@noodleseed/one 0.63.0 → 0.64.0

package/node_modules/@noodle-borg/service/dist/routes/platform-auth-migration-dispatch.js

@@ -0,0 +1,40 @@
+import { applySecurityHeaders, enforceHttps, } from '@noodle-borg/transport-http';
+import { sendJson } from '../http-util.js';
+import { handlePlatformAuthMigrationRoute, } from './platform-auth-migration.js';
+const ROUTES = {
+    '/v1/platform-auth/migration/inventory': { method: 'GET', action: 'inventory' },
+    '/v1/platform-auth/migration/preview': { method: 'POST', action: 'preview' },
+    '/v1/platform-auth/migration/start-import': { method: 'POST', action: 'start_import' },
+    '/v1/platform-auth/migration/status': { method: 'GET', action: 'status' },
+    '/v1/platform-auth/migration/reconcile': { method: 'POST', action: 'reconcile' },
+    '/v1/platform-auth/migration/recover-outbox': { method: 'POST', action: 'recover_outbox' },
+    '/v1/platform-auth/migration/activate': { method: 'POST', action: 'activate' },
+    '/v1/platform-auth/migration/rollback': { method: 'POST', action: 'rollback' },
+    '/v1/platform-auth/migration/finalize': { method: 'POST', action: 'finalize' },
+};
+export function dispatchPlatformAuthMigrationRoutes(req, res, url, deps) {
+    const route = ROUTES[url.pathname];
+    if (route === undefined || req.method !== route.method)
+        return false;
+    applySecurityHeaders(res, deps.tls);
+    if (enforceHttps(req, res, deps.tls))
+        return true;
+    void handlePlatformAuthMigrationRoute(req, res, deps, route.action, url.searchParams).catch(() => {
+        deps.logger.error('platform_auth.migration.error', {
+            code: 'platform_auth_dependency_failed',
+            outcome: 'failed',
+        });
+        if (!res.headersSent) {
+            sendJson(res, 500, {
+                ok: false,
+                code: 'platform_auth_dependency_failed',
+                error: 'platform authentication migration dependency failed',
+            });
+        }
+        else if (!res.writableEnded) {
+            res.end();
+        }
+    });
+    return true;
+}
+//# sourceMappingURL=platform-auth-migration-dispatch.js.map

package/node_modules/@noodle-borg/service/dist/routes/platform-auth-migration-dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-migration-dispatch.js","sourceRoot":"","sources":["../../src/routes/platform-auth-migration-dispatch.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,EACpB,YAAY,GAGb,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,OAAO,EACL,gCAAgC,GAEjC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,GAKR;IACF,uCAAuC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE;IAC/E,qCAAqC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE;IAC5E,0CAA0C,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE;IACtF,oCAAoC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;IACzE,uCAAuC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE;IAChF,4CAA4C,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE;IAC1F,sCAAsC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;IAC9E,sCAAsC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;IAC9E,sCAAsC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;CAC/E,CAAC;AAEF,MAAM,UAAU,mCAAmC,CACjD,GAAoB,EACpB,GAAmB,EACnB,GAAQ,EACR,IAGC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACrE,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,KAAK,gCAAgC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,KAAK,CACzF,GAAG,EAAE;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;YACjD,IAAI,EAAE,iCAAiC;YACvC,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,iCAAiC;gBACvC,KAAK,EAAE,qDAAqD;aAC7D,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YAC9B,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/@noodle-borg/service/dist/routes/platform-auth-migration.d.ts

@@ -0,0 +1,13 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { DeployAuthGate } from '../auth/deploy-gate.js';
+import { type PlatformAuthOperator } from '../platform-auth-operator.js';
+import type { AuditSink } from '../store/audit.js';
+export type PlatformAuthMigrationRouteAction = 'inventory' | 'preview' | 'start_import' | 'status' | 'reconcile' | 'recover_outbox' | 'activate' | 'rollback' | 'finalize';
+export interface PlatformAuthMigrationRouteDeps {
+    readonly gate: DeployAuthGate;
+    readonly operator?: PlatformAuthOperator;
+    readonly audit: AuditSink;
+    readonly maxBody: number;
+}
+export declare function handlePlatformAuthMigrationRoute(req: IncomingMessage, res: ServerResponse, deps: PlatformAuthMigrationRouteDeps, action: PlatformAuthMigrationRouteAction, query?: import("url").URLSearchParams): Promise<void>;
+//# sourceMappingURL=platform-auth-migration.d.ts.map

package/node_modules/@noodle-borg/service/dist/routes/platform-auth-migration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-migration.d.ts","sourceRoot":"","sources":["../../src/routes/platform-auth-migration.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAwB,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAGnF,OAAO,EAML,KAAK,oBAAoB,EAQ1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,MAAM,gCAAgC,GACxC,WAAW,GACX,SAAS,GACT,cAAc,GACd,QAAQ,GACR,WAAW,GACX,gBAAgB,GAChB,UAAU,GACV,UAAU,GACV,UAAU,CAAC;AAEf,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,gCAAgC,CACpD,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,8BAA8B,EACpC,MAAM,EAAE,gCAAgC,EACxC,KAAK,gCAAwB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAkFf"}

package/node_modules/@noodle-borg/service/dist/routes/platform-auth-migration.js

@@ -0,0 +1,158 @@
+import { createHash } from 'node:crypto';
+import { readJsonBody, sendForbidden, sendJson, sendUnauthorized } from '../http-util.js';
+import { PlatformAuthMigrationError } from '../platform-auth-migration.js';
+import { PlatformAuthActivateRequestSchema, PlatformAuthFinalizeRequestSchema, PlatformAuthOperationPreviewSchema, PlatformAuthOperationResultSchema, PlatformAuthOperatorError, PlatformAuthOperatorSnapshotSchema, PlatformAuthPreviewRequestSchema, PlatformAuthReconcileRequestSchema, PlatformAuthRecoverOutboxRequestSchema, PlatformAuthRollbackRequestSchema, PlatformAuthStartImportRequestSchema, } from '../platform-auth-operator.js';
+export async function handlePlatformAuthMigrationRoute(req, res, deps, action, query = new URLSearchParams()) {
+    const identity = await authorize(req, res, deps, action);
+    if (identity === undefined)
+        return;
+    if (deps.operator === undefined) {
+        await emit(deps.audit, action, 409, 'platform_auth_operator_unavailable');
+        return sendJson(res, 409, {
+            ok: false,
+            code: 'platform_auth_operator_unavailable',
+            error: 'platform authentication migration operator is unavailable',
+        });
+    }
+    const actorFingerprint = fingerprint(identity.subject);
+    try {
+        if (action === 'inventory') {
+            const generation = inventoryGeneration(query);
+            if (generation === undefined)
+                return await invalid(res, deps.audit, action);
+            const result = PlatformAuthOperatorSnapshotSchema.parse(await deps.operator.inventory({ actorFingerprint, generation }));
+            await emit(deps.audit, action, 200, 'completed', result.rollout.generation);
+            return sendJson(res, 200, { ok: true, data: result });
+        }
+        if (action === 'status') {
+            const result = PlatformAuthOperatorSnapshotSchema.parse(await deps.operator.status());
+            await emit(deps.audit, action, 200, 'completed', result.rollout.generation);
+            return sendJson(res, 200, { ok: true, data: result });
+        }
+        const body = await readJsonBody(req, deps.maxBody);
+        if (!body.ok) {
+            await emit(deps.audit, action, body.status, 'invalid_request');
+            return sendJson(res, body.status, {
+                ok: false,
+                code: 'invalid_request',
+                error: 'invalid platform authentication migration request',
+            });
+        }
+        if (action === 'preview') {
+            const parsed = PlatformAuthPreviewRequestSchema.safeParse(body.value);
+            if (!parsed.success)
+                return await invalid(res, deps.audit, action);
+            const result = PlatformAuthOperationPreviewSchema.parse(await deps.operator.preview(parsed.data));
+            if (result.operation !== parsed.data.operation) {
+                throw new Error('platform authentication operator returned mismatched preview operation');
+            }
+            await emit(deps.audit, action, 200, result.ready ? 'ready' : 'blocked', result.rollout.generation);
+            return sendJson(res, 200, { ok: true, data: result });
+        }
+        const input = parseMutation(action, body.value, actorFingerprint);
+        if (input === undefined)
+            return await invalid(res, deps.audit, action);
+        const result = PlatformAuthOperationResultSchema.parse(await deps.operator.execute(input));
+        if (result.operation !== input.operation) {
+            throw new Error('platform authentication operator returned mismatched operation');
+        }
+        const status = action === 'start_import' && !result.replayed ? 201 : 200;
+        await emit(deps.audit, action, status, result.replayed ? 'replayed' : 'completed', result.rollout.generation);
+        return sendJson(res, status, { ok: true, data: result });
+    }
+    catch (error) {
+        const code = safeErrorCode(error);
+        if (code !== undefined && code !== 'platform_auth_dependency_failed') {
+            await emit(deps.audit, action, 409, code);
+            return sendJson(res, 409, {
+                ok: false,
+                code,
+                error: 'platform authentication migration operation was rejected',
+            });
+        }
+        await emit(deps.audit, action, 500, 'platform_auth_dependency_failed').catch(() => undefined);
+        throw new PlatformAuthOperatorError('platform_auth_dependency_failed');
+    }
+}
+async function authorize(req, res, deps, action) {
+    const auth = await deps.gate.authorize(req);
+    if (!auth.ok) {
+        await emit(deps.audit, action, auth.status, 'authorization_failed');
+        if (auth.status === 401)
+            sendUnauthorized(res, auth.message);
+        else
+            sendForbidden(res, auth.message);
+        return undefined;
+    }
+    if (auth.identity === undefined) {
+        await emit(deps.audit, action, 401, 'identity_required');
+        sendUnauthorized(res, 'identity required');
+        return undefined;
+    }
+    if (!auth.identity.superAdmin) {
+        await emit(deps.audit, action, 403, 'super_admin_required');
+        sendForbidden(res, 'super-admin required');
+        return undefined;
+    }
+    return auth.identity;
+}
+function parseMutation(action, value, actorFingerprint) {
+    const schema = action === 'start_import'
+        ? PlatformAuthStartImportRequestSchema
+        : action === 'reconcile'
+            ? PlatformAuthReconcileRequestSchema
+            : action === 'recover_outbox'
+                ? PlatformAuthRecoverOutboxRequestSchema
+                : action === 'activate'
+                    ? PlatformAuthActivateRequestSchema
+                    : action === 'rollback'
+                        ? PlatformAuthRollbackRequestSchema
+                        : PlatformAuthFinalizeRequestSchema;
+    const parsed = schema.safeParse(value);
+    if (!parsed.success)
+        return undefined;
+    return { ...parsed.data, operation: action, actorFingerprint };
+}
+async function invalid(res, audit, action) {
+    await emit(audit, action, 400, 'invalid_request');
+    sendJson(res, 400, {
+        ok: false,
+        code: 'invalid_request',
+        error: 'invalid platform authentication migration request',
+    });
+}
+function safeErrorCode(error) {
+    if (error instanceof PlatformAuthOperatorError || error instanceof PlatformAuthMigrationError) {
+        return error.code;
+    }
+    return undefined;
+}
+function emit(audit, action, status, reasonCode, generation) {
+    return audit.emit({
+        eventType: `platform_auth.migration.${action}`,
+        org: 'platform',
+        decision: status < 400 ? 'allow' : 'deny',
+        status,
+        reasonCode,
+        details: {
+            operation: action,
+            outcome: reasonCode,
+            ...(generation === undefined ? {} : { generation }),
+        },
+    });
+}
+function fingerprint(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function inventoryGeneration(query) {
+    if ([...query.keys()].some((key) => key !== 'generation'))
+        return undefined;
+    const values = query.getAll('generation');
+    if (values.length === 0)
+        return 0;
+    if (values.length !== 1 || !/^(0|[1-9][0-9]*)$/.test(values[0] ?? ''))
+        return undefined;
+    const generation = Number(values[0]);
+    return Number.isSafeInteger(generation) ? generation : undefined;
+}
+//# sourceMappingURL=platform-auth-migration.js.map

package/node_modules/@noodle-borg/service/dist/routes/platform-auth-migration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-migration.js","sourceRoot":"","sources":["../../src/routes/platform-auth-migration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EACL,iCAAiC,EAEjC,iCAAiC,EACjC,kCAAkC,EAClC,iCAAiC,EAEjC,yBAAyB,EACzB,kCAAkC,EAClC,gCAAgC,EAChC,kCAAkC,EAClC,sCAAsC,EACtC,iCAAiC,EACjC,oCAAoC,GACrC,MAAM,8BAA8B,CAAC;AAqBtC,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,GAAoB,EACpB,GAAmB,EACnB,IAAoC,EACpC,MAAwC,EACxC,KAAK,GAAG,IAAI,eAAe,EAAE;IAE7B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO;IACnC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,oCAAoC,CAAC,CAAC;QAC1E,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACxB,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,oCAAoC;YAC1C,KAAK,EAAE,2DAA2D;SACnE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,gBAAgB,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,UAAU,KAAK,SAAS;gBAAE,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC5E,MAAM,MAAM,GAAG,kCAAkC,CAAC,KAAK,CACrD,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAChE,CAAC;YACF,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC5E,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,kCAAkC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACtF,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC5E,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;YAC/D,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE;gBAChC,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,iBAAiB;gBACvB,KAAK,EAAE,mDAAmD;aAC3D,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,gCAAgC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtE,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACnE,MAAM,MAAM,GAAG,kCAAkC,CAAC,KAAK,CACrD,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CACzC,CAAC;YACF,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,IAAI,CACR,IAAI,CAAC,KAAK,EACV,MAAM,EACN,GAAG,EACH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAClC,MAAM,CAAC,OAAO,CAAC,UAAU,CAC1B,CAAC;YACF,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAClE,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,iCAAiC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3F,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,KAAK,cAAc,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACzE,MAAM,IAAI,CACR,IAAI,CAAC,KAAK,EACV,MAAM,EACN,MAAM,EACN,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAC1C,MAAM,CAAC,OAAO,CAAC,UAAU,CAC1B,CAAC;QACF,OAAO,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,iCAAiC,EAAE,CAAC;YACrE,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC1C,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACxB,EAAE,EAAE,KAAK;gBACT,IAAI;gBACJ,KAAK,EAAE,0DAA0D;aAClE,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,iCAAiC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9F,MAAM,IAAI,yBAAyB,CAAC,iCAAiC,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,GAAoB,EACpB,GAAmB,EACnB,IAAoC,EACpC,MAAwC;IAExC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;;YACxD,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACzD,gBAAgB,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC9B,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;QAC5D,aAAa,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CACpB,MAAqF,EACrF,KAAc,EACd,gBAAwB;IAExB,MAAM,MAAM,GACV,MAAM,KAAK,cAAc;QACvB,CAAC,CAAC,oCAAoC;QACtC,CAAC,CAAC,MAAM,KAAK,WAAW;YACtB,CAAC,CAAC,kCAAkC;YACpC,CAAC,CAAC,MAAM,KAAK,gBAAgB;gBAC3B,CAAC,CAAC,sCAAsC;gBACxC,CAAC,CAAC,MAAM,KAAK,UAAU;oBACrB,CAAC,CAAC,iCAAiC;oBACnC,CAAC,CAAC,MAAM,KAAK,UAAU;wBACrB,CAAC,CAAC,iCAAiC;wBACnC,CAAC,CAAC,iCAAiC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAA8B,CAAC;AAC7F,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,GAAmB,EACnB,KAAgB,EAChB,MAAwC;IAExC,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAClD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;QACjB,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,mDAAmD;KAC3D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,YAAY,yBAAyB,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;QAC9F,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,IAAI,CACX,KAAgB,EAChB,MAAwC,EACxC,MAAc,EACd,UAAkB,EAClB,UAAmB;IAEnB,OAAO,KAAK,CAAC,IAAI,CAAC;QAChB,SAAS,EAAE,2BAA2B,MAAM,EAAE;QAC9C,GAAG,EAAE,UAAU;QACf,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;QACzC,MAAM;QACN,UAAU;QACV,OAAO,EAAE;YACP,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,UAAU;YACnB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;SACpD;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAsB;IACjD,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,YAAY,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IACxF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC"}

package/node_modules/@noodle-borg/service/dist/serve-options.d.ts

@@ -17,7 +17,11 @@ export type ServeServiceOptions = ServiceOptions & {
      * OR any of these. Does not change the client id reported by `/v1/service/info`.
      */
     readonly googleAdditionalAudiences?: readonly string[];
-    /** Google subjects or emails allowed to manage orgs and memberships (MT-2). */
+    /** Exact immutable Google subjects for CI/build service-account identity tokens. */
+    readonly googleWorkloadSubjects?: readonly string[];
+    /** Temporary direct-human Google bearer compatibility. Defaults true until the fallback is finalized. */
+    readonly googleHumanAuthCompatibility?: boolean;
+    /** Canonical principal subjects allowed to manage orgs; email is legacy direct-Google-only compatibility. */
     readonly controlPlaneAdmins?: readonly string[];
     /** Public self-service signup mode. Default preserves internal-alpha restricted admission. */
     readonly controlPlaneSignupMode?: ControlPlaneSignupMode;
@@ -63,7 +67,7 @@ export type ServeServiceOptions = ServiceOptions & {
     /**
      * Enable the self-hosted OAuth authorization server (OA-2,
      * [ADR 0042](../../../docs/decisions/0042-self-hosted-oauth-authorization-server.md)). When set, the AS
-     * routes are served (DCR + PKCE, federating login to Google), the issuer is advertised in
+     * routes are served (DCR + PKCE, federating human login upstream), the issuer is advertised in
      * protected-resource metadata, and owner-only tokens are verified in-process against the signing key.
      * The OAuth state store is the shared Postgres store when persistence is on, else in-memory.
      */
@@ -71,7 +75,21 @@ export type ServeServiceOptions = ServiceOptions & {
         /** The AS issuer — its public origin (e.g. `https://cloud.noodleseed.dev`). HTTPS, no path/query. */
         readonly issuer: string;
         readonly signer: SigningKeyProvider;
-        readonly google: GoogleAuthenticator;
+        /** Direct Google human federation remains optional during fallback and is removed after finalization. */
+        readonly google?: GoogleAuthenticator;
+        /** Optional complete WorkOS upstream-human configuration. Omit all fields to retain Google/0%. */
+        readonly workos?: {
+            readonly clientId?: string;
+            readonly apiKey?: string;
+            readonly realm?: string;
+            /** Defaults to GoogleOAuth + MagicAuth. Expand only through a compatibility-set rollout. */
+            readonly allowedAuthenticationMethods?: readonly ('GoogleOAuth' | 'MagicAuth' | 'GitHubOAuth' | 'Password' | 'SSO')[];
+        };
+        /** Stable first-party public client used by the hosted Console's server-side PKCE flow. */
+        readonly consoleClient?: {
+            readonly clientId: string;
+            readonly redirectUri: string;
+        };
         /** Restrict authorizing users to this email domain during alpha (e.g. `@noodleseed.com`). */
         readonly allowedEmailDomain?: string;
         /** Benign retry/concurrency window for a rotated refresh token. Default: provider default. */

package/node_modules/@noodle-borg/service/dist/serve-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve-options.d.ts","sourceRoot":"","sources":["../src/serve-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG/D,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG;IACjD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,6FAA6F;IAC7F,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvD,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,8FAA8F;IAC9F,QAAQ,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IACzD,mFAAmF;IACnF,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IACnC,gGAAgG;IAChG,QAAQ,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IACzD,oGAAoG;IACpG,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,qGAAqG;QACrG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;QACpC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;QACrC,6FAA6F;QAC7F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;QACrC,8FAA8F;QAC9F,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAC3C,sGAAsG;QACtG,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;KAC/C,CAAC;IACF,qFAAqF;IACrF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,6FAA6F;IAC7F,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnD,sCAAsC;IACtC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,uCAAuC;IACvC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,wGAAwG;IACxG,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,wGAAwG;IACxG,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,yFAAyF;IACzF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,2FAA2F;IAC3F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;CACtD,CAAC"}
+{"version":3,"file":"serve-options.d.ts","sourceRoot":"","sources":["../src/serve-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG/D,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG;IACjD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,6FAA6F;IAC7F,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvD,oFAAoF;IACpF,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpD,yGAAyG;IACzG,QAAQ,CAAC,4BAA4B,CAAC,EAAE,OAAO,CAAC;IAChD,6GAA6G;IAC7G,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,8FAA8F;IAC9F,QAAQ,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IACzD,mFAAmF;IACnF,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IACnC,gGAAgG;IAChG,QAAQ,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IACzD,oGAAoG;IACpG,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,qGAAqG;QACrG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;QACpC,yGAAyG;QACzG,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;QACtC,kGAAkG;QAClG,QAAQ,CAAC,MAAM,CAAC,EAAE;YAChB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;YAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YACxB,4FAA4F;YAC5F,QAAQ,CAAC,4BAA4B,CAAC,EAAE,SAAS,CAC7C,aAAa,GACb,WAAW,GACX,aAAa,GACb,UAAU,GACV,KAAK,CACR,EAAE,CAAC;SACL,CAAC;QACF,2FAA2F;QAC3F,QAAQ,CAAC,aAAa,CAAC,EAAE;YACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;SAC9B,CAAC;QACF,6FAA6F;QAC7F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;QACrC,8FAA8F;QAC9F,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAC3C,sGAAsG;QACtG,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;KAC/C,CAAC;IACF,qFAAqF;IACrF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,6FAA6F;IAC7F,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnD,sCAAsC;IACtC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,uCAAuC;IACvC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,wGAAwG;IACxG,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,wGAAwG;IACxG,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,yFAAyF;IACzF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,2FAA2F;IAC3F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;CACtD,CAAC"}

package/node_modules/@noodle-borg/service/dist/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAwDjG,OAAO,EAAE,KAAK,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AA2C9D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,4FAA4F;IAC5F,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,iGAAiG;AACjG,wBAAsB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,cAAc,CAAC,CAknB7F"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AA8CtD,OAAO,EAAE,KAAK,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAwC9D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,4FAA4F;IAC5F,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,iGAAiG;AACjG,wBAAsB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,cAAc,CAAC,CA+hB7F"}

package/node_modules/@noodle-borg/service/dist/serve.js

@@ -1,27 +1,27 @@
 import { createServer } from 'node:http';
-import { createJwtVerifier } from '@noodle-borg/auth';
 import { SecretBox, staticMasterKeyProvider } from '@noodle-borg/runtime';
 import { noopLogger } from '@noodle-borg/transport-http';
 import { ALERT_EVALUATION_INTERVAL_MS, AlertEvaluator } from './alert-evaluator.js';
 import { createAssetStore, resolveAssetConfig } from './asset-config.js';
-import { CompositeControlPlaneGate, GoogleControlPlaneGate, NoodleOAuthControlPlaneGate, } from './auth/deploy-gate.js';
 import { createPostgresBillingAuthoritativeAdmissionStore, createPostgresBillingCommercialEnforcementProjectionStore, createPostgresBillingEnforcementActivationStore, startConfiguredShadowBillingObservation, } from './billing/integration.js';
 import { activateBillingEnforcementForRelease, assertBillingEnforcementReleaseConfiguration, } from './billing/service-enforcement-release.js';
 import { createServicePostgresBillingMeterRuntime } from './billing/service-meter-runtime.js';
 import { resolveBillingStripeOverageService, resolveBillingStripeService, } from './billing/stripe-integration-loader.js';
 import { parseBillingUsageHmacKey } from './billing/usage-identity.js';
 import { resolveBuildInfo } from './build-info.js';
-import { createCustomerVerifierFactory, createHostedCustomerVerifierFactory, } from './customer-verifier.js';
-import { geminiEnterpriseDefaultResourceForClient } from './gemini-enterprise-oauth.js';
+import { createDefaultControlPlaneGate } from './control-plane-auth-bootstrap.js';
+import { createHostedCustomerVerifierFactory } from './customer-verifier.js';
 import { GITHUB_RUN_RECONCILE_INTERVAL_MS, GithubDeployRunReconciler, } from './github/deploy-run-reconciler.js';
-import { normalizeOAuthResource } from './http-util.js';
 import { ModuleHost } from './modules/host.js';
 import { loadModules } from './modules/loader.js';
-import { createDeveloperGrantAuthorizer, resolveDeveloperGrantStore, } from './oauth/developer-grant-bootstrap.js';
+import { resolveServiceOAuthBootstrap } from './oauth/service-bootstrap.js';
 import { assertPostgresStoreOwnership } from './persistence-options.js';
+import { resolvePlatformAuthServiceBootstrap, } from './platform-auth-service-bootstrap.js';
+import { startPlatformIdentityMaintenanceWorker } from './platform-identity-maintenance.js';
+import { PostgresPlatformIdentityStore } from './platform-identity-postgres.js';
 import { InMemoryPolicyAssignmentStore } from './policy.js';
 import { ServerRegistry } from './registry.js';
-import { allowedMcpBaseDomains, bridgeAuthForResource, isLoopbackHost, managedSecretForResource, openCustomerCredential, sealCustomerCredential, } from './serve-resource-auth.js';
+import { isLoopbackHost, openCustomerCredential, sealCustomerCredential, } from './serve-resource-auth.js';
 import { createServiceHandler } from './service.js';
 import { resolveServiceConfigSource } from './service-config.js';
 import { closeHttpServer, closeServiceResources, listenHttpServer, } from './service-resource-cleanup.js';
@@ -109,6 +109,8 @@ export async function serveService(options = {}) {
     let githubDeployRunStore = options.githubDeployRunStore;
     let pendingGithubInstallationStore = options.pendingGithubInstallationStore;
     let pgPool;
+    let platformIdentityStore = options.platformIdentityStore;
+    let platformAuth = options.platformAuthOperator === undefined ? {} : { operator: options.platformAuthOperator };
     let billingMeterRuntime;
     let createBillingMeterRuntime;
     if (options.databaseUrl !== undefined || options.cloudSql !== undefined) {
@@ -120,6 +122,10 @@ export async function serveService(options = {}) {
             ...(options.databaseUrl !== undefined ? { databaseUrl: options.databaseUrl } : {}),
             ...(options.cloudSql !== undefined ? { cloudSql: options.cloudSql } : {}),
         });
+        platformIdentityStore = platformIdentityStore ?? new PostgresPlatformIdentityStore(pgPool.pool);
+        if (platformIdentityStore instanceof PostgresPlatformIdentityStore) {
+            await platformIdentityStore.ensureSchema();
+        }
         const postgres = new PostgresArtifactStore(pgPool.pool, secretBox);
         await postgres.ensureSchema();
         if (postgresBillingUsageHmacKey === undefined) {
@@ -156,6 +162,17 @@ export async function serveService(options = {}) {
         githubDeployRunStore =
             githubDeployRunStore ?? new JsonFileGithubDeployRunStore(options.dataDir);
     }
+    platformAuth = await resolvePlatformAuthServiceBootstrap({
+        ...(pgPool === undefined ? {} : { pool: pgPool.pool }),
+        releaseSha: buildInfo.gitSha,
+        workos: options.oauth?.workos,
+        workloadSubjects: options.googleWorkloadSubjects,
+        googleHumanAuthAvailable: options.oauth?.google !== undefined,
+        durablePlatformIdentityAvailable: platformIdentityStore instanceof PostgresPlatformIdentityStore,
+        ...(options.platformAuthOperator === undefined
+            ? {}
+            : { configuredOperator: options.platformAuthOperator }),
+    });
     controlPlaneStore = controlPlaneStore ?? new InMemoryControlPlaneStore();
     billingStripeService = await resolveBillingStripeService({
         configured: billingStripeService,
@@ -292,152 +309,36 @@ export async function serveService(options = {}) {
     for (const subject of options.signupAllowedSubjects ?? []) {
         await controlPlaneStore.allowSignup({ kind: 'subject', value: subject });
     }
-    // Self-hosted authorization server (OA-2): build the AS Express app + its state store (the shared Postgres
-    // store when persistence is on, else in-memory). Express + the SDK auth handlers load lazily, only here, so
-    // an AS-less deployment never pulls them in. Owner-only token verification is wired to the same signing key
-    // in-process (no JWKS round-trip), which is correct because every instance shares the static key via env.
-    let authServerApp;
-    let resolvedVerifyOwnerToken = options.verifyOwnerToken;
-    let resolvedAuthServerIssuer = options.authServerIssuer;
     let registry;
-    let oauthStore;
-    let developerGrantStore = options.developerGrantStore;
-    let delegatedExchange;
-    const allowedMcpDomains = allowedMcpBaseDomains(options);
-    const rawCustomerVerifierFactory = createCustomerVerifierFactory({
-        allowInsecureLocalhost: options.customerVerifierAllowInsecureLocalhost === true,
-        ...(options.customerVerifierFirebaseJwks !== undefined
-            ? { firebaseJwks: options.customerVerifierFirebaseJwks }
-            : {}),
-        ...(options.customerVerifierFirebaseJwksUri !== undefined
-            ? { firebaseJwksUri: options.customerVerifierFirebaseJwksUri }
-            : {}),
+    // Self-hosted authorization server (OA-2) and upstream-human boot are isolated from the service graph.
+    const oauthBootstrap = await resolveServiceOAuthBootstrap({
+        options,
+        ...(pgPool === undefined ? {} : { pool: pgPool.pool }),
+        ...(secretBox === undefined ? {} : { secretBox }),
+        controlPlaneStore,
+        ...(platformIdentityStore === undefined ? {} : { platformIdentityStore }),
+        platformAuth,
+        registry: () => registry,
     });
-    if (options.oauth) {
-        if (pgPool) {
-            const { PostgresOAuthStore } = await import('./oauth/store-postgres.js');
-            const postgresOAuth = new PostgresOAuthStore(pgPool.pool);
-            await postgresOAuth.ensureSchema();
-            oauthStore = postgresOAuth;
-        }
-        else {
-            const { InMemoryOAuthStore } = await import('./oauth/store.js');
-            oauthStore = new InMemoryOAuthStore();
-        }
-        developerGrantStore = await resolveDeveloperGrantStore({
-            ...(pgPool === undefined ? {} : { pool: pgPool.pool }),
-            ...(developerGrantStore === undefined ? {} : { store: developerGrantStore }),
-        });
-        const [{ NoodleOAuthProvider }, { createOAuthApp }] = await Promise.all([
-            import('./oauth/provider.js'),
-            import('./oauth/app.js'),
-        ]);
-        // Normalize once so the token `iss`, the verifier's expected issuer, and the PRM `authorization_servers`
-        // entry are byte-identical (a trailing-slash `PUBLIC_BASE_URL` would otherwise desync them).
-        const oauthIssuer = options.oauth.issuer.replace(/\/+$/, '');
-        // The same issuer/signer pair backs delegated token-exchange assertions (ADR 0152) so customer
-        // token endpoints verify them against the already-published platform JWKS.
-        delegatedExchange = { issuer: oauthIssuer, signer: options.oauth.signer };
-        const provider = new NoodleOAuthProvider({
-            issuer: oauthIssuer,
-            store: oauthStore,
-            signer: options.oauth.signer,
-            google: options.oauth.google,
-            customerBridgeAuthForResource: async (resource) => registry !== undefined
-                ? bridgeAuthForResource(registry, resource, allowedMcpDomains)
-                : undefined,
-            managedSecretForResource: async (resource, name) => registry !== undefined
-                ? managedSecretForResource(registry, resource, name, allowedMcpDomains)
-                : undefined,
-            verifyCustomerBridgeToken: async (auth, token) => {
-                const identity = await rawCustomerVerifierFactory(auth)(token, auth.projectId ?? '');
-                return identity === null ? null : { ...identity, scopes: identity.scopes ?? [] };
-            },
-            sealCustomerCredential: (credential) => sealCustomerCredential(secretBox, credential),
-            signupAuthorizer: controlPlaneStore,
-            developerGrantAuthorizer: createDeveloperGrantAuthorizer({
-                controlPlane: controlPlaneStore,
-                grants: developerGrantStore,
-                registry: () => registry,
-            }),
-            logger: options.logger ?? noopLogger,
-            defaultResourceForClient: (client) => geminiEnterpriseDefaultResourceForClient(client, oauthIssuer),
-            ...(options.oauth.allowedEmailDomain !== undefined
-                ? { allowedEmailDomain: options.oauth.allowedEmailDomain }
-                : {}),
-            ...(options.oauth.refreshTokenGraceSeconds !== undefined
-                ? { refreshTokenGraceSeconds: options.oauth.refreshTokenGraceSeconds }
-                : {}),
-            ...(options.oauth.refreshTokenRecoverySeconds !== undefined
-                ? { refreshTokenRecoverySeconds: options.oauth.refreshTokenRecoverySeconds }
-                : {}),
-        });
-        authServerApp = createOAuthApp(provider, {
-            trustProxy: options.tls?.trustProxy === true,
-        });
-        resolvedAuthServerIssuer = resolvedAuthServerIssuer ?? oauthIssuer;
-        // Resource-server verification uses the AS signing key directly (co-hosted, same process), so an
-        // owner-only endpoint validates tokens without an HTTP JWKS fetch. Multi-instance-safe because the key is
-        // shared via env.
-        resolvedVerifyOwnerToken =
-            resolvedVerifyOwnerToken ??
-                createJwtVerifier({
-                    issuer: oauthIssuer,
-                    keyResolver: await options.oauth.signer.verifierKey(),
-                });
-    }
+    const { authServerApp, verifyOwnerToken: resolvedVerifyOwnerToken, authServerIssuer: resolvedAuthServerIssuer, oauthStore, developerGrantStore, delegatedExchange, rawCustomerVerifierFactory, } = oauthBootstrap;
     if (gate === undefined) {
-        // Compose all configured control-plane verifiers so a first-party caller may present EITHER an AS-issued
-        // token (MCP clients, CLI) OR a Google ID token from a trusted audience (the console, ADR 0116). The AS
-        // gate is tried first; the Google gate (when NOODLE_GOOGLE_CLIENT_ID is set) accepts the console/CLI
-        // Google ID tokens. A lone gate is used directly; two or more wrap in a CompositeControlPlaneGate.
-        const gates = [];
-        if (resolvedVerifyOwnerToken !== undefined && resolvedAuthServerIssuer !== undefined) {
-            const allowedEmailDomain = options.controlPlaneAllowedEmailDomain ?? options.oauth?.allowedEmailDomain;
-            gates.push(new NoodleOAuthControlPlaneGate({
-                verifier: resolvedVerifyOwnerToken,
-                audience: [
-                    normalizeOAuthResource(options.publicBaseUrl ?? resolvedAuthServerIssuer),
-                    `${resolvedAuthServerIssuer}/developer/mcp`,
-                    `${resolvedAuthServerIssuer}/developer/cli`,
-                ],
-                admins: options.controlPlaneAdmins ?? [],
-                signupMode: options.controlPlaneSignupMode ?? 'restricted',
-                signupAuthorizer: controlPlaneStore,
-                deniedSignupDomains: options.deniedSignupDomains ?? [],
-                deniedSignupSubjects: options.deniedSignupSubjects ?? [],
-                ...(allowedEmailDomain !== undefined ? { allowedEmailDomain } : {}),
-            }));
-        }
-        if (options.googleClientId !== undefined) {
-            gates.push(new GoogleControlPlaneGate({
-                // Single audience stays a plain string (unchanged); only a configured additional-audience list
-                // widens it to an array. Keeps the CLI/gcloud single-client path byte-for-byte identical.
-                audience: options.googleAdditionalAudiences && options.googleAdditionalAudiences.length > 0
-                    ? [options.googleClientId, ...options.googleAdditionalAudiences]
-                    : options.googleClientId,
-                admins: options.controlPlaneAdmins ?? [],
-                signupMode: options.controlPlaneSignupMode ?? 'restricted',
-                signupAuthorizer: controlPlaneStore,
-                deniedSignupDomains: options.deniedSignupDomains ?? [],
-                deniedSignupSubjects: options.deniedSignupSubjects ?? [],
-                ...(options.controlPlaneAllowedEmailDomain !== undefined
-                    ? { allowedEmailDomain: options.controlPlaneAllowedEmailDomain }
-                    : {}),
-                ...(options.googleVerifier ? { verifier: options.googleVerifier } : {}),
-            }));
-        }
-        gate =
-            gates.length === 0
-                ? gate
-                : gates.length === 1
-                    ? gates[0]
-                    : new CompositeControlPlaneGate(gates);
+        // Noodle tokens lead temporary human-Google compatibility and the exact-subject workload gate.
+        gate = createDefaultControlPlaneGate({
+            options,
+            controlPlaneStore,
+            ...(resolvedVerifyOwnerToken === undefined
+                ? {}
+                : { verifyOwnerToken: resolvedVerifyOwnerToken }),
+            ...(resolvedAuthServerIssuer === undefined
+                ? {}
+                : { authServerIssuer: resolvedAuthServerIssuer }),
+            ...(platformIdentityStore === undefined ? {} : { platformIdentityStore }),
+        });
     }
     // Fail closed: never expose an unauthenticated deploy endpoint on a non-loopback bind.
     if (gate === undefined && !isLoopbackHost(host)) {
         throw new Error(`refusing to bind a non-loopback host (${host}) without deploy authentication; ` +
-            'set NOODLE_OAUTH_ISSUER/Google OAuth creds, NOODLE_GOOGLE_CLIENT_ID, or pass a deployGate');
+            'configure the Noodle OAuth issuer and an upstream-human provider, NOODLE_GOOGLE_CLIENT_ID, or a deployGate');
     }
     // `local` is a system-owned loopback namespace even when loopback auth is enabled.
     if (isLoopbackHost(host)) {
@@ -470,6 +371,7 @@ export async function serveService(options = {}) {
         ? async () => {
             try {
                 await pgPool.pool.query('SELECT 1');
+                await platformAuth.assertContinuity?.();
                 return true;
             }
             catch {
@@ -479,6 +381,7 @@ export async function serveService(options = {}) {
         : async () => true;
     let billingStripeReconcileTimer;
     let billingStripeOverageSettlementTimer;
+    let platformIdentityMaintenanceTimer;
     const closeResources = () => closeServiceResources({
         ...(retentionTimer === undefined ? {} : { retentionTimer }),
         ...(githubRunReconcileTimer === undefined ? {} : { githubRunReconcileTimer }),
@@ -487,6 +390,9 @@ export async function serveService(options = {}) {
             ? {}
             : { billingStripeOverageSettlementTimer }),
         ...(welcomeEmailTimer === undefined ? {} : { welcomeEmailTimer }),
+        ...(platformIdentityMaintenanceTimer === undefined
+            ? {}
+            : { platformIdentityMaintenanceTimer }),
         alertTimer,
         requestEventBuffer,
         ...(billingMeterRuntime === undefined ? {} : { billingMeterRuntime }),
@@ -555,6 +461,7 @@ export async function serveService(options = {}) {
         requestEventStore,
         alertRuleStore,
         ...(assistantStore !== undefined ? { assistantStore } : {}),
+        ...(platformAuth.operator === undefined ? {} : { platformAuthOperator: platformAuth.operator }),
         captureRequestEvent: options.captureRequestEvent ?? ((event) => requestEventBuffer.capture(event)),
         ...(githubConnectionStore !== undefined ? { githubConnectionStore } : {}),
         ...(githubDeployRunStore !== undefined ? { githubDeployRunStore } : {}),
@@ -575,6 +482,14 @@ export async function serveService(options = {}) {
         http = createServer(createServiceHandler(registry, handlerOptions));
         await listenHttpServer(http, options.port ?? 8787, host);
         billingMeterRuntime?.start();
+        if (platformAuth.runtime !== undefined) {
+            platformIdentityMaintenanceTimer = startPlatformIdentityMaintenanceWorker({
+                sync: platformAuth.runtime.outboxProcessor,
+                events: platformAuth.runtime.eventsProcessor,
+                readiness: platformAuth.runtime.operator,
+                logger: options.logger ?? noopLogger,
+            });
+        }
     }
     catch (error) {
         if (http?.listening)