@cats-inc/cats-platform 0.1.0

package/build/server/platform/auth/googleAccount.js

@@ -0,0 +1,158 @@
+import { randomUUID } from 'node:crypto';
+import { issueBrowserSession } from './session.js';
+export function createFirstAdminGoogleAuthState(input) {
+    if (input.state.accounts.length > 0) {
+        throw new Error('First admin already exists.');
+    }
+    const now = input.now ?? new Date();
+    const nowIso = now.toISOString();
+    const accountId = `auth-account-${randomUUID()}`;
+    const account = {
+        id: accountId,
+        displayName: input.identity.displayName ?? input.identity.email,
+        email: input.identity.email,
+        avatarUrl: input.identity.avatarUrl,
+        status: 'active',
+        createdAt: nowIso,
+        updatedAt: nowIso,
+    };
+    const providerIdentity = {
+        id: `auth-identity-${randomUUID()}`,
+        accountId,
+        provider: 'google',
+        providerSubject: input.identity.providerSubject,
+        email: input.identity.email,
+        createdAt: nowIso,
+        updatedAt: nowIso,
+    };
+    const membership = {
+        id: `auth-membership-${randomUUID()}`,
+        accountId,
+        roles: ['owner', 'admin'],
+        coreActorId: 'actor-owner',
+        createdAt: nowIso,
+        updatedAt: nowIso,
+    };
+    const session = issueBrowserSession({
+        accountId,
+        sessionSecret: input.sessionSecret,
+        ttlMs: input.sessionTtlMs,
+        now,
+    });
+    return {
+        state: {
+            ...input.state,
+            updatedAt: nowIso,
+            accounts: [account],
+            identities: [providerIdentity],
+            memberships: [membership],
+            sessions: [session.session],
+        },
+        account,
+        identity: providerIdentity,
+        membership,
+        session,
+    };
+}
+export function linkGoogleIdentityToAccount(input) {
+    const account = input.state.accounts.find((candidate) => candidate.id === input.accountId && candidate.status === 'active') ?? null;
+    const membership = account
+        ? input.state.memberships.find((candidate) => candidate.accountId === account.id) ?? null
+        : null;
+    if (!account || !membership) {
+        return null;
+    }
+    const identityForSubject = input.state.identities.find((candidate) => candidate.provider === 'google'
+        && candidate.providerSubject === input.identity.providerSubject) ?? null;
+    if (identityForSubject && identityForSubject.accountId !== account.id) {
+        throw new Error('Google identity is already linked to another account.');
+    }
+    const identityForAccount = input.state.identities.find((candidate) => candidate.provider === 'google'
+        && candidate.accountId === account.id) ?? null;
+    if (identityForAccount
+        && identityForAccount.providerSubject !== input.identity.providerSubject) {
+        throw new Error('Account already has a linked Google identity.');
+    }
+    const nowIso = (input.now ?? new Date()).toISOString();
+    const linkedIdentity = identityForSubject
+        ? {
+            ...identityForSubject,
+            email: input.identity.email,
+            updatedAt: nowIso,
+        }
+        : {
+            id: `auth-identity-${randomUUID()}`,
+            accountId: account.id,
+            provider: 'google',
+            providerSubject: input.identity.providerSubject,
+            email: input.identity.email,
+            createdAt: nowIso,
+            updatedAt: nowIso,
+        };
+    const updatedAccount = {
+        ...account,
+        email: input.identity.email,
+        avatarUrl: input.identity.avatarUrl ?? account.avatarUrl,
+        updatedAt: nowIso,
+    };
+    const nextIdentities = identityForSubject
+        ? input.state.identities.map((candidate) => candidate.id === identityForSubject.id ? linkedIdentity : candidate)
+        : [...input.state.identities, linkedIdentity];
+    return {
+        state: {
+            ...input.state,
+            updatedAt: nowIso,
+            accounts: input.state.accounts.map((candidate) => candidate.id === account.id ? updatedAccount : candidate),
+            identities: nextIdentities,
+        },
+        account: updatedAccount,
+        identity: linkedIdentity,
+        membership: structuredClone(membership),
+    };
+}
+export function createGoogleBrowserSessionForLinkedIdentity(input) {
+    const providerIdentity = input.state.identities.find((candidate) => candidate.provider === 'google'
+        && candidate.providerSubject === input.identity.providerSubject) ?? null;
+    const account = providerIdentity
+        ? input.state.accounts.find((candidate) => candidate.id === providerIdentity.accountId) ?? null
+        : null;
+    const membership = account
+        ? input.state.memberships.find((candidate) => candidate.accountId === account.id) ?? null
+        : null;
+    if (!providerIdentity || !account || !membership || account.status !== 'active') {
+        return null;
+    }
+    const now = input.now ?? new Date();
+    const nowIso = now.toISOString();
+    const session = issueBrowserSession({
+        accountId: account.id,
+        sessionSecret: input.sessionSecret,
+        ttlMs: input.sessionTtlMs,
+        now,
+    });
+    const updatedIdentity = {
+        ...providerIdentity,
+        email: input.identity.email,
+        updatedAt: nowIso,
+    };
+    const updatedAccount = {
+        ...account,
+        email: input.identity.email,
+        avatarUrl: input.identity.avatarUrl ?? account.avatarUrl,
+        updatedAt: nowIso,
+    };
+    return {
+        state: {
+            ...input.state,
+            updatedAt: nowIso,
+            accounts: input.state.accounts.map((candidate) => candidate.id === account.id ? updatedAccount : candidate),
+            identities: input.state.identities.map((candidate) => candidate.id === providerIdentity.id ? updatedIdentity : candidate),
+            sessions: [...input.state.sessions, session.session],
+        },
+        account: updatedAccount,
+        identity: updatedIdentity,
+        membership: structuredClone(membership),
+        session,
+    };
+}
+//# sourceMappingURL=googleAccount.js.map

package/build/server/platform/auth/googleAccount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"googleAccount.js","sourceRoot":"","sources":["../../../../src/platform/auth/googleAccount.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,mBAAmB,EAAkC,MAAM,cAAc,CAAC;AAuDnF,MAAM,UAAU,+BAA+B,CAC7C,KAAkC;IAElC,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,gBAAgB,UAAU,EAAE,EAAE,CAAC;IACjD,MAAM,OAAO,GAA0B;QACrC,EAAE,EAAE,SAAS;QACb,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC/D,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC3B,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QACnC,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,gBAAgB,GAA2B;QAC/C,EAAE,EAAE,iBAAiB,UAAU,EAAE,EAAE;QACnC,SAAS;QACT,QAAQ,EAAE,QAAQ;QAClB,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAe;QAC/C,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC3B,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,UAAU,GAA6B;QAC3C,EAAE,EAAE,mBAAmB,UAAU,EAAE,EAAE;QACrC,SAAS;QACT,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QACzB,WAAW,EAAE,aAAa;QAC1B,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,OAAO,GAAG,mBAAmB,CAAC;QAClC,SAAS;QACT,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,YAAY;QACzB,GAAG;KACJ,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE;YACL,GAAG,KAAK,CAAC,KAAK;YACd,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,CAAC,OAAO,CAAC;YACnB,UAAU,EAAE,CAAC,gBAAgB,CAAC;YAC9B,WAAW,EAAE,CAAC,UAAU,CAAC;YACzB,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;SAC5B;QACD,OAAO;QACP,QAAQ,EAAE,gBAAgB;QAC1B,UAAU;QACV,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAAuC;IAEvC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACtD,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAClE,IAAI,IAAI,CAAC;IACV,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;QACzF,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,kBAAkB,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACnE,SAAS,CAAC,QAAQ,KAAK,QAAQ;WAC5B,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,QAAQ,CAAC,eAAe,CAChE,IAAI,IAAI,CAAC;IACV,IAAI,kBAAkB,IAAI,kBAAkB,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,kBAAkB,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACnE,SAAS,CAAC,QAAQ,KAAK,QAAQ;WAC5B,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CACtC,IAAI,IAAI,CAAC;IACV,IACE,kBAAkB;WACf,kBAAkB,CAAC,eAAe,KAAK,KAAK,CAAC,QAAQ,CAAC,eAAe,EACxE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,MAAM,cAAc,GAA2B,kBAAkB;QAC/D,CAAC,CAAC;YACE,GAAG,kBAAkB;YACrB,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;YAC3B,SAAS,EAAE,MAAM;SAClB;QACH,CAAC,CAAC;YACE,EAAE,EAAE,iBAAiB,UAAU,EAAE,EAAE;YACnC,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,QAAQ,EAAE,QAAQ;YAClB,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAe;YAC/C,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;YAC3B,SAAS,EAAE,MAAM;YACjB,SAAS,EAAE,MAAM;SAClB,CAAC;IACN,MAAM,cAAc,GAA0B;QAC5C,GAAG,OAAO;QACV,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC3B,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS;QACxD,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,cAAc,GAAG,kBAAkB;QACvC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACvC,SAAS,CAAC,EAAE,KAAK,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CACpE;QACH,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAEhD,OAAO;QACL,KAAK,EAAE;YACL,GAAG,KAAK,CAAC,KAAK;YACd,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/C,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CACzD;YACD,UAAU,EAAE,cAAc;SAC3B;QACD,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,cAAc;QACxB,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,KAAsC;IAEtC,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjE,SAAS,CAAC,QAAQ,KAAK,QAAQ;WAC5B,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,QAAQ,CAAC,eAAe,CAChE,IAAI,IAAI,CAAC;IACV,MAAM,OAAO,GAAG,gBAAgB;QAC9B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,gBAAgB,CAAC,SAAS,CAAC,IAAI,IAAI;QAC/F,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;QACzF,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,gBAAgB,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,mBAAmB,CAAC;QAClC,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,YAAY;QACzB,GAAG;KACJ,CAAC,CAAC;IACH,MAAM,eAAe,GAA2B;QAC9C,GAAG,gBAAgB;QACnB,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC3B,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,cAAc,GAA0B;QAC5C,GAAG,OAAO;QACV,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC3B,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS;QACxD,SAAS,EAAE,MAAM;KAClB,CAAC;IAEF,OAAO;QACL,KAAK,EAAE;YACL,GAAG,KAAK,CAAC,KAAK;YACd,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/C,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CACzD;YACD,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACnD,SAAS,CAAC,EAAE,KAAK,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CACnE;YACD,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC;SACrD;QACD,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,eAAe;QACzB,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;QACvC,OAAO;KACR,CAAC;AACJ,CAAC"}

package/build/server/platform/auth/googleCsrf.d.ts

@@ -0,0 +1,12 @@
+export declare const GOOGLE_GIS_CSRF_COOKIE_NAME = "g_csrf_token";
+export type GoogleGisCsrfValidationResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: 'missing_cookie' | 'missing_body_token' | 'mismatch';
+};
+export declare function validateGoogleGisCsrfToken(input: {
+    cookieHeader: string | string[] | undefined;
+    bodyToken: unknown;
+}): GoogleGisCsrfValidationResult;
+//# sourceMappingURL=googleCsrf.d.ts.map

package/build/server/platform/auth/googleCsrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"googleCsrf.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/googleCsrf.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,2BAA2B,iBAAiB,CAAC;AAE1D,MAAM,MAAM,6BAA6B,GACrC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,GAAG,UAAU,CAAA;CAAE,CAAC;AAEhF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5C,SAAS,EAAE,OAAO,CAAC;CACpB,GAAG,6BAA6B,CAahC"}

package/build/server/platform/auth/googleCsrf.js

@@ -0,0 +1,29 @@
+export const GOOGLE_GIS_CSRF_COOKIE_NAME = 'g_csrf_token';
+export function validateGoogleGisCsrfToken(input) {
+    const cookieToken = readCookie(input.cookieHeader, GOOGLE_GIS_CSRF_COOKIE_NAME);
+    if (!cookieToken) {
+        return { ok: false, reason: 'missing_cookie' };
+    }
+    const bodyToken = typeof input.bodyToken === 'string' ? input.bodyToken.trim() : '';
+    if (!bodyToken) {
+        return { ok: false, reason: 'missing_body_token' };
+    }
+    if (cookieToken !== bodyToken) {
+        return { ok: false, reason: 'mismatch' };
+    }
+    return { ok: true };
+}
+function readCookie(header, name) {
+    const value = Array.isArray(header) ? header.join(';') : header;
+    if (!value) {
+        return null;
+    }
+    for (const part of value.split(';')) {
+        const [rawName, ...rawValue] = part.trim().split('=');
+        if (rawName === name) {
+            return decodeURIComponent(rawValue.join('=')).trim() || null;
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=googleCsrf.js.map

package/build/server/platform/auth/googleCsrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"googleCsrf.js","sourceRoot":"","sources":["../../../../src/platform/auth/googleCsrf.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,2BAA2B,GAAG,cAAc,CAAC;AAM1D,MAAM,UAAU,0BAA0B,CAAC,KAG1C;IACC,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;IAChF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,UAAU,CACjB,MAAqC,EACrC,IAAY;IAEZ,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAChE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/build/server/platform/auth/googleJwksVerifier.d.ts

@@ -0,0 +1,8 @@
+import { type PlatformGoogleIdTokenVerifier } from './googleVerifier.js';
+export interface GoogleJwksIdTokenVerifierOptions {
+    jwksUrl?: string;
+    fetchImpl?: typeof fetch;
+    now?: () => Date;
+}
+export declare function createGoogleJwksIdTokenVerifier(options?: GoogleJwksIdTokenVerifierOptions): PlatformGoogleIdTokenVerifier;
+//# sourceMappingURL=googleJwksVerifier.d.ts.map

package/build/server/platform/auth/googleJwksVerifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"googleJwksVerifier.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/googleJwksVerifier.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,6BAA6B,EACnC,MAAM,qBAAqB,CAAC;AAuB7B,MAAM,WAAW,gCAAgC;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,GAAE,gCAAqC,GAC7C,6BAA6B,CA+F/B"}

package/build/server/platform/auth/googleJwksVerifier.js

@@ -0,0 +1,116 @@
+import { webcrypto } from 'node:crypto';
+import { PlatformGoogleTokenVerificationError, } from './googleVerifier.js';
+const GOOGLE_JWKS_URL = 'https://www.googleapis.com/oauth2/v3/certs';
+const DEFAULT_JWKS_CACHE_TTL_MS = 60 * 60 * 1000;
+export function createGoogleJwksIdTokenVerifier(options = {}) {
+    const jwksUrl = options.jwksUrl ?? GOOGLE_JWKS_URL;
+    const fetchImpl = options.fetchImpl ?? fetch;
+    let cache = null;
+    async function readKeys(forceRefresh) {
+        const nowMs = (options.now?.() ?? new Date()).getTime();
+        if (!forceRefresh && cache && cache.expiresAtMs > nowMs) {
+            return cache;
+        }
+        let response;
+        try {
+            response = await fetchImpl(jwksUrl, { headers: { Accept: 'application/json' } });
+        }
+        catch (error) {
+            throw new PlatformGoogleTokenVerificationError('invalid_token', `Failed to fetch Google JWKS: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (!response.ok) {
+            throw new PlatformGoogleTokenVerificationError('invalid_token', `Failed to fetch Google JWKS (${response.status}).`);
+        }
+        const payload = await response.json();
+        const keysById = new Map();
+        for (const key of Array.isArray(payload.keys) ? payload.keys : []) {
+            if (!isGoogleRsaSigningJwk(key)) {
+                continue;
+            }
+            keysById.set(key.kid, key);
+        }
+        if (keysById.size === 0) {
+            throw new PlatformGoogleTokenVerificationError('invalid_token', 'Google JWKS did not contain usable RSA signing keys.');
+        }
+        cache = {
+            keysById,
+            expiresAtMs: nowMs + readCacheTtlMs(response.headers),
+        };
+        return cache;
+    }
+    return {
+        async verifyIdToken(input) {
+            const parsed = parseJwt(input.token);
+            if (parsed.header.alg !== 'RS256' || typeof parsed.header.kid !== 'string') {
+                throw new PlatformGoogleTokenVerificationError('invalid_token', 'Google ID token header is not an RS256 token with a key id.');
+            }
+            let keys = await readKeys(false);
+            let jwk = keys.keysById.get(parsed.header.kid);
+            if (!jwk) {
+                keys = await readKeys(true);
+                jwk = keys.keysById.get(parsed.header.kid);
+            }
+            if (!jwk) {
+                throw new PlatformGoogleTokenVerificationError('invalid_token', 'Google ID token key id is not in the current JWKS.');
+            }
+            const key = await webcrypto.subtle.importKey('jwk', jwk, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['verify']);
+            const verified = await webcrypto.subtle.verify({ name: 'RSASSA-PKCS1-v1_5' }, key, parsed.signature, new TextEncoder().encode(parsed.signingInput));
+            if (!verified) {
+                throw new PlatformGoogleTokenVerificationError('invalid_token', 'Google ID token signature is invalid.');
+            }
+            return parsed.claims;
+        },
+    };
+}
+function parseJwt(token) {
+    const [encodedHeader, encodedClaims, encodedSignature, extra] = token.split('.');
+    if (!encodedHeader || !encodedClaims || !encodedSignature || extra !== undefined) {
+        throw new PlatformGoogleTokenVerificationError('invalid_token', 'Google ID token must be a compact JWT.');
+    }
+    return {
+        header: readJsonSegment(encodedHeader, 'header'),
+        claims: readJsonSegment(encodedClaims, 'claims'),
+        signingInput: `${encodedHeader}.${encodedClaims}`,
+        signature: base64UrlDecode(encodedSignature),
+    };
+}
+function readJsonSegment(segment, label) {
+    try {
+        return JSON.parse(Buffer.from(base64UrlDecode(segment)).toString('utf8'));
+    }
+    catch {
+        throw new PlatformGoogleTokenVerificationError('invalid_token', `Google ID token ${label} is not valid JSON.`);
+    }
+}
+function base64UrlDecode(value) {
+    try {
+        return Buffer.from(value, 'base64url');
+    }
+    catch {
+        throw new PlatformGoogleTokenVerificationError('invalid_token', 'Google ID token contains invalid base64url.');
+    }
+}
+function isGoogleRsaSigningJwk(value) {
+    if (typeof value !== 'object' || value === null) {
+        return false;
+    }
+    const key = value;
+    return key.kty === 'RSA'
+        && key.use === 'sig'
+        && key.alg === 'RS256'
+        && typeof key.kid === 'string'
+        && typeof key.n === 'string'
+        && typeof key.e === 'string';
+}
+function readCacheTtlMs(headers) {
+    const cacheControl = headers.get('cache-control');
+    const maxAge = cacheControl?.match(/(?:^|,)\s*max-age=(\d+)/iu)?.[1];
+    if (!maxAge) {
+        return DEFAULT_JWKS_CACHE_TTL_MS;
+    }
+    const parsed = Number.parseInt(maxAge, 10);
+    return Number.isInteger(parsed) && parsed > 0
+        ? parsed * 1000
+        : DEFAULT_JWKS_CACHE_TTL_MS;
+}
+//# sourceMappingURL=googleJwksVerifier.js.map

package/build/server/platform/auth/googleJwksVerifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"googleJwksVerifier.js","sourceRoot":"","sources":["../../../../src/platform/auth/googleJwksVerifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,OAAO,EACL,oCAAoC,GAGrC,MAAM,qBAAqB,CAAC;AAE7B,MAAM,eAAe,GAAG,4CAA4C,CAAC;AACrE,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA0BjD,MAAM,UAAU,+BAA+B,CAC7C,UAA4C,EAAE;IAE9C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,IAAI,KAAK,GAA4B,IAAI,CAAC;IAE1C,KAAK,UAAU,QAAQ,CAAC,YAAqB;QAC3C,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACxD,IAAI,CAAC,YAAY,IAAI,KAAK,IAAI,KAAK,CAAC,WAAW,GAAG,KAAK,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,oCAAoC,CAC5C,eAAe,EACf,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACzF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,oCAAoC,CAC5C,eAAe,EACf,gCAAgC,QAAQ,CAAC,MAAM,IAAI,CACpD,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAwB,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;QACxD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAClE,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChC,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,oCAAoC,CAC5C,eAAe,EACf,sDAAsD,CACvD,CAAC;QACJ,CAAC;QAED,KAAK,GAAG;YACN,QAAQ;YACR,WAAW,EAAE,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC;SACtD,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO;QACL,KAAK,CAAC,aAAa,CAAC,KAAK;YACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC3E,MAAM,IAAI,oCAAoC,CAC5C,eAAe,EACf,6DAA6D,CAC9D,CAAC;YACJ,CAAC;YAED,IAAI,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC5B,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,oCAAoC,CAC5C,eAAe,EACf,oDAAoD,CACrD,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAC1C,KAAK,EACL,GAAG,EACH,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAC9C,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,CAC5C,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAC7B,GAAG,EACH,MAAM,CAAC,SAAS,EAChB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAC9C,CAAC;YACF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,oCAAoC,CAC5C,eAAe,EACf,uCAAuC,CACxC,CAAC;YACJ,CAAC;YAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAM7B,MAAM,CAAC,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjF,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,IAAI,CAAC,gBAAgB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACjF,MAAM,IAAI,oCAAoC,CAC5C,eAAe,EACf,wCAAwC,CACzC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,eAAe,CAAC,aAAa,EAAE,QAAQ,CAAC;QAChD,MAAM,EAAE,eAAe,CAAC,aAAa,EAAE,QAAQ,CAAC;QAChD,YAAY,EAAE,GAAG,aAAa,IAAI,aAAa,EAAE;QACjD,SAAS,EAAE,eAAe,CAAC,gBAAgB,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAI,OAAe,EAAE,KAAa;IACxD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oCAAoC,CAC5C,eAAe,EACf,mBAAmB,KAAK,qBAAqB,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oCAAoC,CAC5C,eAAe,EACf,6CAA6C,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,GAAG,CAAC,GAAG,KAAK,KAAK;WACnB,GAAG,CAAC,GAAG,KAAK,KAAK;WACjB,GAAG,CAAC,GAAG,KAAK,OAAO;WACnB,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;WAC3B,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;WACzB,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CAAC,OAAgB;IACtC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,YAAY,EAAE,KAAK,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;QAC3C,CAAC,CAAC,MAAM,GAAG,IAAI;QACf,CAAC,CAAC,yBAAyB,CAAC;AAChC,CAAC"}

package/build/server/platform/auth/googleVerifier.d.ts

@@ -0,0 +1,43 @@
+export type PlatformGoogleTokenVerificationErrorCode = 'invalid_token' | 'missing_audience' | 'audience_mismatch' | 'issuer_mismatch' | 'expired' | 'missing_subject' | 'missing_email' | 'email_unverified' | 'hosted_domain_mismatch' | 'nonce_mismatch';
+export declare class PlatformGoogleTokenVerificationError extends Error {
+    readonly code: PlatformGoogleTokenVerificationErrorCode;
+    constructor(code: PlatformGoogleTokenVerificationErrorCode, message: string);
+}
+export interface PlatformGoogleIdTokenClaims {
+    sub?: unknown;
+    aud?: unknown;
+    iss?: unknown;
+    exp?: unknown;
+    email?: unknown;
+    email_verified?: unknown;
+    hd?: unknown;
+    name?: unknown;
+    picture?: unknown;
+    nonce?: unknown;
+}
+export interface PlatformVerifiedGoogleIdentity {
+    providerSubject: string;
+    email: string;
+    hostedDomain: string | null;
+    displayName: string | null;
+    avatarUrl: string | null;
+    audience: string;
+    issuer: string;
+    expiresAt: string;
+}
+export interface PlatformGoogleIdTokenVerifier {
+    verifyIdToken(input: {
+        token: string;
+        audiences: readonly string[];
+    }): Promise<PlatformGoogleIdTokenClaims>;
+}
+export declare function verifyPlatformGoogleIdentityToken(input: {
+    token: string;
+    audiences: readonly string[];
+    hostedDomains?: readonly string[];
+    verifier: PlatformGoogleIdTokenVerifier;
+    expectedNonce?: string | null;
+    now?: Date;
+    clockSkewMs?: number;
+}): Promise<PlatformVerifiedGoogleIdentity>;
+//# sourceMappingURL=googleVerifier.d.ts.map

package/build/server/platform/auth/googleVerifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"googleVerifier.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/googleVerifier.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,wCAAwC,GAChD,eAAe,GACf,kBAAkB,GAClB,mBAAmB,GACnB,iBAAiB,GACjB,SAAS,GACT,iBAAiB,GACjB,eAAe,GACf,kBAAkB,GAClB,wBAAwB,GACxB,gBAAgB,CAAC;AAErB,qBAAa,oCAAqC,SAAQ,KAAK;aAE3C,IAAI,EAAE,wCAAwC;gBAA9C,IAAI,EAAE,wCAAwC,EAC9D,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,2BAA2B;IAC1C,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,8BAA8B;IAC7C,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,6BAA6B;IAC5C,aAAa,CAAC,KAAK,EAAE;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;KAC9B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;CAC1C;AAQD,wBAAsB,iCAAiC,CAAC,KAAK,EAAE;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,EAAE,6BAA6B,CAAC;IACxC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,8BAA8B,CAAC,CA+D1C"}

package/build/server/platform/auth/googleVerifier.js

@@ -0,0 +1,110 @@
+export class PlatformGoogleTokenVerificationError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'PlatformGoogleTokenVerificationError';
+    }
+}
+const GOOGLE_TOKEN_ISSUERS = new Set([
+    'accounts.google.com',
+    'https://accounts.google.com',
+]);
+const DEFAULT_CLOCK_SKEW_MS = 60_000;
+export async function verifyPlatformGoogleIdentityToken(input) {
+    const token = input.token.trim();
+    if (!token) {
+        throw new PlatformGoogleTokenVerificationError('invalid_token', 'Google token is required.');
+    }
+    const audiences = normalizeStringList(input.audiences);
+    if (audiences.length === 0) {
+        throw new PlatformGoogleTokenVerificationError('missing_audience', 'At least one Google audience is required.');
+    }
+    const claims = await input.verifier.verifyIdToken({ token, audiences });
+    const issuer = readRequiredString(claims.iss, 'issuer_mismatch', 'Google issuer is missing.');
+    if (!GOOGLE_TOKEN_ISSUERS.has(issuer)) {
+        throw new PlatformGoogleTokenVerificationError('issuer_mismatch', 'Google issuer is not trusted.');
+    }
+    const audience = readAudience(claims.aud, audiences);
+    validateNonce(claims.nonce, input.expectedNonce);
+    const expiresAt = readExpiry(claims.exp);
+    const nowMs = input.now?.getTime() ?? Date.now();
+    const clockSkewMs = input.clockSkewMs ?? DEFAULT_CLOCK_SKEW_MS;
+    if (expiresAt.getTime() <= nowMs - clockSkewMs) {
+        throw new PlatformGoogleTokenVerificationError('expired', 'Google token is expired.');
+    }
+    const providerSubject = readRequiredString(claims.sub, 'missing_subject', 'Google subject is missing.');
+    const email = readRequiredString(claims.email, 'missing_email', 'Google email is missing.');
+    if (claims.email_verified !== true && claims.email_verified !== 'true') {
+        throw new PlatformGoogleTokenVerificationError('email_unverified', 'Google email is not verified.');
+    }
+    const hostedDomain = readOptionalString(claims.hd);
+    const hostedDomains = normalizeStringList(input.hostedDomains ?? []);
+    if (hostedDomains.length > 0 && (!hostedDomain || !hostedDomains.includes(hostedDomain))) {
+        throw new PlatformGoogleTokenVerificationError('hosted_domain_mismatch', 'Google hosted domain is not allowed.');
+    }
+    return {
+        providerSubject,
+        email: email.toLowerCase(),
+        hostedDomain,
+        displayName: readOptionalString(claims.name),
+        avatarUrl: readOptionalString(claims.picture),
+        audience,
+        issuer,
+        expiresAt: expiresAt.toISOString(),
+    };
+}
+// `expectedNonce` is the value the caller (e.g. mobile login route) recorded
+// as the nonce it sent to Google. Verifying that the ID token's `nonce` claim
+// matches it satisfies OIDC §3.1.2.7 / §3.2.2.11 and prevents a different
+// relying party's ID tokens (different nonce) from replaying against Cats.
+//
+// Residual risk: this is "client-supplied nonce" binding, not "server-issued
+// nonce" binding. The nonce travels in the JWT payload (base64-encoded plain
+// text), so an attacker who obtains the bare ID token can read the nonce off
+// of it and replay both together. The remaining mitigations are TLS, Google's
+// short ID-token expiry, and the per-remote-address login throttle. ADR-096
+// §4 ("Google is implemented as an identity provider") records this as a
+// known limitation; a future hardening is to have the platform host issue and
+// pin the nonce itself.
+function validateNonce(value, expectedNonce) {
+    const expected = expectedNonce?.trim();
+    if (!expected) {
+        return;
+    }
+    if (readOptionalString(value) !== expected) {
+        throw new PlatformGoogleTokenVerificationError('nonce_mismatch', 'Google nonce is not valid for this request.');
+    }
+}
+function readAudience(value, allowedAudiences) {
+    const candidates = Array.isArray(value)
+        ? value.filter((entry) => typeof entry === 'string')
+        : typeof value === 'string'
+            ? [value]
+            : [];
+    const matched = candidates.find((candidate) => allowedAudiences.includes(candidate));
+    if (!matched) {
+        throw new PlatformGoogleTokenVerificationError('audience_mismatch', 'Google audience is not allowed.');
+    }
+    return matched;
+}
+function readExpiry(value) {
+    if (typeof value !== 'number' || !Number.isFinite(value)) {
+        throw new PlatformGoogleTokenVerificationError('expired', 'Google expiry is missing.');
+    }
+    return new Date(value * 1000);
+}
+function readRequiredString(value, code, message) {
+    const normalized = readOptionalString(value);
+    if (!normalized) {
+        throw new PlatformGoogleTokenVerificationError(code, message);
+    }
+    return normalized;
+}
+function readOptionalString(value) {
+    return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+function normalizeStringList(values) {
+    return [...new Set(values.map((value) => value.trim()).filter(Boolean))];
+}
+//# sourceMappingURL=googleVerifier.js.map

package/build/server/platform/auth/googleVerifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"googleVerifier.js","sourceRoot":"","sources":["../../../../src/platform/auth/googleVerifier.ts"],"names":[],"mappings":"AAYA,MAAM,OAAO,oCAAqC,SAAQ,KAAK;IAE3C;IADlB,YACkB,IAA8C,EAC9D,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAA0C;QAI9D,IAAI,CAAC,IAAI,GAAG,sCAAsC,CAAC;IACrD,CAAC;CACF;AAiCD,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,qBAAqB;IACrB,6BAA6B;CAC9B,CAAC,CAAC;AACH,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAQvD;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,oCAAoC,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,oCAAoC,CAC5C,kBAAkB,EAClB,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;IAC9F,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,oCAAoC,CAC5C,iBAAiB,EACjB,+BAA+B,CAChC,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACrD,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACjD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,qBAAqB,CAAC;IAC/D,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,KAAK,GAAG,WAAW,EAAE,CAAC;QAC/C,MAAM,IAAI,oCAAoC,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,eAAe,GAAG,kBAAkB,CACxC,MAAM,CAAC,GAAG,EACV,iBAAiB,EACjB,4BAA4B,CAC7B,CAAC;IACF,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,EAAE,0BAA0B,CAAC,CAAC;IAC5F,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,IAAI,MAAM,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;QACvE,MAAM,IAAI,oCAAoC,CAC5C,kBAAkB,EAClB,+BAA+B,CAChC,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnD,MAAM,aAAa,GAAG,mBAAmB,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IACrE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,oCAAoC,CAC5C,wBAAwB,EACxB,sCAAsC,CACvC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,eAAe;QACf,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;QAC1B,YAAY;QACZ,WAAW,EAAE,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5C,SAAS,EAAE,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC;QAC7C,QAAQ;QACR,MAAM;QACN,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;KACnC,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,8EAA8E;AAC9E,0EAA0E;AAC1E,2EAA2E;AAC3E,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,yEAAyE;AACzE,8EAA8E;AAC9E,wBAAwB;AACxB,SAAS,aAAa,CAAC,KAAc,EAAE,aAAwC;IAC7E,MAAM,QAAQ,GAAG,aAAa,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;IACT,CAAC;IACD,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,oCAAoC,CAC5C,gBAAgB,EAChB,6CAA6C,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,gBAAmC;IACvE,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QACrE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,CAAC,CAAC,KAAK,CAAC;YACT,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,oCAAoC,CAC5C,mBAAmB,EACnB,iCAAiC,CAClC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,oCAAoC,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAc,EACd,IAA8C,EAC9C,OAAe;IAEf,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,oCAAoC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAyB;IACpD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC"}

package/build/server/platform/auth/index.d.ts

@@ -0,0 +1,24 @@
+export * from './actorAttribution.js';
+export * from './bootstrap.js';
+export * from './bootstrapEnvelope.js';
+export * from './config.js';
+export * from './cookies.js';
+export * from './csrf.js';
+export * from './effectiveMode.js';
+export * from './errorCodes.js';
+export * from './googleAccount.js';
+export * from './googleCsrf.js';
+export * from './googleJwksVerifier.js';
+export * from './googleVerifier.js';
+export * from './localLogin.js';
+export * from './originGate.js';
+export * from './password.js';
+export * from './principal.js';
+export * from './readiness.js';
+export * from './recovery.js';
+export * from './session.js';
+export * from './state.js';
+export * from './store.js';
+export * from './throttle.js';
+export * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/build/server/platform/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC"}

package/build/server/platform/auth/index.js

@@ -0,0 +1,24 @@
+export * from './actorAttribution.js';
+export * from './bootstrap.js';
+export * from './bootstrapEnvelope.js';
+export * from './config.js';
+export * from './cookies.js';
+export * from './csrf.js';
+export * from './effectiveMode.js';
+export * from './errorCodes.js';
+export * from './googleAccount.js';
+export * from './googleCsrf.js';
+export * from './googleJwksVerifier.js';
+export * from './googleVerifier.js';
+export * from './localLogin.js';
+export * from './originGate.js';
+export * from './password.js';
+export * from './principal.js';
+export * from './readiness.js';
+export * from './recovery.js';
+export * from './session.js';
+export * from './state.js';
+export * from './store.js';
+export * from './throttle.js';
+export * from './types.js';
+//# sourceMappingURL=index.js.map

package/build/server/platform/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/platform/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC"}

package/build/server/platform/auth/localLogin.d.ts

@@ -0,0 +1,11 @@
+import type { PlatformAccountRecord, PlatformAuthState, PlatformIdentityRecord, PlatformMembershipRecord } from './types.js';
+export interface PlatformLocalPasswordCredentialMatch {
+    identity: PlatformIdentityRecord;
+    account: PlatformAccountRecord;
+    membership: PlatformMembershipRecord;
+}
+export declare function verifyPlatformLocalPasswordCredential(state: PlatformAuthState, input: {
+    identifier: string;
+    password: string;
+}): Promise<PlatformLocalPasswordCredentialMatch | null>;
+//# sourceMappingURL=localLogin.d.ts.map

package/build/server/platform/auth/localLogin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"localLogin.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/localLogin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,oCAAoC;IACnD,QAAQ,EAAE,sBAAsB,CAAC;IACjC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,UAAU,EAAE,wBAAwB,CAAC;CACtC;AAED,wBAAsB,qCAAqC,CACzD,KAAK,EAAE,iBAAiB,EACxB,KAAK,EAAE;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB,GACA,OAAO,CAAC,oCAAoC,GAAG,IAAI,CAAC,CA4BtD"}

package/build/server/platform/auth/localLogin.js

@@ -0,0 +1,27 @@
+import { verifyLocalPassword } from './password.js';
+export async function verifyPlatformLocalPasswordCredential(state, input) {
+    const identity = state.identities.find((candidate) => candidate.provider === 'local_password'
+        && (candidate.providerSubject === input.identifier
+            || candidate.email?.toLowerCase() === input.identifier)) ?? null;
+    const account = identity
+        ? state.accounts.find((candidate) => candidate.id === identity.accountId) ?? null
+        : null;
+    const membership = account
+        ? state.memberships.find((candidate) => candidate.accountId === account.id) ?? null
+        : null;
+    const valid = identity?.passwordHash && identity.passwordHashAlgorithm
+        ? await verifyLocalPassword(input.password, {
+            passwordHash: identity.passwordHash,
+            passwordHashAlgorithm: identity.passwordHashAlgorithm,
+        })
+        : false;
+    if (!identity || !account || !membership || account.status !== 'active' || !valid) {
+        return null;
+    }
+    return {
+        identity: structuredClone(identity),
+        account: structuredClone(account),
+        membership: structuredClone(membership),
+    };
+}
+//# sourceMappingURL=localLogin.js.map

package/build/server/platform/auth/localLogin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localLogin.js","sourceRoot":"","sources":["../../../../src/platform/auth/localLogin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAcpD,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAAwB,EACxB,KAGC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACnD,SAAS,CAAC,QAAQ,KAAK,gBAAgB;WACpC,CACD,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,UAAU;eAC3C,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,KAAK,CAAC,UAAU,CACvD,CACF,IAAI,IAAI,CAAC;IACV,MAAM,OAAO,GAAG,QAAQ;QACtB,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI;QACjF,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;QACnF,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,KAAK,GAAG,QAAQ,EAAE,YAAY,IAAI,QAAQ,CAAC,qBAAqB;QACpE,CAAC,CAAC,MAAM,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE;YACxC,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;SACtD,CAAC;QACJ,CAAC,CAAC,KAAK,CAAC;IACV,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC;QACnC,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC;QACjC,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;KACxC,CAAC;AACJ,CAAC"}