@cats-inc/cats-platform 0.1.9 → 0.1.21

package/build/server/design/components/useProviderTargetReconciliation.js

@@ -1,4 +1,5 @@
 import { useEffect, useRef, useState } from 'react';
+import { isProductProviderDefaultModelPlaceholder } from '../../shared/providerCatalog.js';
 import { resolveCatalogTargetSelection, sameProviderModelSelection, } from '../../shared/providerSelection.js';
 import { attachExecutionLabelToProviderTarget, sanitizePersistentTargetSelection, shouldDeferCatalogTargetReconciliation, shouldTreatPersistedTargetAsLegacyModel, } from './providerModelFieldsSupport.js';
 export function useProviderTargetReconciliation(input) {
@@ -60,12 +61,13 @@ export function useProviderTargetReconciliation(input) {
         if (input.effectiveCatalog.models.length === 0 || hasBlankLegacyDraft) {
             return;
         }
+        const providerDefaultPlaceholder = isProductProviderDefaultModelPlaceholder(input.provider, input.model);
         const deferStaticCatalogReconciliation = shouldDeferCatalogTargetReconciliation({
             catalogSource: input.effectiveCatalog.source,
             advancedCatalogSource: input.effectiveAdvancedCatalog.source,
             model: input.model,
             modelSelection: input.modelSelection,
-        });
+        }) && (input.catalogLoading || !providerDefaultPlaceholder);
         if (deferStaticCatalogReconciliation) {
             return;
         }

package/build/server/design/components/useProviderTargetReconciliation.js.map

@@ -1 +1 @@
-{"version":3,"file":"useProviderTargetReconciliation.js","sourceRoot":"","sources":["../../../../src/design/components/useProviderTargetReconciliation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAMpD,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,GAG3B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,oCAAoC,EACpC,iCAAiC,EACjC,sCAAsC,EACtC,uCAAuC,GACxC,MAAM,iCAAiC,CAAC;AAEzC,MAAM,UAAU,+BAA+B,CAAC,KAW/C;IACC,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxF,MAAM,wBAAwB,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAEvD,SAAS,CAAC,GAAG,EAAE;QACb,iBAAiB,CAAC,OAAO,GAAG,KAAK,CAAC,cAAc,CAAC;IACnD,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;IAE3B,MAAM,SAAS,GAAG,GAAG,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,gBAAgB,EAAE,CAAC;IACjE,MAAM,0BAA0B,GAC9B,CAAC,KAAK,CAAC,cAAc;WAClB,uCAAuC,CAAC;YACzC,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;IACL,MAAM,mBAAmB,GACvB,qBAAqB,KAAK,SAAS;WAChC,0BAA0B,CAAC;IAChC,MAAM,mBAAmB,GACvB,qBAAqB,KAAK,SAAS;WAChC,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;WACxC,CAAC,KAAK,CAAC,cAAc,CAAC;IAC3B,MAAM,yBAAyB,GAC7B,wBAAwB,CAAC,OAAO,KAAK,SAAS;WAC3C,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;WAC7B,mBAAmB,CAAC;IAEzB,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,IAAI,iBAAiB,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC5C,iBAAiB,CAAC,OAAO,GAAG,SAAS,CAAC;YACtC,wBAAwB,CAAC,OAAO,GAAG,IAAI,CAAC;YACxC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YACxE,iBAAiB,CAAC,OAAO,CAAC,oCAAoC,CAAC;gBAC7D,MAAM,EAAE;oBACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,QAAQ,EAAE,KAAK,CAAC,gBAAgB;oBAChC,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,cAAc,EAAE,KAAK,CAAC,cAAc;iBACrC;gBACD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;aACzD,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC,EAAE;QACD,KAAK,CAAC,wBAAwB;QAC9B,KAAK,CAAC,gBAAgB;QACtB,KAAK,CAAC,mBAAmB;QACzB,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,gBAAgB;QACtB,SAAS;KACV,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,mBAAmB,EAAE,CAAC;YACtE,OAAO;QACT,CAAC;QAED,MAAM,gCAAgC,GAAG,sCAAsC,CAAC;YAC9E,aAAa,EAAE,KAAK,CAAC,gBAAgB,CAAC,MAAM;YAC5C,qBAAqB,EAAE,KAAK,CAAC,wBAAwB,CAAC,MAAM;YAC5D,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,IAAI,gCAAgC,EAAE,CAAC;YACrC,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,6BAA6B,CAAC;YAC/C,MAAM,EAAE;gBACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,KAAK,CAAC,gBAAgB;gBAChC,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC;YACD,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,eAAe,EAAE,KAAK,CAAC,wBAAwB;YAC/C,oBAAoB,EAAE,yBAAyB;YAC/C,wBAAwB,EAAE,yBAAyB;SACpD,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,iCAAiC,CAAC;YACxD,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,KAAK,CAAC,wBAAwB,CAAC,QAAQ;SAClD,CAAC,CAAC;QAEH,IACE,eAAe,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;eACxC,eAAe,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;eACrC,CAAC,0BAA0B,CAAC,eAAe,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,EACpF,CAAC;YACD,iBAAiB,CAAC,OAAO,CAAC,oCAAoC,CAAC;gBAC7D,MAAM,EAAE,eAAe;gBACvB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;aACzD,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC,EAAE;QACD,KAAK,CAAC,wBAAwB;QAC9B,KAAK,CAAC,gBAAgB;QACtB,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,gBAAgB;QACtB,yBAAyB;QACzB,SAAS;QACT,mBAAmB;KACpB,CAAC,CAAC;IAEH,SAAS,oBAAoB;QAC3B,wBAAwB,CAAC,OAAO,GAAG,IAAI,CAAC;QACxC,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,SAAS,mBAAmB;QAC1B,wBAAwB,CAAC,OAAO,GAAG,SAAS,CAAC;QAC7C,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,SAAS,yBAAyB;QAChC,wBAAwB,CAAC,OAAO,GAAG,SAAS,CAAC;QAC7C,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,OAAO;QACL,0BAA0B;QAC1B,mBAAmB;QACnB,oBAAoB;QACpB,mBAAmB;QACnB,yBAAyB;KAC1B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"useProviderTargetReconciliation.js","sourceRoot":"","sources":["../../../../src/design/components/useProviderTargetReconciliation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAMpD,OAAO,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,GAG3B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,oCAAoC,EACpC,iCAAiC,EACjC,sCAAsC,EACtC,uCAAuC,GACxC,MAAM,iCAAiC,CAAC;AAEzC,MAAM,UAAU,+BAA+B,CAAC,KAW/C;IACC,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxF,MAAM,wBAAwB,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAEvD,SAAS,CAAC,GAAG,EAAE;QACb,iBAAiB,CAAC,OAAO,GAAG,KAAK,CAAC,cAAc,CAAC;IACnD,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;IAE3B,MAAM,SAAS,GAAG,GAAG,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,gBAAgB,EAAE,CAAC;IACjE,MAAM,0BAA0B,GAC9B,CAAC,KAAK,CAAC,cAAc;WAClB,uCAAuC,CAAC;YACzC,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;IACL,MAAM,mBAAmB,GACvB,qBAAqB,KAAK,SAAS;WAChC,0BAA0B,CAAC;IAChC,MAAM,mBAAmB,GACvB,qBAAqB,KAAK,SAAS;WAChC,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;WACxC,CAAC,KAAK,CAAC,cAAc,CAAC;IAC3B,MAAM,yBAAyB,GAC7B,wBAAwB,CAAC,OAAO,KAAK,SAAS;WAC3C,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;WAC7B,mBAAmB,CAAC;IAEzB,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,IAAI,iBAAiB,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC5C,iBAAiB,CAAC,OAAO,GAAG,SAAS,CAAC;YACtC,wBAAwB,CAAC,OAAO,GAAG,IAAI,CAAC;YACxC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YACxE,iBAAiB,CAAC,OAAO,CAAC,oCAAoC,CAAC;gBAC7D,MAAM,EAAE;oBACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,QAAQ,EAAE,KAAK,CAAC,gBAAgB;oBAChC,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,cAAc,EAAE,KAAK,CAAC,cAAc;iBACrC;gBACD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;aACzD,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC,EAAE;QACD,KAAK,CAAC,wBAAwB;QAC9B,KAAK,CAAC,gBAAgB;QACtB,KAAK,CAAC,mBAAmB;QACzB,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,gBAAgB;QACtB,SAAS;KACV,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,mBAAmB,EAAE,CAAC;YACtE,OAAO;QACT,CAAC;QAED,MAAM,0BAA0B,GAAG,wCAAwC,CACzE,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,KAAK,CACZ,CAAC;QACF,MAAM,gCAAgC,GAAG,sCAAsC,CAAC;YAC9E,aAAa,EAAE,KAAK,CAAC,gBAAgB,CAAC,MAAM;YAC5C,qBAAqB,EAAE,KAAK,CAAC,wBAAwB,CAAC,MAAM;YAC5D,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC5D,IAAI,gCAAgC,EAAE,CAAC;YACrC,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,6BAA6B,CAAC;YAC/C,MAAM,EAAE;gBACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,KAAK,CAAC,gBAAgB;gBAChC,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC;YACD,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,eAAe,EAAE,KAAK,CAAC,wBAAwB;YAC/C,oBAAoB,EAAE,yBAAyB;YAC/C,wBAAwB,EAAE,yBAAyB;SACpD,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,iCAAiC,CAAC;YACxD,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,KAAK,CAAC,wBAAwB,CAAC,QAAQ;SAClD,CAAC,CAAC;QAEH,IACE,eAAe,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;eACxC,eAAe,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;eACrC,CAAC,0BAA0B,CAAC,eAAe,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,EACpF,CAAC;YACD,iBAAiB,CAAC,OAAO,CAAC,oCAAoC,CAAC;gBAC7D,MAAM,EAAE,eAAe;gBACvB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;aACzD,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC,EAAE;QACD,KAAK,CAAC,wBAAwB;QAC9B,KAAK,CAAC,gBAAgB;QACtB,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,gBAAgB;QACtB,yBAAyB;QACzB,SAAS;QACT,mBAAmB;KACpB,CAAC,CAAC;IAEH,SAAS,oBAAoB;QAC3B,wBAAwB,CAAC,OAAO,GAAG,IAAI,CAAC;QACxC,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,SAAS,mBAAmB;QAC1B,wBAAwB,CAAC,OAAO,GAAG,SAAS,CAAC;QAC7C,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,SAAS,yBAAyB;QAChC,wBAAwB,CAAC,OAAO,GAAG,SAAS,CAAC;QAC7C,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,OAAO;QACL,0BAA0B;QAC1B,mBAAmB;QACnB,oBAAoB;QACpB,mBAAmB;QACnB,yBAAyB;KAC1B,CAAC;AACJ,CAAC"}

package/build/server/platform/auth/actionGrant.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Short-lived, single-use, purpose-bound step-up capability.
+ *
+ * ADR-111 section 3 rejects both a renderer-only password modal and a broad
+ * `recentlyAuthenticatedAt` timestamp on the session: the first is not an
+ * authorization boundary at all, and the second can authorize several
+ * unrelated sensitive actions. A grant is therefore bound to one account, one
+ * browser session, and one purpose, and is consumed on the first attempt that
+ * presents it — whether or not the rest of that attempt succeeds.
+ *
+ * Grants live in memory only. They are five-minute capabilities that should
+ * die with the process, so they are never written to the auth-state file.
+ */
+export declare const PLATFORM_AUTH_ACTION_GRANT_TTL_MS: number;
+export declare const PLATFORM_AUTH_ACTION_GRANT_TOKEN_BYTES = 32;
+export declare const MAX_PENDING_PLATFORM_AUTH_ACTION_GRANTS = 32;
+export declare const PLATFORM_AUTH_ACTION_HEADER = "x-cats-auth-action";
+export declare const PLATFORM_AUTH_ACTION_GRANT_PURPOSES: readonly ["link_google", "unlink_google"];
+export type PlatformAuthActionGrantPurpose = (typeof PLATFORM_AUTH_ACTION_GRANT_PURPOSES)[number];
+export declare function isPlatformAuthActionGrantPurpose(value: unknown): value is PlatformAuthActionGrantPurpose;
+export interface PlatformAuthActionGrantIssueInput {
+    accountId: string;
+    sessionId: string;
+    purpose: PlatformAuthActionGrantPurpose;
+    sessionSecret: string;
+    ttlMs?: number;
+    now?: Date;
+}
+export interface PlatformAuthActionGrantIssueResult {
+    token: string;
+    expiresAt: string;
+}
+export interface PlatformAuthActionGrantConsumeInput {
+    token: string;
+    accountId: string;
+    sessionId: string;
+    purpose: PlatformAuthActionGrantPurpose;
+    sessionSecret: string;
+    now?: Date;
+}
+export type PlatformAuthActionGrantRejectionReason = 'missing_token' | 'unknown_or_expired' | 'purpose_mismatch' | 'account_mismatch' | 'session_mismatch';
+export type PlatformAuthActionGrantConsumeOutcome = {
+    ok: true;
+    purpose: PlatformAuthActionGrantPurpose;
+} | {
+    ok: false;
+    reason: PlatformAuthActionGrantRejectionReason;
+};
+export interface PlatformAuthActionGrantStore {
+    issue(input: PlatformAuthActionGrantIssueInput): PlatformAuthActionGrantIssueResult;
+    consume(input: PlatformAuthActionGrantConsumeInput): PlatformAuthActionGrantConsumeOutcome;
+    revokeForSession(sessionId: string): void;
+}
+export declare class MemoryPlatformAuthActionGrantStore implements PlatformAuthActionGrantStore {
+    private readonly grants;
+    issue(input: PlatformAuthActionGrantIssueInput): PlatformAuthActionGrantIssueResult;
+    consume(input: PlatformAuthActionGrantConsumeInput): PlatformAuthActionGrantConsumeOutcome;
+    revokeForSession(sessionId: string): void;
+    private prune;
+}
+//# sourceMappingURL=actionGrant.d.ts.map

package/build/server/platform/auth/actionGrant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actionGrant.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/actionGrant.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,iCAAiC,QAAgB,CAAC;AAC/D,eAAO,MAAM,sCAAsC,KAAK,CAAC;AACzD,eAAO,MAAM,uCAAuC,KAAK,CAAC;AAC1D,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAEhE,eAAO,MAAM,mCAAmC,2CAGtC,CAAC;AAEX,MAAM,MAAM,8BAA8B,GACxC,CAAC,OAAO,mCAAmC,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,8BAA8B,CAGzC;AAED,MAAM,WAAW,iCAAiC;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,8BAA8B,CAAC;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,kCAAkC;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mCAAmC;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,8BAA8B,CAAC;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,MAAM,sCAAsC,GAC9C,eAAe,GACf,oBAAoB,GACpB,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,CAAC;AAEvB,MAAM,MAAM,qCAAqC,GAC7C;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,8BAA8B,CAAA;CAAE,GACrD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,sCAAsC,CAAA;CAAE,CAAC;AAElE,MAAM,WAAW,4BAA4B;IAC3C,KAAK,CAAC,KAAK,EAAE,iCAAiC,GAAG,kCAAkC,CAAC;IACpF,OAAO,CAAC,KAAK,EAAE,mCAAmC,GAAG,qCAAqC,CAAC;IAC3F,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAWD,qBAAa,kCAAmC,YAAW,4BAA4B;IACrF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoD;IAE3E,KAAK,CAAC,KAAK,EAAE,iCAAiC,GAAG,kCAAkC;IAsCnF,OAAO,CAAC,KAAK,EAAE,mCAAmC,GAAG,qCAAqC;IA8B1F,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAQzC,OAAO,CAAC,KAAK;CAQd"}

package/build/server/platform/auth/actionGrant.js

@@ -0,0 +1,108 @@
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { hashSessionToken } from './session.js';
+/**
+ * Short-lived, single-use, purpose-bound step-up capability.
+ *
+ * ADR-111 section 3 rejects both a renderer-only password modal and a broad
+ * `recentlyAuthenticatedAt` timestamp on the session: the first is not an
+ * authorization boundary at all, and the second can authorize several
+ * unrelated sensitive actions. A grant is therefore bound to one account, one
+ * browser session, and one purpose, and is consumed on the first attempt that
+ * presents it — whether or not the rest of that attempt succeeds.
+ *
+ * Grants live in memory only. They are five-minute capabilities that should
+ * die with the process, so they are never written to the auth-state file.
+ */
+export const PLATFORM_AUTH_ACTION_GRANT_TTL_MS = 5 * 60 * 1000;
+export const PLATFORM_AUTH_ACTION_GRANT_TOKEN_BYTES = 32;
+export const MAX_PENDING_PLATFORM_AUTH_ACTION_GRANTS = 32;
+export const PLATFORM_AUTH_ACTION_HEADER = 'x-cats-auth-action';
+export const PLATFORM_AUTH_ACTION_GRANT_PURPOSES = [
+    'link_google',
+    'unlink_google',
+];
+export function isPlatformAuthActionGrantPurpose(value) {
+    return typeof value === 'string'
+        && PLATFORM_AUTH_ACTION_GRANT_PURPOSES.includes(value);
+}
+export class MemoryPlatformAuthActionGrantStore {
+    grants = new Map();
+    issue(input) {
+        const accountId = input.accountId.trim();
+        const sessionId = input.sessionId.trim();
+        if (!accountId || !sessionId) {
+            throw new Error('Action grant account and session ids are required.');
+        }
+        const now = input.now ?? new Date();
+        this.prune(now);
+        const ttlMs = input.ttlMs ?? PLATFORM_AUTH_ACTION_GRANT_TTL_MS;
+        const token = randomBytes(PLATFORM_AUTH_ACTION_GRANT_TOKEN_BYTES).toString('base64url');
+        const tokenHash = hashSessionToken(token, input.sessionSecret);
+        const expiresAt = new Date(now.getTime() + ttlMs).toISOString();
+        // A caller that keeps requesting grants without spending them must not be
+        // able to grow this map without bound. Evicting the oldest entry keeps the
+        // most recent step-up usable, which is the one the operator just performed.
+        if (this.grants.size >= MAX_PENDING_PLATFORM_AUTH_ACTION_GRANTS) {
+            const oldest = [...this.grants.entries()].sort((left, right) => Date.parse(left[1].createdAt) - Date.parse(right[1].createdAt))[0];
+            if (oldest) {
+                this.grants.delete(oldest[0]);
+            }
+        }
+        this.grants.set(tokenHash, {
+            tokenHash,
+            accountId,
+            sessionId,
+            purpose: input.purpose,
+            createdAt: now.toISOString(),
+            expiresAt,
+        });
+        return { token, expiresAt };
+    }
+    consume(input) {
+        const token = input.token.trim();
+        if (!token) {
+            return { ok: false, reason: 'missing_token' };
+        }
+        const now = input.now ?? new Date();
+        this.prune(now);
+        const tokenHash = hashSessionToken(token, input.sessionSecret);
+        const stored = this.grants.get(tokenHash) ?? null;
+        if (!stored || !matchesTokenHash(stored.tokenHash, tokenHash)) {
+            return { ok: false, reason: 'unknown_or_expired' };
+        }
+        // SPEC-113 requirement 22: the grant is spent on the first matching attempt
+        // even when a later check in that same attempt fails.
+        this.grants.delete(tokenHash);
+        if (stored.purpose !== input.purpose) {
+            return { ok: false, reason: 'purpose_mismatch' };
+        }
+        if (stored.accountId !== input.accountId) {
+            return { ok: false, reason: 'account_mismatch' };
+        }
+        if (stored.sessionId !== input.sessionId) {
+            return { ok: false, reason: 'session_mismatch' };
+        }
+        return { ok: true, purpose: stored.purpose };
+    }
+    revokeForSession(sessionId) {
+        for (const [tokenHash, grant] of this.grants) {
+            if (grant.sessionId === sessionId) {
+                this.grants.delete(tokenHash);
+            }
+        }
+    }
+    prune(now) {
+        const nowMs = now.getTime();
+        for (const [tokenHash, grant] of this.grants) {
+            if (Date.parse(grant.expiresAt) <= nowMs) {
+                this.grants.delete(tokenHash);
+            }
+        }
+    }
+}
+function matchesTokenHash(storedHash, candidateHash) {
+    const stored = Buffer.from(storedHash, 'utf8');
+    const candidate = Buffer.from(candidateHash, 'utf8');
+    return stored.length === candidate.length && timingSafeEqual(stored, candidate);
+}
+//# sourceMappingURL=actionGrant.js.map

package/build/server/platform/auth/actionGrant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actionGrant.js","sourceRoot":"","sources":["../../../../src/platform/auth/actionGrant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD;;;;;;;;;;;;GAYG;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/D,MAAM,CAAC,MAAM,sCAAsC,GAAG,EAAE,CAAC;AACzD,MAAM,CAAC,MAAM,uCAAuC,GAAG,EAAE,CAAC;AAC1D,MAAM,CAAC,MAAM,2BAA2B,GAAG,oBAAoB,CAAC;AAEhE,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,aAAa;IACb,eAAe;CACP,CAAC;AAKX,MAAM,UAAU,gCAAgC,CAC9C,KAAc;IAEd,OAAO,OAAO,KAAK,KAAK,QAAQ;WAC1B,mCAAyD,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClF,CAAC;AAmDD,MAAM,OAAO,kCAAkC;IAC5B,MAAM,GAAG,IAAI,GAAG,EAAyC,CAAC;IAE3E,KAAK,CAAC,KAAwC;QAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEhB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,iCAAiC,CAAC;QAC/D,MAAM,KAAK,GAAG,WAAW,CAAC,sCAAsC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACxF,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAEhE,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,uCAAuC,EAAE,CAAC;YAChE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAC5C,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAChF,CAAC,CAAC,CAAC,CAAC;YACL,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE;YACzB,SAAS;YACT,SAAS;YACT,SAAS;YACT,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;YAC5B,SAAS;SACV,CAAC,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,OAAO,CAAC,KAA0C;QAChD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAChD,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEhB,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;QAClD,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;YAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACrD,CAAC;QAED,4EAA4E;QAC5E,sDAAsD;QACtD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE9B,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACnD,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;YACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACnD,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;YACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACnD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC/C,CAAC;IAED,gBAAgB,CAAC,SAAiB;QAChC,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7C,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAClC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,GAAS;QACrB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7C,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,EAAE,CAAC;gBACzC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,UAAkB,EAAE,aAAqB;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAClF,CAAC"}

package/build/server/platform/auth/adminCredentials.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Shared Admin credential rules for first-admin setup and repair bootstrap.
+ *
+ * ADR-111 fixes one promotion-period password policy for both paths: 8 to 256
+ * Unicode code points inclusive, with no composition rules. Length is counted
+ * in code points, not UTF-16 code units, so an emoji or other astral character
+ * counts once rather than twice.
+ */
+export declare const PLATFORM_ADMIN_PASSWORD_MIN_CODE_POINTS = 8;
+export declare const PLATFORM_ADMIN_PASSWORD_MAX_CODE_POINTS = 256;
+export type PlatformAdminCredentialRejectionReason = 'identifier_required' | 'password_required' | 'password_too_short' | 'password_too_long';
+export interface PlatformAdminCredentials {
+    identifier: string;
+    password: string;
+}
+export type PlatformAdminCredentialValidation = {
+    ok: true;
+    credentials: PlatformAdminCredentials;
+} | {
+    ok: false;
+    reason: PlatformAdminCredentialRejectionReason;
+};
+export declare class PlatformAdminCredentialError extends Error {
+    readonly reason: PlatformAdminCredentialRejectionReason;
+    constructor(reason: PlatformAdminCredentialRejectionReason);
+}
+export declare function countUnicodeCodePoints(value: string): number;
+export declare function validatePlatformAdminCredentials(input: {
+    identifier: unknown;
+    password: unknown;
+}): PlatformAdminCredentialValidation;
+export declare function assertPlatformAdminCredentials(input: {
+    identifier: unknown;
+    password: unknown;
+}): PlatformAdminCredentials;
+export declare function describePlatformAdminCredentialRejection(reason: PlatformAdminCredentialRejectionReason): string;
+//# sourceMappingURL=adminCredentials.d.ts.map

package/build/server/platform/auth/adminCredentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminCredentials.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/adminCredentials.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,eAAO,MAAM,uCAAuC,IAAI,CAAC;AACzD,eAAO,MAAM,uCAAuC,MAAM,CAAC;AAE3D,MAAM,MAAM,sCAAsC,GAC9C,qBAAqB,GACrB,mBAAmB,GACnB,oBAAoB,GACpB,mBAAmB,CAAC;AAExB,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,iCAAiC,GACzC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,wBAAwB,CAAA;CAAE,GACnD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,sCAAsC,CAAA;CAAE,CAAC;AAElE,qBAAa,4BAA6B,SAAQ,KAAK;aACzB,MAAM,EAAE,sCAAsC;gBAA9C,MAAM,EAAE,sCAAsC;CAI3E;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM5D;AAED,wBAAgB,gCAAgC,CAAC,KAAK,EAAE;IACtD,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;CACnB,GAAG,iCAAiC,CAoBpC;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;CACnB,GAAG,wBAAwB,CAM3B;AAED,wBAAgB,wCAAwC,CACtD,MAAM,EAAE,sCAAsC,GAC7C,MAAM,CAeR"}

package/build/server/platform/auth/adminCredentials.js

@@ -0,0 +1,63 @@
+/**
+ * Shared Admin credential rules for first-admin setup and repair bootstrap.
+ *
+ * ADR-111 fixes one promotion-period password policy for both paths: 8 to 256
+ * Unicode code points inclusive, with no composition rules. Length is counted
+ * in code points, not UTF-16 code units, so an emoji or other astral character
+ * counts once rather than twice.
+ */
+export const PLATFORM_ADMIN_PASSWORD_MIN_CODE_POINTS = 8;
+export const PLATFORM_ADMIN_PASSWORD_MAX_CODE_POINTS = 256;
+export class PlatformAdminCredentialError extends Error {
+    reason;
+    constructor(reason) {
+        super(describePlatformAdminCredentialRejection(reason));
+        this.reason = reason;
+        this.name = 'PlatformAdminCredentialError';
+    }
+}
+export function countUnicodeCodePoints(value) {
+    let count = 0;
+    for (const _codePoint of value) {
+        count += 1;
+    }
+    return count;
+}
+export function validatePlatformAdminCredentials(input) {
+    const identifier = typeof input.identifier === 'string' ? input.identifier.trim() : '';
+    if (!identifier) {
+        return { ok: false, reason: 'identifier_required' };
+    }
+    const password = typeof input.password === 'string' ? input.password : '';
+    if (!password) {
+        return { ok: false, reason: 'password_required' };
+    }
+    const codePoints = countUnicodeCodePoints(password);
+    if (codePoints < PLATFORM_ADMIN_PASSWORD_MIN_CODE_POINTS) {
+        return { ok: false, reason: 'password_too_short' };
+    }
+    if (codePoints > PLATFORM_ADMIN_PASSWORD_MAX_CODE_POINTS) {
+        return { ok: false, reason: 'password_too_long' };
+    }
+    return { ok: true, credentials: { identifier, password } };
+}
+export function assertPlatformAdminCredentials(input) {
+    const validation = validatePlatformAdminCredentials(input);
+    if (!validation.ok) {
+        throw new PlatformAdminCredentialError(validation.reason);
+    }
+    return validation.credentials;
+}
+export function describePlatformAdminCredentialRejection(reason) {
+    switch (reason) {
+        case 'identifier_required':
+            return 'Admin identifier is required.';
+        case 'password_required':
+            return 'Admin password is required.';
+        case 'password_too_short':
+            return `Admin password must contain at least ${PLATFORM_ADMIN_PASSWORD_MIN_CODE_POINTS} characters.`;
+        case 'password_too_long':
+            return `Admin password must contain at most ${PLATFORM_ADMIN_PASSWORD_MAX_CODE_POINTS} characters.`;
+    }
+}
+//# sourceMappingURL=adminCredentials.js.map

package/build/server/platform/auth/adminCredentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminCredentials.js","sourceRoot":"","sources":["../../../../src/platform/auth/adminCredentials.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC;AACzD,MAAM,CAAC,MAAM,uCAAuC,GAAG,GAAG,CAAC;AAiB3D,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACzB;IAA5B,YAA4B,MAA8C;QACxE,KAAK,CAAC,wCAAwC,CAAC,MAAM,CAAC,CAAC,CAAC;QAD9B,WAAM,GAAN,MAAM,CAAwC;QAExE,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;QAC/B,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,KAGhD;IACC,MAAM,UAAU,GAAG,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,GAAG,uCAAuC,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,UAAU,GAAG,uCAAuC,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAG9C;IACC,MAAM,UAAU,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,4BAA4B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,UAAU,CAAC,WAAW,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,MAA8C;IAE9C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,qBAAqB;YACxB,OAAO,+BAA+B,CAAC;QACzC,KAAK,mBAAmB;YACtB,OAAO,6BAA6B,CAAC;QACvC,KAAK,oBAAoB;YACvB,OAAO,wCACL,uCACF,cAAc,CAAC;QACjB,KAAK,mBAAmB;YACtB,OAAO,uCACL,uCACF,cAAc,CAAC;IACnB,CAAC;AACH,CAAC"}

package/build/server/platform/auth/bootstrap.d.ts

@@ -1,5 +1,19 @@
 import { type BrowserSessionIssueResult } from './session.js';
 import type { PlatformAccountRecord, PlatformAuthState, PlatformIdentityRecord, PlatformMembershipRecord } from './types.js';
+/**
+ * Raised when first-admin creation loses the uniqueness recheck that runs
+ * inside the serialized auth-state mutation. Callers map this to a conflict
+ * response instead of creating a second Account.
+ */
+export declare class PlatformFirstAdminExistsError extends Error {
+    constructor();
+}
+/**
+ * SPEC-113 requirement 5: the "no Admin exists" check must run inside the same
+ * serialized mutation that persists the new records. A prior setup-status read
+ * is not concurrency control.
+ */
+export declare function hasExistingPlatformAdmin(state: PlatformAuthState): boolean;
 export interface CreateFirstAdminLocalInput {
     state: PlatformAuthState;
     displayName: string;

package/build/server/platform/auth/bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/bootstrap.ts"],"names":[],"mappings":"AAGA,OAAO,EAAuB,KAAK,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACnF,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,wBAAwB,CAAC;IACrC,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,2BAA2B,CAAC,CA0DtC;AAED,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAMrE"}
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/bootstrap.ts"],"names":[],"mappings":"AAIA,OAAO,EAAuB,KAAK,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACnF,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;;CAKvD;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAK1E;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,wBAAwB,CAAC;IACrC,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,2BAA2B,CAAC,CA8DtC;AAED,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAMrE"}

package/build/server/platform/auth/bootstrap.js

@@ -1,15 +1,40 @@
 import { randomUUID } from 'node:crypto';
+import { assertPlatformAdminCredentials } from './adminCredentials.js';
 import { createLocalPasswordHash } from './password.js';
 import { issueBrowserSession } from './session.js';
+/**
+ * Raised when first-admin creation loses the uniqueness recheck that runs
+ * inside the serialized auth-state mutation. Callers map this to a conflict
+ * response instead of creating a second Account.
+ */
+export class PlatformFirstAdminExistsError extends Error {
+    constructor() {
+        super('First admin already exists.');
+        this.name = 'PlatformFirstAdminExistsError';
+    }
+}
+/**
+ * SPEC-113 requirement 5: the "no Admin exists" check must run inside the same
+ * serialized mutation that persists the new records. A prior setup-status read
+ * is not concurrency control.
+ */
+export function hasExistingPlatformAdmin(state) {
+    return state.accounts.length > 0
+        || state.memberships.some((membership) => membership.roles.some((role) => role === 'owner' || role === 'admin'));
+}
 export async function createFirstAdminLocalAuthState(input) {
-    if (input.state.accounts.length > 0) {
-        throw new Error('First admin already exists.');
+    if (hasExistingPlatformAdmin(input.state)) {
+        throw new PlatformFirstAdminExistsError();
     }
+    const credentials = assertPlatformAdminCredentials({
+        identifier: input.identifier,
+        password: input.password,
+    });
     const now = input.now ?? new Date();
     const nowIso = now.toISOString();
     const accountId = `auth-account-${randomUUID()}`;
-    const normalizedIdentifier = normalizeAccountIdentifier(input.identifier);
-    const password = await createLocalPasswordHash(input.password);
+    const normalizedIdentifier = normalizeAccountIdentifier(credentials.identifier);
+    const password = await createLocalPasswordHash(credentials.password);
     const account = {
         id: accountId,
         displayName: input.displayName.trim() || 'Owner',

package/build/server/platform/auth/bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../../../src/platform/auth/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAkC,MAAM,cAAc,CAAC;AA0BnF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAiC;IAEjC,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,gBAAgB,UAAU,EAAE,EAAE,CAAC;IACjD,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,OAAO,GAA0B;QACrC,EAAE,EAAE,SAAS;QACb,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,OAAO;QAChD,KAAK,EAAE,cAAc,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI;QACzE,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,QAAQ,GAA2B;QACvC,EAAE,EAAE,iBAAiB,UAAU,EAAE,EAAE;QACnC,SAAS;QACT,QAAQ,EAAE,gBAAgB;QAC1B,eAAe,EAAE,oBAAoB;QACrC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;QACrD,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,UAAU,GAA6B;QAC3C,EAAE,EAAE,mBAAmB,UAAU,EAAE,EAAE;QACrC,SAAS;QACT,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QACzB,WAAW,EAAE,aAAa;QAC1B,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,OAAO,GAAG,mBAAmB,CAAC;QAClC,SAAS;QACT,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,YAAY;QACzB,GAAG;KACJ,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE;YACL,GAAG,KAAK,CAAC,KAAK;YACd,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,CAAC,OAAO,CAAC;YACnB,UAAU,EAAE,CAAC,QAAQ,CAAC;YACtB,WAAW,EAAE,CAAC,UAAU,CAAC;YACzB,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;SAC5B;QACD,OAAO;QACP,QAAQ;QACR,UAAU;QACV,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,UAAkB;IACxC,OAAO,6BAA6B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../../../src/platform/auth/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAkC,MAAM,cAAc,CAAC;AAQnF;;;;GAIG;AACH,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD;QACE,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAwB;IAC/D,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;WAC3B,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CACvC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC,CACtE,CAAC;AACN,CAAC;AAoBD,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAiC;IAEjC,IAAI,wBAAwB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,6BAA6B,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,WAAW,GAAG,8BAA8B,CAAC;QACjD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,gBAAgB,UAAU,EAAE,EAAE,CAAC;IACjD,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACrE,MAAM,OAAO,GAA0B;QACrC,EAAE,EAAE,SAAS;QACb,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,OAAO;QAChD,KAAK,EAAE,cAAc,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI;QACzE,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,QAAQ,GAA2B;QACvC,EAAE,EAAE,iBAAiB,UAAU,EAAE,EAAE;QACnC,SAAS;QACT,QAAQ,EAAE,gBAAgB;QAC1B,eAAe,EAAE,oBAAoB;QACrC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;QACrD,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,UAAU,GAA6B;QAC3C,EAAE,EAAE,mBAAmB,UAAU,EAAE,EAAE;QACrC,SAAS;QACT,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QACzB,WAAW,EAAE,aAAa;QAC1B,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,OAAO,GAAG,mBAAmB,CAAC;QAClC,SAAS;QACT,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,YAAY;QACzB,GAAG;KACJ,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE;YACL,GAAG,KAAK,CAAC,KAAK;YACd,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,CAAC,OAAO,CAAC;YACnB,UAAU,EAAE,CAAC,QAAQ,CAAC;YACtB,WAAW,EAAE,CAAC,UAAU,CAAC;YACzB,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;SAC5B;QACD,OAAO;QACP,QAAQ;QACR,UAAU;QACV,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,UAAkB;IACxC,OAAO,6BAA6B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACxD,CAAC"}

package/build/server/platform/auth/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/config.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,iBAAiB,CAAC;AAEzE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,wBAAwB,CAAC;CAClC;AAED,eAAO,MAAM,2BAA2B,QAA0B,CAAC;AACnE,eAAO,MAAM,kCAAkC,QAA2B,CAAC;AAC3E,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAClD,eAAO,MAAM,6BAA6B,QAAS,CAAC;AACpD,eAAO,MAAM,sCAAsC,MAAM,CAAC;AAC1D,eAAO,MAAM,gCAAgC,QAAiB,CAAC;AAC/D,eAAO,MAAM,qCAAqC,MAAM,CAAC;AAEzD,MAAM,WAAW,2BAA2B;IAC1C,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,kBAAkB,CAqD7F"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/config.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,iBAAiB,CAAC;AAEzE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,wBAAwB,CAAC;CAClC;AAED,eAAO,MAAM,2BAA2B,QAA2B,CAAC;AACpE,eAAO,MAAM,kCAAkC,QAA2B,CAAC;AAC3E,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAClD,eAAO,MAAM,6BAA6B,QAAS,CAAC;AACpD,eAAO,MAAM,sCAAsC,MAAM,CAAC;AAC1D,eAAO,MAAM,gCAAgC,QAAiB,CAAC;AAC/D,eAAO,MAAM,qCAAqC,MAAM,CAAC;AAEzD,MAAM,WAAW,2BAA2B;IAC1C,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,kBAAkB,CAqD7F"}

package/build/server/platform/auth/config.js

@@ -1,5 +1,5 @@
 import { resolvePlatformAuthRecoveryTokenPathFromChatState, resolvePlatformAuthStatePathFromChatState, } from '../../shared/platformPaths.js';
-export const DEFAULT_AUTH_SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+export const DEFAULT_AUTH_SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 export const DEFAULT_AUTH_MOBILE_SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 export const DEFAULT_AUTH_LOGIN_FAILURE_LIMIT = 5;
 export const DEFAULT_AUTH_LOGIN_LOCKOUT_MS = 30_000;

package/build/server/platform/auth/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/platform/auth/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iDAAiD,EACjD,yCAAyC,GAC1C,MAAM,+BAA+B,CAAC;AA2BvC,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACnE,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3E,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAClD,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AACpD,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,CAAC;AAC1D,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/D,MAAM,CAAC,MAAM,qCAAqC,GAAG,GAAG,CAAC;AASzD,MAAM,UAAU,sBAAsB,CAAC,KAAkC;IACvE,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACxD,MAAM,qBAAqB,GAAG,eAAe,CAC3C,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAC5C,IAAI,4BAA4B,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,IAAI,KAAK,iBAAiB;QACnC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,IAAI;QACjE,YAAY,EAAE,gBAAgB,CAC5B,KAAK,CAAC,GAAG,CAAC,wBAAwB,EAClC,2BAA2B,EAC3B,0BAA0B,CAC3B;QACD,kBAAkB,EAAE,gBAAgB,CAClC,KAAK,CAAC,GAAG,CAAC,+BAA+B,EACzC,kCAAkC,EAClC,iCAAiC,CAClC;QACD,iBAAiB,EAAE,gBAAgB,CACjC,KAAK,CAAC,GAAG,CAAC,6BAA6B,EACvC,gCAAgC,EAChC,+BAA+B,CAChC;QACD,cAAc,EAAE,gBAAgB,CAC9B,KAAK,CAAC,GAAG,CAAC,0BAA0B,EACpC,6BAA6B,EAC7B,4BAA4B,CAC7B;QACD,sBAAsB,EAAE,gBAAgB,CACtC,KAAK,CAAC,GAAG,CAAC,mCAAmC,EAC7C,sCAAsC,EACtC,qCAAqC,CACtC;QACD,iBAAiB,EAAE,gBAAgB,CACjC,KAAK,CAAC,GAAG,CAAC,6BAA6B,EACvC,gCAAgC,EAChC,+BAA+B,CAChC;QACD,qBAAqB,EAAE,gBAAgB,CACrC,KAAK,CAAC,GAAG,CAAC,kCAAkC,EAC5C,qCAAqC,EACrC,oCAAoC,CACrC;QACD,qBAAqB;QACrB,aAAa,EAAE,yCAAyC,CAAC,KAAK,CAAC,aAAa,CAAC;QAC7E,iBAAiB,EAAE,iDAAiD,CAAC,KAAK,CAAC,aAAa,CAAC;QACzF,MAAM,EAAE;YACN,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,IAAI;YAC9D,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACtD,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAAC;SACvE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAuB;IAC5C,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAuB,EAAE,QAAgB,EAAE,IAAY;IAC/E,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAuB;IACvC,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO;SACX,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,eAAe,CAAC,GAAuB;IAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAY,EAAE,IAAY;IAC9D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;YACjB,eAAe,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;YACzC,uBAAuB;YACvB,uBAAuB;SACxB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,gCAAgC,KAAK,MACnC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/platform/auth/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iDAAiD,EACjD,yCAAyC,GAC1C,MAAM,+BAA+B,CAAC;AA2BvC,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACpE,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3E,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAClD,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AACpD,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,CAAC;AAC1D,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/D,MAAM,CAAC,MAAM,qCAAqC,GAAG,GAAG,CAAC;AASzD,MAAM,UAAU,sBAAsB,CAAC,KAAkC;IACvE,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACxD,MAAM,qBAAqB,GAAG,eAAe,CAC3C,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAC5C,IAAI,4BAA4B,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,IAAI,KAAK,iBAAiB;QACnC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,IAAI;QACjE,YAAY,EAAE,gBAAgB,CAC5B,KAAK,CAAC,GAAG,CAAC,wBAAwB,EAClC,2BAA2B,EAC3B,0BAA0B,CAC3B;QACD,kBAAkB,EAAE,gBAAgB,CAClC,KAAK,CAAC,GAAG,CAAC,+BAA+B,EACzC,kCAAkC,EAClC,iCAAiC,CAClC;QACD,iBAAiB,EAAE,gBAAgB,CACjC,KAAK,CAAC,GAAG,CAAC,6BAA6B,EACvC,gCAAgC,EAChC,+BAA+B,CAChC;QACD,cAAc,EAAE,gBAAgB,CAC9B,KAAK,CAAC,GAAG,CAAC,0BAA0B,EACpC,6BAA6B,EAC7B,4BAA4B,CAC7B;QACD,sBAAsB,EAAE,gBAAgB,CACtC,KAAK,CAAC,GAAG,CAAC,mCAAmC,EAC7C,sCAAsC,EACtC,qCAAqC,CACtC;QACD,iBAAiB,EAAE,gBAAgB,CACjC,KAAK,CAAC,GAAG,CAAC,6BAA6B,EACvC,gCAAgC,EAChC,+BAA+B,CAChC;QACD,qBAAqB,EAAE,gBAAgB,CACrC,KAAK,CAAC,GAAG,CAAC,kCAAkC,EAC5C,qCAAqC,EACrC,oCAAoC,CACrC;QACD,qBAAqB;QACrB,aAAa,EAAE,yCAAyC,CAAC,KAAK,CAAC,aAAa,CAAC;QAC7E,iBAAiB,EAAE,iDAAiD,CAAC,KAAK,CAAC,aAAa,CAAC;QACzF,MAAM,EAAE;YACN,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,IAAI;YAC9D,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACtD,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAAC;SACvE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAuB;IAC5C,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAuB,EAAE,QAAgB,EAAE,IAAY;IAC/E,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAuB;IACvC,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO;SACX,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,eAAe,CAAC,GAAuB;IAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAY,EAAE,IAAY;IAC9D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;YACjB,eAAe,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;YACzC,uBAAuB;YACvB,uBAAuB;SACxB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,gCAAgC,KAAK,MACnC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;IACJ,CAAC;AACH,CAAC"}

package/build/server/platform/auth/errorCodes.d.ts

@@ -2,6 +2,8 @@ export declare const PLATFORM_AUTH_ERROR_CODES: {
     readonly unauthenticated: "E_UNAUTHENTICATED";
     readonly forbidden: "E_FORBIDDEN";
     readonly csrfMismatch: "E_CSRF_MISMATCH";
+    readonly reauthRequired: "E_REAUTH_REQUIRED";
+    readonly identityConflict: "E_IDENTITY_CONFLICT";
 };
 export type PlatformAuthErrorCode = (typeof PLATFORM_AUTH_ERROR_CODES)[keyof typeof PLATFORM_AUTH_ERROR_CODES];
 //# sourceMappingURL=errorCodes.d.ts.map

package/build/server/platform/auth/errorCodes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errorCodes.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/errorCodes.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,yBAAyB;;;;CAI5B,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAC/B,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC"}
+{"version":3,"file":"errorCodes.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/errorCodes.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,yBAAyB;;;;;;CAM5B,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAC/B,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC"}

package/build/server/platform/auth/errorCodes.js

@@ -2,5 +2,7 @@ export const PLATFORM_AUTH_ERROR_CODES = {
     unauthenticated: 'E_UNAUTHENTICATED',
     forbidden: 'E_FORBIDDEN',
     csrfMismatch: 'E_CSRF_MISMATCH',
+    reauthRequired: 'E_REAUTH_REQUIRED',
+    identityConflict: 'E_IDENTITY_CONFLICT',
 };
 //# sourceMappingURL=errorCodes.js.map

package/build/server/platform/auth/errorCodes.js.map

@@ -1 +1 @@
-{"version":3,"file":"errorCodes.js","sourceRoot":"","sources":["../../../../src/platform/auth/errorCodes.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,eAAe,EAAE,mBAAmB;IACpC,SAAS,EAAE,aAAa;IACxB,YAAY,EAAE,iBAAiB;CACvB,CAAC"}
+{"version":3,"file":"errorCodes.js","sourceRoot":"","sources":["../../../../src/platform/auth/errorCodes.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,eAAe,EAAE,mBAAmB;IACpC,SAAS,EAAE,aAAa;IACxB,YAAY,EAAE,iBAAiB;IAC/B,cAAc,EAAE,mBAAmB;IACnC,gBAAgB,EAAE,qBAAqB;CAC/B,CAAC"}

package/build/server/platform/auth/googleAccount.d.ts

@@ -1,47 +1,74 @@
 import { type BrowserSessionIssueResult } from './session.js';
 import type { PlatformAccountRecord, PlatformAuthState, PlatformIdentityRecord, PlatformMembershipRecord } from './types.js';
 import type { PlatformVerifiedGoogleIdentity } from './googleVerifier.js';
-export interface CreateFirstAdminGoogleInput {
+export interface CreateGoogleBrowserSessionInput {
     state: PlatformAuthState;
     identity: PlatformVerifiedGoogleIdentity;
     sessionSecret: string;
     sessionTtlMs: number;
     now?: Date;
 }
-export interface CreateFirstAdminGoogleResult {
+export interface CreateGoogleBrowserSessionResult {
     state: PlatformAuthState;
     account: PlatformAccountRecord;
     identity: PlatformIdentityRecord;
     membership: PlatformMembershipRecord;
     session: BrowserSessionIssueResult;
 }
-export interface CreateGoogleBrowserSessionInput {
+export interface LinkGoogleIdentityToAccountInput {
     state: PlatformAuthState;
+    accountId: string;
     identity: PlatformVerifiedGoogleIdentity;
-    sessionSecret: string;
-    sessionTtlMs: number;
     now?: Date;
 }
-export interface CreateGoogleBrowserSessionResult {
+export interface LinkGoogleIdentityToAccountResult {
     state: PlatformAuthState;
     account: PlatformAccountRecord;
     identity: PlatformIdentityRecord;
     membership: PlatformMembershipRecord;
-    session: BrowserSessionIssueResult;
+    adoptedAccountEmail: boolean;
 }
-export interface LinkGoogleIdentityToAccountInput {
+export type GoogleIdentityLinkRejectionReason = 'account_not_found' | 'email_mismatch' | 'subject_owned_by_other_account' | 'account_has_other_google_identity';
+export type LinkGoogleIdentityToAccountOutcome = {
+    ok: true;
+    result: LinkGoogleIdentityToAccountResult;
+} | {
+    ok: false;
+    reason: GoogleIdentityLinkRejectionReason;
+};
+export interface UnlinkGoogleIdentityFromAccountInput {
     state: PlatformAuthState;
     accountId: string;
-    identity: PlatformVerifiedGoogleIdentity;
+    keepSessionId: string;
     now?: Date;
 }
-export interface LinkGoogleIdentityToAccountResult {
+export interface UnlinkGoogleIdentityFromAccountResult {
     state: PlatformAuthState;
     account: PlatformAccountRecord;
-    identity: PlatformIdentityRecord;
     membership: PlatformMembershipRecord;
+    revokedSessionIds: string[];
 }
-export declare function createFirstAdminGoogleAuthState(input: CreateFirstAdminGoogleInput): CreateFirstAdminGoogleResult;
-export declare function linkGoogleIdentityToAccount(input: LinkGoogleIdentityToAccountInput): LinkGoogleIdentityToAccountResult | null;
+export type GoogleIdentityUnlinkRejectionReason = 'account_not_found' | 'google_not_linked' | 'local_fallback_missing';
+export type UnlinkGoogleIdentityFromAccountOutcome = {
+    ok: true;
+    result: UnlinkGoogleIdentityFromAccountResult;
+} | {
+    ok: false;
+    reason: GoogleIdentityUnlinkRejectionReason;
+};
+/**
+ * ADR-111 section 4: trim and lowercase only. Cats deliberately does not apply
+ * Gmail alias, dot, or plus-address canonicalization, so two addresses Google
+ * may route to one mailbox stay distinct here.
+ */
+export declare function normalizePlatformAccountEmail(value: string | null | undefined): string | null;
+export declare function linkGoogleIdentityToAccount(input: LinkGoogleIdentityToAccountInput): LinkGoogleIdentityToAccountOutcome;
+/**
+ * ADR-111 section 6: unlinking must preserve a usable local login and must not
+ * leave ambient access behind. Session records do not retain which identity
+ * established them, so every other browser and mobile session for the account
+ * is revoked and only the step-up-verified session survives.
+ */
+export declare function unlinkGoogleIdentityFromAccount(input: UnlinkGoogleIdentityFromAccountInput): UnlinkGoogleIdentityFromAccountOutcome;
 export declare function createGoogleBrowserSessionForLinkedIdentity(input: CreateGoogleBrowserSessionInput): CreateGoogleBrowserSessionResult | null;
 //# sourceMappingURL=googleAccount.d.ts.map

package/build/server/platform/auth/googleAccount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"googleAccount.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/googleAccount.ts"],"names":[],"mappings":"AAEA,OAAO,EAAuB,KAAK,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACnF,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AAE1E,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,iBAAiB,CAAC;IACzB,QAAQ,EAAE,8BAA8B,CAAC;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,wBAAwB,CAAC;IACrC,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,MAAM,WAAW,+BAA+B;IAC9C,KAAK,EAAE,iBAAiB,CAAC;IACzB,QAAQ,EAAE,8BAA8B,CAAC;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,wBAAwB,CAAC;IACrC,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,iBAAiB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,8BAA8B,CAAC;IACzC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,wBAAwB,CAAC;CACtC;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,2BAA2B,GACjC,4BAA4B,CAsD9B;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,gCAAgC,GACtC,iCAAiC,GAAG,IAAI,CAuE1C;AAED,wBAAgB,2CAA2C,CACzD,KAAK,EAAE,+BAA+B,GACrC,gCAAgC,GAAG,IAAI,CAoDzC"}
+{"version":3,"file":"googleAccount.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/googleAccount.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AAE1E,MAAM,WAAW,+BAA+B;IAC9C,KAAK,EAAE,iBAAiB,CAAC;IACzB,QAAQ,EAAE,8BAA8B,CAAC;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,wBAAwB,CAAC;IACrC,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,iBAAiB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,8BAA8B,CAAC;IACzC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,wBAAwB,CAAC;IACrC,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,MAAM,iCAAiC,GACzC,mBAAmB,GACnB,gBAAgB,GAChB,gCAAgC,GAChC,mCAAmC,CAAC;AAExC,MAAM,MAAM,kCAAkC,GAC1C;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,iCAAiC,CAAA;CAAE,GACvD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,iCAAiC,CAAA;CAAE,CAAC;AAE7D,MAAM,WAAW,oCAAoC;IACnD,KAAK,EAAE,iBAAiB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,qCAAqC;IACpD,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,UAAU,EAAE,wBAAwB,CAAC;IACrC,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,MAAM,mCAAmC,GAC3C,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,CAAC;AAE7B,MAAM,MAAM,sCAAsC,GAC9C;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,qCAAqC,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,mCAAmC,CAAA;CAAE,CAAC;AAE/D;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAG7F;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,gCAAgC,GACtC,kCAAkC,CAqFpC;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,oCAAoC,GAC1C,sCAAsC,CA2DxC;AAED,wBAAgB,2CAA2C,CACzD,KAAK,EAAE,+BAA+B,GACrC,gCAAgC,GAAG,IAAI,CAmDzC"}