@cats-inc/cats-platform 0.1.9 → 0.1.21

package/build/server/platform/auth/googleAccount.js

@@ -1,58 +1,13 @@
 import { randomUUID } from 'node:crypto';
-import { issueBrowserSession } from './session.js';
-export function createFirstAdminGoogleAuthState(input) {
-    if (input.state.accounts.length > 0) {
-        throw new Error('First admin already exists.');
-    }
-    const now = input.now ?? new Date();
-    const nowIso = now.toISOString();
-    const accountId = `auth-account-${randomUUID()}`;
-    const account = {
-        id: accountId,
-        displayName: input.identity.displayName ?? input.identity.email,
-        email: input.identity.email,
-        avatarUrl: input.identity.avatarUrl,
-        status: 'active',
-        createdAt: nowIso,
-        updatedAt: nowIso,
-    };
-    const providerIdentity = {
-        id: `auth-identity-${randomUUID()}`,
-        accountId,
-        provider: 'google',
-        providerSubject: input.identity.providerSubject,
-        email: input.identity.email,
-        createdAt: nowIso,
-        updatedAt: nowIso,
-    };
-    const membership = {
-        id: `auth-membership-${randomUUID()}`,
-        accountId,
-        roles: ['owner', 'admin'],
-        coreActorId: 'actor-owner',
-        createdAt: nowIso,
-        updatedAt: nowIso,
-    };
-    const session = issueBrowserSession({
-        accountId,
-        sessionSecret: input.sessionSecret,
-        ttlMs: input.sessionTtlMs,
-        now,
-    });
-    return {
-        state: {
-            ...input.state,
-            updatedAt: nowIso,
-            accounts: [account],
-            identities: [providerIdentity],
-            memberships: [membership],
-            sessions: [session.session],
-        },
-        account,
-        identity: providerIdentity,
-        membership,
-        session,
-    };
+import { issueBrowserSession, revokeSession, } from './session.js';
+/**
+ * ADR-111 section 4: trim and lowercase only. Cats deliberately does not apply
+ * Gmail alias, dot, or plus-address canonicalization, so two addresses Google
+ * may route to one mailbox stay distinct here.
+ */
+export function normalizePlatformAccountEmail(value) {
+    const normalized = value?.trim().toLowerCase();
+    return normalized ? normalized : null;
 }
 export function linkGoogleIdentityToAccount(input) {
     const account = input.state.accounts.find((candidate) => candidate.id === input.accountId && candidate.status === 'active') ?? null;
@@ -60,24 +15,32 @@ export function linkGoogleIdentityToAccount(input) {
         ? input.state.memberships.find((candidate) => candidate.accountId === account.id) ?? null
         : null;
     if (!account || !membership) {
-        return null;
+        return { ok: false, reason: 'account_not_found' };
     }
     const identityForSubject = input.state.identities.find((candidate) => candidate.provider === 'google'
         && candidate.providerSubject === input.identity.providerSubject) ?? null;
     if (identityForSubject && identityForSubject.accountId !== account.id) {
-        throw new Error('Google identity is already linked to another account.');
+        return { ok: false, reason: 'subject_owned_by_other_account' };
     }
     const identityForAccount = input.state.identities.find((candidate) => candidate.provider === 'google'
         && candidate.accountId === account.id) ?? null;
     if (identityForAccount
         && identityForAccount.providerSubject !== input.identity.providerSubject) {
-        throw new Error('Account already has a linked Google identity.');
+        return { ok: false, reason: 'account_has_other_google_identity' };
+    }
+    // SPEC-113 requirements 28 and 29: an account that already carries an email
+    // must match it exactly. Only an email-less local-handle account may adopt
+    // the verified Google address, and only through this step-up-protected path.
+    const accountEmail = normalizePlatformAccountEmail(account.email);
+    const verifiedEmail = normalizePlatformAccountEmail(input.identity.email);
+    if (accountEmail && accountEmail !== verifiedEmail) {
+        return { ok: false, reason: 'email_mismatch' };
     }
     const nowIso = (input.now ?? new Date()).toISOString();
     const linkedIdentity = identityForSubject
         ? {
             ...identityForSubject,
-            email: input.identity.email,
+            email: verifiedEmail,
             updatedAt: nowIso,
         }
         : {
@@ -85,13 +48,14 @@ export function linkGoogleIdentityToAccount(input) {
             accountId: account.id,
             provider: 'google',
             providerSubject: input.identity.providerSubject,
-            email: input.identity.email,
+            email: verifiedEmail,
             createdAt: nowIso,
             updatedAt: nowIso,
         };
+    const adoptedAccountEmail = accountEmail === null && verifiedEmail !== null;
     const updatedAccount = {
         ...account,
-        email: input.identity.email,
+        email: adoptedAccountEmail ? verifiedEmail : account.email,
         avatarUrl: input.identity.avatarUrl ?? account.avatarUrl,
         updatedAt: nowIso,
     };
@@ -99,15 +63,71 @@ export function linkGoogleIdentityToAccount(input) {
         ? input.state.identities.map((candidate) => candidate.id === identityForSubject.id ? linkedIdentity : candidate)
         : [...input.state.identities, linkedIdentity];
     return {
-        state: {
-            ...input.state,
-            updatedAt: nowIso,
-            accounts: input.state.accounts.map((candidate) => candidate.id === account.id ? updatedAccount : candidate),
-            identities: nextIdentities,
+        ok: true,
+        result: {
+            state: {
+                ...input.state,
+                updatedAt: nowIso,
+                accounts: input.state.accounts.map((candidate) => candidate.id === account.id ? updatedAccount : candidate),
+                identities: nextIdentities,
+            },
+            account: updatedAccount,
+            identity: linkedIdentity,
+            membership: structuredClone(membership),
+            adoptedAccountEmail,
+        },
+    };
+}
+/**
+ * ADR-111 section 6: unlinking must preserve a usable local login and must not
+ * leave ambient access behind. Session records do not retain which identity
+ * established them, so every other browser and mobile session for the account
+ * is revoked and only the step-up-verified session survives.
+ */
+export function unlinkGoogleIdentityFromAccount(input) {
+    const account = input.state.accounts.find((candidate) => candidate.id === input.accountId && candidate.status === 'active') ?? null;
+    const membership = account
+        ? input.state.memberships.find((candidate) => candidate.accountId === account.id) ?? null
+        : null;
+    if (!account || !membership) {
+        return { ok: false, reason: 'account_not_found' };
+    }
+    const googleIdentity = input.state.identities.find((candidate) => candidate.provider === 'google' && candidate.accountId === account.id) ?? null;
+    if (!googleIdentity) {
+        return { ok: false, reason: 'google_not_linked' };
+    }
+    const hasLocalFallback = input.state.identities.some((candidate) => candidate.provider === 'local_password'
+        && candidate.accountId === account.id
+        && Boolean(candidate.passwordHash)
+        && Boolean(candidate.passwordHashAlgorithm));
+    if (!hasLocalFallback) {
+        return { ok: false, reason: 'local_fallback_missing' };
+    }
+    const now = input.now ?? new Date();
+    const nowIso = now.toISOString();
+    const revokedSessionIds = [];
+    const sessions = input.state.sessions.map((session) => {
+        if (session.accountId !== account.id
+            || session.id === input.keepSessionId
+            || session.revokedAt !== null) {
+            return session;
+        }
+        revokedSessionIds.push(session.id);
+        return revokeSession(session, now);
+    });
+    return {
+        ok: true,
+        result: {
+            state: {
+                ...input.state,
+                updatedAt: nowIso,
+                identities: input.state.identities.filter((candidate) => candidate.id !== googleIdentity.id),
+                sessions,
+            },
+            account: structuredClone(account),
+            membership: structuredClone(membership),
+            revokedSessionIds,
         },
-        account: updatedAccount,
-        identity: linkedIdentity,
-        membership: structuredClone(membership),
     };
 }
 export function createGoogleBrowserSessionForLinkedIdentity(input) {
@@ -132,12 +152,11 @@ export function createGoogleBrowserSessionForLinkedIdentity(input) {
     });
     const updatedIdentity = {
         ...providerIdentity,
-        email: input.identity.email,
+        email: normalizePlatformAccountEmail(input.identity.email),
         updatedAt: nowIso,
     };
     const updatedAccount = {
         ...account,
-        email: input.identity.email,
         avatarUrl: input.identity.avatarUrl ?? account.avatarUrl,
         updatedAt: nowIso,
     };

package/build/server/platform/auth/googleAccount.js.map

@@ -1 +1 @@
-{"version":3,"file":"googleAccount.js","sourceRoot":"","sources":["../../../../src/platform/auth/googleAccount.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,mBAAmB,EAAkC,MAAM,cAAc,CAAC;AAuDnF,MAAM,UAAU,+BAA+B,CAC7C,KAAkC;IAElC,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,gBAAgB,UAAU,EAAE,EAAE,CAAC;IACjD,MAAM,OAAO,GAA0B;QACrC,EAAE,EAAE,SAAS;QACb,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC/D,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC3B,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QACnC,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,gBAAgB,GAA2B;QAC/C,EAAE,EAAE,iBAAiB,UAAU,EAAE,EAAE;QACnC,SAAS;QACT,QAAQ,EAAE,QAAQ;QAClB,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAe;QAC/C,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC3B,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,UAAU,GAA6B;QAC3C,EAAE,EAAE,mBAAmB,UAAU,EAAE,EAAE;QACrC,SAAS;QACT,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QACzB,WAAW,EAAE,aAAa;QAC1B,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,OAAO,GAAG,mBAAmB,CAAC;QAClC,SAAS;QACT,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,YAAY;QACzB,GAAG;KACJ,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE;YACL,GAAG,KAAK,CAAC,KAAK;YACd,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,CAAC,OAAO,CAAC;YACnB,UAAU,EAAE,CAAC,gBAAgB,CAAC;YAC9B,WAAW,EAAE,CAAC,UAAU,CAAC;YACzB,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;SAC5B;QACD,OAAO;QACP,QAAQ,EAAE,gBAAgB;QAC1B,UAAU;QACV,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAAuC;IAEvC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACtD,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAClE,IAAI,IAAI,CAAC;IACV,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;QACzF,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,kBAAkB,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACnE,SAAS,CAAC,QAAQ,KAAK,QAAQ;WAC5B,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,QAAQ,CAAC,eAAe,CAChE,IAAI,IAAI,CAAC;IACV,IAAI,kBAAkB,IAAI,kBAAkB,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,kBAAkB,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACnE,SAAS,CAAC,QAAQ,KAAK,QAAQ;WAC5B,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CACtC,IAAI,IAAI,CAAC;IACV,IACE,kBAAkB;WACf,kBAAkB,CAAC,eAAe,KAAK,KAAK,CAAC,QAAQ,CAAC,eAAe,EACxE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,MAAM,cAAc,GAA2B,kBAAkB;QAC/D,CAAC,CAAC;YACE,GAAG,kBAAkB;YACrB,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;YAC3B,SAAS,EAAE,MAAM;SAClB;QACH,CAAC,CAAC;YACE,EAAE,EAAE,iBAAiB,UAAU,EAAE,EAAE;YACnC,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,QAAQ,EAAE,QAAQ;YAClB,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAe;YAC/C,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;YAC3B,SAAS,EAAE,MAAM;YACjB,SAAS,EAAE,MAAM;SAClB,CAAC;IACN,MAAM,cAAc,GAA0B;QAC5C,GAAG,OAAO;QACV,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC3B,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS;QACxD,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,cAAc,GAAG,kBAAkB;QACvC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACvC,SAAS,CAAC,EAAE,KAAK,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CACpE;QACH,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAEhD,OAAO;QACL,KAAK,EAAE;YACL,GAAG,KAAK,CAAC,KAAK;YACd,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/C,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CACzD;YACD,UAAU,EAAE,cAAc;SAC3B;QACD,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,cAAc;QACxB,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,KAAsC;IAEtC,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjE,SAAS,CAAC,QAAQ,KAAK,QAAQ;WAC5B,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,QAAQ,CAAC,eAAe,CAChE,IAAI,IAAI,CAAC;IACV,MAAM,OAAO,GAAG,gBAAgB;QAC9B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,gBAAgB,CAAC,SAAS,CAAC,IAAI,IAAI;QAC/F,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;QACzF,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,gBAAgB,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,mBAAmB,CAAC;QAClC,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,YAAY;QACzB,GAAG;KACJ,CAAC,CAAC;IACH,MAAM,eAAe,GAA2B;QAC9C,GAAG,gBAAgB;QACnB,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC3B,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,cAAc,GAA0B;QAC5C,GAAG,OAAO;QACV,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC3B,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS;QACxD,SAAS,EAAE,MAAM;KAClB,CAAC;IAEF,OAAO;QACL,KAAK,EAAE;YACL,GAAG,KAAK,CAAC,KAAK;YACd,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/C,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CACzD;YACD,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACnD,SAAS,CAAC,EAAE,KAAK,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CACnE;YACD,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC;SACrD;QACD,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,eAAe;QACzB,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;QACvC,OAAO;KACR,CAAC;AACJ,CAAC"}
+{"version":3,"file":"googleAccount.js","sourceRoot":"","sources":["../../../../src/platform/auth/googleAccount.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,mBAAmB,EACnB,aAAa,GAEd,MAAM,cAAc,CAAC;AAyEtB;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAAgC;IAC5E,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,OAAO,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAAuC;IAEvC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACtD,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAClE,IAAI,IAAI,CAAC;IACV,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;QACzF,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,kBAAkB,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACnE,SAAS,CAAC,QAAQ,KAAK,QAAQ;WAC5B,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,QAAQ,CAAC,eAAe,CAChE,IAAI,IAAI,CAAC;IACV,IAAI,kBAAkB,IAAI,kBAAkB,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,kBAAkB,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACnE,SAAS,CAAC,QAAQ,KAAK,QAAQ;WAC5B,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CACtC,IAAI,IAAI,CAAC;IACV,IACE,kBAAkB;WACf,kBAAkB,CAAC,eAAe,KAAK,KAAK,CAAC,QAAQ,CAAC,eAAe,EACxE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IACpE,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,YAAY,GAAG,6BAA6B,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1E,IAAI,YAAY,IAAI,YAAY,KAAK,aAAa,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,MAAM,cAAc,GAA2B,kBAAkB;QAC/D,CAAC,CAAC;YACE,GAAG,kBAAkB;YACrB,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,MAAM;SAClB;QACH,CAAC,CAAC;YACE,EAAE,EAAE,iBAAiB,UAAU,EAAE,EAAE;YACnC,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,QAAQ,EAAE,QAAQ;YAClB,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAe;YAC/C,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,MAAM;YACjB,SAAS,EAAE,MAAM;SAClB,CAAC;IACN,MAAM,mBAAmB,GAAG,YAAY,KAAK,IAAI,IAAI,aAAa,KAAK,IAAI,CAAC;IAC5E,MAAM,cAAc,GAA0B;QAC5C,GAAG,OAAO;QACV,KAAK,EAAE,mBAAmB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK;QAC1D,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS;QACxD,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,cAAc,GAAG,kBAAkB;QACvC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACvC,SAAS,CAAC,EAAE,KAAK,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CACpE;QACH,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAEhD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,KAAK,EAAE;gBACL,GAAG,KAAK,CAAC,KAAK;gBACd,SAAS,EAAE,MAAM;gBACjB,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/C,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CACzD;gBACD,UAAU,EAAE,cAAc;aAC3B;YACD,OAAO,EAAE,cAAc;YACvB,QAAQ,EAAE,cAAc;YACxB,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;YACvC,mBAAmB;SACpB;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,KAA2C;IAE3C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACtD,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAClE,IAAI,IAAI,CAAC;IACV,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;QACzF,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/D,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CACtE,IAAI,IAAI,CAAC;IACV,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjE,SAAS,CAAC,QAAQ,KAAK,gBAAgB;WACpC,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE;WAClC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC;WAC/B,OAAO,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAC5C,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,iBAAiB,GAAa,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACpD,IACE,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE;eAC7B,OAAO,CAAC,EAAE,KAAK,KAAK,CAAC,aAAa;eAClC,OAAO,CAAC,SAAS,KAAK,IAAI,EAC7B,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,OAAO,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,KAAK,EAAE;gBACL,GAAG,KAAK,CAAC,KAAK;gBACd,SAAS,EAAE,MAAM;gBACjB,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CACvC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,CAClD;gBACD,QAAQ;aACT;YACD,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC;YACjC,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;YACvC,iBAAiB;SAClB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,KAAsC;IAEtC,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjE,SAAS,CAAC,QAAQ,KAAK,QAAQ;WAC5B,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,QAAQ,CAAC,eAAe,CAChE,IAAI,IAAI,CAAC;IACV,MAAM,OAAO,GAAG,gBAAgB;QAC9B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,gBAAgB,CAAC,SAAS,CAAC,IAAI,IAAI;QAC/F,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;QACzF,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,gBAAgB,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,mBAAmB,CAAC;QAClC,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,YAAY;QACzB,GAAG;KACJ,CAAC,CAAC;IACH,MAAM,eAAe,GAA2B;QAC9C,GAAG,gBAAgB;QACnB,KAAK,EAAE,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC1D,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,cAAc,GAA0B;QAC5C,GAAG,OAAO;QACV,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS;QACxD,SAAS,EAAE,MAAM;KAClB,CAAC;IAEF,OAAO;QACL,KAAK,EAAE;YACL,GAAG,KAAK,CAAC,KAAK;YACd,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/C,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CACzD;YACD,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACnD,SAAS,CAAC,EAAE,KAAK,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CACnE;YACD,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC;SACrD;QACD,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,eAAe;QACzB,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;QACvC,OAAO;KACR,CAAC;AACJ,CAAC"}

package/build/server/platform/auth/index.d.ts

@@ -1,4 +1,6 @@
+export * from './actionGrant.js';
 export * from './actorAttribution.js';
+export * from './adminCredentials.js';
 export * from './bootstrap.js';
 export * from './bootstrapEnvelope.js';
 export * from './browserHandoff.js';
@@ -12,11 +14,13 @@ export * from './googleCsrf.js';
 export * from './googleJwksVerifier.js';
 export * from './googleVerifier.js';
 export * from './localLogin.js';
+export * from './loginMethods.js';
 export * from './originGate.js';
 export * from './password.js';
 export * from './principal.js';
 export * from './readiness.js';
 export * from './recovery.js';
+export * from './securityEvents.js';
 export * from './session.js';
 export * from './state.js';
 export * from './store.js';

package/build/server/platform/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC"}

package/build/server/platform/auth/index.js

@@ -1,4 +1,6 @@
+export * from './actionGrant.js';
 export * from './actorAttribution.js';
+export * from './adminCredentials.js';
 export * from './bootstrap.js';
 export * from './bootstrapEnvelope.js';
 export * from './browserHandoff.js';
@@ -12,11 +14,13 @@ export * from './googleCsrf.js';
 export * from './googleJwksVerifier.js';
 export * from './googleVerifier.js';
 export * from './localLogin.js';
+export * from './loginMethods.js';
 export * from './originGate.js';
 export * from './password.js';
 export * from './principal.js';
 export * from './readiness.js';
 export * from './recovery.js';
+export * from './securityEvents.js';
 export * from './session.js';
 export * from './state.js';
 export * from './store.js';

package/build/server/platform/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/platform/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/platform/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC"}

package/build/server/platform/auth/localLogin.d.ts

@@ -4,6 +4,16 @@ export interface PlatformLocalPasswordCredentialMatch {
     account: PlatformAccountRecord;
     membership: PlatformMembershipRecord;
 }
+/**
+ * SPEC-113 requirement 16: step-up verifies the local-password Identity that
+ * belongs to the *current* account. The caller must never be able to choose
+ * which identity is checked, so this takes an account id rather than a
+ * client-supplied identifier.
+ */
+export declare function verifyPlatformLocalPasswordForAccount(state: PlatformAuthState, input: {
+    accountId: string;
+    password: string;
+}): Promise<PlatformLocalPasswordCredentialMatch | null>;
 export declare function verifyPlatformLocalPasswordCredential(state: PlatformAuthState, input: {
     identifier: string;
     password: string;

package/build/server/platform/auth/localLogin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"localLogin.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/localLogin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,oCAAoC;IACnD,QAAQ,EAAE,sBAAsB,CAAC;IACjC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,UAAU,EAAE,wBAAwB,CAAC;CACtC;AAED,wBAAsB,qCAAqC,CACzD,KAAK,EAAE,iBAAiB,EACxB,KAAK,EAAE;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB,GACA,OAAO,CAAC,oCAAoC,GAAG,IAAI,CAAC,CA4BtD"}
+{"version":3,"file":"localLogin.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/localLogin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,oCAAoC;IACnD,QAAQ,EAAE,sBAAsB,CAAC;IACjC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,UAAU,EAAE,wBAAwB,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAsB,qCAAqC,CACzD,KAAK,EAAE,iBAAiB,EACxB,KAAK,EAAE;IACL,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB,GACA,OAAO,CAAC,oCAAoC,GAAG,IAAI,CAAC,CAYtD;AAED,wBAAsB,qCAAqC,CACzD,KAAK,EAAE,iBAAiB,EACxB,KAAK,EAAE;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB,GACA,OAAO,CAAC,oCAAoC,GAAG,IAAI,CAAC,CA4BtD"}

package/build/server/platform/auth/localLogin.js

@@ -1,4 +1,21 @@
 import { verifyLocalPassword } from './password.js';
+/**
+ * SPEC-113 requirement 16: step-up verifies the local-password Identity that
+ * belongs to the *current* account. The caller must never be able to choose
+ * which identity is checked, so this takes an account id rather than a
+ * client-supplied identifier.
+ */
+export async function verifyPlatformLocalPasswordForAccount(state, input) {
+    const identity = state.identities.find((candidate) => candidate.provider === 'local_password'
+        && candidate.accountId === input.accountId) ?? null;
+    if (!identity) {
+        return null;
+    }
+    return verifyPlatformLocalPasswordCredential(state, {
+        identifier: identity.providerSubject,
+        password: input.password,
+    });
+}
 export async function verifyPlatformLocalPasswordCredential(state, input) {
     const identity = state.identities.find((candidate) => candidate.provider === 'local_password'
         && (candidate.providerSubject === input.identifier

package/build/server/platform/auth/localLogin.js.map

@@ -1 +1 @@
-{"version":3,"file":"localLogin.js","sourceRoot":"","sources":["../../../../src/platform/auth/localLogin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAcpD,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAAwB,EACxB,KAGC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACnD,SAAS,CAAC,QAAQ,KAAK,gBAAgB;WACpC,CACD,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,UAAU;eAC3C,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,KAAK,CAAC,UAAU,CACvD,CACF,IAAI,IAAI,CAAC;IACV,MAAM,OAAO,GAAG,QAAQ;QACtB,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI;QACjF,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;QACnF,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,KAAK,GAAG,QAAQ,EAAE,YAAY,IAAI,QAAQ,CAAC,qBAAqB;QACpE,CAAC,CAAC,MAAM,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE;YACxC,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;SACtD,CAAC;QACJ,CAAC,CAAC,KAAK,CAAC;IACV,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC;QACnC,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC;QACjC,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;KACxC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"localLogin.js","sourceRoot":"","sources":["../../../../src/platform/auth/localLogin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAcpD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAAwB,EACxB,KAGC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACnD,SAAS,CAAC,QAAQ,KAAK,gBAAgB;WACpC,SAAS,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAC3C,IAAI,IAAI,CAAC;IACV,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,qCAAqC,CAAC,KAAK,EAAE;QAClD,UAAU,EAAE,QAAQ,CAAC,eAAe;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAAwB,EACxB,KAGC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACnD,SAAS,CAAC,QAAQ,KAAK,gBAAgB;WACpC,CACD,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,UAAU;eAC3C,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,KAAK,CAAC,UAAU,CACvD,CACF,IAAI,IAAI,CAAC;IACV,MAAM,OAAO,GAAG,QAAQ;QACtB,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI;QACjF,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;QACnF,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,KAAK,GAAG,QAAQ,EAAE,YAAY,IAAI,QAAQ,CAAC,qBAAqB;QACpE,CAAC,CAAC,MAAM,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE;YACxC,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;SACtD,CAAC;QACJ,CAAC,CAAC,KAAK,CAAC;IACV,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC;QACnC,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC;QACjC,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;KACxC,CAAC;AACJ,CAAC"}

package/build/server/platform/auth/loginMethods.d.ts

@@ -0,0 +1,18 @@
+import type { PlatformAuthState } from './types.js';
+/**
+ * SPEC-113 requirement 10: the authenticated auth-status projection reports
+ * which login methods the current account owns. Requirement 13 makes Identity
+ * records the only source; the renderer must not infer linked state from
+ * account email, avatar, or a prior login result.
+ */
+export interface PlatformLoginMethodsSummary {
+    localPassword: {
+        linked: boolean;
+    };
+    google: {
+        linked: boolean;
+        email: string | null;
+    };
+}
+export declare function summarizePlatformLoginMethods(state: PlatformAuthState, accountId: string): PlatformLoginMethodsSummary;
+//# sourceMappingURL=loginMethods.d.ts.map

package/build/server/platform/auth/loginMethods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginMethods.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/loginMethods.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE;QACb,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;IACF,MAAM,EAAE;QACN,MAAM,EAAE,OAAO,CAAC;QAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;KACtB,CAAC;CACH;AAED,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,iBAAiB,EACxB,SAAS,EAAE,MAAM,GAChB,2BAA2B,CAsB7B"}

package/build/server/platform/auth/loginMethods.js

@@ -0,0 +1,19 @@
+import { normalizePlatformAccountEmail } from './googleAccount.js';
+export function summarizePlatformLoginMethods(state, accountId) {
+    const identities = state.identities.filter((identity) => identity.accountId === accountId);
+    const googleIdentity = identities.find((identity) => identity.provider === 'google') ?? null;
+    return {
+        localPassword: {
+            linked: identities.some((identity) => identity.provider === 'local_password'
+                && Boolean(identity.passwordHash)
+                && Boolean(identity.passwordHashAlgorithm)),
+        },
+        google: {
+            linked: googleIdentity !== null,
+            email: googleIdentity
+                ? normalizePlatformAccountEmail(googleIdentity.email)
+                : null,
+        },
+    };
+}
+//# sourceMappingURL=loginMethods.js.map

package/build/server/platform/auth/loginMethods.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginMethods.js","sourceRoot":"","sources":["../../../../src/platform/auth/loginMethods.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AAmBnE,MAAM,UAAU,6BAA6B,CAC3C,KAAwB,EACxB,SAAiB;IAEjB,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CACxC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAC/C,CAAC;IACF,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CACpC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAC7C,IAAI,IAAI,CAAC;IACV,OAAO;QACL,aAAa,EAAE;YACb,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CACnC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;mBACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;mBAC9B,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAC3C;SACF;QACD,MAAM,EAAE;YACN,MAAM,EAAE,cAAc,KAAK,IAAI;YAC/B,KAAK,EAAE,cAAc;gBACnB,CAAC,CAAC,6BAA6B,CAAC,cAAc,CAAC,KAAK,CAAC;gBACrD,CAAC,CAAC,IAAI;SACT;KACF,CAAC;AACJ,CAAC"}

package/build/server/platform/auth/securityEvents.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Secret-free identity-lifecycle security events.
+ *
+ * ADR-111 section 7 requires these to be emitted through an injected reporter
+ * so a later audit sink can persist the same events without rewriting the auth
+ * routes. The payload is deliberately narrow: stable Cats identifiers, an
+ * outcome, and a bounded reason code. Passwords, raw session or action tokens,
+ * Google credentials, and provider-token claims must never reach a reporter.
+ */
+export declare const PLATFORM_AUTH_SECURITY_EVENT_KINDS: readonly ["first_admin_created", "step_up_succeeded", "step_up_failed", "google_link_succeeded", "google_link_failed", "google_unlink_succeeded", "google_unlink_failed"];
+export type PlatformAuthSecurityEventKind = (typeof PLATFORM_AUTH_SECURITY_EVENT_KINDS)[number];
+export type PlatformAuthSecurityEventOutcome = 'success' | 'failure';
+export interface PlatformAuthSecurityEvent {
+    kind: PlatformAuthSecurityEventKind;
+    outcome: PlatformAuthSecurityEventOutcome;
+    occurredAt: string;
+    accountId: string | null;
+    sessionId: string | null;
+    reason: string | null;
+}
+export type PlatformAuthSecurityEventReporter = (event: PlatformAuthSecurityEvent) => void | Promise<void>;
+export interface CreatePlatformAuthSecurityEventInput {
+    kind: PlatformAuthSecurityEventKind;
+    outcome: PlatformAuthSecurityEventOutcome;
+    now: Date;
+    accountId?: string | null;
+    sessionId?: string | null;
+    reason?: string | null;
+}
+export declare function createPlatformAuthSecurityEvent(input: CreatePlatformAuthSecurityEventInput): PlatformAuthSecurityEvent;
+//# sourceMappingURL=securityEvents.d.ts.map

package/build/server/platform/auth/securityEvents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityEvents.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/securityEvents.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,kCAAkC,2KAQrC,CAAC;AAEX,MAAM,MAAM,6BAA6B,GACvC,CAAC,OAAO,kCAAkC,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtD,MAAM,MAAM,gCAAgC,GAAG,SAAS,GAAG,SAAS,CAAC;AAErE,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,6BAA6B,CAAC;IACpC,OAAO,EAAE,gCAAgC,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,MAAM,iCAAiC,GAAG,CAC9C,KAAK,EAAE,yBAAyB,KAC7B,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B,MAAM,WAAW,oCAAoC;IACnD,IAAI,EAAE,6BAA6B,CAAC;IACpC,OAAO,EAAE,gCAAgC,CAAC;IAC1C,GAAG,EAAE,IAAI,CAAC;IACV,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAID,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,oCAAoC,GAC1C,yBAAyB,CAS3B"}

package/build/server/platform/auth/securityEvents.js

@@ -0,0 +1,45 @@
+/**
+ * Secret-free identity-lifecycle security events.
+ *
+ * ADR-111 section 7 requires these to be emitted through an injected reporter
+ * so a later audit sink can persist the same events without rewriting the auth
+ * routes. The payload is deliberately narrow: stable Cats identifiers, an
+ * outcome, and a bounded reason code. Passwords, raw session or action tokens,
+ * Google credentials, and provider-token claims must never reach a reporter.
+ */
+export const PLATFORM_AUTH_SECURITY_EVENT_KINDS = [
+    'first_admin_created',
+    'step_up_succeeded',
+    'step_up_failed',
+    'google_link_succeeded',
+    'google_link_failed',
+    'google_unlink_succeeded',
+    'google_unlink_failed',
+];
+const MAX_REASON_LENGTH = 64;
+export function createPlatformAuthSecurityEvent(input) {
+    return {
+        kind: input.kind,
+        outcome: input.outcome,
+        occurredAt: input.now.toISOString(),
+        accountId: input.accountId ?? null,
+        sessionId: input.sessionId ?? null,
+        reason: normalizeReason(input.reason),
+    };
+}
+/**
+ * Reason codes are machine-readable slugs, never free text a caller supplied.
+ * Anything longer than a slug is dropped rather than truncated so an unexpected
+ * value cannot smuggle credential material into a log line.
+ */
+function normalizeReason(reason) {
+    const trimmed = reason?.trim();
+    if (!trimmed) {
+        return null;
+    }
+    if (trimmed.length > MAX_REASON_LENGTH || !/^[a-z0-9_]+$/u.test(trimmed)) {
+        return 'unspecified';
+    }
+    return trimmed;
+}
+//# sourceMappingURL=securityEvents.js.map

package/build/server/platform/auth/securityEvents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityEvents.js","sourceRoot":"","sources":["../../../../src/platform/auth/securityEvents.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,qBAAqB;IACrB,mBAAmB;IACnB,gBAAgB;IAChB,uBAAuB;IACvB,oBAAoB;IACpB,yBAAyB;IACzB,sBAAsB;CACd,CAAC;AA6BX,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,MAAM,UAAU,+BAA+B,CAC7C,KAA2C;IAE3C,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC;KACtC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,MAAiC;IACxD,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,iBAAiB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACzE,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/build/server/products/chat/api/contracts.d.ts

@@ -685,14 +685,6 @@ export interface ChannelExportPayload {
     assignedParticipants?: ChatChannelParticipant[];
     assignedCats: ChatChannelCat[];
 }
-export interface SetupCompleteInput {
-    ownerDisplayName: string;
-    bossCatName?: string;
-    bossCatProvider: string;
-    bossCatInstance?: string;
-    bossCatModel?: string;
-    bossCatModelSelection?: ProviderModelSelection | null;
-}
 export interface CreateBotBindingInput {
     platform: 'telegram' | 'line';
     botName: string;