@cats-inc/cats-platform 0.1.0

package/build/server/platform/auth/bootstrap.d.ts

@@ -0,0 +1,21 @@
+import { type BrowserSessionIssueResult } from './session.js';
+import type { PlatformAccountRecord, PlatformAuthState, PlatformIdentityRecord, PlatformMembershipRecord } from './types.js';
+export interface CreateFirstAdminLocalInput {
+    state: PlatformAuthState;
+    displayName: string;
+    identifier: string;
+    password: string;
+    sessionSecret: string;
+    sessionTtlMs: number;
+    now?: Date;
+}
+export interface CreateFirstAdminLocalResult {
+    state: PlatformAuthState;
+    account: PlatformAccountRecord;
+    identity: PlatformIdentityRecord;
+    membership: PlatformMembershipRecord;
+    session: BrowserSessionIssueResult;
+}
+export declare function createFirstAdminLocalAuthState(input: CreateFirstAdminLocalInput): Promise<CreateFirstAdminLocalResult>;
+export declare function normalizeAccountIdentifier(identifier: string): string;
+//# sourceMappingURL=bootstrap.d.ts.map

package/build/server/platform/auth/bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/bootstrap.ts"],"names":[],"mappings":"AAGA,OAAO,EAAuB,KAAK,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACnF,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,wBAAwB,CAAC;IACrC,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,2BAA2B,CAAC,CA0DtC;AAED,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAMrE"}

package/build/server/platform/auth/bootstrap.js

@@ -0,0 +1,72 @@
+import { randomUUID } from 'node:crypto';
+import { createLocalPasswordHash } from './password.js';
+import { issueBrowserSession } from './session.js';
+export async function createFirstAdminLocalAuthState(input) {
+    if (input.state.accounts.length > 0) {
+        throw new Error('First admin already exists.');
+    }
+    const now = input.now ?? new Date();
+    const nowIso = now.toISOString();
+    const accountId = `auth-account-${randomUUID()}`;
+    const normalizedIdentifier = normalizeAccountIdentifier(input.identifier);
+    const password = await createLocalPasswordHash(input.password);
+    const account = {
+        id: accountId,
+        displayName: input.displayName.trim() || 'Owner',
+        email: looksLikeEmail(normalizedIdentifier) ? normalizedIdentifier : null,
+        avatarUrl: null,
+        status: 'active',
+        createdAt: nowIso,
+        updatedAt: nowIso,
+    };
+    const identity = {
+        id: `auth-identity-${randomUUID()}`,
+        accountId,
+        provider: 'local_password',
+        providerSubject: normalizedIdentifier,
+        email: account.email,
+        passwordHash: password.passwordHash,
+        passwordHashAlgorithm: password.passwordHashAlgorithm,
+        createdAt: nowIso,
+        updatedAt: nowIso,
+    };
+    const membership = {
+        id: `auth-membership-${randomUUID()}`,
+        accountId,
+        roles: ['owner', 'admin'],
+        coreActorId: 'actor-owner',
+        createdAt: nowIso,
+        updatedAt: nowIso,
+    };
+    const session = issueBrowserSession({
+        accountId,
+        sessionSecret: input.sessionSecret,
+        ttlMs: input.sessionTtlMs,
+        now,
+    });
+    return {
+        state: {
+            ...input.state,
+            updatedAt: nowIso,
+            accounts: [account],
+            identities: [identity],
+            memberships: [membership],
+            sessions: [session.session],
+        },
+        account,
+        identity,
+        membership,
+        session,
+    };
+}
+export function normalizeAccountIdentifier(identifier) {
+    const normalized = identifier.trim().toLowerCase();
+    if (!normalized) {
+        throw new Error('Account identifier is required.');
+    }
+    return normalized;
+}
+function looksLikeEmail(identifier) {
+    return /^[^@\s]+@[^@\s]+\.[^@\s]+$/u.test(identifier);
+}
+//# sourceMappingURL=bootstrap.js.map

package/build/server/platform/auth/bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../../../src/platform/auth/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAkC,MAAM,cAAc,CAAC;AA0BnF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAiC;IAEjC,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,gBAAgB,UAAU,EAAE,EAAE,CAAC;IACjD,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,OAAO,GAA0B;QACrC,EAAE,EAAE,SAAS;QACb,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,OAAO;QAChD,KAAK,EAAE,cAAc,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI;QACzE,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,QAAQ,GAA2B;QACvC,EAAE,EAAE,iBAAiB,UAAU,EAAE,EAAE;QACnC,SAAS;QACT,QAAQ,EAAE,gBAAgB;QAC1B,eAAe,EAAE,oBAAoB;QACrC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;QACrD,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,UAAU,GAA6B;QAC3C,EAAE,EAAE,mBAAmB,UAAU,EAAE,EAAE;QACrC,SAAS;QACT,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QACzB,WAAW,EAAE,aAAa;QAC1B,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,OAAO,GAAG,mBAAmB,CAAC;QAClC,SAAS;QACT,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,YAAY;QACzB,GAAG;KACJ,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE;YACL,GAAG,KAAK,CAAC,KAAK;YACd,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,CAAC,OAAO,CAAC;YACnB,UAAU,EAAE,CAAC,QAAQ,CAAC;YACtB,WAAW,EAAE,CAAC,UAAU,CAAC;YACzB,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;SAC5B;QACD,OAAO;QACP,QAAQ;QACR,UAAU;QACV,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,UAAkB;IACxC,OAAO,6BAA6B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACxD,CAAC"}

package/build/server/platform/auth/bootstrapEnvelope.d.ts

@@ -0,0 +1,33 @@
+import type { PlatformAuthConfig } from './config.js';
+import { createPlatformAppDescriptor, createPlatformResponseMetadata } from '../../shared/platformEnvelopeMetadata.js';
+export type PlatformAuthBootstrapRouteTarget = 'setup' | 'login' | 'repair';
+export type PlatformAuthBootstrapStateStatus = 'ready' | 'missing' | 'corrupt';
+export interface PlatformAuthBootstrapEnvelope {
+    app: ReturnType<typeof createPlatformAppDescriptor>;
+    metadata: ReturnType<typeof createPlatformResponseMetadata>;
+    setup: {
+        completeAt: string | null;
+        required: boolean;
+        repairRequired: boolean;
+    };
+    auth: {
+        authenticated: false;
+        csrfToken: null;
+        providers: {
+            google: {
+                enabled: boolean;
+                clientId: string | null;
+            };
+        };
+    };
+    routeTarget: PlatformAuthBootstrapRouteTarget;
+}
+export declare function buildPlatformAuthBootstrapEnvelope(input: {
+    auth: PlatformAuthConfig;
+    host: string;
+    port: number;
+    setupCompleteAt: string | null;
+    authStateStatus: PlatformAuthBootstrapStateStatus;
+    now?: Date;
+}): PlatformAuthBootstrapEnvelope;
+//# sourceMappingURL=bootstrapEnvelope.d.ts.map

package/build/server/platform/auth/bootstrapEnvelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrapEnvelope.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/bootstrapEnvelope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,EAC/B,MAAM,0CAA0C,CAAC;AAElD,MAAM,MAAM,gCAAgC,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAC5E,MAAM,MAAM,gCAAgC,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/E,MAAM,WAAW,6BAA6B;IAC5C,GAAG,EAAE,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC;IACpD,QAAQ,EAAE,UAAU,CAAC,OAAO,8BAA8B,CAAC,CAAC;IAC5D,KAAK,EAAE;QACL,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,QAAQ,EAAE,OAAO,CAAC;QAClB,cAAc,EAAE,OAAO,CAAC;KACzB,CAAC;IACF,IAAI,EAAE;QACJ,aAAa,EAAE,KAAK,CAAC;QACrB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE;YACT,MAAM,EAAE;gBACN,OAAO,EAAE,OAAO,CAAC;gBACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;aACzB,CAAC;SACH,CAAC;KACH,CAAC;IACF,WAAW,EAAE,gCAAgC,CAAC;CAC/C;AAED,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,IAAI,EAAE,kBAAkB,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,gCAAgC,CAAC;IAClD,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,6BAA6B,CA8BhC"}

package/build/server/platform/auth/bootstrapEnvelope.js

@@ -0,0 +1,33 @@
+import { createPlatformAppDescriptor, createPlatformResponseMetadata, } from '../../shared/platformEnvelopeMetadata.js';
+export function buildPlatformAuthBootstrapEnvelope(input) {
+    const repairRequired = input.setupCompleteAt !== null && input.authStateStatus !== 'ready';
+    return {
+        app: createPlatformAppDescriptor(),
+        metadata: createPlatformResponseMetadata({
+            generatedAt: input.now ?? new Date(),
+            host: input.host,
+            port: input.port,
+        }),
+        setup: {
+            completeAt: input.setupCompleteAt,
+            required: input.setupCompleteAt === null,
+            repairRequired,
+        },
+        auth: {
+            authenticated: false,
+            csrfToken: null,
+            providers: {
+                google: {
+                    enabled: Boolean(input.auth.google.clientId),
+                    clientId: input.auth.google.clientId,
+                },
+            },
+        },
+        routeTarget: repairRequired
+            ? 'repair'
+            : input.setupCompleteAt === null
+                ? 'setup'
+                : 'login',
+    };
+}
+//# sourceMappingURL=bootstrapEnvelope.js.map

package/build/server/platform/auth/bootstrapEnvelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrapEnvelope.js","sourceRoot":"","sources":["../../../../src/platform/auth/bootstrapEnvelope.ts"],"names":[],"mappings":"AACA,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,0CAA0C,CAAC;AA0BlD,MAAM,UAAU,kCAAkC,CAAC,KAOlD;IACC,MAAM,cAAc,GAAG,KAAK,CAAC,eAAe,KAAK,IAAI,IAAI,KAAK,CAAC,eAAe,KAAK,OAAO,CAAC;IAC3F,OAAO;QACL,GAAG,EAAE,2BAA2B,EAAE;QAClC,QAAQ,EAAE,8BAA8B,CAAC;YACvC,WAAW,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC;QACF,KAAK,EAAE;YACL,UAAU,EAAE,KAAK,CAAC,eAAe;YACjC,QAAQ,EAAE,KAAK,CAAC,eAAe,KAAK,IAAI;YACxC,cAAc;SACf;QACD,IAAI,EAAE;YACJ,aAAa,EAAE,KAAK;YACpB,SAAS,EAAE,IAAI;YACf,SAAS,EAAE;gBACT,MAAM,EAAE;oBACN,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;oBAC5C,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ;iBACrC;aACF;SACF;QACD,WAAW,EAAE,cAAc;YACzB,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,KAAK,CAAC,eAAe,KAAK,IAAI;gBAC9B,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,OAAO;KACd,CAAC;AACJ,CAAC"}

package/build/server/platform/auth/config.d.ts

@@ -0,0 +1,37 @@
+export type PlatformAuthMode = 'default' | 'enabled' | 'unsafe_disabled';
+export interface PlatformGoogleAuthConfig {
+    clientId: string | null;
+    hostedDomains: string[];
+    mobileAudiences: string[];
+}
+export interface PlatformAuthConfig {
+    mode: PlatformAuthMode;
+    enabled: boolean;
+    sessionSecret: string | null;
+    sessionTtlMs: number;
+    mobileSessionTtlMs: number;
+    loginFailureLimit: number;
+    loginLockoutMs: number;
+    accountDailyFailureCap: number;
+    accountCooldownMs: number;
+    subnetDailyFailureCap: number;
+    allowedBrowserOrigins: string[];
+    authStatePath: string;
+    recoveryTokenPath: string;
+    google: PlatformGoogleAuthConfig;
+}
+export declare const DEFAULT_AUTH_SESSION_TTL_MS: number;
+export declare const DEFAULT_AUTH_MOBILE_SESSION_TTL_MS: number;
+export declare const DEFAULT_AUTH_LOGIN_FAILURE_LIMIT = 5;
+export declare const DEFAULT_AUTH_LOGIN_LOCKOUT_MS = 30000;
+export declare const DEFAULT_AUTH_ACCOUNT_DAILY_FAILURE_CAP = 100;
+export declare const DEFAULT_AUTH_ACCOUNT_COOLDOWN_MS: number;
+export declare const DEFAULT_AUTH_SUBNET_DAILY_FAILURE_CAP = 500;
+export interface LoadPlatformAuthConfigInput {
+    env: NodeJS.ProcessEnv;
+    host: string;
+    port: number;
+    chatStatePath: string;
+}
+export declare function loadPlatformAuthConfig(input: LoadPlatformAuthConfigInput): PlatformAuthConfig;
+//# sourceMappingURL=config.d.ts.map

package/build/server/platform/auth/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/config.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,iBAAiB,CAAC;AAEzE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,wBAAwB,CAAC;CAClC;AAED,eAAO,MAAM,2BAA2B,QAA0B,CAAC;AACnE,eAAO,MAAM,kCAAkC,QAA2B,CAAC;AAC3E,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAClD,eAAO,MAAM,6BAA6B,QAAS,CAAC;AACpD,eAAO,MAAM,sCAAsC,MAAM,CAAC;AAC1D,eAAO,MAAM,gCAAgC,QAAiB,CAAC;AAC/D,eAAO,MAAM,qCAAqC,MAAM,CAAC;AAEzD,MAAM,WAAW,2BAA2B;IAC1C,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,kBAAkB,CAqD7F"}

package/build/server/platform/auth/config.js

@@ -0,0 +1,93 @@
+import { resolvePlatformAuthRecoveryTokenPathFromChatState, resolvePlatformAuthStatePathFromChatState, } from '../../shared/platformPaths.js';
+export const DEFAULT_AUTH_SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+export const DEFAULT_AUTH_MOBILE_SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+export const DEFAULT_AUTH_LOGIN_FAILURE_LIMIT = 5;
+export const DEFAULT_AUTH_LOGIN_LOCKOUT_MS = 30_000;
+export const DEFAULT_AUTH_ACCOUNT_DAILY_FAILURE_CAP = 100;
+export const DEFAULT_AUTH_ACCOUNT_COOLDOWN_MS = 15 * 60 * 1000;
+export const DEFAULT_AUTH_SUBNET_DAILY_FAILURE_CAP = 500;
+export function loadPlatformAuthConfig(input) {
+    const mode = parseAuthMode(input.env.CATS_AUTH_ENABLED);
+    const allowedBrowserOrigins = parseOriginList(input.env.CATS_AUTH_ALLOWED_BROWSER_ORIGINS) ?? defaultAllowedBrowserOrigins(input.host, input.port);
+    return {
+        mode,
+        enabled: mode !== 'unsafe_disabled',
+        sessionSecret: input.env.CATS_AUTH_SESSION_SECRET?.trim() || null,
+        sessionTtlMs: parsePositiveInt(input.env.CATS_AUTH_SESSION_TTL_MS, DEFAULT_AUTH_SESSION_TTL_MS, 'CATS_AUTH_SESSION_TTL_MS'),
+        mobileSessionTtlMs: parsePositiveInt(input.env.CATS_AUTH_MOBILE_SESSION_TTL_MS, DEFAULT_AUTH_MOBILE_SESSION_TTL_MS, 'CATS_AUTH_MOBILE_SESSION_TTL_MS'),
+        loginFailureLimit: parsePositiveInt(input.env.CATS_AUTH_LOGIN_FAILURE_LIMIT, DEFAULT_AUTH_LOGIN_FAILURE_LIMIT, 'CATS_AUTH_LOGIN_FAILURE_LIMIT'),
+        loginLockoutMs: parsePositiveInt(input.env.CATS_AUTH_LOGIN_LOCKOUT_MS, DEFAULT_AUTH_LOGIN_LOCKOUT_MS, 'CATS_AUTH_LOGIN_LOCKOUT_MS'),
+        accountDailyFailureCap: parsePositiveInt(input.env.CATS_AUTH_ACCOUNT_DAILY_FAILURE_CAP, DEFAULT_AUTH_ACCOUNT_DAILY_FAILURE_CAP, 'CATS_AUTH_ACCOUNT_DAILY_FAILURE_CAP'),
+        accountCooldownMs: parsePositiveInt(input.env.CATS_AUTH_ACCOUNT_COOLDOWN_MS, DEFAULT_AUTH_ACCOUNT_COOLDOWN_MS, 'CATS_AUTH_ACCOUNT_COOLDOWN_MS'),
+        subnetDailyFailureCap: parsePositiveInt(input.env.CATS_AUTH_SUBNET_DAILY_FAILURE_CAP, DEFAULT_AUTH_SUBNET_DAILY_FAILURE_CAP, 'CATS_AUTH_SUBNET_DAILY_FAILURE_CAP'),
+        allowedBrowserOrigins,
+        authStatePath: resolvePlatformAuthStatePathFromChatState(input.chatStatePath),
+        recoveryTokenPath: resolvePlatformAuthRecoveryTokenPathFromChatState(input.chatStatePath),
+        google: {
+            clientId: input.env.CATS_AUTH_GOOGLE_CLIENT_ID?.trim() || null,
+            hostedDomains: parseCsv(input.env.CATS_AUTH_GOOGLE_HD),
+            mobileAudiences: parseCsv(input.env.CATS_AUTH_GOOGLE_MOBILE_AUDIENCES),
+        },
+    };
+}
+function parseAuthMode(raw) {
+    const trimmed = raw?.trim().toLowerCase();
+    if (!trimmed) {
+        return 'default';
+    }
+    if (trimmed === 'true') {
+        return 'enabled';
+    }
+    if (trimmed === 'false') {
+        return 'unsafe_disabled';
+    }
+    throw new Error('CATS_AUTH_ENABLED must be true or false when set.');
+}
+function parsePositiveInt(raw, fallback, name) {
+    const trimmed = raw?.trim();
+    if (!trimmed) {
+        return fallback;
+    }
+    const parsed = Number.parseInt(trimmed, 10);
+    if (!Number.isInteger(parsed) || parsed <= 0) {
+        throw new Error(`${name} must be a positive integer.`);
+    }
+    return parsed;
+}
+function parseCsv(raw) {
+    const trimmed = raw?.trim();
+    if (!trimmed) {
+        return [];
+    }
+    return trimmed
+        .split(',')
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+}
+function parseOriginList(raw) {
+    const entries = parseCsv(raw);
+    if (entries.length === 0) {
+        return null;
+    }
+    return [...new Set(entries.map(normalizeOrigin))];
+}
+function defaultAllowedBrowserOrigins(host, port) {
+    return [...new Set([
+            normalizeOrigin(`http://${host}:${port}`),
+            'http://localhost:5173',
+            'http://127.0.0.1:5173',
+        ])];
+}
+function normalizeOrigin(value) {
+    try {
+        const parsed = new URL(value);
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+            throw new Error('origin must use http or https');
+        }
+        return parsed.origin;
+    }
+    catch (error) {
+        throw new Error(`Invalid auth browser origin '${value}': ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+//# sourceMappingURL=config.js.map

package/build/server/platform/auth/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/platform/auth/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iDAAiD,EACjD,yCAAyC,GAC1C,MAAM,+BAA+B,CAAC;AA2BvC,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACnE,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3E,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAClD,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AACpD,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,CAAC;AAC1D,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/D,MAAM,CAAC,MAAM,qCAAqC,GAAG,GAAG,CAAC;AASzD,MAAM,UAAU,sBAAsB,CAAC,KAAkC;IACvE,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACxD,MAAM,qBAAqB,GAAG,eAAe,CAC3C,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAC5C,IAAI,4BAA4B,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,IAAI,KAAK,iBAAiB;QACnC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,IAAI;QACjE,YAAY,EAAE,gBAAgB,CAC5B,KAAK,CAAC,GAAG,CAAC,wBAAwB,EAClC,2BAA2B,EAC3B,0BAA0B,CAC3B;QACD,kBAAkB,EAAE,gBAAgB,CAClC,KAAK,CAAC,GAAG,CAAC,+BAA+B,EACzC,kCAAkC,EAClC,iCAAiC,CAClC;QACD,iBAAiB,EAAE,gBAAgB,CACjC,KAAK,CAAC,GAAG,CAAC,6BAA6B,EACvC,gCAAgC,EAChC,+BAA+B,CAChC;QACD,cAAc,EAAE,gBAAgB,CAC9B,KAAK,CAAC,GAAG,CAAC,0BAA0B,EACpC,6BAA6B,EAC7B,4BAA4B,CAC7B;QACD,sBAAsB,EAAE,gBAAgB,CACtC,KAAK,CAAC,GAAG,CAAC,mCAAmC,EAC7C,sCAAsC,EACtC,qCAAqC,CACtC;QACD,iBAAiB,EAAE,gBAAgB,CACjC,KAAK,CAAC,GAAG,CAAC,6BAA6B,EACvC,gCAAgC,EAChC,+BAA+B,CAChC;QACD,qBAAqB,EAAE,gBAAgB,CACrC,KAAK,CAAC,GAAG,CAAC,kCAAkC,EAC5C,qCAAqC,EACrC,oCAAoC,CACrC;QACD,qBAAqB;QACrB,aAAa,EAAE,yCAAyC,CAAC,KAAK,CAAC,aAAa,CAAC;QAC7E,iBAAiB,EAAE,iDAAiD,CAAC,KAAK,CAAC,aAAa,CAAC;QACzF,MAAM,EAAE;YACN,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,IAAI;YAC9D,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACtD,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAAC;SACvE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAuB;IAC5C,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAuB,EAAE,QAAgB,EAAE,IAAY;IAC/E,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAuB;IACvC,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO;SACX,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,eAAe,CAAC,GAAuB;IAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAY,EAAE,IAAY;IAC9D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;YACjB,eAAe,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;YACzC,uBAAuB;YACvB,uBAAuB;SACxB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,gCAAgC,KAAK,MACnC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;IACJ,CAAC;AACH,CAAC"}

package/build/server/platform/auth/cookies.d.ts

@@ -0,0 +1,4 @@
+export declare const AUTH_SESSION_COOKIE_NAME = "cats_session";
+export declare function serializeAuthSessionCookie(token: string, ttlMs: number): string;
+export declare function clearAuthSessionCookie(): string;
+//# sourceMappingURL=cookies.d.ts.map

package/build/server/platform/auth/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/cookies.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,wBAAwB,iBAAiB,CAAC;AAEvD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ/E;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAQ/C"}

package/build/server/platform/auth/cookies.js

@@ -0,0 +1,20 @@
+export const AUTH_SESSION_COOKIE_NAME = 'cats_session';
+export function serializeAuthSessionCookie(token, ttlMs) {
+    return [
+        `${AUTH_SESSION_COOKIE_NAME}=${encodeURIComponent(token)}`,
+        'Path=/',
+        'HttpOnly',
+        'SameSite=Lax',
+        `Max-Age=${Math.max(1, Math.floor(ttlMs / 1000))}`,
+    ].join('; ');
+}
+export function clearAuthSessionCookie() {
+    return [
+        `${AUTH_SESSION_COOKIE_NAME}=`,
+        'Path=/',
+        'HttpOnly',
+        'SameSite=Lax',
+        'Max-Age=0',
+    ].join('; ');
+}
+//# sourceMappingURL=cookies.js.map

package/build/server/platform/auth/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../../../src/platform/auth/cookies.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,wBAAwB,GAAG,cAAc,CAAC;AAEvD,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,KAAa;IACrE,OAAO;QACL,GAAG,wBAAwB,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QAC1D,QAAQ;QACR,UAAU;QACV,cAAc;QACd,WAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,EAAE;KACnD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO;QACL,GAAG,wBAAwB,GAAG;QAC9B,QAAQ;QACR,UAAU;QACV,cAAc;QACd,WAAW;KACZ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/build/server/platform/auth/csrf.d.ts

@@ -0,0 +1,13 @@
+import type { PlatformSessionRecord } from './types.js';
+export type CatsCsrfValidationResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: 'missing_secret' | 'missing_token' | 'missing_session_hash' | 'mismatch';
+};
+export declare function validateCatsCsrfToken(input: {
+    session: PlatformSessionRecord;
+    token: string | undefined;
+    sessionSecret: string | null;
+}): CatsCsrfValidationResult;
+//# sourceMappingURL=csrf.d.ts.map

package/build/server/platform/auth/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/csrf.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAExD,MAAM,MAAM,wBAAwB,GAChC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,GAAG,eAAe,GAAG,sBAAsB,GAAG,UAAU,CAAA;CAAE,CAAC;AAEpG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,OAAO,EAAE,qBAAqB,CAAC;IAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,GAAG,wBAAwB,CAc3B"}

package/build/server/platform/auth/csrf.js

@@ -0,0 +1,17 @@
+import { verifySessionTokenHash } from './session.js';
+export function validateCatsCsrfToken(input) {
+    if (!input.sessionSecret) {
+        return { ok: false, reason: 'missing_secret' };
+    }
+    if (!input.token) {
+        return { ok: false, reason: 'missing_token' };
+    }
+    if (!input.session.csrfTokenHash) {
+        return { ok: false, reason: 'missing_session_hash' };
+    }
+    if (!verifySessionTokenHash(input.token, input.session.csrfTokenHash, input.sessionSecret)) {
+        return { ok: false, reason: 'mismatch' };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=csrf.js.map

package/build/server/platform/auth/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../../../src/platform/auth/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAOtD,MAAM,UAAU,qBAAqB,CAAC,KAIrC;IACC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/build/server/platform/auth/effectiveMode.d.ts

@@ -0,0 +1,16 @@
+import type { PlatformAuthMode } from './config.js';
+export type EffectivePlatformAuthGateMode = {
+    status: 'enabled';
+} | {
+    status: 'unsafe_disabled';
+} | {
+    status: 'configuration_error';
+    message: string;
+};
+export declare function resolveEffectivePlatformAuthGateMode(input: {
+    configuredMode: PlatformAuthMode;
+    host: string;
+    setupCompleteAt: string | null;
+}): EffectivePlatformAuthGateMode;
+export declare function isLoopbackAuthHost(host: string): boolean;
+//# sourceMappingURL=effectiveMode.d.ts.map

package/build/server/platform/auth/effectiveMode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"effectiveMode.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/effectiveMode.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,MAAM,6BAA6B,GACrC;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,iBAAiB,CAAA;CAAE,GAC7B;IAAE,MAAM,EAAE,qBAAqB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD,wBAAgB,oCAAoC,CAAC,KAAK,EAAE;IAC1D,cAAc,EAAE,gBAAgB,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,GAAG,6BAA6B,CAiBhC;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMxD"}

package/build/server/platform/auth/effectiveMode.js

@@ -0,0 +1,26 @@
+export function resolveEffectivePlatformAuthGateMode(input) {
+    if (input.configuredMode !== 'unsafe_disabled') {
+        return { status: 'enabled' };
+    }
+    if (input.setupCompleteAt !== null) {
+        return {
+            status: 'configuration_error',
+            message: 'CATS_AUTH_ENABLED=false is not allowed after setup is complete.',
+        };
+    }
+    if (!isLoopbackAuthHost(input.host)) {
+        return {
+            status: 'configuration_error',
+            message: 'CATS_AUTH_ENABLED=false is allowed only on loopback before setup is complete.',
+        };
+    }
+    return { status: 'unsafe_disabled' };
+}
+export function isLoopbackAuthHost(host) {
+    const normalized = host.trim().toLowerCase().replace(/^\[/u, '').replace(/\]$/u, '');
+    return normalized === 'localhost'
+        || normalized === '127.0.0.1'
+        || normalized === '::1'
+        || normalized === '0:0:0:0:0:0:0:1';
+}
+//# sourceMappingURL=effectiveMode.js.map

package/build/server/platform/auth/effectiveMode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"effectiveMode.js","sourceRoot":"","sources":["../../../../src/platform/auth/effectiveMode.ts"],"names":[],"mappings":"AAOA,MAAM,UAAU,oCAAoC,CAAC,KAIpD;IACC,IAAI,KAAK,CAAC,cAAc,KAAK,iBAAiB,EAAE,CAAC;QAC/C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACnC,OAAO;YACL,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EAAE,iEAAiE;SAC3E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EAAE,+EAA+E;SACzF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrF,OAAO,UAAU,KAAK,WAAW;WAC5B,UAAU,KAAK,WAAW;WAC1B,UAAU,KAAK,KAAK;WACpB,UAAU,KAAK,iBAAiB,CAAC;AACxC,CAAC"}

package/build/server/platform/auth/errorCodes.d.ts

@@ -0,0 +1,7 @@
+export declare const PLATFORM_AUTH_ERROR_CODES: {
+    readonly unauthenticated: "E_UNAUTHENTICATED";
+    readonly forbidden: "E_FORBIDDEN";
+    readonly csrfMismatch: "E_CSRF_MISMATCH";
+};
+export type PlatformAuthErrorCode = (typeof PLATFORM_AUTH_ERROR_CODES)[keyof typeof PLATFORM_AUTH_ERROR_CODES];
+//# sourceMappingURL=errorCodes.d.ts.map

package/build/server/platform/auth/errorCodes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorCodes.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/errorCodes.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,yBAAyB;;;;CAI5B,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAC/B,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC"}

package/build/server/platform/auth/errorCodes.js

@@ -0,0 +1,6 @@
+export const PLATFORM_AUTH_ERROR_CODES = {
+    unauthenticated: 'E_UNAUTHENTICATED',
+    forbidden: 'E_FORBIDDEN',
+    csrfMismatch: 'E_CSRF_MISMATCH',
+};
+//# sourceMappingURL=errorCodes.js.map

package/build/server/platform/auth/errorCodes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorCodes.js","sourceRoot":"","sources":["../../../../src/platform/auth/errorCodes.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,eAAe,EAAE,mBAAmB;IACpC,SAAS,EAAE,aAAa;IACxB,YAAY,EAAE,iBAAiB;CACvB,CAAC"}

package/build/server/platform/auth/googleAccount.d.ts

@@ -0,0 +1,47 @@
+import { type BrowserSessionIssueResult } from './session.js';
+import type { PlatformAccountRecord, PlatformAuthState, PlatformIdentityRecord, PlatformMembershipRecord } from './types.js';
+import type { PlatformVerifiedGoogleIdentity } from './googleVerifier.js';
+export interface CreateFirstAdminGoogleInput {
+    state: PlatformAuthState;
+    identity: PlatformVerifiedGoogleIdentity;
+    sessionSecret: string;
+    sessionTtlMs: number;
+    now?: Date;
+}
+export interface CreateFirstAdminGoogleResult {
+    state: PlatformAuthState;
+    account: PlatformAccountRecord;
+    identity: PlatformIdentityRecord;
+    membership: PlatformMembershipRecord;
+    session: BrowserSessionIssueResult;
+}
+export interface CreateGoogleBrowserSessionInput {
+    state: PlatformAuthState;
+    identity: PlatformVerifiedGoogleIdentity;
+    sessionSecret: string;
+    sessionTtlMs: number;
+    now?: Date;
+}
+export interface CreateGoogleBrowserSessionResult {
+    state: PlatformAuthState;
+    account: PlatformAccountRecord;
+    identity: PlatformIdentityRecord;
+    membership: PlatformMembershipRecord;
+    session: BrowserSessionIssueResult;
+}
+export interface LinkGoogleIdentityToAccountInput {
+    state: PlatformAuthState;
+    accountId: string;
+    identity: PlatformVerifiedGoogleIdentity;
+    now?: Date;
+}
+export interface LinkGoogleIdentityToAccountResult {
+    state: PlatformAuthState;
+    account: PlatformAccountRecord;
+    identity: PlatformIdentityRecord;
+    membership: PlatformMembershipRecord;
+}
+export declare function createFirstAdminGoogleAuthState(input: CreateFirstAdminGoogleInput): CreateFirstAdminGoogleResult;
+export declare function linkGoogleIdentityToAccount(input: LinkGoogleIdentityToAccountInput): LinkGoogleIdentityToAccountResult | null;
+export declare function createGoogleBrowserSessionForLinkedIdentity(input: CreateGoogleBrowserSessionInput): CreateGoogleBrowserSessionResult | null;
+//# sourceMappingURL=googleAccount.d.ts.map

package/build/server/platform/auth/googleAccount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"googleAccount.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/googleAccount.ts"],"names":[],"mappings":"AAEA,OAAO,EAAuB,KAAK,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACnF,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AAE1E,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,iBAAiB,CAAC;IACzB,QAAQ,EAAE,8BAA8B,CAAC;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,wBAAwB,CAAC;IACrC,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,MAAM,WAAW,+BAA+B;IAC9C,KAAK,EAAE,iBAAiB,CAAC;IACzB,QAAQ,EAAE,8BAA8B,CAAC;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,wBAAwB,CAAC;IACrC,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,iBAAiB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,8BAA8B,CAAC;IACzC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,wBAAwB,CAAC;CACtC;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,2BAA2B,GACjC,4BAA4B,CAsD9B;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,gCAAgC,GACtC,iCAAiC,GAAG,IAAI,CAuE1C;AAED,wBAAgB,2CAA2C,CACzD,KAAK,EAAE,+BAA+B,GACrC,gCAAgC,GAAG,IAAI,CAoDzC"}