@noodleseed/one 0.62.0 → 0.63.1

package/dist/platform-support.js

@@ -0,0 +1,118 @@
+import { existsSync } from 'node:fs';
+import { delimiter, join } from 'node:path';
+import { EXIT, printJsonFailure } from './commands/output.js';
+const DISCOVERY_COMMANDS = new Set(['--help', '-h', 'help', '--version', '-v', 'version']);
+const MOUNTED_WINDOWS_PATH = /^\/mnt\/[a-z](?:\/|$)/i;
+export function platformSupportFailure(argv, platform) {
+    if (platform !== 'win32' || DISCOVERY_COMMANDS.has(argv[0] ?? ''))
+        return undefined;
+    return {
+        code: 'unsupported_platform',
+        message: 'Noodle CLI commands run on macOS or Windows through WSL2.',
+        cause: 'Native Windows shells are not supported in this first slice.',
+        fix: 'Install WSL2 with Ubuntu and run Noodle from its Linux terminal.',
+        next: 'wsl --install -d Ubuntu',
+    };
+}
+export function enforcePlatformSupport(argv, platform) {
+    const failure = platformSupportFailure(argv, platform);
+    if (failure === undefined)
+        return undefined;
+    if (argv.includes('--json'))
+        return printJsonFailure(failure, EXIT.USAGE);
+    console.error([
+        `${failure.code}: ${failure.message}`,
+        `Cause: ${failure.cause}`,
+        `Fix: ${failure.fix}`,
+        `Next: ${failure.next}`,
+    ].join('\n'));
+    return EXIT.USAGE;
+}
+export function wslPlatformChecks(input) {
+    if (!isWsl(input.platform, input.env, input.kernelRelease))
+        return [];
+    const distro = input.env.WSL_DISTRO_NAME;
+    const isWsl2 = /wsl2/i.test(input.kernelRelease);
+    const isUbuntu = distro !== undefined && /^ubuntu(?:-|$)/i.test(distro);
+    const checks = [
+        !isWsl2
+            ? {
+                level: 'WARN',
+                name: 'Platform',
+                message: `WSL version 2 not detected${distro ? ` (${distro})` : ''}`,
+                cause: 'The supported Windows environment is WSL2 with Ubuntu.',
+                fix: 'Upgrade this distro to WSL2 from PowerShell.',
+                next: distro !== undefined
+                    ? `wsl.exe --set-version ${distro} 2`
+                    : 'wsl.exe --set-default-version 2',
+            }
+            : distro === undefined
+                ? {
+                    level: 'WARN',
+                    name: 'Platform',
+                    message: 'WSL2 distro could not be identified',
+                    cause: 'The supported Windows environment is WSL2 with Ubuntu.',
+                    fix: 'Run Noodle from an Ubuntu WSL2 terminal.',
+                    next: 'wsl.exe --list --verbose',
+                }
+                : !isUbuntu
+                    ? {
+                        level: 'WARN',
+                        name: 'Platform',
+                        message: `WSL2 distro is not Ubuntu (${distro})`,
+                        cause: 'The supported Windows environment is WSL2 with Ubuntu.',
+                        fix: 'Install the supported Ubuntu distro for Noodle CLI work.',
+                        next: 'wsl.exe --install -d Ubuntu',
+                    }
+                    : {
+                        level: 'PASS',
+                        name: 'Platform',
+                        message: `WSL2 (${distro})`,
+                    },
+    ];
+    if (isMountedWindowsPath(input.cwd)) {
+        checks.push({
+            level: 'WARN',
+            name: 'WSL workspace',
+            message: input.cwd,
+            cause: 'The project is on a mounted Windows drive, which makes Node file watching and installs slower and less reliable.',
+            fix: 'Move the repository into the WSL Linux filesystem, such as ~/src.',
+            next: 'mkdir -p ~/src',
+        });
+    }
+    if (isMountedWindowsPath(input.nodePath) || isMountedWindowsPath(input.npmPath)) {
+        checks.push({
+            level: 'WARN',
+            name: 'WSL runtime',
+            message: 'mounted Windows Node/npm detected',
+            cause: 'Node or npm resolves from /mnt, so the CLI is mixing Windows tools with the WSL environment.',
+            fix: 'Install Node 24 and npm inside WSL, then ensure the Linux binaries appear first on PATH.',
+            next: 'command -v node && command -v npm',
+        });
+    }
+    return checks;
+}
+export function findExecutableOnPath(name, pathValue) {
+    if (!pathValue)
+        return undefined;
+    for (const directory of pathValue.split(delimiter)) {
+        if (!directory)
+            continue;
+        for (const candidateName of [name, `${name}.cmd`, `${name}.exe`]) {
+            const candidate = join(directory, candidateName);
+            if (existsSync(candidate))
+                return candidate;
+        }
+    }
+    return undefined;
+}
+function isWsl(platform, env, kernelRelease) {
+    return (platform === 'linux' &&
+        (env.WSL_DISTRO_NAME !== undefined ||
+            env.WSL_INTEROP !== undefined ||
+            /microsoft|wsl/i.test(kernelRelease)));
+}
+function isMountedWindowsPath(path) {
+    return path !== undefined && MOUNTED_WINDOWS_PATH.test(path);
+}
+//# sourceMappingURL=platform-support.js.map

package/dist/platform-support.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-support.js","sourceRoot":"","sources":["../src/platform-support.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AAC3F,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAoBtD,MAAM,UAAU,sBAAsB,CACpC,IAAuB,EACvB,QAAyB;IAEzB,IAAI,QAAQ,KAAK,OAAO,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IACpF,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,2DAA2D;QACpE,KAAK,EAAE,8DAA8D;QACrE,GAAG,EAAE,kEAAkE;QACvE,IAAI,EAAE,yBAAyB;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,IAAuB,EACvB,QAAyB;IAEzB,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1E,OAAO,CAAC,KAAK,CACX;QACE,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE;QACrC,UAAU,OAAO,CAAC,KAAK,EAAE;QACzB,QAAQ,OAAO,CAAC,GAAG,EAAE;QACrB,SAAS,OAAO,CAAC,IAAI,EAAE;KACxB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAuB;IACvD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,aAAa,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,MAAM,GAA0B;QACpC,CAAC,MAAM;YACL,CAAC,CAAC;gBACE,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,6BAA6B,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACpE,KAAK,EAAE,wDAAwD;gBAC/D,GAAG,EAAE,8CAA8C;gBACnD,IAAI,EACF,MAAM,KAAK,SAAS;oBAClB,CAAC,CAAC,yBAAyB,MAAM,IAAI;oBACrC,CAAC,CAAC,iCAAiC;aACxC;YACH,CAAC,CAAC,MAAM,KAAK,SAAS;gBACpB,CAAC,CAAC;oBACE,KAAK,EAAE,MAAM;oBACb,IAAI,EAAE,UAAU;oBAChB,OAAO,EAAE,qCAAqC;oBAC9C,KAAK,EAAE,wDAAwD;oBAC/D,GAAG,EAAE,0CAA0C;oBAC/C,IAAI,EAAE,0BAA0B;iBACjC;gBACH,CAAC,CAAC,CAAC,QAAQ;oBACT,CAAC,CAAC;wBACE,KAAK,EAAE,MAAM;wBACb,IAAI,EAAE,UAAU;wBAChB,OAAO,EAAE,8BAA8B,MAAM,GAAG;wBAChD,KAAK,EAAE,wDAAwD;wBAC/D,GAAG,EAAE,0DAA0D;wBAC/D,IAAI,EAAE,6BAA6B;qBACpC;oBACH,CAAC,CAAC;wBACE,KAAK,EAAE,MAAM;wBACb,IAAI,EAAE,UAAU;wBAChB,OAAO,EAAE,SAAS,MAAM,GAAG;qBAC5B;KACV,CAAC;IAEF,IAAI,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,KAAK,CAAC,GAAG;YAClB,KAAK,EACH,kHAAkH;YACpH,GAAG,EAAE,mEAAmE;YACxE,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,mCAAmC;YAC5C,KAAK,EACH,8FAA8F;YAChG,GAAG,EAAE,0FAA0F;YAC/F,IAAI,EAAE,mCAAmC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,SAA6B;IAE7B,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,KAAK,MAAM,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,KAAK,MAAM,aAAa,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,EAAE,CAAC;YACjE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YACjD,IAAI,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,KAAK,CAAC,QAAyB,EAAE,GAAsB,EAAE,aAAqB;IACrF,OAAO,CACL,QAAQ,KAAK,OAAO;QACpB,CAAC,GAAG,CAAC,eAAe,KAAK,SAAS;YAChC,GAAG,CAAC,WAAW,KAAK,SAAS;YAC7B,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAwB;IACpD,OAAO,IAAI,KAAK,SAAS,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/oauth/app.ts"],"names":[],"mappings":"AAIA,OAAgB,EAAE,KAAK,OAAO,EAA+B,MAAM,SAAS,CAAC;AAE7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEzD;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAqET;AAkCD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/oauth/app.ts"],"names":[],"mappings":"AAIA,OAAgB,EAAE,KAAK,OAAO,EAA+B,MAAM,SAAS,CAAC;AAG7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEzD;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAuIT;AA0CD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/app.js

@@ -3,6 +3,7 @@ import { clientRegistrationHandler } from '@modelcontextprotocol/sdk/server/auth
 import { revocationHandler } from '@modelcontextprotocol/sdk/server/auth/handlers/revoke.js';
 import { tokenHandler } from '@modelcontextprotocol/sdk/server/auth/handlers/token.js';
 import express, {} from 'express';
+import { rateLimit as createRateLimit } from 'express-rate-limit';
 import { renderOAuthErrorPage } from './branding.js';
 export function createOAuthApp(provider, options = {}) {
     const app = express();
@@ -17,7 +18,64 @@ export function createOAuthApp(provider, options = {}) {
             xForwardedForHeader: false,
         },
     };
+    app.use(['/device_authorization', '/device', '/oauth/device/callback'], createRateLimit({
+        windowMs: 60_000,
+        limit: 30,
+        standardHeaders: true,
+        legacyHeaders: false,
+        ...rateLimit,
+    }), createRateLimit({
+        windowMs: 60_000,
+        limit: 600,
+        standardHeaders: false,
+        legacyHeaders: false,
+        keyGenerator: transportRateLimitKey,
+        validate: rateLimit.validate,
+    }));
+    const deviceTokenRateLimit = createRateLimit({
+        windowMs: 60_000,
+        limit: 30,
+        standardHeaders: true,
+        legacyHeaders: false,
+        ...rateLimit,
+    });
+    const deviceTokenTransportRateLimit = createRateLimit({
+        windowMs: 60_000,
+        limit: 600,
+        standardHeaders: false,
+        legacyHeaders: false,
+        keyGenerator: transportRateLimitKey,
+        validate: rateLimit.validate,
+    });
     app.use('/authorize', authorizationHandler({ provider, rateLimit }));
+    app.post('/device_authorization', express.urlencoded({ extended: false }), (req, res) => {
+        void provider.deviceAuthorizationFlow
+            .handleAuthorization(req, res)
+            .catch(() => failJson(res));
+    });
+    app.get('/device', (req, res) => {
+        provider.deviceAuthorizationFlow.handleVerificationPage(req, res);
+    });
+    app.post('/device', express.urlencoded({ extended: false }), (req, res) => {
+        void provider.deviceAuthorizationFlow.handleVerification(req, res).catch(() => failPlain(res));
+    });
+    app.get('/oauth/device/callback', (req, res) => {
+        void provider.deviceAuthorizationFlow.handleCallback(req, res).catch(() => failPlain(res));
+    });
+    app.use(express.urlencoded({ extended: false }));
+    app.use('/token', allowCors);
+    app.use('/token', (req, res, next) => {
+        const body = (req.body ?? {});
+        if (body.grant_type !== 'urn:ietf:params:oauth:grant-type:device_code') {
+            next();
+            return;
+        }
+        deviceTokenTransportRateLimit(req, res, () => {
+            deviceTokenRateLimit(req, res, () => {
+                void provider.deviceAuthorizationFlow.handleToken(req, res).catch(() => failJson(res));
+            });
+        });
+    });
     app.use('/token', tokenHandler({ provider, rateLimit }));
     app.use('/revoke', revocationHandler({ provider, rateLimit }));
     app.use('/register', clientRegistrationHandler({ clientsStore: provider.clientsStore, rateLimit }));
@@ -63,6 +121,10 @@ function failPlain(res) {
     if (!res.headersSent)
         res.status(500).type('text/html').send(renderOAuthErrorPage());
 }
+function failJson(res) {
+    if (!res.headersSent)
+        res.status(500).json({ error: 'server_error' });
+}
 function rateLimitKey(req, trustProxy) {
     if (trustProxy) {
         const forwarded = firstForwardedFor(req.headers.forwarded);
@@ -74,6 +136,9 @@ function rateLimitKey(req, trustProxy) {
     }
     return req.ip ?? req.socket.remoteAddress ?? 'unknown';
 }
+function transportRateLimitKey(req) {
+    return req.socket.remoteAddress ?? 'unknown';
+}
 function firstForwardedFor(value) {
     const raw = firstHeaderValue(value);
     if (!raw)

package/node_modules/@noodle-borg/service/dist/oauth/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/oauth/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,yBAAyB,EAAE,MAAM,4DAA4D,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,yDAAyD,CAAC;AACvF,OAAO,OAAO,EAAE,EAA6C,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAgBrD,MAAM,UAAU,cAAc,CAC5B,QAA6B,EAC7B,UAA2B,EAAE;IAE7B,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,IAAI,OAAO,CAAC,UAAU;QAAE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAErD,MAAM,SAAS,GAAG;QAChB,YAAY,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC;QAC9E,QAAQ,EAAE;YACR,eAAe,EAAE,KAAK;YACtB,sBAAsB,EAAE,KAAK;YAC7B,mBAAmB,EAAE,KAAK;SAC3B;KACF,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACrE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC/D,GAAG,CAAC,GAAG,CACL,WAAW,EACX,yBAAyB,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,CAC9E,CAAC;IAEF,8FAA8F;IAC9F,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC7F,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC5E,KAAK,QAAQ;aACV,IAAI,EAAE;aACN,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aAC9B,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,4FAA4F;IAC5F,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAChE,KAAK,QAAQ,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CACN,gBAAgB,EAChB,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvC,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9B,KAAK,QAAQ,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC,CACF,CAAC;IACF,GAAG,CAAC,IAAI,CACN,wBAAwB,EACxB,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvC,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9B,KAAK,QAAQ,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC,CACF,CAAC;IACF,GAAG,CAAC,IAAI,CACN,mCAAmC,EACnC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvC,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9B,KAAK,QAAQ,CAAC,8BAA8B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACrF,CAAC,CACF,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,oCAAoC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC5E,KAAK,QAAQ,CAAC,+BAA+B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3E,KAAK,QAAQ,CAAC,8BAA8B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,oCAAoC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC5E,KAAK,QAAQ,CAAC,+BAA+B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,IAAa,EAAE,GAAa,EAAE,IAAgB;IAC/D,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC;AACT,CAAC;AAED,SAAS,SAAS,CAAC,GAAa;IAC9B,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,YAAY,CAAC,GAAY,EAAE,UAAmB;IACrD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACvE,IAAI,aAAa;YAAE,OAAO,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC;IACjF,CAAC;IACD,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;AACzD,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAoC;IAC7D,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IACvC,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAoC;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/oauth/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,yBAAyB,EAAE,MAAM,4DAA4D,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,yDAAyD,CAAC;AACvF,OAAO,OAAO,EAAE,EAA6C,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,SAAS,IAAI,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAgBrD,MAAM,UAAU,cAAc,CAC5B,QAA6B,EAC7B,UAA2B,EAAE;IAE7B,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,IAAI,OAAO,CAAC,UAAU;QAAE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAErD,MAAM,SAAS,GAAG;QAChB,YAAY,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC;QAC9E,QAAQ,EAAE;YACR,eAAe,EAAE,KAAK;YACtB,sBAAsB,EAAE,KAAK;YAC7B,mBAAmB,EAAE,KAAK;SAC3B;KACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,CAAC,uBAAuB,EAAE,SAAS,EAAE,wBAAwB,CAAC,EAC9D,eAAe,CAAC;QACd,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,EAAE;QACT,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,KAAK;QACpB,GAAG,SAAS;KACb,CAAC,EACF,eAAe,CAAC;QACd,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,GAAG;QACV,eAAe,EAAE,KAAK;QACtB,aAAa,EAAE,KAAK;QACpB,YAAY,EAAE,qBAAqB;QACnC,QAAQ,EAAE,SAAS,CAAC,QAAQ;KAC7B,CAAC,CACH,CAAC;IACF,MAAM,oBAAoB,GAAG,eAAe,CAAC;QAC3C,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,EAAE;QACT,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,KAAK;QACpB,GAAG,SAAS;KACb,CAAC,CAAC;IACH,MAAM,6BAA6B,GAAG,eAAe,CAAC;QACpD,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,GAAG;QACV,eAAe,EAAE,KAAK;QACtB,aAAa,EAAE,KAAK;QACpB,YAAY,EAAE,qBAAqB;QACnC,QAAQ,EAAE,SAAS,CAAC,QAAQ;KAC7B,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACrE,GAAG,CAAC,IAAI,CACN,uBAAuB,EACvB,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvC,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9B,KAAK,QAAQ,CAAC,uBAAuB;aAClC,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC;aAC7B,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,CAAC,CACF,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACjD,QAAQ,CAAC,uBAAuB,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3F,KAAK,QAAQ,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAChE,KAAK,QAAQ,CAAC,uBAAuB,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACjD,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,IAAgB,EAAE,EAAE;QAClE,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QACzD,IAAI,IAAI,CAAC,UAAU,KAAK,8CAA8C,EAAE,CAAC;YACvE,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,6BAA6B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC3C,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;gBAClC,KAAK,QAAQ,CAAC,uBAAuB,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACzF,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC/D,GAAG,CAAC,GAAG,CACL,WAAW,EACX,yBAAyB,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,CAC9E,CAAC;IAEF,8FAA8F;IAC9F,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC7F,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC5E,KAAK,QAAQ;aACV,IAAI,EAAE;aACN,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aAC9B,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,4FAA4F;IAC5F,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAChE,KAAK,QAAQ,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CACN,gBAAgB,EAChB,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvC,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9B,KAAK,QAAQ,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC,CACF,CAAC;IACF,GAAG,CAAC,IAAI,CACN,wBAAwB,EACxB,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvC,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9B,KAAK,QAAQ,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC,CACF,CAAC;IACF,GAAG,CAAC,IAAI,CACN,mCAAmC,EACnC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvC,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9B,KAAK,QAAQ,CAAC,8BAA8B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACrF,CAAC,CACF,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,oCAAoC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC5E,KAAK,QAAQ,CAAC,+BAA+B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3E,KAAK,QAAQ,CAAC,8BAA8B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,oCAAoC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC5E,KAAK,QAAQ,CAAC,+BAA+B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,IAAa,EAAE,GAAa,EAAE,IAAgB;IAC/D,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC;AACT,CAAC;AAED,SAAS,SAAS,CAAC,GAAa;IAC9B,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,QAAQ,CAAC,GAAa;IAC7B,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,YAAY,CAAC,GAAY,EAAE,UAAmB;IACrD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACvE,IAAI,aAAa;YAAE,OAAO,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC;IACjF,CAAC;IACD,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;AACzD,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAY;IACzC,OAAO,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;AAC/C,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAoC;IAC7D,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IACvC,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAoC;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/branding.d.ts

@@ -20,6 +20,8 @@ export interface OAuthPageInput {
     readonly heading: string;
     /** Pre-escaped inner HTML (lede, detail list, form). Callers own their own escaping. */
     readonly contentHtml: string;
+    /** Optional trusted static CSS appended after the shared OAuth styles. */
+    readonly additionalStyles?: string;
     /** Optional pre-built `<script>` block appended before `</body>` (e.g. the customer sign-in module). */
     readonly scriptHtml?: string;
 }

package/node_modules/@noodle-borg/service/dist/oauth/branding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"branding.d.ts","sourceRoot":"","sources":["../../src/oauth/branding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAiLH,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oBAAoB;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wFAAwF;IACxF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wGAAwG;IACxG,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,oGAAoG;AACpG,wBAAgB,eAAe,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CA+B7D;AAED,mFAAmF;AACnF,wBAAgB,oBAAoB,IAAI,MAAM,CAQ7C"}
+{"version":3,"file":"branding.d.ts","sourceRoot":"","sources":["../../src/oauth/branding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAkLH,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oBAAoB;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wFAAwF;IACxF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,wGAAwG;IACxG,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,oGAAoG;AACpG,wBAAgB,eAAe,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CA+B7D;AAED,mFAAmF;AACnF,wBAAgB,oBAAoB,IAAI,MAAM,CAQ7C"}

package/node_modules/@noodle-borg/service/dist/oauth/branding.js

@@ -120,7 +120,7 @@ body{
   margin:0;min-height:100dvh;background:var(--bg);color:var(--fg);
   font-family:"Geist",ui-sans-serif,system-ui,-apple-system,"Segoe UI",sans-serif;
   -webkit-font-smoothing:antialiased;text-rendering:optimizeLegibility;
-  display:grid;place-items:center;padding:24px;position:relative;overflow:hidden;
+  display:flex;justify-content:center;align-items:flex-start;padding:24px;position:relative;overflow:auto;
 }
 /* WebGL grain-gradient canvas over an on-brand CSS radial-gradient fallback. */
 .ns-canvas{position:fixed;inset:0;width:100%;height:100%;z-index:-4;display:block;pointer-events:none}
@@ -139,6 +139,7 @@ body{
   border:1px solid var(--border);border-radius:1.1rem;background:var(--card);
   -webkit-backdrop-filter:blur(16px) saturate(1.2);backdrop-filter:blur(16px) saturate(1.2);
   padding:1.9rem;
+  margin:auto 0;
   box-shadow:0 30px 90px -45px rgba(0,0,0,.9),0 0 0 1px rgba(255,255,255,.02),inset 0 1px 0 0 rgba(255,255,255,.06);
 }
 .ns-head{display:flex;align-items:center;margin-bottom:1.6rem}
@@ -193,7 +194,7 @@ export function renderOAuthPage(input) {
 <link rel="preconnect" href="https://fonts.googleapis.com" />
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
 <link href="https://fonts.googleapis.com/css2?family=Geist:wght@400;500;600;700&display=swap" rel="stylesheet" />
-<style>${STYLES}</style>
+<style>${STYLES}${input.additionalStyles ?? ''}</style>
 </head>
 <body>
 <canvas id="ns-canvas" class="ns-canvas" aria-hidden="true"></canvas>

package/node_modules/@noodle-borg/service/dist/oauth/branding.js.map

@@ -1 +1 @@
-{"version":3,"file":"branding.js","sourceRoot":"","sources":["../../src/oauth/branding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,2FAA2F;AAC3F,MAAM,OAAO,GAAG,sBAAsB,kBAAkB,CACtD,0nBAA0nB,CAC3nB,EAAE,CAAC;AAEJ,8GAA8G;AAC9G,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;OAcV,CAAC;AAER;;;;;GAKG;AACH,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA6DZ,CAAC;AAEX,0GAA0G;AAC1G,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0EAwE2D,CAAC;AAe3E,oGAAoG;AACpG,MAAM,UAAU,eAAe,CAAC,KAAqB;IACnD,OAAO;;;;;;;SAOA,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;8CACqB,OAAO;;;;SAI5C,MAAM;;;;;;;;;yBASU,QAAQ;yBACR,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;yBACjB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;IACvC,KAAK,CAAC,WAAW;;EAEnB,aAAa;EACb,KAAK,CAAC,UAAU,IAAI,EAAE;;QAEhB,CAAC;AACT,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,oBAAoB;IAClC,OAAO,eAAe,CAAC;QACrB,KAAK,EAAE,6BAA6B;QACpC,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,eAAe;QACxB,WAAW,EACT,6HAA6H;KAChI,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"branding.js","sourceRoot":"","sources":["../../src/oauth/branding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,2FAA2F;AAC3F,MAAM,OAAO,GAAG,sBAAsB,kBAAkB,CACtD,0nBAA0nB,CAC3nB,EAAE,CAAC;AAEJ,8GAA8G;AAC9G,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;OAcV,CAAC;AAER;;;;;GAKG;AACH,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA6DZ,CAAC;AAEX,0GAA0G;AAC1G,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0EAyE2D,CAAC;AAiB3E,oGAAoG;AACpG,MAAM,UAAU,eAAe,CAAC,KAAqB;IACnD,OAAO;;;;;;;SAOA,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;8CACqB,OAAO;;;;SAI5C,MAAM,GAAG,KAAK,CAAC,gBAAgB,IAAI,EAAE;;;;;;;;;yBASrB,QAAQ;yBACR,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;yBACjB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;IACvC,KAAK,CAAC,WAAW;;EAEnB,aAAa;EACb,KAAK,CAAC,UAAU,IAAI,EAAE;;QAEhB,CAAC;AACT,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,oBAAoB;IAClC,OAAO,eAAe,CAAC;QACrB,KAAK,EAAE,6BAA6B;QACpC,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,eAAe;QACxB,WAAW,EACT,6HAA6H;KAChI,CAAC,CAAC;AACL,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"developer-grant-page.d.ts","sourceRoot":"","sources":["../../src/oauth/developer-grant-page.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAE5E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACnD;AAQD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,CAyB/E"}
+{"version":3,"file":"developer-grant-page.d.ts","sourceRoot":"","sources":["../../src/oauth/developer-grant-page.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAE5E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACnD;AA+HD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,CAuB/E"}

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-page.js

@@ -4,21 +4,133 @@ const CAPABILITY_COPY = {
     'deployments:write': 'Build and deploy apps to the selected environments',
     'deployments:rollback': 'Roll back deployments',
 };
+const ENVIRONMENT_PRIORITY = {
+    dev: 0,
+    staging: 1,
+    prod: 3,
+};
+const DEVELOPER_GRANT_STYLES = `
+.ns-card{width:min(100%,46rem)}
+.ns-title{max-width:38rem;white-space:normal}
+.developer-context{grid-template-columns:repeat(3,minmax(0,1fr));gap:.75rem;margin-bottom:1.55rem}
+.developer-context>div{min-width:0}
+.developer-context .ns-dd{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.developer-grant{display:grid;gap:1.35rem}
+.developer-section{min-width:0;margin:0;padding:0;border:0}
+.developer-step{display:flex;align-items:center;gap:.6rem;margin:0 0 .3rem;color:var(--fg);font-size:.94rem;font-weight:650}
+.developer-step-number{display:grid;place-items:center;width:1.6rem;height:1.6rem;border:1px solid var(--border);border-radius:999px;color:var(--orange);font-size:.72rem}
+.developer-help{margin:0 0 .8rem;color:var(--muted);font-size:.8rem;line-height:1.5}
+.developer-org-list{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:.65rem}
+.developer-org-choice{position:relative;display:block;min-width:0;cursor:pointer}
+.developer-org-choice>input{position:absolute;width:1px;height:1px;opacity:0;pointer-events:none}
+.developer-org-card{display:flex;align-items:center;justify-content:space-between;gap:.85rem;min-height:4rem;padding:.85rem .95rem;border:1px solid var(--border);border-radius:.8rem;background:rgba(255,255,255,.025);transition:border-color .16s ease,background .16s ease,box-shadow .16s ease}
+.developer-org-choice:hover .developer-org-card{border-color:color-mix(in srgb,var(--border),var(--fg) 20%);background:rgba(255,255,255,.04)}
+.developer-org-choice>input:focus-visible+.developer-org-card{outline:2px solid var(--orange);outline-offset:2px}
+.developer-org-choice>input:checked+.developer-org-card{border-color:color-mix(in srgb,var(--orange) 70%,transparent);background:linear-gradient(135deg,color-mix(in srgb,var(--orange) 13%,transparent),rgba(255,255,255,.025));box-shadow:inset 0 0 0 1px color-mix(in srgb,var(--orange) 12%,transparent)}
+.developer-org-name{display:block;overflow:hidden;color:var(--fg);font-size:.88rem;font-weight:650;text-overflow:ellipsis;white-space:nowrap}
+.developer-org-access{display:block;margin-top:.18rem;color:var(--muted);font-size:.72rem}
+.developer-choice-mark{display:grid;flex:0 0 auto;place-items:center;width:1.1rem;height:1.1rem;border:1px solid var(--border);border-radius:999px;color:transparent;font-size:.65rem}
+.developer-org-choice>input:checked+.developer-org-card .developer-choice-mark{border-color:var(--orange);background:var(--orange);color:#130b07}
+.developer-environment-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:.6rem}
+.developer-environment{position:relative;display:block;min-width:0;cursor:pointer}
+.developer-environment>input{position:absolute;width:1px;height:1px;opacity:0;pointer-events:none}
+.developer-environment-card{display:flex;align-items:flex-start;gap:.65rem;min-height:4.1rem;padding:.8rem;border:1px solid var(--border);border-radius:.75rem;background:rgba(255,255,255,.025);transition:border-color .16s ease,background .16s ease}
+.developer-environment:hover .developer-environment-card{border-color:color-mix(in srgb,var(--border),var(--fg) 20%);background:rgba(255,255,255,.04)}
+.developer-environment>input:focus-visible+.developer-environment-card{outline:2px solid var(--orange);outline-offset:2px}
+.developer-environment>input:checked+.developer-environment-card{border-color:color-mix(in srgb,var(--orange) 70%,transparent);background:color-mix(in srgb,var(--orange) 10%,transparent)}
+.developer-checkbox{display:grid;flex:0 0 auto;place-items:center;width:1rem;height:1rem;margin-top:.08rem;border:1px solid var(--border);border-radius:.25rem;color:transparent;font-size:.68rem}
+.developer-environment>input:checked+.developer-environment-card .developer-checkbox{border-color:var(--orange);background:var(--orange);color:#130b07}
+.developer-environment-name{display:block;color:var(--fg);font-size:.84rem;font-weight:650}
+.developer-environment-note{display:block;margin-top:.2rem;color:var(--muted);font-size:.68rem;line-height:1.35}
+.developer-environment-note.is-production{color:#f1a273}
+.developer-capabilities{margin:.75rem 0 0;padding:.7rem .8rem;border:1px solid var(--border);border-radius:.7rem;background:rgba(0,0,0,.12);color:var(--muted);font-size:.75rem}
+.developer-capabilities summary{cursor:pointer;color:var(--fg);font-weight:600}
+.developer-capabilities ul{display:grid;gap:.35rem;margin:.6rem 0 0;padding-left:1.15rem;line-height:1.45}
+.developer-summary{padding:.85rem .95rem;border:1px solid var(--border);border-radius:.75rem;background:rgba(255,255,255,.025)}
+.developer-summary-label{margin:0 0 .24rem;color:var(--muted);font-size:.65rem;font-weight:700;letter-spacing:.12em;text-transform:uppercase}
+.developer-summary-copy{margin:0;color:var(--fg);font-size:.8rem;line-height:1.5}
+.developer-selection-error{margin:.45rem 0 0;color:#f1a273;font-size:.75rem}
+.developer-grant .ns-row{margin-top:0}
+.developer-grant .btn-primary:disabled{cursor:not-allowed;filter:none;opacity:.45}
+@media(max-width:680px){
+  .ns-card{padding:1.35rem}
+  .developer-context,.developer-org-list,.developer-environment-grid{grid-template-columns:1fr}
+  .developer-context{gap:.55rem}
+}
+`;
+const DEVELOPER_GRANT_SCRIPT = `<script>
+(function(){
+  var form=document.querySelector('[data-developer-grant]');
+  if(!form)return;
+  var choices=Array.from(form.querySelectorAll('[data-org-choice]'));
+  var panels=Array.from(form.querySelectorAll('[data-org-panel]'));
+  var authorize=form.querySelector('[data-authorize]');
+  var summary=form.querySelector('[data-selection-summary]');
+  var error=form.querySelector('[data-selection-error]');
+  var clientName=form.getAttribute('data-client-name')||'The developer plugin';
+  function activeIndex(){
+    var selected=choices.find(function(choice){return choice.checked;});
+    return selected ? Number(selected.getAttribute('data-org-choice')) : -1;
+  }
+  function activeEnvironments(){
+    var panel=panels[activeIndex()];
+    return panel ? Array.from(panel.querySelectorAll('input[name="environment"]:checked')).map(function(input){return input.value;}) : [];
+  }
+  function naturalList(values){
+    if(values.length<2)return values[0]||'';
+    if(values.length===2)return values[0]+' and '+values[1];
+    return values.slice(0,-1).join(', ')+', and '+values[values.length-1];
+  }
+  function update(){
+    var panel=panels[activeIndex()];
+    var environments=activeEnvironments();
+    var valid=panel!==undefined&&environments.length>0;
+    authorize.disabled=!valid;
+    error.hidden=valid;
+    if(valid){
+      summary.textContent=clientName+' can '+panel.getAttribute('data-capability-summary')+' in '+panel.getAttribute('data-org-name')+' for '+naturalList(environments)+'.';
+    }else{
+      summary.textContent='Select at least one environment to continue.';
+    }
+  }
+  choices.forEach(function(choice){
+    choice.addEventListener('change',function(){
+      var next=activeIndex();
+      panels.forEach(function(panel,index){
+        var active=index===next;
+        panel.hidden=!active;
+        var environments=Array.from(panel.querySelectorAll('input[name="environment"]'));
+        environments.forEach(function(environment){environment.checked=false;environment.disabled=!active;});
+        if(active){
+          var preferred=environments.find(function(environment){return environment.value==='dev';});
+          if(preferred)preferred.checked=true;
+        }
+      });
+      update();
+    });
+  });
+  form.addEventListener('change',function(event){
+    if(event.target&&event.target.matches('input[name="environment"]'))update();
+  });
+  form.addEventListener('submit',function(event){
+    var submitter=event.submitter;
+    if(submitter&&submitter.value==='deny')return;
+    if(activeEnvironments().length===0){event.preventDefault();update();}
+  });
+  update();
+})();
+</script>`;
 export function renderDeveloperGrantPage(input) {
-    const choices = input.choices.map(renderChoice).join('');
     const controls = input.choices.length === 0
-        ? '<p class="ns-note">No organizations are available for this account.</p>'
-        : `${choices}<div class="ns-row">
-        <button type="submit" name="decision" value="deny" class="btn btn-ghost">Deny</button>
-        <span class="btn-glow"><button type="submit" name="decision" value="approve" class="btn btn-primary">Authorize</button></span>
-      </div>`;
-    const contentHtml = `<p class="ns-lede"><strong>${escapeHtml(input.clientName)}</strong> will be able to guide and operate Noodle Cloud autonomously within the access you select.</p>
-    <dl class="ns-dl">
-      <div><dt class="ns-dt">Signed in as</dt><dd class="ns-dd">${escapeHtml(input.userEmail)}</dd></div>
-      <div><dt class="ns-dt">Noodle Cloud</dt><dd class="ns-dd">${escapeHtml(input.resourceHost)}</dd></div>
-      <div><dt class="ns-dt">Redirects to</dt><dd class="ns-dd">${escapeHtml(input.redirectHost)}</dd></div>
+        ? '<div class="ns-alert"><p class="ns-note">No organizations are available for this account.</p></div>'
+        : renderControls(input);
+    const contentHtml = `<p class="ns-lede">Review and choose the exact access for <strong>${escapeHtml(input.clientName)}</strong>. You can select more than one environment.</p>
+    <dl class="ns-dl developer-context">
+      <div><dt class="ns-dt">Signed in as</dt><dd class="ns-dd" title="${escapeHtml(input.userEmail)}">${escapeHtml(input.userEmail)}</dd></div>
+      <div><dt class="ns-dt">Noodle Cloud</dt><dd class="ns-dd" title="${escapeHtml(input.resourceHost)}">${escapeHtml(input.resourceHost)}</dd></div>
+      <div><dt class="ns-dt">Redirects to</dt><dd class="ns-dd" title="${escapeHtml(input.redirectHost)}">${escapeHtml(input.redirectHost)}</dd></div>
     </dl>
-    <form method="post" action="${escapeHtml(input.grantAction)}">
+    <form method="post" action="${escapeHtml(input.grantAction)}" class="developer-grant" data-developer-grant data-client-name="${escapeHtml(input.clientName)}">
       <input type="hidden" name="grant_token" value="${escapeHtml(input.grantToken)}" />
       ${controls}
     </form>`;
@@ -27,28 +139,104 @@ export function renderDeveloperGrantPage(input) {
         kicker: 'Developer access',
         heading: 'Choose where this developer plugin can operate',
         contentHtml,
+        additionalStyles: DEVELOPER_GRANT_STYLES,
+        ...(input.choices.length === 0 ? {} : { scriptHtml: DEVELOPER_GRANT_SCRIPT }),
     });
 }
-function renderChoice(choice, index) {
-    const org = escapeHtml(choice.org);
-    const label = escapeHtml(choice.displayName ?? choice.org);
-    const environments = choice.environments
-        .map((environment) => {
-        const escaped = escapeHtml(environment);
-        const productionNote = environment === 'prod' ? ' <span class="ns-note">explicit access</span>' : '';
-        return `<label><input type="checkbox" name="environment" value="${escaped}" /> ${escaped}${productionNote}</label>`;
-    })
+function renderControls(input) {
+    const organizations = input.choices.map(renderOrganizationChoice).join('');
+    const panels = input.choices.map(renderEnvironmentPanel).join('');
+    const first = input.choices[0];
+    const initialEnvironment = first?.environments.includes('dev') ? 'dev' : first?.environments[0];
+    const initialSummary = first !== undefined && initialEnvironment !== undefined
+        ? `${input.clientName} can ${capabilitySummary(first.capabilities)} in ${first.displayName ?? first.org} for ${initialEnvironment}.`
+        : 'Select at least one environment to continue.';
+    return `<fieldset class="developer-section">
+      <legend class="developer-step"><span class="developer-step-number">1</span>Choose organization</legend>
+      <p class="developer-help">Only one organization can be authorized in this connection.</p>
+      <div class="developer-org-list">${organizations}</div>
+    </fieldset>
+    <div>${panels}</div>
+    <div class="developer-summary" aria-live="polite">
+      <p class="developer-summary-label">Access summary</p>
+      <p class="developer-summary-copy" data-selection-summary>${escapeHtml(initialSummary)}</p>
+      <p class="developer-selection-error" data-selection-error hidden>Select at least one environment to continue.</p>
+    </div>
+    <div class="ns-row">
+      <button type="submit" name="decision" value="deny" class="btn btn-ghost">Deny</button>
+      <span class="btn-glow"><button type="submit" name="decision" value="approve" class="btn btn-primary" data-authorize>Authorize access</button></span>
+    </div>`;
+}
+function renderOrganizationChoice(choice, index) {
+    const label = choice.displayName ?? choice.org;
+    const access = choice.capabilities.includes('deployments:rollback')
+        ? 'Owner access'
+        : 'Developer access';
+    return `<label class="developer-org-choice">
+      <input type="radio" name="org" value="${escapeHtml(choice.org)}" data-org-choice="${index}"${index === 0 ? ' checked' : ''} />
+      <span class="developer-org-card">
+        <span><span class="developer-org-name">${escapeHtml(label)}</span><span class="developer-org-access">${access}</span></span>
+        <span class="developer-choice-mark" aria-hidden="true">✓</span>
+      </span>
+    </label>`;
+}
+function renderEnvironmentPanel(choice, choiceIndex) {
+    const environments = orderedEnvironments(choice.environments)
+        .map((environment, environmentIndex) => renderEnvironment(environment, choiceIndex, environmentIndex, choiceIndex === 0))
         .join('');
     const capabilities = choice.capabilities
         .map((capability) => `<li>${escapeHtml(CAPABILITY_COPY[capability])}</li>`)
         .join('');
-    return `<fieldset>
-      <legend><label><input type="radio" name="org" value="${org}"${index === 0 ? ' checked' : ''} /> ${label}</label></legend>
-      <p class="ns-note">Environments</p>
-      <div>${environments}</div>
-      <p class="ns-note">Autonomous capabilities</p>
-      <ul>${capabilities}</ul>
-    </fieldset>`;
+    const label = choice.displayName ?? choice.org;
+    return `<section class="developer-section" data-org-panel="${choiceIndex}" data-org-name="${escapeHtml(label)}" data-capability-summary="${escapeHtml(capabilitySummary(choice.capabilities))}"${choiceIndex === 0 ? '' : ' hidden'}>
+      <h2 class="developer-step"><span class="developer-step-number">2</span>Choose environments</h2>
+      <p class="developer-help">Select every environment this plugin should be able to operate. Development is selected for you.</p>
+      <div class="developer-environment-grid">${environments}</div>
+      <details class="developer-capabilities">
+        <summary>What the plugin can do</summary>
+        <ul>${capabilities}</ul>
+      </details>
+    </section>`;
+}
+function renderEnvironment(environment, choiceIndex, environmentIndex, active) {
+    const id = `developer-environment-${choiceIndex}-${environmentIndex}`;
+    const selected = active && environment === 'dev';
+    const note = environmentNote(environment);
+    return `<label class="developer-environment" for="${id}">
+      <input id="${id}" type="checkbox" name="environment" value="${escapeHtml(environment)}"${selected ? ' checked' : ''}${active ? '' : ' disabled'} />
+      <span class="developer-environment-card">
+        <span class="developer-checkbox" aria-hidden="true">✓</span>
+        <span><span class="developer-environment-name">${escapeHtml(environment)}</span><span class="developer-environment-note${environment === 'prod' ? ' is-production' : ''}">${note}</span></span>
+      </span>
+    </label>`;
+}
+function orderedEnvironments(environments) {
+    return [...new Set(environments)].sort((left, right) => {
+        const leftPriority = ENVIRONMENT_PRIORITY[left] ?? 2;
+        const rightPriority = ENVIRONMENT_PRIORITY[right] ?? 2;
+        return leftPriority - rightPriority || left.localeCompare(right);
+    });
+}
+function environmentNote(environment) {
+    if (environment === 'dev')
+        return 'Recommended';
+    if (environment === 'prod')
+        return 'Can affect live users';
+    return 'Optional';
+}
+function capabilitySummary(capabilities) {
+    const actions = [];
+    if (capabilities.includes('cloud:read'))
+        actions.push('read cloud state');
+    if (capabilities.includes('deployments:write'))
+        actions.push('build and deploy apps');
+    if (capabilities.includes('deployments:rollback'))
+        actions.push('roll back deployments');
+    if (actions.length === 0)
+        return 'use its assigned capabilities';
+    if (actions.length === 1)
+        return actions[0] ?? 'use its assigned capabilities';
+    return `${actions.slice(0, -1).join(', ')} and ${actions.at(-1)}`;
 }
 function escapeHtml(value) {
     return value

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-page.js.map

@@ -1 +1 @@
-{"version":3,"file":"developer-grant-page.js","sourceRoot":"","sources":["../../src/oauth/developer-grant-page.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAahD,MAAM,eAAe,GAAkD;IACrE,YAAY,EAAE,gEAAgE;IAC9E,mBAAmB,EAAE,oDAAoD;IACzE,sBAAsB,EAAE,uBAAuB;CAChD,CAAC;AAEF,MAAM,UAAU,wBAAwB,CAAC,KAA8B;IACrE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzD,MAAM,QAAQ,GACZ,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QACxB,CAAC,CAAC,yEAAyE;QAC3E,CAAC,CAAC,GAAG,OAAO;;;aAGL,CAAC;IACZ,MAAM,WAAW,GAAG,8BAA8B,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;;kEAEd,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;kEAC3B,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC;kEAC9B,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC;;kCAE9D,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;uDACR,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;QAC3E,QAAQ;YACJ,CAAC;IACX,OAAO,eAAe,CAAC;QACrB,KAAK,EAAE,0CAA0C;QACjD,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,gDAAgD;QACzD,WAAW;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,MAA4B,EAAE,KAAa;IAC/D,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY;SACrC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;QACnB,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,cAAc,GAClB,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,2DAA2D,OAAO,QAAQ,OAAO,GAAG,cAAc,UAAU,CAAC;IACtH,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY;SACrC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;SAC1E,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO;6DACoD,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK;;aAEhG,YAAY;;YAEb,YAAY;gBACR,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"developer-grant-page.js","sourceRoot":"","sources":["../../src/oauth/developer-grant-page.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAahD,MAAM,eAAe,GAAkD;IACrE,YAAY,EAAE,gEAAgE;IAC9E,mBAAmB,EAAE,oDAAoD;IACzE,sBAAsB,EAAE,uBAAuB;CAChD,CAAC;AAEF,MAAM,oBAAoB,GAAqC;IAC7D,GAAG,EAAE,CAAC;IACN,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgD9B,CAAC;AAEF,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA6DrB,CAAC;AAEX,MAAM,UAAU,wBAAwB,CAAC,KAA8B;IACrE,MAAM,QAAQ,GACZ,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QACxB,CAAC,CAAC,qGAAqG;QACvG,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,WAAW,GAAG,qEAAqE,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;;yEAE9C,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;yEAC3D,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC;yEACjE,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC;;kCAExG,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,oEAAoE,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;uDACxG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;QAC3E,QAAQ;YACJ,CAAC;IACX,OAAO,eAAe,CAAC;QACrB,KAAK,EAAE,0CAA0C;QACjD,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,gDAAgD;QACzD,WAAW;QACX,gBAAgB,EAAE,sBAAsB;QACxC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAC;KAC9E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,KAA8B;IACpD,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,kBAAkB,GAAG,KAAK,EAAE,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAChG,MAAM,cAAc,GAClB,KAAK,KAAK,SAAS,IAAI,kBAAkB,KAAK,SAAS;QACrD,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,QAAQ,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,GAAG,QAAQ,kBAAkB,GAAG;QACpI,CAAC,CAAC,8CAA8C,CAAC;IACrD,OAAO;;;wCAG+B,aAAa;;WAE1C,MAAM;;;iEAGgD,UAAU,CAAC,cAAc,CAAC;;;;;;WAMhF,CAAC;AACZ,CAAC;AAED,SAAS,wBAAwB,CAAC,MAA4B,EAAE,KAAa;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QACjE,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,kBAAkB,CAAC;IACvB,OAAO;8CACqC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,sBAAsB,KAAK,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;;iDAE/E,UAAU,CAAC,KAAK,CAAC,6CAA6C,MAAM;;;aAGxG,CAAC;AACd,CAAC;AAED,SAAS,sBAAsB,CAAC,MAA4B,EAAE,WAAmB;IAC/E,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC;SAC1D,GAAG,CAAC,CAAC,WAAW,EAAE,gBAAgB,EAAE,EAAE,CACrC,iBAAiB,CAAC,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,KAAK,CAAC,CAAC,CACjF;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY;SACrC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;SAC1E,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC;IAC/C,OAAO,sDAAsD,WAAW,oBAAoB,UAAU,CAAC,KAAK,CAAC,8BAA8B,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;;;gDAGrL,YAAY;;;cAG9C,YAAY;;eAEX,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CACxB,WAAmB,EACnB,WAAmB,EACnB,gBAAwB,EACxB,MAAe;IAEf,MAAM,EAAE,GAAG,yBAAyB,WAAW,IAAI,gBAAgB,EAAE,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,WAAW,KAAK,KAAK,CAAC;IACjD,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC1C,OAAO,6CAA6C,EAAE;mBACrC,EAAE,+CAA+C,UAAU,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW;;;yDAG5F,UAAU,CAAC,WAAW,CAAC,iDAAiD,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI;;aAE3K,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,YAA+B;IAC1D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACrD,MAAM,YAAY,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,aAAa,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvD,OAAO,YAAY,GAAG,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,WAAmB;IAC1C,IAAI,WAAW,KAAK,KAAK;QAAE,OAAO,aAAa,CAAC;IAChD,IAAI,WAAW,KAAK,MAAM;QAAE,OAAO,uBAAuB,CAAC;IAC3D,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,iBAAiB,CAAC,YAA4C;IACrE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC1E,IAAI,YAAY,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACtF,IAAI,YAAY,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACzF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,+BAA+B,CAAC;IACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,+BAA+B,CAAC;IAC/E,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/device-flow.d.ts

@@ -0,0 +1,20 @@
+import type { Request, Response } from 'express';
+import type { NoodleOAuthProvider } from './provider.js';
+import type { OAuthStore } from './store.js';
+export declare const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+/** RFC 8628 endpoints, backed by the existing authorization-code consent path in the browser. */
+export declare class DeviceAuthorizationFlow {
+    #private;
+    constructor(input: {
+        readonly issuer: string;
+        readonly store: OAuthStore;
+        readonly provider: NoodleOAuthProvider;
+        readonly now?: () => number;
+    });
+    handleAuthorization(req: Request, res: Response): Promise<void>;
+    handleVerificationPage(req: Request, res: Response): void;
+    handleVerification(req: Request, res: Response): Promise<void>;
+    handleCallback(req: Request, res: Response): Promise<void>;
+    handleToken(req: Request, res: Response): Promise<void>;
+}
+//# sourceMappingURL=device-flow.d.ts.map