables/useRunDeepLink.spec.ts

@@ -0,0 +1,51 @@
+import { createPinia, setActivePinia } from 'pinia'
+import { beforeEach, describe, expect, it } from 'vitest'
+import { captureRunDeepLink } from './useRunDeepLink'
+
+/** Point `window.location` + `history` at a URL the capture can read and rewrite. */
+function setUrl(search: string): void {
+  history.replaceState(null, '', `/${search}`)
+}
+
+describe('captureRunDeepLink', () => {
+  beforeEach(() => {
+    setActivePinia(createPinia())
+    setUrl('')
+  })
+
+  it('returns null when the URL carries no run link', () => {
+    setUrl('?other=1')
+    expect(captureRunDeepLink()).toBeNull()
+    // An unrelated param is left alone.
+    expect(window.location.search).toBe('?other=1')
+  })
+
+  it('parses the report link the engine emits', () => {
+    setUrl('?ws=ws_1&block=blk_1&run=exec_1&view=observability')
+    expect(captureRunDeepLink()).toEqual({
+      workspaceId: 'ws_1',
+      blockId: 'blk_1',
+      runId: 'exec_1',
+      view: 'observability',
+    })
+  })
+
+  it('strips its own params so a reload does not re-open the panel', () => {
+    setUrl('?ws=ws_1&run=exec_1&view=observability&keep=yes')
+    captureRunDeepLink()
+    // Only the link's own params are consumed; anything else survives.
+    expect(window.location.search).toBe('?keep=yes')
+    // …and a second read finds nothing left to replay.
+    expect(captureRunDeepLink()).toBeNull()
+  })
+
+  it('tolerates a partial link (run id alone still resolves)', () => {
+    setUrl('?run=exec_1')
+    expect(captureRunDeepLink()).toEqual({
+      workspaceId: null,
+      blockId: null,
+      runId: 'exec_1',
+      view: null,
+    })
+  })
+})

package/app/composables/useRunDeepLink.ts

@@ -0,0 +1,91 @@
+/**
+ * Boot-time replay of a RUN deep link — `?ws=<id>&block=<id>&run=<id>&view=observability`.
+ *
+ * The engine's PR verification report links each PR back to the run's observability panel
+ * (Model activity / Provided context), built from the deployment's public app URL. The SPA is a
+ * single canvas with no URL identity for anything, so this is the narrow consumer that makes
+ * that link resolve: pin the board before the snapshot loads, then — once the board is ready —
+ * select the task and open the panel for the run.
+ *
+ * Deliberately narrow. The GENERAL parser (every entity, every window, plus state→URL sync) is
+ * slice 4 of `docs/initiatives/global-search-and-deep-links.md`; when it lands, this composable
+ * is deleted rather than kept alongside it.
+ */
+import { watch } from 'vue'
+import { useUiStore } from '../stores/ui'
+import { useWorkspaceStore } from '../stores/workspace'
+
+/** The parsed link, or null when the URL carried none. */
+interface PendingRunLink {
+  workspaceId: string | null
+  blockId: string | null
+  runId: string
+  view: string | null
+}
+
+const RUN_LINK_PARAMS = ['ws', 'block', 'run', 'view'] as const
+
+/**
+ * Read (and strip) a run deep link from the current URL. Called BEFORE `workspace.init()` so
+ * the pinned board id is in place when `resolveActiveBoard` picks which board to open. The
+ * params are removed from the URL — mirroring the `?invite=` / `?infraSetup=` handling — so a
+ * reload doesn't re-open the panel and the link isn't left sitting in history.
+ */
+export function captureRunDeepLink(): PendingRunLink | null {
+  if (typeof window === 'undefined') return null
+  const params = new URLSearchParams(window.location.search)
+  const runId = params.get('run')
+  if (!runId) return null
+
+  const link: PendingRunLink = {
+    workspaceId: params.get('ws'),
+    blockId: params.get('block'),
+    runId,
+    view: params.get('view'),
+  }
+  for (const key of RUN_LINK_PARAMS) params.delete(key)
+  const qs = params.toString()
+  history.replaceState(null, '', window.location.pathname + (qs ? `?${qs}` : ''))
+  return link
+}
+
+/**
+ * Capture a run deep link and, once the board has hydrated, apply it. Returns nothing; the
+ * caller mounts it once, next to `workspace.init()`.
+ *
+ * Applying WAITS for `workspace.ready`: opening the panel against a half-loaded board would
+ * read an execution the snapshot hasn't delivered yet. The watcher is one-shot — a later
+ * refresh must not re-open a panel the user closed.
+ */
+export function useRunDeepLink(): void {
+  const link = captureRunDeepLink()
+  if (!link) return
+
+  const workspace = useWorkspaceStore()
+  const ui = useUiStore()
+
+  // Pin the board the link names BEFORE init resolves the active one, so the run's own board
+  // opens rather than whichever one was last used on this device.
+  if (link.workspaceId) workspace.workspaceId = link.workspaceId
+
+  // Applied at most once — a later refresh must not re-open a panel the user closed. The guard
+  // is a flag rather than `{ once: true }` (which would burn the single run on the immediate
+  // not-ready tick and never navigate) and `stop` is a `let` rather than a `const` (with
+  // `immediate`, the callback runs synchronously BEFORE the binding initialises, so an
+  // already-hydrated board would hit the temporal dead zone instead of navigating).
+  let applied = false
+  let stop: (() => void) | undefined
+  stop = watch(
+    () => workspace.ready,
+    (ready) => {
+      if (!ready || applied) return
+      applied = true
+      if (link.blockId) ui.select(link.blockId)
+      // `observability` is the only view this narrow parser serves — an unknown view still
+      // lands the user on the right board and task rather than failing the navigation.
+      if (link.view === 'observability') ui.openObservability(link.runId)
+      stop?.()
+    },
+    { immediate: true },
+  )
+}

package/app/pages/index.vue

@@ -145,6 +145,10 @@ useKeyboardShortcuts()
 
 // Load the board from the backend before rendering it.
 onMounted(() => {
+  // Consume a run deep link (`?ws=…&block=…&run=…&view=observability`) BEFORE init, so the
+  // board it names is the one that opens. This is what makes the observability link on an
+  // engine-published PR verification report resolve.
+  useRunDeepLink()
   void workspace.init()
   // Honour a `cat-factory k3s` CLI hand-off (`?infraSetup=local-k3s&…`): open the Infrastructure
   // window pre-seeded with the provisioned connection so the user only pastes the token + saves.

package/app/stores/auth/mothership.ts

@@ -0,0 +1,108 @@
+import type { Ref } from 'vue'
+import type { LocalModeConfig } from '@cat-factory/contracts'
+import type { AuthUser } from '~/types/domain'
+
+/**
+ * Shared reactive state + injected dependencies the auth-store redirect factory closes over.
+ * Created once in the `auth` store setup and threaded into {@link createAuthRedirectActions} so
+ * the split operations stay behaviourally identical to the original single-closure store — a
+ * size-only extraction mirroring `stores/board/` and `stores/pipelines/`, not a new seam.
+ */
+export interface AuthRedirectContext {
+  api: ReturnType<typeof useApi>
+  token: Ref<string | null>
+  localMode: Ref<LocalModeConfig | null>
+  mothershipError: Ref<string | null>
+  /** Apply a freshly-minted token + user (the session factory's setter). */
+  applySession: (result: { token: string; user: AuthUser }) => void
+}
+
+/**
+ * The URL-fragment / redirect handling the boot handshake runs before it resolves a session:
+ * capturing a token handed back by our OWN backend's OAuth round-trip, and — in mothership
+ * mode — exchanging a returning MOTHERSHIP session for a local one.
+ */
+export function createAuthRedirectActions(ctx: AuthRedirectContext) {
+  const { api, token, localMode, mothershipError, applySession } = ctx
+
+  /** Pull a token handed back in the post-login URL fragment (#token=…). */
+  function consumeRedirectToken() {
+    if (typeof window === 'undefined') return
+    const match = /(?:^#|[#&])token=([^&]+)/.exec(window.location.hash)
+    if (!match) return
+    token.value = decodeURIComponent(match[1]!)
+    // Strip the token from the URL so it isn't left in history or shared.
+    history.replaceState(null, '', window.location.pathname + window.location.search)
+  }
+
+  /**
+   * Mothership mode: when the mothership OAuth redirect returns here (flagged
+   * `?mothership_connect=1`), the URL fragment carries a MOTHERSHIP session — not a local one.
+   * Hand it to our OWN node, which exchanges it for a cached machine token and returns a LOCAL
+   * session for the same user. Returns true when it handled the redirect (so the caller skips
+   * the normal `consumeRedirectToken`, which would wrongly store the mothership session locally).
+   */
+  async function maybeConnectMothership(): Promise<boolean> {
+    if (typeof window === 'undefined') return false
+    const params = new URLSearchParams(window.location.search)
+    if (params.get('mothership_connect') !== '1') return false
+    const match = /(?:^#|[#&])token=([^&]+)/.exec(window.location.hash)
+    const session = match ? decodeURIComponent(match[1]!) : null
+    // Clean the flag + fragment from the URL regardless of outcome, so it isn't left in history.
+    params.delete('mothership_connect')
+    const qs = params.toString()
+    history.replaceState(null, '', window.location.pathname + (qs ? `?${qs}` : ''))
+    if (!session) return true
+    try {
+      const result = await api.connectMothership(session)
+      applySession({ token: result.session, user: result.user })
+      mothershipError.value = null
+    } catch (err) {
+      // Surface the failure so the login screen shows it, rather than silently dropping the
+      // user back on the sign-in button as if the click did nothing. The captured session is
+      // already stripped from the URL, so recovery is a fresh "Sign in via mothership".
+      mothershipError.value =
+        err instanceof Error ? err.message : 'Could not connect to the mothership'
+    }
+    return true
+  }
+
+  /**
+   * Mothership mode: sign in through the hosted mothership. The mothership owns identity + the
+   * allowlist, so we send the browser to ITS OAuth and return here flagged for the connect
+   * exchange ({@link maybeConnectMothership}). No-op if the mothership URL isn't known.
+   */
+  function signInViaMothership() {
+    if (typeof window === 'undefined') return
+    const base = localMode.value?.mothershipUrl
+    if (!base) return
+    mothershipError.value = null
+    const here = new URL(window.location.origin + window.location.pathname)
+    here.searchParams.set('mothership_connect', '1')
+    const redirect = new URLSearchParams({ redirect: here.toString() })
+    window.location.href = `${base.replace(/\/$/, '')}/auth/login?${redirect}`
+  }
+
+  /** Redeem an `?invite=` token in the URL for the signed-in user, then clean the URL. */
+  async function maybeAcceptInvite() {
+    if (typeof window === 'undefined') return
+    const params = new URLSearchParams(window.location.search)
+    const inviteToken = params.get('invite')
+    if (!inviteToken) return
+    try {
+      await api.acceptInvite(inviteToken)
+    } catch {
+      // Stale/already-accepted invite — ignore and let the app load normally.
+    }
+    params.delete('invite')
+    const qs = params.toString()
+    history.replaceState(null, '', window.location.pathname + (qs ? `?${qs}` : ''))
+  }
+
+  return {
+    consumeRedirectToken,
+    maybeConnectMothership,
+    signInViaMothership,
+    maybeAcceptInvite,
+  }
+}

package/app/stores/auth/session.ts

@@ -0,0 +1,118 @@
+import type { Ref } from 'vue'
+import type { AuthUser } from '~/types/domain'
+
+/**
+ * Shared reactive state + injected dependencies the auth-store sign-in factory closes over.
+ * Created once in the `auth` store setup and threaded into {@link createAuthSessionActions} so
+ * the split operations stay behaviourally identical to the original single-closure store — a
+ * size-only extraction mirroring `stores/board/` and `stores/pipelines/`, not a new seam.
+ */
+export interface AuthSessionContext {
+  api: ReturnType<typeof useApi>
+  /** The backend's base URL, for the browser-navigating OAuth entry points. */
+  apiBase: string
+  token: Ref<string | null>
+  user: Ref<AuthUser | null>
+  autoLoginProvider: Ref<'github' | 'gitlab' | null>
+}
+
+/**
+ * The sign-in / sign-out operations: the browser-navigating OAuth entry points, the
+ * email-password + PAT credential flows, and the session teardown paths (explicit logout vs the
+ * API client's 401 handler, which differ in whether they forget the remembered PAT provider).
+ */
+export function createAuthSessionActions(ctx: AuthSessionContext) {
+  const { api, apiBase, token, user, autoLoginProvider } = ctx
+
+  /** Build a post-login redirect back to the current page, with an optional invite. */
+  function redirectTarget(invite?: string): string {
+    const here = window.location.origin + window.location.pathname
+    const params = new URLSearchParams({ redirect: here })
+    if (invite) params.set('invite', invite)
+    return params.toString()
+  }
+
+  /** Send the browser to the backend's GitHub login, returning here after. */
+  function login(invite?: string) {
+    if (typeof window === 'undefined') return
+    window.location.href = `${apiBase}/auth/login?${redirectTarget(invite)}`
+  }
+
+  /** Send the browser to the backend's Google login, returning here after. */
+  function loginWithGoogle(invite?: string) {
+    if (typeof window === 'undefined') return
+    window.location.href = `${apiBase}/auth/google/login?${redirectTarget(invite)}`
+  }
+
+  /** Apply a freshly-minted token + user (from password signup/login). */
+  function applySession(result: { token: string; user: AuthUser }) {
+    token.value = result.token
+    user.value = result.user
+  }
+
+  /** Register a new email/password user (optionally redeeming an invite). */
+  async function signup(body: { email: string; password: string; name?: string; invite?: string }) {
+    applySession(await api.signup(body))
+  }
+
+  /** Sign in with email/password. */
+  async function passwordLogin(body: { email: string; password: string }) {
+    applySession(await api.passwordLogin(body))
+  }
+
+  /**
+   * Local mode: sign in as the account a source-control PAT belongs to. `token` omitted
+   * uses the server-configured PAT (one-click); otherwise a pasted token. Resolves to the
+   * SAME canonical user as GitHub OAuth would (keyed on the provider's numeric id).
+   */
+  async function patLogin(body: { provider: 'github' | 'gitlab'; token?: string }) {
+    applySession(await api.patLogin(body))
+    // Remember the choice so a later load re-mints the session from the env PAT silently.
+    autoLoginProvider.value = body.provider
+  }
+
+  /** Request a password-reset link by email (always resolves; never reveals existence). */
+  async function forgotPassword(email: string) {
+    await api.forgotPassword({ email })
+  }
+
+  /** Redeem a reset token and set a new password. Throws on an invalid/expired token. */
+  async function resetPassword(token: string, password: string) {
+    await api.resetPassword({ token, password })
+  }
+
+  /** Drop the local session (sessions are stateless server-side). */
+  function logout() {
+    api.logout().catch(() => {})
+    token.value = null
+    user.value = null
+    // Forget the remembered provider so logout sticks (otherwise bootstrap would
+    // immediately re-mint a session from the env PAT).
+    autoLoginProvider.value = null
+  }
+
+  /**
+   * Called by the API client when a request comes back 401. Drops the dead session but KEEPS
+   * the remembered provider (unlike logout): a 401 from an expired/rotated token or a
+   * transient blip should let the next load silently re-mint from the env PAT, not force the
+   * login screen. The guarded re-mint in `bootstrap` clears the choice itself if it genuinely
+   * fails (PAT removed/revoked), so there's no re-login loop.
+   */
+  function handleUnauthorized() {
+    token.value = null
+    user.value = null
+  }
+
+  return {
+    applySession,
+    login,
+    loginWithGoogle,
+    signup,
+    passwordLogin,
+    patLogin,
+    forgotPassword,
+    resetPassword,
+    logout,
+    handleUnauthorized,
+  }
+}

package/app/stores/auth.ts

@@ -7,6 +7,8 @@ import { defineStore } from 'pinia'
 import { computed, ref } from 'vue'
 import type { AuthUser } from '~/types/domain'
 import { retryWhileBackendUnreachable } from '~/utils/backendReady'
+import { createAuthSessionActions } from '~/stores/auth/session'
+import { createAuthRedirectActions } from '~/stores/auth/mothership'
 
 /**
  * "Login with GitHub" session state. The backend mints a signed session token
@@ -121,63 +123,19 @@ export const useAuthStore = defineStore(
       return true
     })
 
-    /** Pull a token handed back in the post-login URL fragment (#token=…). */
-    function consumeRedirectToken() {
-      if (typeof window === 'undefined') return
-      const match = /(?:^#|[#&])token=([^&]+)/.exec(window.location.hash)
-      if (!match) return
-      token.value = decodeURIComponent(match[1]!)
-      // Strip the token from the URL so it isn't left in history or shared.
-      history.replaceState(null, '', window.location.pathname + window.location.search)
-    }
-
-    /**
-     * Mothership mode: when the mothership OAuth redirect returns here (flagged
-     * `?mothership_connect=1`), the URL fragment carries a MOTHERSHIP session — not a local one.
-     * Hand it to our OWN node, which exchanges it for a cached machine token and returns a LOCAL
-     * session for the same user. Returns true when it handled the redirect (so the caller skips
-     * the normal `consumeRedirectToken`, which would wrongly store the mothership session locally).
-     */
-    async function maybeConnectMothership(): Promise<boolean> {
-      if (typeof window === 'undefined') return false
-      const params = new URLSearchParams(window.location.search)
-      if (params.get('mothership_connect') !== '1') return false
-      const match = /(?:^#|[#&])token=([^&]+)/.exec(window.location.hash)
-      const session = match ? decodeURIComponent(match[1]!) : null
-      // Clean the flag + fragment from the URL regardless of outcome, so it isn't left in history.
-      params.delete('mothership_connect')
-      const qs = params.toString()
-      history.replaceState(null, '', window.location.pathname + (qs ? `?${qs}` : ''))
-      if (!session) return true
-      try {
-        const result = await api.connectMothership(session)
-        applySession({ token: result.session, user: result.user })
-        mothershipError.value = null
-      } catch (err) {
-        // Surface the failure so the login screen shows it, rather than silently dropping the
-        // user back on the sign-in button as if the click did nothing. The captured session is
-        // already stripped from the URL, so recovery is a fresh "Sign in via mothership".
-        mothershipError.value =
-          err instanceof Error ? err.message : 'Could not connect to the mothership'
-      }
-      return true
-    }
-
-    /**
-     * Mothership mode: sign in through the hosted mothership. The mothership owns identity + the
-     * allowlist, so we send the browser to ITS OAuth and return here flagged for the connect
-     * exchange (`maybeConnectMothership`). No-op if the mothership URL isn't known.
-     */
-    function signInViaMothership() {
-      if (typeof window === 'undefined') return
-      const base = localMode.value?.mothershipUrl
-      if (!base) return
-      mothershipError.value = null
-      const here = new URL(window.location.origin + window.location.pathname)
-      here.searchParams.set('mothership_connect', '1')
-      const redirect = new URLSearchParams({ redirect: here.toString() })
-      window.location.href = `${base.replace(/\/$/, '')}/auth/login?${redirect}`
-    }
+    // The sign-in / sign-out operations and the redirect-fragment handling, split into cohesive
+    // factories sharing the state above (a size-only extraction mirroring `stores/board/` —
+    // behaviour is identical to the former in-closure functions). The redirect factory applies a
+    // mothership-exchanged session through the session factory's setter.
+    const { applySession, ...session } = createAuthSessionActions({
+      api,
+      apiBase,
+      token,
+      user,
+      autoLoginProvider,
+    })
+    const { consumeRedirectToken, maybeConnectMothership, signInViaMothership, maybeAcceptInvite } =
+      createAuthRedirectActions({ api, token, localMode, mothershipError, applySession })
 
     /** Resolve auth state: capture any redirect token, then check the backend. */
     async function bootstrap() {
@@ -237,7 +195,7 @@ export const useAuthStore = defineStore(
         localMode.value.patLogin?.configured.includes(autoLoginProvider.value)
       ) {
         try {
-          await patLogin({ provider: autoLoginProvider.value })
+          await session.patLogin({ provider: autoLoginProvider.value })
         } catch {
           autoLoginProvider.value = null
         }
@@ -248,106 +206,6 @@ export const useAuthStore = defineStore(
       ready.value = true
     }
 
-    /** Redeem an `?invite=` token in the URL for the signed-in user, then clean the URL. */
-    async function maybeAcceptInvite() {
-      if (typeof window === 'undefined') return
-      const params = new URLSearchParams(window.location.search)
-      const inviteToken = params.get('invite')
-      if (!inviteToken) return
-      try {
-        await api.acceptInvite(inviteToken)
-      } catch {
-        // Stale/already-accepted invite — ignore and let the app load normally.
-      }
-      params.delete('invite')
-      const qs = params.toString()
-      history.replaceState(null, '', window.location.pathname + (qs ? `?${qs}` : ''))
-    }
-
-    /** Build a post-login redirect back to the current page, with an optional invite. */
-    function redirectTarget(invite?: string): string {
-      const here = window.location.origin + window.location.pathname
-      const params = new URLSearchParams({ redirect: here })
-      if (invite) params.set('invite', invite)
-      return params.toString()
-    }
-
-    /** Send the browser to the backend's GitHub login, returning here after. */
-    function login(invite?: string) {
-      if (typeof window === 'undefined') return
-      window.location.href = `${apiBase}/auth/login?${redirectTarget(invite)}`
-    }
-
-    /** Send the browser to the backend's Google login, returning here after. */
-    function loginWithGoogle(invite?: string) {
-      if (typeof window === 'undefined') return
-      window.location.href = `${apiBase}/auth/google/login?${redirectTarget(invite)}`
-    }
-
-    /** Apply a freshly-minted token + user (from password signup/login). */
-    function applySession(result: { token: string; user: AuthUser }) {
-      token.value = result.token
-      user.value = result.user
-    }
-
-    /** Register a new email/password user (optionally redeeming an invite). */
-    async function signup(body: {
-      email: string
-      password: string
-      name?: string
-      invite?: string
-    }) {
-      applySession(await api.signup(body))
-    }
-
-    /** Sign in with email/password. */
-    async function passwordLogin(body: { email: string; password: string }) {
-      applySession(await api.passwordLogin(body))
-    }
-
-    /**
-     * Local mode: sign in as the account a source-control PAT belongs to. `token` omitted
-     * uses the server-configured PAT (one-click); otherwise a pasted token. Resolves to the
-     * SAME canonical user as GitHub OAuth would (keyed on the provider's numeric id).
-     */
-    async function patLogin(body: { provider: 'github' | 'gitlab'; token?: string }) {
-      applySession(await api.patLogin(body))
-      // Remember the choice so a later load re-mints the session from the env PAT silently.
-      autoLoginProvider.value = body.provider
-    }
-
-    /** Request a password-reset link by email (always resolves; never reveals existence). */
-    async function forgotPassword(email: string) {
-      await api.forgotPassword({ email })
-    }
-
-    /** Redeem a reset token and set a new password. Throws on an invalid/expired token. */
-    async function resetPassword(token: string, password: string) {
-      await api.resetPassword({ token, password })
-    }
-
-    /** Drop the local session (sessions are stateless server-side). */
-    function logout() {
-      api.logout().catch(() => {})
-      token.value = null
-      user.value = null
-      // Forget the remembered provider so logout sticks (otherwise bootstrap would
-      // immediately re-mint a session from the env PAT).
-      autoLoginProvider.value = null
-    }
-
-    /**
-     * Called by the API client when a request comes back 401. Drops the dead session but KEEPS
-     * the remembered provider (unlike logout): a 401 from an expired/rotated token or a
-     * transient blip should let the next load silently re-mint from the env PAT, not force the
-     * login screen. The guarded re-mint in `bootstrap` clears the choice itself if it genuinely
-     * fails (PAT removed/revoked), so there's no re-login loop.
-     */
-    function handleUnauthorized() {
-      token.value = null
-      user.value = null
-    }
-
     return {
       token,
       user,
@@ -367,16 +225,8 @@ export const useAuthStore = defineStore(
       isMisconfigured,
       needsLogin,
       bootstrap,
-      login,
-      loginWithGoogle,
       signInViaMothership,
-      signup,
-      passwordLogin,
-      patLogin,
-      forgotPassword,
-      resetPassword,
-      logout,
-      handleUnauthorized,
+      ...session,
     }
   },
   { persist: { pick: ['token', 'autoLoginProvider'] } },