@noodleseed/one 0.63.0 → 0.64.0

package/node_modules/@noodle-borg/service/dist/oauth/tokens.js

@@ -1,5 +1,5 @@
 import { createHash, randomBytes } from 'node:crypto';
-/** A high-entropy (256-bit) opaque token — used for authorization codes, refresh tokens, and the Google `state` nonce. */
+/** A high-entropy (256-bit) opaque token used for codes, refresh tokens, and upstream-login state. */
 export function randomToken() {
     return randomBytes(32).toString('base64url');
 }

package/node_modules/@noodle-borg/service/dist/oauth/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/oauth/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,0HAA0H;AAC1H,MAAM,UAAU,WAAW;IACzB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/oauth/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,sGAAsG;AACtG,MAAM,UAAU,WAAW;IACzB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-callback-availability.d.ts

@@ -0,0 +1,4 @@
+import type { Response } from 'express';
+/** Keeps a skewed instance from burning a shared pending callback it cannot complete. */
+export declare function rejectUnavailableUpstreamCallback(res: Response, available: boolean): boolean;
+//# sourceMappingURL=upstream-callback-availability.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-callback-availability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-callback-availability.d.ts","sourceRoot":"","sources":["../../src/oauth/upstream-callback-availability.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,yFAAyF;AACzF,wBAAgB,iCAAiC,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAI5F"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-callback-availability.js

@@ -0,0 +1,8 @@
+/** Keeps a skewed instance from burning a shared pending callback it cannot complete. */
+export function rejectUnavailableUpstreamCallback(res, available) {
+    if (available)
+        return false;
+    res.status(503).set('Retry-After', '5').type('text/plain').send('upstream authentication failed');
+    return true;
+}
+//# sourceMappingURL=upstream-callback-availability.js.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-callback-availability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-callback-availability.js","sourceRoot":"","sources":["../../src/oauth/upstream-callback-availability.ts"],"names":[],"mappings":"AAEA,yFAAyF;AACzF,MAAM,UAAU,iCAAiC,CAAC,GAAa,EAAE,SAAkB;IACjF,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAClG,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-callback-handler.d.ts

@@ -0,0 +1,34 @@
+import type { Logger } from '@noodle-borg/transport-http';
+import type { Request, Response } from 'express';
+import type { ControlPlaneSignupMode, SignupAuthorizer } from '../auth/deploy-gate.js';
+import { type PlatformPrincipalResolver, type ResolvedPlatformIdentity } from '../platform-identity.js';
+import type { ConsentClaims } from './consent-claims.js';
+import type { DeveloperGrantOAuthFlow } from './developer-grant-flow.js';
+import type { GoogleAuthenticator } from './google.js';
+import type { OAuthStore } from './store.js';
+import type { OAuthTokenIssuer } from './token-issuer.js';
+import type { UpstreamHumanOAuthAuthenticator, UpstreamHumanProvider } from './upstream-human.js';
+export declare function handleUpstreamHumanCallback(input: {
+    readonly provider: UpstreamHumanProvider;
+    readonly req: Request;
+    readonly res: Response;
+    readonly store: OAuthStore;
+    readonly issuer: string;
+    readonly google?: GoogleAuthenticator;
+    readonly workos?: UpstreamHumanOAuthAuthenticator;
+    readonly resolver?: PlatformPrincipalResolver;
+    readonly signupAuthorizer?: SignupAuthorizer;
+    readonly signupMode: ControlPlaneSignupMode;
+    readonly allowedEmailDomain?: string;
+    readonly deniedSignupDomains: readonly string[];
+    readonly deniedSignupSubjects: readonly string[];
+    readonly provisionPlatformPrincipal?: (identity: ResolvedPlatformIdentity & {
+        readonly email: string;
+    }) => Promise<void>;
+    readonly developerGrantFlow?: DeveloperGrantOAuthFlow;
+    readonly tokenIssuer: OAuthTokenIssuer;
+    readonly signConsent: (claims: ConsentClaims) => Promise<string>;
+    readonly logger: Logger;
+    readonly now: () => number;
+}): Promise<void>;
+//# sourceMappingURL=upstream-callback-handler.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-callback-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-callback-handler.d.ts","sourceRoot":"","sources":["../../src/oauth/upstream-callback-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAa1D,OAAO,KAAK,EAAE,+BAA+B,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAElG,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,+BAA+B,CAAC;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CACpC,QAAQ,EAAE,wBAAwB,GAAG;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAC5D,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IACtD,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;CAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CAsGhB"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-callback-handler.js

@@ -0,0 +1,109 @@
+import { PlatformIdentityError, } from '../platform-identity.js';
+import { hashToken } from './tokens.js';
+import { rejectUnavailableUpstreamCallback } from './upstream-callback-availability.js';
+import { logUpstreamCallback, redirectPendingAuthorizationError, } from './upstream-callback-support.js';
+import { renderUpstreamConsent } from './upstream-consent.js';
+import { exchangeUpstreamHumanIdentity, resolveUpstreamHumanPrincipal, } from './upstream-federation.js';
+export async function handleUpstreamHumanCallback(input) {
+    const startedAt = input.now();
+    const record = (outcome, resolutionResult) => logUpstreamCallback({
+        logger: input.logger,
+        provider: input.provider,
+        startedAt,
+        finishedAt: input.now(),
+        outcome,
+        resolutionResult,
+    });
+    const available = input.provider === 'google' ? input.google !== undefined : input.workos !== undefined;
+    if (rejectUnavailableUpstreamCallback(input.res, available)) {
+        record('rejected', 'provider_unavailable');
+        return;
+    }
+    if (typeof input.req.query.error === 'string') {
+        const state = typeof input.req.query.state === 'string' ? input.req.query.state : undefined;
+        const redirected = await redirectPendingAuthorizationError({
+            store: input.store,
+            res: input.res,
+            state,
+            error: 'access_denied',
+            callbackKind: input.provider,
+        });
+        record('rejected', redirected ? 'upstream_denied' : 'pending_not_found');
+        return;
+    }
+    const code = typeof input.req.query.code === 'string' ? input.req.query.code : undefined;
+    const state = typeof input.req.query.state === 'string' ? input.req.query.state : undefined;
+    if (!code || !state) {
+        input.res.status(400).type('text/plain').send('missing authorization code or state');
+        record('rejected', 'invalid_request');
+        return;
+    }
+    const pending = await input.store.consumePendingAuthorization(hashToken(state), input.provider);
+    if (!pending) {
+        input.res.status(400).type('text/plain').send('unknown or expired authorization request');
+        record('rejected', 'pending_not_found');
+        return;
+    }
+    let identity;
+    try {
+        identity = await exchangeUpstreamHumanIdentity({
+            provider: input.provider,
+            code,
+            ...(input.google === undefined ? {} : { google: input.google }),
+            ...(input.workos === undefined ? {} : { workos: input.workos }),
+        });
+    }
+    catch {
+        input.res.status(400).type('text/plain').send('upstream authentication failed');
+        record('failed', 'exchange_failed');
+        return;
+    }
+    let ownerSubject;
+    try {
+        ownerSubject = await resolveUpstreamHumanPrincipal({
+            provider: input.provider,
+            identity,
+            ...(input.resolver === undefined ? {} : { resolver: input.resolver }),
+            ...(input.signupAuthorizer === undefined ? {} : { signupAuthorizer: input.signupAuthorizer }),
+            ...(input.allowedEmailDomain === undefined
+                ? {}
+                : { allowedEmailDomain: input.allowedEmailDomain }),
+            signupMode: input.signupMode,
+            deniedSignupDomains: input.deniedSignupDomains,
+            deniedSignupSubjects: input.deniedSignupSubjects,
+        });
+    }
+    catch (error) {
+        const code = error instanceof PlatformIdentityError ? error.code : 'identity_not_permitted';
+        input.res.status(403).type('text/plain').send(code);
+        record('rejected', 'identity_denied');
+        return;
+    }
+    try {
+        if (input.provisionPlatformPrincipal !== undefined) {
+            const resolved = await input.resolver?.resolveExisting(ownerSubject);
+            if (resolved === undefined)
+                throw new PlatformIdentityError('identity_link_required');
+            await input.provisionPlatformPrincipal({ ...resolved, email: identity.email });
+        }
+        await renderUpstreamConsent({
+            pending,
+            identity,
+            ownerSubject,
+            issuer: input.issuer,
+            store: input.store,
+            tokenIssuer: input.tokenIssuer,
+            ...(input.developerGrantFlow === undefined
+                ? {}
+                : { developerGrantFlow: input.developerGrantFlow }),
+            signConsent: input.signConsent,
+            res: input.res,
+        });
+        record('succeeded', 'principal_resolved');
+    }
+    catch (error) {
+        record('failed', 'completion_failed');
+        throw error;
+    }
+}
+//# sourceMappingURL=upstream-callback-handler.js.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-callback-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-callback-handler.js","sourceRoot":"","sources":["../../src/oauth/upstream-callback-handler.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,qBAAqB,GAGtB,MAAM,yBAAyB,CAAC;AAMjC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AACxF,OAAO,EACL,mBAAmB,EACnB,iCAAiC,GAElC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AAGlC,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAsBjD;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,CACb,OAA4C,EAC5C,gBAAkD,EAC5C,EAAE,CACR,mBAAmB,CAAC;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS;QACT,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE;QACvB,OAAO;QACP,gBAAgB;KACjB,CAAC,CAAC;IACL,MAAM,SAAS,GACb,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC;IACxF,IAAI,iCAAiC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;QAC5D,MAAM,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,MAAM,UAAU,GAAG,MAAM,iCAAiC,CAAC;YACzD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK;YACL,KAAK,EAAE,eAAe;YACtB,YAAY,EAAE,KAAK,CAAC,QAAQ;SAC7B,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACrF,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,2BAA2B,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChG,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC1F,MAAM,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IACD,IAAI,QAAmE,CAAC;IACxE,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,6BAA6B,CAAC;YAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI;YACJ,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAChF,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACpC,OAAO;IACT,CAAC;IACD,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,6BAA6B,CAAC;YACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ;YACR,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAC7F,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACrD,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;SACjD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,KAAK,YAAY,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC;QAC5F,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,0BAA0B,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,eAAe,CAAC,YAAY,CAAC,CAAC;YACrE,IAAI,QAAQ,KAAK,SAAS;gBAAE,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;YACtF,MAAM,KAAK,CAAC,0BAA0B,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,qBAAqB,CAAC;YAC1B,OAAO;YACP,QAAQ;YACR,YAAY;YACZ,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACrD,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,GAAG,EAAE,KAAK,CAAC,GAAG;SACf,CAAC,CAAC;QACH,MAAM,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QACtC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-callback-support.d.ts

@@ -0,0 +1,22 @@
+import type { Logger } from '@noodle-borg/transport-http';
+import type { Response } from 'express';
+import type { OAuthStore, PendingAuthorizationCallbackKind } from './store.js';
+import type { UpstreamHumanProvider } from './upstream-human.js';
+export type UpstreamCallbackResolutionResult = 'principal_resolved' | 'provider_unavailable' | 'upstream_denied' | 'invalid_request' | 'pending_not_found' | 'exchange_failed' | 'identity_denied' | 'completion_failed';
+/** Emits only the bounded aggregate fields approved for platform-auth rollout telemetry. */
+export declare function logUpstreamCallback(input: {
+    readonly logger: Logger;
+    readonly provider: UpstreamHumanProvider;
+    readonly startedAt: number;
+    readonly finishedAt: number;
+    readonly outcome: 'succeeded' | 'rejected' | 'failed';
+    readonly resolutionResult: UpstreamCallbackResolutionResult;
+}): void;
+export declare function redirectPendingAuthorizationError(input: {
+    readonly store: OAuthStore;
+    readonly res: Response;
+    readonly state: string | undefined;
+    readonly error: string;
+    readonly callbackKind: PendingAuthorizationCallbackKind;
+}): Promise<boolean>;
+//# sourceMappingURL=upstream-callback-support.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-callback-support.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-callback-support.d.ts","sourceRoot":"","sources":["../../src/oauth/upstream-callback-support.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,gCAAgC,EAAE,MAAM,YAAY,CAAC;AAE/E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE,MAAM,MAAM,gCAAgC,GACxC,oBAAoB,GACpB,sBAAsB,GACtB,iBAAiB,GACjB,iBAAiB,GACjB,mBAAmB,GACnB,iBAAiB,GACjB,iBAAiB,GACjB,mBAAmB,CAAC;AAExB,4FAA4F;AAC5F,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,GAAG,QAAQ,CAAC;IACtD,QAAQ,CAAC,gBAAgB,EAAE,gCAAgC,CAAC;CAC7D,GAAG,IAAI,CASP;AAED,wBAAsB,iCAAiC,CAAC,KAAK,EAAE;IAC7D,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,gCAAgC,CAAC;CACzD,GAAG,OAAO,CAAC,OAAO,CAAC,CAkBnB"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-callback-support.js

@@ -0,0 +1,30 @@
+import { hashToken } from './tokens.js';
+/** Emits only the bounded aggregate fields approved for platform-auth rollout telemetry. */
+export function logUpstreamCallback(input) {
+    input.logger.info('oauth.upstream_callback', {
+        provider: input.provider,
+        cohort: 'interactive_human',
+        surface: 'oauth_callback',
+        outcome: input.outcome,
+        resolutionResult: input.resolutionResult,
+        latencyMs: Math.max(0, input.finishedAt - input.startedAt),
+    });
+}
+export async function redirectPendingAuthorizationError(input) {
+    if (input.state === undefined) {
+        input.res.status(400).type('text/plain').send(`customer authorization failed: ${input.error}`);
+        return false;
+    }
+    const pending = await input.store.consumePendingAuthorization(hashToken(input.state), input.callbackKind);
+    if (!pending) {
+        input.res.status(400).type('text/plain').send('unknown or expired authorization request');
+        return false;
+    }
+    const redirect = new URL(pending.redirectUri);
+    redirect.searchParams.set('error', input.error);
+    if (pending.clientState !== undefined)
+        redirect.searchParams.set('state', pending.clientState);
+    input.res.redirect(302, redirect.href);
+    return true;
+}
+//# sourceMappingURL=upstream-callback-support.js.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-callback-support.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-callback-support.js","sourceRoot":"","sources":["../../src/oauth/upstream-callback-support.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAaxC,4FAA4F;AAC5F,MAAM,UAAU,mBAAmB,CAAC,KAOnC;IACC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;QAC3C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,gBAAgB;QACzB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;KAC3D,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAMvD;IACC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,kCAAkC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,2BAA2B,CAC3D,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EACtB,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC1F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/F,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-consent.d.ts

@@ -0,0 +1,21 @@
+import type { Response } from 'express';
+import type { ConsentClaims } from './consent-claims.js';
+import { type DeveloperGrantOAuthFlow } from './developer-grant-flow.js';
+import type { OAuthStore, PendingAuthorizationRecord } from './store.js';
+import type { OAuthTokenIssuer } from './token-issuer.js';
+export declare function renderUpstreamConsent(input: {
+    readonly pending: PendingAuthorizationRecord;
+    readonly identity: {
+        readonly email: string;
+        readonly locale?: string;
+        readonly timeZone?: string;
+    };
+    readonly ownerSubject: string;
+    readonly issuer: string;
+    readonly store: OAuthStore;
+    readonly tokenIssuer: OAuthTokenIssuer;
+    readonly developerGrantFlow?: DeveloperGrantOAuthFlow;
+    readonly signConsent: (claims: ConsentClaims) => Promise<string>;
+    readonly res: Response;
+}): Promise<void>;
+//# sourceMappingURL=upstream-consent.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-consent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-consent.d.ts","sourceRoot":"","sources":["../../src/oauth/upstream-consent.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,KAAK,EAAE,UAAU,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IACtD,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;CACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8DhB"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-consent.js

@@ -0,0 +1,56 @@
+import { renderConsentPage } from './consent.js';
+import { isDeveloperResourceForIssuer, } from './developer-grant-flow.js';
+import { storedOAuthOwnerPreferences } from './identity-preferences.js';
+import { hostOf } from './provider-util.js';
+export async function renderUpstreamConsent(input) {
+    const preferences = storedOAuthOwnerPreferences(input.identity);
+    if (isDeveloperResourceForIssuer(input.pending.resource, input.issuer)) {
+        if (input.developerGrantFlow === undefined) {
+            input.res.status(400).type('text/plain').send('developer access is not configured');
+            return;
+        }
+        await input.developerGrantFlow.renderSelection(input.pending, { subject: input.ownerSubject, email: input.identity.email, ...preferences }, input.res);
+        return;
+    }
+    if (await input.store.hasConsentGrant(input.pending.clientId, input.ownerSubject, input.pending.resource)) {
+        await input.tokenIssuer.issueAuthorizationCode(input.res, {
+            clientId: input.pending.clientId,
+            codeChallenge: input.pending.codeChallenge,
+            redirectUri: input.pending.redirectUri,
+            resource: input.pending.resource,
+            ownerSubject: input.ownerSubject,
+            ownerEmail: input.identity.email,
+            ...preferences,
+            ...(input.pending.clientState !== undefined
+                ? { clientState: input.pending.clientState }
+                : {}),
+            ...(input.pending.scope !== undefined ? { scope: input.pending.scope } : {}),
+        });
+        return;
+    }
+    const consentToken = await input.signConsent({
+        kind: 'consent',
+        clientId: input.pending.clientId,
+        redirectUri: input.pending.redirectUri,
+        codeChallenge: input.pending.codeChallenge,
+        resource: input.pending.resource,
+        ownerSubject: input.ownerSubject,
+        ownerEmail: input.identity.email,
+        ...preferences,
+        ...(input.pending.clientState !== undefined ? { clientState: input.pending.clientState } : {}),
+        ...(input.pending.scope !== undefined ? { scope: input.pending.scope } : {}),
+    });
+    const client = await input.store.getClient(input.pending.clientId);
+    input.res
+        .status(200)
+        .type('html')
+        .send(renderConsentPage({
+        clientName: client?.client_name ?? input.pending.clientId,
+        resourceHost: hostOf(input.pending.resource),
+        redirectHost: hostOf(input.pending.redirectUri),
+        userEmail: input.identity.email,
+        consentToken,
+        consentAction: '/oauth/consent',
+    }));
+}
+//# sourceMappingURL=upstream-consent.js.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-consent.js","sourceRoot":"","sources":["../../src/oauth/upstream-consent.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAEL,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAI5C,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAc3C;IACC,MAAM,WAAW,GAAG,2BAA2B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC3C,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC,kBAAkB,CAAC,eAAe,CAC5C,KAAK,CAAC,OAAO,EACb,EAAE,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,WAAW,EAAE,EAC5E,KAAK,CAAC,GAAG,CACV,CAAC;QACF,OAAO;IACT,CAAC;IACD,IACE,MAAM,KAAK,CAAC,KAAK,CAAC,eAAe,CAC/B,KAAK,CAAC,OAAO,CAAC,QAAQ,EACtB,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,OAAO,CAAC,QAAQ,CACvB,EACD,CAAC;QACD,MAAM,KAAK,CAAC,WAAW,CAAC,sBAAsB,CAAC,KAAK,CAAC,GAAG,EAAE;YACxD,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;YAChC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa;YAC1C,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW;YACtC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;YAChC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;YAChC,GAAG,WAAW;YACd,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7E,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;QAC3C,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;QAChC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW;QACtC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa;QAC1C,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAChC,GAAG,WAAW;QACd,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnE,KAAK,CAAC,GAAG;SACN,MAAM,CAAC,GAAG,CAAC;SACX,IAAI,CAAC,MAAM,CAAC;SACZ,IAAI,CACH,iBAAiB,CAAC;QAChB,UAAU,EAAE,MAAM,EAAE,WAAW,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ;QACzD,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC5C,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAC/C,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC/B,YAAY;QACZ,aAAa,EAAE,gBAAgB;KAChC,CAAC,CACH,CAAC;AACN,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-federation.d.ts

@@ -0,0 +1,30 @@
+import type { ControlPlaneSignupMode, SignupAuthorizer } from '../auth/deploy-gate.js';
+import { type PlatformPrincipalResolver, type UpstreamHumanIdentity } from '../platform-identity.js';
+import type { GoogleAuthenticator } from './google.js';
+import type { UpstreamHumanOAuthAuthenticator, UpstreamHumanProvider } from './upstream-human.js';
+export declare function upstreamAuthorizationUrl(input: {
+    readonly provider: UpstreamHumanProvider;
+    readonly google?: GoogleAuthenticator;
+    readonly workos?: UpstreamHumanOAuthAuthenticator;
+    readonly state: string;
+}): string;
+export declare function exchangeUpstreamHumanIdentity(input: {
+    readonly provider: UpstreamHumanProvider;
+    readonly code: string;
+    readonly google?: GoogleAuthenticator;
+    readonly workos?: UpstreamHumanOAuthAuthenticator;
+}): Promise<UpstreamHumanIdentity & {
+    readonly locale?: string;
+    readonly timeZone?: string;
+}>;
+export declare function resolveUpstreamHumanPrincipal(input: {
+    readonly provider: UpstreamHumanProvider;
+    readonly identity: UpstreamHumanIdentity;
+    readonly resolver?: PlatformPrincipalResolver;
+    readonly signupAuthorizer?: SignupAuthorizer;
+    readonly allowedEmailDomain?: string;
+    readonly signupMode?: ControlPlaneSignupMode;
+    readonly deniedSignupDomains?: readonly string[];
+    readonly deniedSignupSubjects?: readonly string[];
+}): Promise<string>;
+//# sourceMappingURL=upstream-federation.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-federation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-federation.d.ts","sourceRoot":"","sources":["../../src/oauth/upstream-federation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EAAE,+BAA+B,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAElG,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,+BAA+B,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GAAG,MAAM,CAMT;AAED,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IACzD,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,+BAA+B,CAAC;CACnD,GAAG,OAAO,CAAC,qBAAqB,GAAG;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAoB5F;AAED,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IACzD,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,sBAAsB,CAAC;IAC7C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnD,GAAG,OAAO,CAAC,MAAM,CAAC,CA6ClB"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-federation.js

@@ -0,0 +1,94 @@
+import { PlatformIdentityError, } from '../platform-identity.js';
+export function upstreamAuthorizationUrl(input) {
+    if (input.provider === 'google') {
+        if (input.google === undefined)
+            throw new Error('Google authenticator is unavailable');
+        return input.google.authorizationUrl(input.state);
+    }
+    return input.workos?.authorizationUrl(input.state) ?? '';
+}
+export async function exchangeUpstreamHumanIdentity(input) {
+    if (input.provider === 'workos') {
+        if (input.workos === undefined)
+            throw new Error('WorkOS authenticator is unavailable');
+        const identity = await input.workos.exchange(input.code);
+        if (identity.provider !== input.workos.provider || identity.realm !== input.workos.realm) {
+            throw new Error('WorkOS identity provider or realm mismatch');
+        }
+        return identity;
+    }
+    if (input.google === undefined)
+        throw new Error('Google authenticator is unavailable');
+    const identity = await input.google.exchange(input.code);
+    return {
+        provider: 'google',
+        realm: 'accounts.google.com',
+        subject: identity.subject,
+        email: identity.email,
+        emailVerified: true,
+        ...(identity.locale !== undefined ? { locale: identity.locale } : {}),
+        ...(identity.timeZone !== undefined ? { timeZone: identity.timeZone } : {}),
+    };
+}
+export async function resolveUpstreamHumanPrincipal(input) {
+    if (input.provider === 'google') {
+        // Admission is evaluated against the verified Google identity before creating canonical state or
+        // enqueueing WorkOS synchronization. Rejected callbacks must be side-effect free.
+        assertIdentityIsNotDenied(input, input.identity.subject);
+        if ((input.signupMode ?? 'restricted') === 'restricted' &&
+            input.allowedEmailDomain !== undefined &&
+            !emailMatchesDomain(input.identity.email, input.allowedEmailDomain) &&
+            !(await input.signupAuthorizer?.isSignupAllowed({
+                subject: input.identity.subject,
+                email: input.identity.email.toLowerCase(),
+            }))) {
+            throw new PlatformIdentityError('identity_link_required');
+        }
+        return input.resolver === undefined
+            ? input.identity.subject
+            : (await input.resolver.resolve(input.identity)).subject;
+    }
+    if (input.resolver === undefined)
+        throw new PlatformIdentityError('identity_link_required');
+    const existing = await input.resolver.resolveLinked(input.identity);
+    // Linked identities are still observed through the resolver so a newer verified WorkOS email becomes the
+    // sole current provider/realm evidence. This is not email linking: the immutable WorkOS ID was resolved first.
+    if (existing !== undefined) {
+        assertIdentityIsNotDenied(input, existing.subject);
+        return (await input.resolver.resolve(input.identity)).subject;
+    }
+    if (await input.resolver.hasVerifiedEmailEvidence(input.identity.email)) {
+        throw new PlatformIdentityError('identity_link_required');
+    }
+    assertIdentityIsNotDenied(input);
+    if ((input.signupMode ?? 'restricted') === 'public') {
+        return (await input.resolver.resolve(input.identity)).subject;
+    }
+    const signupAllowed = await input.signupAuthorizer?.isSignupAllowed({
+        subject: input.identity.subject,
+        email: input.identity.email.toLowerCase(),
+    });
+    const domainAllowed = input.allowedEmailDomain !== undefined &&
+        emailMatchesDomain(input.identity.email, input.allowedEmailDomain);
+    if (!domainAllowed && signupAllowed !== true)
+        throw new PlatformIdentityError('identity_link_required');
+    return (await input.resolver.resolve(input.identity)).subject;
+}
+function assertIdentityIsNotDenied(input, canonicalSubject) {
+    const subjects = new Set((input.deniedSignupSubjects ?? []).map((subject) => subject.trim().toLowerCase()));
+    const externalSubject = input.identity.subject.toLowerCase();
+    const canonical = canonicalSubject?.toLowerCase();
+    const deniedDomain = (input.deniedSignupDomains ?? []).some((domain) => emailMatchesDomain(input.identity.email, domain));
+    if (subjects.has(externalSubject) ||
+        (canonical !== undefined && subjects.has(canonical)) ||
+        deniedDomain) {
+        throw new PlatformIdentityError('identity_signup_denied');
+    }
+}
+function emailMatchesDomain(email, configuredDomain) {
+    const domain = configuredDomain.trim().toLowerCase();
+    if (domain.length === 0)
+        return false;
+    return email.toLowerCase().endsWith(domain.startsWith('@') ? domain : `@${domain}`);
+}
+//# sourceMappingURL=upstream-federation.js.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-federation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-federation.js","sourceRoot":"","sources":["../../src/oauth/upstream-federation.ts"],"names":[],"mappings":"AACA,OAAO,EACL,qBAAqB,GAGtB,MAAM,yBAAyB,CAAC;AAIjC,MAAM,UAAU,wBAAwB,CAAC,KAKxC;IACC,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACvF,OAAO,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAKnD;IACC,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACzF,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACvF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzD,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,qBAAqB;QAC5B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,aAAa,EAAE,IAAI;QACnB,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KASnD;IACC,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,iGAAiG;QACjG,kFAAkF;QAClF,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzD,IACE,CAAC,KAAK,CAAC,UAAU,IAAI,YAAY,CAAC,KAAK,YAAY;YACnD,KAAK,CAAC,kBAAkB,KAAK,SAAS;YACtC,CAAC,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC;YACnE,CAAC,CAAC,MAAM,KAAK,CAAC,gBAAgB,EAAE,eAAe,CAAC;gBAC9C,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;gBAC/B,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE;aAC1C,CAAC,CAAC,EACH,CAAC;YACD,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS;YACjC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO;YACxB,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7D,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpE,yGAAyG;IACzG,+GAA+G;IAC/G,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,yBAAyB,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnD,OAAO,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;IAC5D,CAAC;IACD,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,YAAY,CAAC,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE,eAAe,CAAC;QAClE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;QAC/B,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE;KAC1C,CAAC,CAAC;IACH,MAAM,aAAa,GACjB,KAAK,CAAC,kBAAkB,KAAK,SAAS;QACtC,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACrE,IAAI,CAAC,aAAa,IAAI,aAAa,KAAK,IAAI;QAC1C,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;IAC5D,OAAO,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAED,SAAS,yBAAyB,CAChC,KAIC,EACD,gBAAyB;IAEzB,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAClF,CAAC;IACF,MAAM,eAAe,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IAC7D,MAAM,SAAS,GAAG,gBAAgB,EAAE,WAAW,EAAE,CAAC;IAClD,MAAM,YAAY,GAAG,CAAC,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACrE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CACjD,CAAC;IACF,IACE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;QAC7B,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpD,YAAY,EACZ,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,gBAAwB;IACjE,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;AACtF,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-human.d.ts

@@ -0,0 +1,33 @@
+import type { UpstreamHumanIdentity } from '../platform-identity.js';
+export type UpstreamHumanProvider = 'google' | 'workos';
+/**
+ * The OAuth-facing federation boundary. Implementations receive an authorization code and return identity
+ * claims only: upstream access and refresh credentials are deliberately discarded at this boundary.
+ */
+export interface UpstreamHumanOAuthAuthenticator {
+    readonly provider: UpstreamHumanProvider;
+    readonly realm: string;
+    authorizationUrl(state: string): string;
+    exchange(code: string): Promise<UpstreamHumanIdentity & {
+        readonly locale?: string;
+        readonly timeZone?: string;
+    }>;
+}
+export interface UpstreamHumanRollout {
+    readonly workosPercentage: number;
+    readonly workosCanaryClientIds: readonly string[];
+    /** Recovery clients remain WorkOS-routed while the normal percentage is rolled back to zero. */
+    readonly workosRecoveryClientIds?: readonly string[];
+    /**
+     * Server-owned rollback state may offer an explicit browser choice to use WorkOS even when this
+     * transaction's normal rollout selection is Google. OAuth clients cannot set this value.
+     */
+    readonly allowUserSelectedWorkosRecovery?: boolean;
+}
+export declare const GOOGLE_ONLY_UPSTREAM_ROLLOUT: UpstreamHumanRollout;
+/** Select once at authorization creation; callbacks must use the stored result, never recalculate rollout. */
+export declare function selectUpstreamHumanProvider(input: {
+    readonly clientId: string;
+    readonly transactionNonce: string;
+}, rollout?: UpstreamHumanRollout): UpstreamHumanProvider;
+//# sourceMappingURL=upstream-human.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-human.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-human.d.ts","sourceRoot":"","sources":["../../src/oauth/upstream-human.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExD;;;GAGG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACxC,QAAQ,CACN,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,qBAAqB,GAAG;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9F;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,gGAAgG;IAChG,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrD;;;OAGG;IACH,QAAQ,CAAC,+BAA+B,CAAC,EAAE,OAAO,CAAC;CACpD;AAED,eAAO,MAAM,4BAA4B,EAAE,oBAK1C,CAAC;AAEF,8GAA8G;AAC9G,wBAAgB,2BAA2B,CACzC,KAAK,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,EACvE,OAAO,GAAE,oBAAmD,GAC3D,qBAAqB,CAavB"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-human.js

@@ -0,0 +1,27 @@
+import { createHash } from 'node:crypto';
+export const GOOGLE_ONLY_UPSTREAM_ROLLOUT = {
+    workosPercentage: 0,
+    workosCanaryClientIds: [],
+    workosRecoveryClientIds: [],
+    allowUserSelectedWorkosRecovery: false,
+};
+/** Select once at authorization creation; callbacks must use the stored result, never recalculate rollout. */
+export function selectUpstreamHumanProvider(input, rollout = GOOGLE_ONLY_UPSTREAM_ROLLOUT) {
+    if (rollout.workosRecoveryClientIds?.includes(input.clientId) === true)
+        return 'workos';
+    if (rollout.workosPercentage <= 0)
+        return 'google';
+    if (rollout.workosCanaryClientIds.includes(input.clientId))
+        return 'workos';
+    if (rollout.workosPercentage >= 100)
+        return 'workos';
+    const digest = createHash('sha256')
+        .update(`${input.clientId}:${input.transactionNonce}`)
+        .digest();
+    // Map a full uint32 into the exact [0, 2^32) range rather than reducing one byte modulo 100, whose
+    // uneven buckets bias an intermediate rollout. The threshold form needs no rejection sampling.
+    const bucket = digest.readUInt32BE(0);
+    const threshold = (rollout.workosPercentage / 100) * 0x1_0000_0000;
+    return bucket < threshold ? 'workos' : 'google';
+}
+//# sourceMappingURL=upstream-human.js.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-human.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-human.js","sourceRoot":"","sources":["../../src/oauth/upstream-human.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA8BzC,MAAM,CAAC,MAAM,4BAA4B,GAAyB;IAChE,gBAAgB,EAAE,CAAC;IACnB,qBAAqB,EAAE,EAAE;IACzB,uBAAuB,EAAE,EAAE;IAC3B,+BAA+B,EAAE,KAAK;CACvC,CAAC;AAEF,8GAA8G;AAC9G,MAAM,UAAU,2BAA2B,CACzC,KAAuE,EACvE,UAAgC,4BAA4B;IAE5D,IAAI,OAAO,CAAC,uBAAuB,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACxF,IAAI,OAAO,CAAC,gBAAgB,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACnD,IAAI,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5E,IAAI,OAAO,CAAC,gBAAgB,IAAI,GAAG;QAAE,OAAO,QAAQ,CAAC;IACrD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;SACrD,MAAM,EAAE,CAAC;IACZ,mGAAmG;IACnG,+FAA+F;IAC/F,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,gBAAgB,GAAG,GAAG,CAAC,GAAG,aAAa,CAAC;IACnE,OAAO,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClD,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-provider-choice.d.ts

@@ -0,0 +1,13 @@
+import type { Request, Response } from 'express';
+import type { GoogleAuthenticator } from './google.js';
+import type { OAuthStore } from './store.js';
+import type { UpstreamHumanOAuthAuthenticator } from './upstream-human.js';
+export declare function renderUpstreamProviderChoice(state: string): string;
+export declare function continueUpstreamProviderChoice(input: {
+    readonly req: Request;
+    readonly res: Response;
+    readonly store: OAuthStore;
+    readonly google?: GoogleAuthenticator;
+    readonly workos?: UpstreamHumanOAuthAuthenticator;
+}): Promise<void>;
+//# sourceMappingURL=upstream-provider-choice.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-provider-choice.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-provider-choice.d.ts","sourceRoot":"","sources":["../../src/oauth/upstream-provider-choice.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAA8B,MAAM,YAAY,CAAC;AAGzE,OAAO,KAAK,EAAE,+BAA+B,EAAyB,MAAM,qBAAqB,CAAC;AAElG,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAalE;AAED,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAC1D,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,+BAA+B,CAAC;CACnD,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BhB"}