@cats-inc/cats-platform 0.1.10 → 0.2.8

package/build/server/platform/auth/bootstrap.js

@@ -1,15 +1,40 @@
 import { randomUUID } from 'node:crypto';
+import { assertPlatformAdminCredentials } from './adminCredentials.js';
 import { createLocalPasswordHash } from './password.js';
 import { issueBrowserSession } from './session.js';
+/**
+ * Raised when first-admin creation loses the uniqueness recheck that runs
+ * inside the serialized auth-state mutation. Callers map this to a conflict
+ * response instead of creating a second Account.
+ */
+export class PlatformFirstAdminExistsError extends Error {
+    constructor() {
+        super('First admin already exists.');
+        this.name = 'PlatformFirstAdminExistsError';
+    }
+}
+/**
+ * SPEC-113 requirement 5: the "no Admin exists" check must run inside the same
+ * serialized mutation that persists the new records. A prior setup-status read
+ * is not concurrency control.
+ */
+export function hasExistingPlatformAdmin(state) {
+    return state.accounts.length > 0
+        || state.memberships.some((membership) => membership.roles.some((role) => role === 'owner' || role === 'admin'));
+}
 export async function createFirstAdminLocalAuthState(input) {
-    if (input.state.accounts.length > 0) {
-        throw new Error('First admin already exists.');
+    if (hasExistingPlatformAdmin(input.state)) {
+        throw new PlatformFirstAdminExistsError();
     }
+    const credentials = assertPlatformAdminCredentials({
+        identifier: input.identifier,
+        password: input.password,
+    });
     const now = input.now ?? new Date();
     const nowIso = now.toISOString();
     const accountId = `auth-account-${randomUUID()}`;
-    const normalizedIdentifier = normalizeAccountIdentifier(input.identifier);
-    const password = await createLocalPasswordHash(input.password);
+    const normalizedIdentifier = normalizeAccountIdentifier(credentials.identifier);
+    const password = await createLocalPasswordHash(credentials.password);
     const account = {
         id: accountId,
         displayName: input.displayName.trim() || 'Owner',

package/build/server/platform/auth/bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../../../src/platform/auth/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAkC,MAAM,cAAc,CAAC;AA0BnF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAiC;IAEjC,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,gBAAgB,UAAU,EAAE,EAAE,CAAC;IACjD,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,OAAO,GAA0B;QACrC,EAAE,EAAE,SAAS;QACb,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,OAAO;QAChD,KAAK,EAAE,cAAc,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI;QACzE,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,QAAQ,GAA2B;QACvC,EAAE,EAAE,iBAAiB,UAAU,EAAE,EAAE;QACnC,SAAS;QACT,QAAQ,EAAE,gBAAgB;QAC1B,eAAe,EAAE,oBAAoB;QACrC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;QACrD,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,UAAU,GAA6B;QAC3C,EAAE,EAAE,mBAAmB,UAAU,EAAE,EAAE;QACrC,SAAS;QACT,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QACzB,WAAW,EAAE,aAAa;QAC1B,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,OAAO,GAAG,mBAAmB,CAAC;QAClC,SAAS;QACT,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,YAAY;QACzB,GAAG;KACJ,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE;YACL,GAAG,KAAK,CAAC,KAAK;YACd,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,CAAC,OAAO,CAAC;YACnB,UAAU,EAAE,CAAC,QAAQ,CAAC;YACtB,WAAW,EAAE,CAAC,UAAU,CAAC;YACzB,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;SAC5B;QACD,OAAO;QACP,QAAQ;QACR,UAAU;QACV,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,UAAkB;IACxC,OAAO,6BAA6B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../../../src/platform/auth/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAkC,MAAM,cAAc,CAAC;AAQnF;;;;GAIG;AACH,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD;QACE,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAwB;IAC/D,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;WAC3B,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CACvC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC,CACtE,CAAC;AACN,CAAC;AAoBD,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAiC;IAEjC,IAAI,wBAAwB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,6BAA6B,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,WAAW,GAAG,8BAA8B,CAAC;QACjD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,gBAAgB,UAAU,EAAE,EAAE,CAAC;IACjD,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACrE,MAAM,OAAO,GAA0B;QACrC,EAAE,EAAE,SAAS;QACb,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,OAAO;QAChD,KAAK,EAAE,cAAc,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI;QACzE,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,QAAQ,GAA2B;QACvC,EAAE,EAAE,iBAAiB,UAAU,EAAE,EAAE;QACnC,SAAS;QACT,QAAQ,EAAE,gBAAgB;QAC1B,eAAe,EAAE,oBAAoB;QACrC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;QACrD,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,UAAU,GAA6B;QAC3C,EAAE,EAAE,mBAAmB,UAAU,EAAE,EAAE;QACrC,SAAS;QACT,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QACzB,WAAW,EAAE,aAAa;QAC1B,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,OAAO,GAAG,mBAAmB,CAAC;QAClC,SAAS;QACT,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,YAAY;QACzB,GAAG;KACJ,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE;YACL,GAAG,KAAK,CAAC,KAAK;YACd,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,CAAC,OAAO,CAAC;YACnB,UAAU,EAAE,CAAC,QAAQ,CAAC;YACtB,WAAW,EAAE,CAAC,UAAU,CAAC;YACzB,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;SAC5B;QACD,OAAO;QACP,QAAQ;QACR,UAAU;QACV,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,UAAkB;IACxC,OAAO,6BAA6B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACxD,CAAC"}

package/build/server/platform/auth/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/config.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,iBAAiB,CAAC;AAEzE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,wBAAwB,CAAC;CAClC;AAED,eAAO,MAAM,2BAA2B,QAA0B,CAAC;AACnE,eAAO,MAAM,kCAAkC,QAA2B,CAAC;AAC3E,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAClD,eAAO,MAAM,6BAA6B,QAAS,CAAC;AACpD,eAAO,MAAM,sCAAsC,MAAM,CAAC;AAC1D,eAAO,MAAM,gCAAgC,QAAiB,CAAC;AAC/D,eAAO,MAAM,qCAAqC,MAAM,CAAC;AAEzD,MAAM,WAAW,2BAA2B;IAC1C,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,kBAAkB,CAqD7F"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/config.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,iBAAiB,CAAC;AAEzE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,wBAAwB,CAAC;CAClC;AAED,eAAO,MAAM,2BAA2B,QAA2B,CAAC;AACpE,eAAO,MAAM,kCAAkC,QAA2B,CAAC;AAC3E,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAClD,eAAO,MAAM,6BAA6B,QAAS,CAAC;AACpD,eAAO,MAAM,sCAAsC,MAAM,CAAC;AAC1D,eAAO,MAAM,gCAAgC,QAAiB,CAAC;AAC/D,eAAO,MAAM,qCAAqC,MAAM,CAAC;AAEzD,MAAM,WAAW,2BAA2B;IAC1C,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,kBAAkB,CAqD7F"}

package/build/server/platform/auth/config.js

@@ -1,5 +1,5 @@
 import { resolvePlatformAuthRecoveryTokenPathFromChatState, resolvePlatformAuthStatePathFromChatState, } from '../../shared/platformPaths.js';
-export const DEFAULT_AUTH_SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+export const DEFAULT_AUTH_SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 export const DEFAULT_AUTH_MOBILE_SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 export const DEFAULT_AUTH_LOGIN_FAILURE_LIMIT = 5;
 export const DEFAULT_AUTH_LOGIN_LOCKOUT_MS = 30_000;

package/build/server/platform/auth/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/platform/auth/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iDAAiD,EACjD,yCAAyC,GAC1C,MAAM,+BAA+B,CAAC;AA2BvC,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACnE,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3E,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAClD,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AACpD,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,CAAC;AAC1D,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/D,MAAM,CAAC,MAAM,qCAAqC,GAAG,GAAG,CAAC;AASzD,MAAM,UAAU,sBAAsB,CAAC,KAAkC;IACvE,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACxD,MAAM,qBAAqB,GAAG,eAAe,CAC3C,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAC5C,IAAI,4BAA4B,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,IAAI,KAAK,iBAAiB;QACnC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,IAAI;QACjE,YAAY,EAAE,gBAAgB,CAC5B,KAAK,CAAC,GAAG,CAAC,wBAAwB,EAClC,2BAA2B,EAC3B,0BAA0B,CAC3B;QACD,kBAAkB,EAAE,gBAAgB,CAClC,KAAK,CAAC,GAAG,CAAC,+BAA+B,EACzC,kCAAkC,EAClC,iCAAiC,CAClC;QACD,iBAAiB,EAAE,gBAAgB,CACjC,KAAK,CAAC,GAAG,CAAC,6BAA6B,EACvC,gCAAgC,EAChC,+BAA+B,CAChC;QACD,cAAc,EAAE,gBAAgB,CAC9B,KAAK,CAAC,GAAG,CAAC,0BAA0B,EACpC,6BAA6B,EAC7B,4BAA4B,CAC7B;QACD,sBAAsB,EAAE,gBAAgB,CACtC,KAAK,CAAC,GAAG,CAAC,mCAAmC,EAC7C,sCAAsC,EACtC,qCAAqC,CACtC;QACD,iBAAiB,EAAE,gBAAgB,CACjC,KAAK,CAAC,GAAG,CAAC,6BAA6B,EACvC,gCAAgC,EAChC,+BAA+B,CAChC;QACD,qBAAqB,EAAE,gBAAgB,CACrC,KAAK,CAAC,GAAG,CAAC,kCAAkC,EAC5C,qCAAqC,EACrC,oCAAoC,CACrC;QACD,qBAAqB;QACrB,aAAa,EAAE,yCAAyC,CAAC,KAAK,CAAC,aAAa,CAAC;QAC7E,iBAAiB,EAAE,iDAAiD,CAAC,KAAK,CAAC,aAAa,CAAC;QACzF,MAAM,EAAE;YACN,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,IAAI;YAC9D,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACtD,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAAC;SACvE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAuB;IAC5C,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAuB,EAAE,QAAgB,EAAE,IAAY;IAC/E,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAuB;IACvC,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO;SACX,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,eAAe,CAAC,GAAuB;IAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAY,EAAE,IAAY;IAC9D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;YACjB,eAAe,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;YACzC,uBAAuB;YACvB,uBAAuB;SACxB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,gCAAgC,KAAK,MACnC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/platform/auth/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iDAAiD,EACjD,yCAAyC,GAC1C,MAAM,+BAA+B,CAAC;AA2BvC,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACpE,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3E,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAClD,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AACpD,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,CAAC;AAC1D,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/D,MAAM,CAAC,MAAM,qCAAqC,GAAG,GAAG,CAAC;AASzD,MAAM,UAAU,sBAAsB,CAAC,KAAkC;IACvE,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACxD,MAAM,qBAAqB,GAAG,eAAe,CAC3C,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAC5C,IAAI,4BAA4B,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,IAAI,KAAK,iBAAiB;QACnC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,IAAI;QACjE,YAAY,EAAE,gBAAgB,CAC5B,KAAK,CAAC,GAAG,CAAC,wBAAwB,EAClC,2BAA2B,EAC3B,0BAA0B,CAC3B;QACD,kBAAkB,EAAE,gBAAgB,CAClC,KAAK,CAAC,GAAG,CAAC,+BAA+B,EACzC,kCAAkC,EAClC,iCAAiC,CAClC;QACD,iBAAiB,EAAE,gBAAgB,CACjC,KAAK,CAAC,GAAG,CAAC,6BAA6B,EACvC,gCAAgC,EAChC,+BAA+B,CAChC;QACD,cAAc,EAAE,gBAAgB,CAC9B,KAAK,CAAC,GAAG,CAAC,0BAA0B,EACpC,6BAA6B,EAC7B,4BAA4B,CAC7B;QACD,sBAAsB,EAAE,gBAAgB,CACtC,KAAK,CAAC,GAAG,CAAC,mCAAmC,EAC7C,sCAAsC,EACtC,qCAAqC,CACtC;QACD,iBAAiB,EAAE,gBAAgB,CACjC,KAAK,CAAC,GAAG,CAAC,6BAA6B,EACvC,gCAAgC,EAChC,+BAA+B,CAChC;QACD,qBAAqB,EAAE,gBAAgB,CACrC,KAAK,CAAC,GAAG,CAAC,kCAAkC,EAC5C,qCAAqC,EACrC,oCAAoC,CACrC;QACD,qBAAqB;QACrB,aAAa,EAAE,yCAAyC,CAAC,KAAK,CAAC,aAAa,CAAC;QAC7E,iBAAiB,EAAE,iDAAiD,CAAC,KAAK,CAAC,aAAa,CAAC;QACzF,MAAM,EAAE;YACN,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,IAAI;YAC9D,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACtD,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAAC;SACvE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAuB;IAC5C,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAuB,EAAE,QAAgB,EAAE,IAAY;IAC/E,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAuB;IACvC,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO;SACX,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,eAAe,CAAC,GAAuB;IAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAY,EAAE,IAAY;IAC9D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;YACjB,eAAe,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;YACzC,uBAAuB;YACvB,uBAAuB;SACxB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,gCAAgC,KAAK,MACnC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;IACJ,CAAC;AACH,CAAC"}

package/build/server/platform/auth/errorCodes.d.ts

@@ -2,6 +2,8 @@ export declare const PLATFORM_AUTH_ERROR_CODES: {
     readonly unauthenticated: "E_UNAUTHENTICATED";
     readonly forbidden: "E_FORBIDDEN";
     readonly csrfMismatch: "E_CSRF_MISMATCH";
+    readonly reauthRequired: "E_REAUTH_REQUIRED";
+    readonly identityConflict: "E_IDENTITY_CONFLICT";
 };
 export type PlatformAuthErrorCode = (typeof PLATFORM_AUTH_ERROR_CODES)[keyof typeof PLATFORM_AUTH_ERROR_CODES];
 //# sourceMappingURL=errorCodes.d.ts.map

package/build/server/platform/auth/errorCodes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errorCodes.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/errorCodes.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,yBAAyB;;;;CAI5B,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAC/B,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC"}
+{"version":3,"file":"errorCodes.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/errorCodes.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,yBAAyB;;;;;;CAM5B,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAC/B,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC"}

package/build/server/platform/auth/errorCodes.js

@@ -2,5 +2,7 @@ export const PLATFORM_AUTH_ERROR_CODES = {
     unauthenticated: 'E_UNAUTHENTICATED',
     forbidden: 'E_FORBIDDEN',
     csrfMismatch: 'E_CSRF_MISMATCH',
+    reauthRequired: 'E_REAUTH_REQUIRED',
+    identityConflict: 'E_IDENTITY_CONFLICT',
 };
 //# sourceMappingURL=errorCodes.js.map

package/build/server/platform/auth/errorCodes.js.map

@@ -1 +1 @@
-{"version":3,"file":"errorCodes.js","sourceRoot":"","sources":["../../../../src/platform/auth/errorCodes.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,eAAe,EAAE,mBAAmB;IACpC,SAAS,EAAE,aAAa;IACxB,YAAY,EAAE,iBAAiB;CACvB,CAAC"}
+{"version":3,"file":"errorCodes.js","sourceRoot":"","sources":["../../../../src/platform/auth/errorCodes.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,eAAe,EAAE,mBAAmB;IACpC,SAAS,EAAE,aAAa;IACxB,YAAY,EAAE,iBAAiB;IAC/B,cAAc,EAAE,mBAAmB;IACnC,gBAAgB,EAAE,qBAAqB;CAC/B,CAAC"}

package/build/server/platform/auth/googleAccount.d.ts

@@ -1,47 +1,74 @@
 import { type BrowserSessionIssueResult } from './session.js';
 import type { PlatformAccountRecord, PlatformAuthState, PlatformIdentityRecord, PlatformMembershipRecord } from './types.js';
 import type { PlatformVerifiedGoogleIdentity } from './googleVerifier.js';
-export interface CreateFirstAdminGoogleInput {
+export interface CreateGoogleBrowserSessionInput {
     state: PlatformAuthState;
     identity: PlatformVerifiedGoogleIdentity;
     sessionSecret: string;
     sessionTtlMs: number;
     now?: Date;
 }
-export interface CreateFirstAdminGoogleResult {
+export interface CreateGoogleBrowserSessionResult {
     state: PlatformAuthState;
     account: PlatformAccountRecord;
     identity: PlatformIdentityRecord;
     membership: PlatformMembershipRecord;
     session: BrowserSessionIssueResult;
 }
-export interface CreateGoogleBrowserSessionInput {
+export interface LinkGoogleIdentityToAccountInput {
     state: PlatformAuthState;
+    accountId: string;
     identity: PlatformVerifiedGoogleIdentity;
-    sessionSecret: string;
-    sessionTtlMs: number;
     now?: Date;
 }
-export interface CreateGoogleBrowserSessionResult {
+export interface LinkGoogleIdentityToAccountResult {
     state: PlatformAuthState;
     account: PlatformAccountRecord;
     identity: PlatformIdentityRecord;
     membership: PlatformMembershipRecord;
-    session: BrowserSessionIssueResult;
+    adoptedAccountEmail: boolean;
 }
-export interface LinkGoogleIdentityToAccountInput {
+export type GoogleIdentityLinkRejectionReason = 'account_not_found' | 'email_mismatch' | 'subject_owned_by_other_account' | 'account_has_other_google_identity';
+export type LinkGoogleIdentityToAccountOutcome = {
+    ok: true;
+    result: LinkGoogleIdentityToAccountResult;
+} | {
+    ok: false;
+    reason: GoogleIdentityLinkRejectionReason;
+};
+export interface UnlinkGoogleIdentityFromAccountInput {
     state: PlatformAuthState;
     accountId: string;
-    identity: PlatformVerifiedGoogleIdentity;
+    keepSessionId: string;
     now?: Date;
 }
-export interface LinkGoogleIdentityToAccountResult {
+export interface UnlinkGoogleIdentityFromAccountResult {
     state: PlatformAuthState;
     account: PlatformAccountRecord;
-    identity: PlatformIdentityRecord;
     membership: PlatformMembershipRecord;
+    revokedSessionIds: string[];
 }
-export declare function createFirstAdminGoogleAuthState(input: CreateFirstAdminGoogleInput): CreateFirstAdminGoogleResult;
-export declare function linkGoogleIdentityToAccount(input: LinkGoogleIdentityToAccountInput): LinkGoogleIdentityToAccountResult | null;
+export type GoogleIdentityUnlinkRejectionReason = 'account_not_found' | 'google_not_linked' | 'local_fallback_missing';
+export type UnlinkGoogleIdentityFromAccountOutcome = {
+    ok: true;
+    result: UnlinkGoogleIdentityFromAccountResult;
+} | {
+    ok: false;
+    reason: GoogleIdentityUnlinkRejectionReason;
+};
+/**
+ * ADR-111 section 4: trim and lowercase only. Cats deliberately does not apply
+ * Gmail alias, dot, or plus-address canonicalization, so two addresses Google
+ * may route to one mailbox stay distinct here.
+ */
+export declare function normalizePlatformAccountEmail(value: string | null | undefined): string | null;
+export declare function linkGoogleIdentityToAccount(input: LinkGoogleIdentityToAccountInput): LinkGoogleIdentityToAccountOutcome;
+/**
+ * ADR-111 section 6: unlinking must preserve a usable local login and must not
+ * leave ambient access behind. Session records do not retain which identity
+ * established them, so every other browser and mobile session for the account
+ * is revoked and only the step-up-verified session survives.
+ */
+export declare function unlinkGoogleIdentityFromAccount(input: UnlinkGoogleIdentityFromAccountInput): UnlinkGoogleIdentityFromAccountOutcome;
 export declare function createGoogleBrowserSessionForLinkedIdentity(input: CreateGoogleBrowserSessionInput): CreateGoogleBrowserSessionResult | null;
 //# sourceMappingURL=googleAccount.d.ts.map

package/build/server/platform/auth/googleAccount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"googleAccount.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/googleAccount.ts"],"names":[],"mappings":"AAEA,OAAO,EAAuB,KAAK,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACnF,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AAE1E,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,iBAAiB,CAAC;IACzB,QAAQ,EAAE,8BAA8B,CAAC;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,wBAAwB,CAAC;IACrC,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,MAAM,WAAW,+BAA+B;IAC9C,KAAK,EAAE,iBAAiB,CAAC;IACzB,QAAQ,EAAE,8BAA8B,CAAC;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,wBAAwB,CAAC;IACrC,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,iBAAiB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,8BAA8B,CAAC;IACzC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,wBAAwB,CAAC;CACtC;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,2BAA2B,GACjC,4BAA4B,CAsD9B;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,gCAAgC,GACtC,iCAAiC,GAAG,IAAI,CAuE1C;AAED,wBAAgB,2CAA2C,CACzD,KAAK,EAAE,+BAA+B,GACrC,gCAAgC,GAAG,IAAI,CAoDzC"}
+{"version":3,"file":"googleAccount.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/googleAccount.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AAE1E,MAAM,WAAW,+BAA+B;IAC9C,KAAK,EAAE,iBAAiB,CAAC;IACzB,QAAQ,EAAE,8BAA8B,CAAC;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,wBAAwB,CAAC;IACrC,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,iBAAiB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,8BAA8B,CAAC;IACzC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,wBAAwB,CAAC;IACrC,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,MAAM,iCAAiC,GACzC,mBAAmB,GACnB,gBAAgB,GAChB,gCAAgC,GAChC,mCAAmC,CAAC;AAExC,MAAM,MAAM,kCAAkC,GAC1C;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,iCAAiC,CAAA;CAAE,GACvD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,iCAAiC,CAAA;CAAE,CAAC;AAE7D,MAAM,WAAW,oCAAoC;IACnD,KAAK,EAAE,iBAAiB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,qCAAqC;IACpD,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,UAAU,EAAE,wBAAwB,CAAC;IACrC,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,MAAM,mCAAmC,GAC3C,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,CAAC;AAE7B,MAAM,MAAM,sCAAsC,GAC9C;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,qCAAqC,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,mCAAmC,CAAA;CAAE,CAAC;AAE/D;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAG7F;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,gCAAgC,GACtC,kCAAkC,CAqFpC;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,oCAAoC,GAC1C,sCAAsC,CA2DxC;AAED,wBAAgB,2CAA2C,CACzD,KAAK,EAAE,+BAA+B,GACrC,gCAAgC,GAAG,IAAI,CAmDzC"}

package/build/server/platform/auth/googleAccount.js

@@ -1,58 +1,13 @@
 import { randomUUID } from 'node:crypto';
-import { issueBrowserSession } from './session.js';
-export function createFirstAdminGoogleAuthState(input) {
-    if (input.state.accounts.length > 0) {
-        throw new Error('First admin already exists.');
-    }
-    const now = input.now ?? new Date();
-    const nowIso = now.toISOString();
-    const accountId = `auth-account-${randomUUID()}`;
-    const account = {
-        id: accountId,
-        displayName: input.identity.displayName ?? input.identity.email,
-        email: input.identity.email,
-        avatarUrl: input.identity.avatarUrl,
-        status: 'active',
-        createdAt: nowIso,
-        updatedAt: nowIso,
-    };
-    const providerIdentity = {
-        id: `auth-identity-${randomUUID()}`,
-        accountId,
-        provider: 'google',
-        providerSubject: input.identity.providerSubject,
-        email: input.identity.email,
-        createdAt: nowIso,
-        updatedAt: nowIso,
-    };
-    const membership = {
-        id: `auth-membership-${randomUUID()}`,
-        accountId,
-        roles: ['owner', 'admin'],
-        coreActorId: 'actor-owner',
-        createdAt: nowIso,
-        updatedAt: nowIso,
-    };
-    const session = issueBrowserSession({
-        accountId,
-        sessionSecret: input.sessionSecret,
-        ttlMs: input.sessionTtlMs,
-        now,
-    });
-    return {
-        state: {
-            ...input.state,
-            updatedAt: nowIso,
-            accounts: [account],
-            identities: [providerIdentity],
-            memberships: [membership],
-            sessions: [session.session],
-        },
-        account,
-        identity: providerIdentity,
-        membership,
-        session,
-    };
+import { issueBrowserSession, revokeSession, } from './session.js';
+/**
+ * ADR-111 section 4: trim and lowercase only. Cats deliberately does not apply
+ * Gmail alias, dot, or plus-address canonicalization, so two addresses Google
+ * may route to one mailbox stay distinct here.
+ */
+export function normalizePlatformAccountEmail(value) {
+    const normalized = value?.trim().toLowerCase();
+    return normalized ? normalized : null;
 }
 export function linkGoogleIdentityToAccount(input) {
     const account = input.state.accounts.find((candidate) => candidate.id === input.accountId && candidate.status === 'active') ?? null;
@@ -60,24 +15,32 @@ export function linkGoogleIdentityToAccount(input) {
         ? input.state.memberships.find((candidate) => candidate.accountId === account.id) ?? null
         : null;
     if (!account || !membership) {
-        return null;
+        return { ok: false, reason: 'account_not_found' };
     }
     const identityForSubject = input.state.identities.find((candidate) => candidate.provider === 'google'
         && candidate.providerSubject === input.identity.providerSubject) ?? null;
     if (identityForSubject && identityForSubject.accountId !== account.id) {
-        throw new Error('Google identity is already linked to another account.');
+        return { ok: false, reason: 'subject_owned_by_other_account' };
     }
     const identityForAccount = input.state.identities.find((candidate) => candidate.provider === 'google'
         && candidate.accountId === account.id) ?? null;
     if (identityForAccount
         && identityForAccount.providerSubject !== input.identity.providerSubject) {
-        throw new Error('Account already has a linked Google identity.');
+        return { ok: false, reason: 'account_has_other_google_identity' };
+    }
+    // SPEC-113 requirements 28 and 29: an account that already carries an email
+    // must match it exactly. Only an email-less local-handle account may adopt
+    // the verified Google address, and only through this step-up-protected path.
+    const accountEmail = normalizePlatformAccountEmail(account.email);
+    const verifiedEmail = normalizePlatformAccountEmail(input.identity.email);
+    if (accountEmail && accountEmail !== verifiedEmail) {
+        return { ok: false, reason: 'email_mismatch' };
     }
     const nowIso = (input.now ?? new Date()).toISOString();
     const linkedIdentity = identityForSubject
         ? {
             ...identityForSubject,
-            email: input.identity.email,
+            email: verifiedEmail,
             updatedAt: nowIso,
         }
         : {
@@ -85,13 +48,14 @@ export function linkGoogleIdentityToAccount(input) {
             accountId: account.id,
             provider: 'google',
             providerSubject: input.identity.providerSubject,
-            email: input.identity.email,
+            email: verifiedEmail,
             createdAt: nowIso,
             updatedAt: nowIso,
         };
+    const adoptedAccountEmail = accountEmail === null && verifiedEmail !== null;
     const updatedAccount = {
         ...account,
-        email: input.identity.email,
+        email: adoptedAccountEmail ? verifiedEmail : account.email,
         avatarUrl: input.identity.avatarUrl ?? account.avatarUrl,
         updatedAt: nowIso,
     };
@@ -99,15 +63,71 @@ export function linkGoogleIdentityToAccount(input) {
         ? input.state.identities.map((candidate) => candidate.id === identityForSubject.id ? linkedIdentity : candidate)
         : [...input.state.identities, linkedIdentity];
     return {
-        state: {
-            ...input.state,
-            updatedAt: nowIso,
-            accounts: input.state.accounts.map((candidate) => candidate.id === account.id ? updatedAccount : candidate),
-            identities: nextIdentities,
+        ok: true,
+        result: {
+            state: {
+                ...input.state,
+                updatedAt: nowIso,
+                accounts: input.state.accounts.map((candidate) => candidate.id === account.id ? updatedAccount : candidate),
+                identities: nextIdentities,
+            },
+            account: updatedAccount,
+            identity: linkedIdentity,
+            membership: structuredClone(membership),
+            adoptedAccountEmail,
+        },
+    };
+}
+/**
+ * ADR-111 section 6: unlinking must preserve a usable local login and must not
+ * leave ambient access behind. Session records do not retain which identity
+ * established them, so every other browser and mobile session for the account
+ * is revoked and only the step-up-verified session survives.
+ */
+export function unlinkGoogleIdentityFromAccount(input) {
+    const account = input.state.accounts.find((candidate) => candidate.id === input.accountId && candidate.status === 'active') ?? null;
+    const membership = account
+        ? input.state.memberships.find((candidate) => candidate.accountId === account.id) ?? null
+        : null;
+    if (!account || !membership) {
+        return { ok: false, reason: 'account_not_found' };
+    }
+    const googleIdentity = input.state.identities.find((candidate) => candidate.provider === 'google' && candidate.accountId === account.id) ?? null;
+    if (!googleIdentity) {
+        return { ok: false, reason: 'google_not_linked' };
+    }
+    const hasLocalFallback = input.state.identities.some((candidate) => candidate.provider === 'local_password'
+        && candidate.accountId === account.id
+        && Boolean(candidate.passwordHash)
+        && Boolean(candidate.passwordHashAlgorithm));
+    if (!hasLocalFallback) {
+        return { ok: false, reason: 'local_fallback_missing' };
+    }
+    const now = input.now ?? new Date();
+    const nowIso = now.toISOString();
+    const revokedSessionIds = [];
+    const sessions = input.state.sessions.map((session) => {
+        if (session.accountId !== account.id
+            || session.id === input.keepSessionId
+            || session.revokedAt !== null) {
+            return session;
+        }
+        revokedSessionIds.push(session.id);
+        return revokeSession(session, now);
+    });
+    return {
+        ok: true,
+        result: {
+            state: {
+                ...input.state,
+                updatedAt: nowIso,
+                identities: input.state.identities.filter((candidate) => candidate.id !== googleIdentity.id),
+                sessions,
+            },
+            account: structuredClone(account),
+            membership: structuredClone(membership),
+            revokedSessionIds,
         },
-        account: updatedAccount,
-        identity: linkedIdentity,
-        membership: structuredClone(membership),
     };
 }
 export function createGoogleBrowserSessionForLinkedIdentity(input) {
@@ -132,12 +152,11 @@ export function createGoogleBrowserSessionForLinkedIdentity(input) {
     });
     const updatedIdentity = {
         ...providerIdentity,
-        email: input.identity.email,
+        email: normalizePlatformAccountEmail(input.identity.email),
         updatedAt: nowIso,
     };
     const updatedAccount = {
         ...account,
-        email: input.identity.email,
         avatarUrl: input.identity.avatarUrl ?? account.avatarUrl,
         updatedAt: nowIso,
     };

package/build/server/platform/auth/googleAccount.js.map

@@ -1 +1 @@
-{"version":3,"file":"googleAccount.js","sourceRoot":"","sources":["../../../../src/platform/auth/googleAccount.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,mBAAmB,EAAkC,MAAM,cAAc,CAAC;AAuDnF,MAAM,UAAU,+BAA+B,CAC7C,KAAkC;IAElC,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,gBAAgB,UAAU,EAAE,EAAE,CAAC;IACjD,MAAM,OAAO,GAA0B;QACrC,EAAE,EAAE,SAAS;QACb,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC/D,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC3B,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QACnC,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,gBAAgB,GAA2B;QAC/C,EAAE,EAAE,iBAAiB,UAAU,EAAE,EAAE;QACnC,SAAS;QACT,QAAQ,EAAE,QAAQ;QAClB,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAe;QAC/C,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC3B,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,UAAU,GAA6B;QAC3C,EAAE,EAAE,mBAAmB,UAAU,EAAE,EAAE;QACrC,SAAS;QACT,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QACzB,WAAW,EAAE,aAAa;QAC1B,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,OAAO,GAAG,mBAAmB,CAAC;QAClC,SAAS;QACT,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,YAAY;QACzB,GAAG;KACJ,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE;YACL,GAAG,KAAK,CAAC,KAAK;YACd,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,CAAC,OAAO,CAAC;YACnB,UAAU,EAAE,CAAC,gBAAgB,CAAC;YAC9B,WAAW,EAAE,CAAC,UAAU,CAAC;YACzB,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;SAC5B;QACD,OAAO;QACP,QAAQ,EAAE,gBAAgB;QAC1B,UAAU;QACV,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAAuC;IAEvC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACtD,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAClE,IAAI,IAAI,CAAC;IACV,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;QACzF,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,kBAAkB,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACnE,SAAS,CAAC,QAAQ,KAAK,QAAQ;WAC5B,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,QAAQ,CAAC,eAAe,CAChE,IAAI,IAAI,CAAC;IACV,IAAI,kBAAkB,IAAI,kBAAkB,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,kBAAkB,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACnE,SAAS,CAAC,QAAQ,KAAK,QAAQ;WAC5B,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CACtC,IAAI,IAAI,CAAC;IACV,IACE,kBAAkB;WACf,kBAAkB,CAAC,eAAe,KAAK,KAAK,CAAC,QAAQ,CAAC,eAAe,EACxE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,MAAM,cAAc,GAA2B,kBAAkB;QAC/D,CAAC,CAAC;YACE,GAAG,kBAAkB;YACrB,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;YAC3B,SAAS,EAAE,MAAM;SAClB;QACH,CAAC,CAAC;YACE,EAAE,EAAE,iBAAiB,UAAU,EAAE,EAAE;YACnC,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,QAAQ,EAAE,QAAQ;YAClB,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAe;YAC/C,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;YAC3B,SAAS,EAAE,MAAM;YACjB,SAAS,EAAE,MAAM;SAClB,CAAC;IACN,MAAM,cAAc,GAA0B;QAC5C,GAAG,OAAO;QACV,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC3B,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS;QACxD,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,cAAc,GAAG,kBAAkB;QACvC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACvC,SAAS,CAAC,EAAE,KAAK,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CACpE;QACH,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAEhD,OAAO;QACL,KAAK,EAAE;YACL,GAAG,KAAK,CAAC,KAAK;YACd,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/C,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CACzD;YACD,UAAU,EAAE,cAAc;SAC3B;QACD,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,cAAc;QACxB,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,KAAsC;IAEtC,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjE,SAAS,CAAC,QAAQ,KAAK,QAAQ;WAC5B,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,QAAQ,CAAC,eAAe,CAChE,IAAI,IAAI,CAAC;IACV,MAAM,OAAO,GAAG,gBAAgB;QAC9B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,gBAAgB,CAAC,SAAS,CAAC,IAAI,IAAI;QAC/F,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;QACzF,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,gBAAgB,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,mBAAmB,CAAC;QAClC,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,YAAY;QACzB,GAAG;KACJ,CAAC,CAAC;IACH,MAAM,eAAe,GAA2B;QAC9C,GAAG,gBAAgB;QACnB,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC3B,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,cAAc,GAA0B;QAC5C,GAAG,OAAO;QACV,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC3B,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS;QACxD,SAAS,EAAE,MAAM;KAClB,CAAC;IAEF,OAAO;QACL,KAAK,EAAE;YACL,GAAG,KAAK,CAAC,KAAK;YACd,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/C,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CACzD;YACD,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACnD,SAAS,CAAC,EAAE,KAAK,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CACnE;YACD,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC;SACrD;QACD,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,eAAe;QACzB,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;QACvC,OAAO;KACR,CAAC;AACJ,CAAC"}
+{"version":3,"file":"googleAccount.js","sourceRoot":"","sources":["../../../../src/platform/auth/googleAccount.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,mBAAmB,EACnB,aAAa,GAEd,MAAM,cAAc,CAAC;AAyEtB;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAAgC;IAC5E,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,OAAO,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAAuC;IAEvC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACtD,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAClE,IAAI,IAAI,CAAC;IACV,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;QACzF,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,kBAAkB,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACnE,SAAS,CAAC,QAAQ,KAAK,QAAQ;WAC5B,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,QAAQ,CAAC,eAAe,CAChE,IAAI,IAAI,CAAC;IACV,IAAI,kBAAkB,IAAI,kBAAkB,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,kBAAkB,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACnE,SAAS,CAAC,QAAQ,KAAK,QAAQ;WAC5B,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CACtC,IAAI,IAAI,CAAC;IACV,IACE,kBAAkB;WACf,kBAAkB,CAAC,eAAe,KAAK,KAAK,CAAC,QAAQ,CAAC,eAAe,EACxE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IACpE,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,YAAY,GAAG,6BAA6B,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1E,IAAI,YAAY,IAAI,YAAY,KAAK,aAAa,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,MAAM,cAAc,GAA2B,kBAAkB;QAC/D,CAAC,CAAC;YACE,GAAG,kBAAkB;YACrB,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,MAAM;SAClB;QACH,CAAC,CAAC;YACE,EAAE,EAAE,iBAAiB,UAAU,EAAE,EAAE;YACnC,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,QAAQ,EAAE,QAAQ;YAClB,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAe;YAC/C,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,MAAM;YACjB,SAAS,EAAE,MAAM;SAClB,CAAC;IACN,MAAM,mBAAmB,GAAG,YAAY,KAAK,IAAI,IAAI,aAAa,KAAK,IAAI,CAAC;IAC5E,MAAM,cAAc,GAA0B;QAC5C,GAAG,OAAO;QACV,KAAK,EAAE,mBAAmB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK;QAC1D,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS;QACxD,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,cAAc,GAAG,kBAAkB;QACvC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACvC,SAAS,CAAC,EAAE,KAAK,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CACpE;QACH,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAEhD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,KAAK,EAAE;gBACL,GAAG,KAAK,CAAC,KAAK;gBACd,SAAS,EAAE,MAAM;gBACjB,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/C,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CACzD;gBACD,UAAU,EAAE,cAAc;aAC3B;YACD,OAAO,EAAE,cAAc;YACvB,QAAQ,EAAE,cAAc;YACxB,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;YACvC,mBAAmB;SACpB;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,KAA2C;IAE3C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACtD,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAClE,IAAI,IAAI,CAAC;IACV,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;QACzF,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/D,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CACtE,IAAI,IAAI,CAAC;IACV,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjE,SAAS,CAAC,QAAQ,KAAK,gBAAgB;WACpC,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE;WAClC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC;WAC/B,OAAO,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAC5C,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,iBAAiB,GAAa,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACpD,IACE,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE;eAC7B,OAAO,CAAC,EAAE,KAAK,KAAK,CAAC,aAAa;eAClC,OAAO,CAAC,SAAS,KAAK,IAAI,EAC7B,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,OAAO,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,KAAK,EAAE;gBACL,GAAG,KAAK,CAAC,KAAK;gBACd,SAAS,EAAE,MAAM;gBACjB,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CACvC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,CAClD;gBACD,QAAQ;aACT;YACD,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC;YACjC,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;YACvC,iBAAiB;SAClB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,KAAsC;IAEtC,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjE,SAAS,CAAC,QAAQ,KAAK,QAAQ;WAC5B,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,QAAQ,CAAC,eAAe,CAChE,IAAI,IAAI,CAAC;IACV,MAAM,OAAO,GAAG,gBAAgB;QAC9B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,gBAAgB,CAAC,SAAS,CAAC,IAAI,IAAI;QAC/F,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;QACzF,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,gBAAgB,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,mBAAmB,CAAC;QAClC,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,YAAY;QACzB,GAAG;KACJ,CAAC,CAAC;IACH,MAAM,eAAe,GAA2B;QAC9C,GAAG,gBAAgB;QACnB,KAAK,EAAE,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC1D,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,cAAc,GAA0B;QAC5C,GAAG,OAAO;QACV,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS;QACxD,SAAS,EAAE,MAAM;KAClB,CAAC;IAEF,OAAO;QACL,KAAK,EAAE;YACL,GAAG,KAAK,CAAC,KAAK;YACd,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/C,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CACzD;YACD,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACnD,SAAS,CAAC,EAAE,KAAK,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CACnE;YACD,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC;SACrD;QACD,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,eAAe;QACzB,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;QACvC,OAAO;KACR,CAAC;AACJ,CAAC"}

package/build/server/platform/auth/index.d.ts

@@ -1,4 +1,6 @@
+export * from './actionGrant.js';
 export * from './actorAttribution.js';
+export * from './adminCredentials.js';
 export * from './bootstrap.js';
 export * from './bootstrapEnvelope.js';
 export * from './browserHandoff.js';
@@ -12,11 +14,13 @@ export * from './googleCsrf.js';
 export * from './googleJwksVerifier.js';
 export * from './googleVerifier.js';
 export * from './localLogin.js';
+export * from './loginMethods.js';
 export * from './originGate.js';
 export * from './password.js';
 export * from './principal.js';
 export * from './readiness.js';
 export * from './recovery.js';
+export * from './securityEvents.js';
 export * from './session.js';
 export * from './state.js';
 export * from './store.js';

package/build/server/platform/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC"}

package/build/server/platform/auth/index.js

@@ -1,4 +1,6 @@
+export * from './actionGrant.js';
 export * from './actorAttribution.js';
+export * from './adminCredentials.js';
 export * from './bootstrap.js';
 export * from './bootstrapEnvelope.js';
 export * from './browserHandoff.js';
@@ -12,11 +14,13 @@ export * from './googleCsrf.js';
 export * from './googleJwksVerifier.js';
 export * from './googleVerifier.js';
 export * from './localLogin.js';
+export * from './loginMethods.js';
 export * from './originGate.js';
 export * from './password.js';
 export * from './principal.js';
 export * from './readiness.js';
 export * from './recovery.js';
+export * from './securityEvents.js';
 export * from './session.js';
 export * from './state.js';
 export * from './store.js';

package/build/server/platform/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/platform/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/platform/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC"}

package/build/server/platform/auth/localLogin.d.ts

@@ -4,6 +4,16 @@ export interface PlatformLocalPasswordCredentialMatch {
     account: PlatformAccountRecord;
     membership: PlatformMembershipRecord;
 }
+/**
+ * SPEC-113 requirement 16: step-up verifies the local-password Identity that
+ * belongs to the *current* account. The caller must never be able to choose
+ * which identity is checked, so this takes an account id rather than a
+ * client-supplied identifier.
+ */
+export declare function verifyPlatformLocalPasswordForAccount(state: PlatformAuthState, input: {
+    accountId: string;
+    password: string;
+}): Promise<PlatformLocalPasswordCredentialMatch | null>;
 export declare function verifyPlatformLocalPasswordCredential(state: PlatformAuthState, input: {
     identifier: string;
     password: string;

package/build/server/platform/auth/localLogin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"localLogin.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/localLogin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,oCAAoC;IACnD,QAAQ,EAAE,sBAAsB,CAAC;IACjC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,UAAU,EAAE,wBAAwB,CAAC;CACtC;AAED,wBAAsB,qCAAqC,CACzD,KAAK,EAAE,iBAAiB,EACxB,KAAK,EAAE;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB,GACA,OAAO,CAAC,oCAAoC,GAAG,IAAI,CAAC,CA4BtD"}
+{"version":3,"file":"localLogin.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/localLogin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,oCAAoC;IACnD,QAAQ,EAAE,sBAAsB,CAAC;IACjC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,UAAU,EAAE,wBAAwB,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAsB,qCAAqC,CACzD,KAAK,EAAE,iBAAiB,EACxB,KAAK,EAAE;IACL,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB,GACA,OAAO,CAAC,oCAAoC,GAAG,IAAI,CAAC,CAYtD;AAED,wBAAsB,qCAAqC,CACzD,KAAK,EAAE,iBAAiB,EACxB,KAAK,EAAE;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB,GACA,OAAO,CAAC,oCAAoC,GAAG,IAAI,CAAC,CA4BtD"}

package/build/server/platform/auth/localLogin.js

@@ -1,4 +1,21 @@
 import { verifyLocalPassword } from './password.js';
+/**
+ * SPEC-113 requirement 16: step-up verifies the local-password Identity that
+ * belongs to the *current* account. The caller must never be able to choose
+ * which identity is checked, so this takes an account id rather than a
+ * client-supplied identifier.
+ */
+export async function verifyPlatformLocalPasswordForAccount(state, input) {
+    const identity = state.identities.find((candidate) => candidate.provider === 'local_password'
+        && candidate.accountId === input.accountId) ?? null;
+    if (!identity) {
+        return null;
+    }
+    return verifyPlatformLocalPasswordCredential(state, {
+        identifier: identity.providerSubject,
+        password: input.password,
+    });
+}
 export async function verifyPlatformLocalPasswordCredential(state, input) {
     const identity = state.identities.find((candidate) => candidate.provider === 'local_password'
         && (candidate.providerSubject === input.identifier

package/build/server/platform/auth/localLogin.js.map

@@ -1 +1 @@
-{"version":3,"file":"localLogin.js","sourceRoot":"","sources":["../../../../src/platform/auth/localLogin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAcpD,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAAwB,EACxB,KAGC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACnD,SAAS,CAAC,QAAQ,KAAK,gBAAgB;WACpC,CACD,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,UAAU;eAC3C,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,KAAK,CAAC,UAAU,CACvD,CACF,IAAI,IAAI,CAAC;IACV,MAAM,OAAO,GAAG,QAAQ;QACtB,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI;QACjF,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;QACnF,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,KAAK,GAAG,QAAQ,EAAE,YAAY,IAAI,QAAQ,CAAC,qBAAqB;QACpE,CAAC,CAAC,MAAM,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE;YACxC,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;SACtD,CAAC;QACJ,CAAC,CAAC,KAAK,CAAC;IACV,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC;QACnC,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC;QACjC,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;KACxC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"localLogin.js","sourceRoot":"","sources":["../../../../src/platform/auth/localLogin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAcpD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAAwB,EACxB,KAGC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACnD,SAAS,CAAC,QAAQ,KAAK,gBAAgB;WACpC,SAAS,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAC3C,IAAI,IAAI,CAAC;IACV,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,qCAAqC,CAAC,KAAK,EAAE;QAClD,UAAU,EAAE,QAAQ,CAAC,eAAe;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAAwB,EACxB,KAGC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACnD,SAAS,CAAC,QAAQ,KAAK,gBAAgB;WACpC,CACD,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,UAAU;eAC3C,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,KAAK,CAAC,UAAU,CACvD,CACF,IAAI,IAAI,CAAC;IACV,MAAM,OAAO,GAAG,QAAQ;QACtB,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI;QACjF,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;QACnF,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,KAAK,GAAG,QAAQ,EAAE,YAAY,IAAI,QAAQ,CAAC,qBAAqB;QACpE,CAAC,CAAC,MAAM,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE;YACxC,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;SACtD,CAAC;QACJ,CAAC,CAAC,KAAK,CAAC;IACV,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC;QACnC,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC;QACjC,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;KACxC,CAAC;AACJ,CAAC"}

package/build/server/platform/auth/loginMethods.d.ts

@@ -0,0 +1,18 @@
+import type { PlatformAuthState } from './types.js';
+/**
+ * SPEC-113 requirement 10: the authenticated auth-status projection reports
+ * which login methods the current account owns. Requirement 13 makes Identity
+ * records the only source; the renderer must not infer linked state from
+ * account email, avatar, or a prior login result.
+ */
+export interface PlatformLoginMethodsSummary {
+    localPassword: {
+        linked: boolean;
+    };
+    google: {
+        linked: boolean;
+        email: string | null;
+    };
+}
+export declare function summarizePlatformLoginMethods(state: PlatformAuthState, accountId: string): PlatformLoginMethodsSummary;
+//# sourceMappingURL=loginMethods.d.ts.map

package/build/server/platform/auth/loginMethods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginMethods.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/loginMethods.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE;QACb,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;IACF,MAAM,EAAE;QACN,MAAM,EAAE,OAAO,CAAC;QAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;KACtB,CAAC;CACH;AAED,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,iBAAiB,EACxB,SAAS,EAAE,MAAM,GAChB,2BAA2B,CAsB7B"}