@noodleseed/one 0.63.0 → 0.64.0

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-page.js

@@ -4,21 +4,133 @@ const CAPABILITY_COPY = {
     'deployments:write': 'Build and deploy apps to the selected environments',
     'deployments:rollback': 'Roll back deployments',
 };
+const ENVIRONMENT_PRIORITY = {
+    dev: 0,
+    staging: 1,
+    prod: 3,
+};
+const DEVELOPER_GRANT_STYLES = `
+.ns-card{width:min(100%,46rem)}
+.ns-title{max-width:38rem;white-space:normal}
+.developer-context{grid-template-columns:repeat(3,minmax(0,1fr));gap:.75rem;margin-bottom:1.55rem}
+.developer-context>div{min-width:0}
+.developer-context .ns-dd{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.developer-grant{display:grid;gap:1.35rem}
+.developer-section{min-width:0;margin:0;padding:0;border:0}
+.developer-step{display:flex;align-items:center;gap:.6rem;margin:0 0 .3rem;color:var(--fg);font-size:.94rem;font-weight:650}
+.developer-step-number{display:grid;place-items:center;width:1.6rem;height:1.6rem;border:1px solid var(--border);border-radius:999px;color:var(--orange);font-size:.72rem}
+.developer-help{margin:0 0 .8rem;color:var(--muted);font-size:.8rem;line-height:1.5}
+.developer-org-list{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:.65rem}
+.developer-org-choice{position:relative;display:block;min-width:0;cursor:pointer}
+.developer-org-choice>input{position:absolute;width:1px;height:1px;opacity:0;pointer-events:none}
+.developer-org-card{display:flex;align-items:center;justify-content:space-between;gap:.85rem;min-height:4rem;padding:.85rem .95rem;border:1px solid var(--border);border-radius:.8rem;background:rgba(255,255,255,.025);transition:border-color .16s ease,background .16s ease,box-shadow .16s ease}
+.developer-org-choice:hover .developer-org-card{border-color:color-mix(in srgb,var(--border),var(--fg) 20%);background:rgba(255,255,255,.04)}
+.developer-org-choice>input:focus-visible+.developer-org-card{outline:2px solid var(--orange);outline-offset:2px}
+.developer-org-choice>input:checked+.developer-org-card{border-color:color-mix(in srgb,var(--orange) 70%,transparent);background:linear-gradient(135deg,color-mix(in srgb,var(--orange) 13%,transparent),rgba(255,255,255,.025));box-shadow:inset 0 0 0 1px color-mix(in srgb,var(--orange) 12%,transparent)}
+.developer-org-name{display:block;overflow:hidden;color:var(--fg);font-size:.88rem;font-weight:650;text-overflow:ellipsis;white-space:nowrap}
+.developer-org-access{display:block;margin-top:.18rem;color:var(--muted);font-size:.72rem}
+.developer-choice-mark{display:grid;flex:0 0 auto;place-items:center;width:1.1rem;height:1.1rem;border:1px solid var(--border);border-radius:999px;color:transparent;font-size:.65rem}
+.developer-org-choice>input:checked+.developer-org-card .developer-choice-mark{border-color:var(--orange);background:var(--orange);color:#130b07}
+.developer-environment-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:.6rem}
+.developer-environment{position:relative;display:block;min-width:0;cursor:pointer}
+.developer-environment>input{position:absolute;width:1px;height:1px;opacity:0;pointer-events:none}
+.developer-environment-card{display:flex;align-items:flex-start;gap:.65rem;min-height:4.1rem;padding:.8rem;border:1px solid var(--border);border-radius:.75rem;background:rgba(255,255,255,.025);transition:border-color .16s ease,background .16s ease}
+.developer-environment:hover .developer-environment-card{border-color:color-mix(in srgb,var(--border),var(--fg) 20%);background:rgba(255,255,255,.04)}
+.developer-environment>input:focus-visible+.developer-environment-card{outline:2px solid var(--orange);outline-offset:2px}
+.developer-environment>input:checked+.developer-environment-card{border-color:color-mix(in srgb,var(--orange) 70%,transparent);background:color-mix(in srgb,var(--orange) 10%,transparent)}
+.developer-checkbox{display:grid;flex:0 0 auto;place-items:center;width:1rem;height:1rem;margin-top:.08rem;border:1px solid var(--border);border-radius:.25rem;color:transparent;font-size:.68rem}
+.developer-environment>input:checked+.developer-environment-card .developer-checkbox{border-color:var(--orange);background:var(--orange);color:#130b07}
+.developer-environment-name{display:block;color:var(--fg);font-size:.84rem;font-weight:650}
+.developer-environment-note{display:block;margin-top:.2rem;color:var(--muted);font-size:.68rem;line-height:1.35}
+.developer-environment-note.is-production{color:#f1a273}
+.developer-capabilities{margin:.75rem 0 0;padding:.7rem .8rem;border:1px solid var(--border);border-radius:.7rem;background:rgba(0,0,0,.12);color:var(--muted);font-size:.75rem}
+.developer-capabilities summary{cursor:pointer;color:var(--fg);font-weight:600}
+.developer-capabilities ul{display:grid;gap:.35rem;margin:.6rem 0 0;padding-left:1.15rem;line-height:1.45}
+.developer-summary{padding:.85rem .95rem;border:1px solid var(--border);border-radius:.75rem;background:rgba(255,255,255,.025)}
+.developer-summary-label{margin:0 0 .24rem;color:var(--muted);font-size:.65rem;font-weight:700;letter-spacing:.12em;text-transform:uppercase}
+.developer-summary-copy{margin:0;color:var(--fg);font-size:.8rem;line-height:1.5}
+.developer-selection-error{margin:.45rem 0 0;color:#f1a273;font-size:.75rem}
+.developer-grant .ns-row{margin-top:0}
+.developer-grant .btn-primary:disabled{cursor:not-allowed;filter:none;opacity:.45}
+@media(max-width:680px){
+  .ns-card{padding:1.35rem}
+  .developer-context,.developer-org-list,.developer-environment-grid{grid-template-columns:1fr}
+  .developer-context{gap:.55rem}
+}
+`;
+const DEVELOPER_GRANT_SCRIPT = `<script>
+(function(){
+  var form=document.querySelector('[data-developer-grant]');
+  if(!form)return;
+  var choices=Array.from(form.querySelectorAll('[data-org-choice]'));
+  var panels=Array.from(form.querySelectorAll('[data-org-panel]'));
+  var authorize=form.querySelector('[data-authorize]');
+  var summary=form.querySelector('[data-selection-summary]');
+  var error=form.querySelector('[data-selection-error]');
+  var clientName=form.getAttribute('data-client-name')||'The developer plugin';
+  function activeIndex(){
+    var selected=choices.find(function(choice){return choice.checked;});
+    return selected ? Number(selected.getAttribute('data-org-choice')) : -1;
+  }
+  function activeEnvironments(){
+    var panel=panels[activeIndex()];
+    return panel ? Array.from(panel.querySelectorAll('input[name="environment"]:checked')).map(function(input){return input.value;}) : [];
+  }
+  function naturalList(values){
+    if(values.length<2)return values[0]||'';
+    if(values.length===2)return values[0]+' and '+values[1];
+    return values.slice(0,-1).join(', ')+', and '+values[values.length-1];
+  }
+  function update(){
+    var panel=panels[activeIndex()];
+    var environments=activeEnvironments();
+    var valid=panel!==undefined&&environments.length>0;
+    authorize.disabled=!valid;
+    error.hidden=valid;
+    if(valid){
+      summary.textContent=clientName+' can '+panel.getAttribute('data-capability-summary')+' in '+panel.getAttribute('data-org-name')+' for '+naturalList(environments)+'.';
+    }else{
+      summary.textContent='Select at least one environment to continue.';
+    }
+  }
+  choices.forEach(function(choice){
+    choice.addEventListener('change',function(){
+      var next=activeIndex();
+      panels.forEach(function(panel,index){
+        var active=index===next;
+        panel.hidden=!active;
+        var environments=Array.from(panel.querySelectorAll('input[name="environment"]'));
+        environments.forEach(function(environment){environment.checked=false;environment.disabled=!active;});
+        if(active){
+          var preferred=environments.find(function(environment){return environment.value==='dev';});
+          if(preferred)preferred.checked=true;
+        }
+      });
+      update();
+    });
+  });
+  form.addEventListener('change',function(event){
+    if(event.target&&event.target.matches('input[name="environment"]'))update();
+  });
+  form.addEventListener('submit',function(event){
+    var submitter=event.submitter;
+    if(submitter&&submitter.value==='deny')return;
+    if(activeEnvironments().length===0){event.preventDefault();update();}
+  });
+  update();
+})();
+</script>`;
 export function renderDeveloperGrantPage(input) {
-    const choices = input.choices.map(renderChoice).join('');
     const controls = input.choices.length === 0
-        ? '<p class="ns-note">No organizations are available for this account.</p>'
-        : `${choices}<div class="ns-row">
-        <button type="submit" name="decision" value="deny" class="btn btn-ghost">Deny</button>
-        <span class="btn-glow"><button type="submit" name="decision" value="approve" class="btn btn-primary">Authorize</button></span>
-      </div>`;
-    const contentHtml = `<p class="ns-lede"><strong>${escapeHtml(input.clientName)}</strong> will be able to guide and operate Noodle Cloud autonomously within the access you select.</p>
-    <dl class="ns-dl">
-      <div><dt class="ns-dt">Signed in as</dt><dd class="ns-dd">${escapeHtml(input.userEmail)}</dd></div>
-      <div><dt class="ns-dt">Noodle Cloud</dt><dd class="ns-dd">${escapeHtml(input.resourceHost)}</dd></div>
-      <div><dt class="ns-dt">Redirects to</dt><dd class="ns-dd">${escapeHtml(input.redirectHost)}</dd></div>
+        ? '<div class="ns-alert"><p class="ns-note">No organizations are available for this account.</p></div>'
+        : renderControls(input);
+    const contentHtml = `<p class="ns-lede">Review and choose the exact access for <strong>${escapeHtml(input.clientName)}</strong>. You can select more than one environment.</p>
+    <dl class="ns-dl developer-context">
+      <div><dt class="ns-dt">Signed in as</dt><dd class="ns-dd" title="${escapeHtml(input.userEmail)}">${escapeHtml(input.userEmail)}</dd></div>
+      <div><dt class="ns-dt">Noodle Cloud</dt><dd class="ns-dd" title="${escapeHtml(input.resourceHost)}">${escapeHtml(input.resourceHost)}</dd></div>
+      <div><dt class="ns-dt">Redirects to</dt><dd class="ns-dd" title="${escapeHtml(input.redirectHost)}">${escapeHtml(input.redirectHost)}</dd></div>
     </dl>
-    <form method="post" action="${escapeHtml(input.grantAction)}">
+    <form method="post" action="${escapeHtml(input.grantAction)}" class="developer-grant" data-developer-grant data-client-name="${escapeHtml(input.clientName)}">
       <input type="hidden" name="grant_token" value="${escapeHtml(input.grantToken)}" />
       ${controls}
     </form>`;
@@ -27,28 +139,104 @@ export function renderDeveloperGrantPage(input) {
         kicker: 'Developer access',
         heading: 'Choose where this developer plugin can operate',
         contentHtml,
+        additionalStyles: DEVELOPER_GRANT_STYLES,
+        ...(input.choices.length === 0 ? {} : { scriptHtml: DEVELOPER_GRANT_SCRIPT }),
     });
 }
-function renderChoice(choice, index) {
-    const org = escapeHtml(choice.org);
-    const label = escapeHtml(choice.displayName ?? choice.org);
-    const environments = choice.environments
-        .map((environment) => {
-        const escaped = escapeHtml(environment);
-        const productionNote = environment === 'prod' ? ' <span class="ns-note">explicit access</span>' : '';
-        return `<label><input type="checkbox" name="environment" value="${escaped}" /> ${escaped}${productionNote}</label>`;
-    })
+function renderControls(input) {
+    const organizations = input.choices.map(renderOrganizationChoice).join('');
+    const panels = input.choices.map(renderEnvironmentPanel).join('');
+    const first = input.choices[0];
+    const initialEnvironment = first?.environments.includes('dev') ? 'dev' : first?.environments[0];
+    const initialSummary = first !== undefined && initialEnvironment !== undefined
+        ? `${input.clientName} can ${capabilitySummary(first.capabilities)} in ${first.displayName ?? first.org} for ${initialEnvironment}.`
+        : 'Select at least one environment to continue.';
+    return `<fieldset class="developer-section">
+      <legend class="developer-step"><span class="developer-step-number">1</span>Choose organization</legend>
+      <p class="developer-help">Only one organization can be authorized in this connection.</p>
+      <div class="developer-org-list">${organizations}</div>
+    </fieldset>
+    <div>${panels}</div>
+    <div class="developer-summary" aria-live="polite">
+      <p class="developer-summary-label">Access summary</p>
+      <p class="developer-summary-copy" data-selection-summary>${escapeHtml(initialSummary)}</p>
+      <p class="developer-selection-error" data-selection-error hidden>Select at least one environment to continue.</p>
+    </div>
+    <div class="ns-row">
+      <button type="submit" name="decision" value="deny" class="btn btn-ghost">Deny</button>
+      <span class="btn-glow"><button type="submit" name="decision" value="approve" class="btn btn-primary" data-authorize>Authorize access</button></span>
+    </div>`;
+}
+function renderOrganizationChoice(choice, index) {
+    const label = choice.displayName ?? choice.org;
+    const access = choice.capabilities.includes('deployments:rollback')
+        ? 'Owner access'
+        : 'Developer access';
+    return `<label class="developer-org-choice">
+      <input type="radio" name="org" value="${escapeHtml(choice.org)}" data-org-choice="${index}"${index === 0 ? ' checked' : ''} />
+      <span class="developer-org-card">
+        <span><span class="developer-org-name">${escapeHtml(label)}</span><span class="developer-org-access">${access}</span></span>
+        <span class="developer-choice-mark" aria-hidden="true">✓</span>
+      </span>
+    </label>`;
+}
+function renderEnvironmentPanel(choice, choiceIndex) {
+    const environments = orderedEnvironments(choice.environments)
+        .map((environment, environmentIndex) => renderEnvironment(environment, choiceIndex, environmentIndex, choiceIndex === 0))
         .join('');
     const capabilities = choice.capabilities
         .map((capability) => `<li>${escapeHtml(CAPABILITY_COPY[capability])}</li>`)
         .join('');
-    return `<fieldset>
-      <legend><label><input type="radio" name="org" value="${org}"${index === 0 ? ' checked' : ''} /> ${label}</label></legend>
-      <p class="ns-note">Environments</p>
-      <div>${environments}</div>
-      <p class="ns-note">Autonomous capabilities</p>
-      <ul>${capabilities}</ul>
-    </fieldset>`;
+    const label = choice.displayName ?? choice.org;
+    return `<section class="developer-section" data-org-panel="${choiceIndex}" data-org-name="${escapeHtml(label)}" data-capability-summary="${escapeHtml(capabilitySummary(choice.capabilities))}"${choiceIndex === 0 ? '' : ' hidden'}>
+      <h2 class="developer-step"><span class="developer-step-number">2</span>Choose environments</h2>
+      <p class="developer-help">Select every environment this plugin should be able to operate. Development is selected for you.</p>
+      <div class="developer-environment-grid">${environments}</div>
+      <details class="developer-capabilities">
+        <summary>What the plugin can do</summary>
+        <ul>${capabilities}</ul>
+      </details>
+    </section>`;
+}
+function renderEnvironment(environment, choiceIndex, environmentIndex, active) {
+    const id = `developer-environment-${choiceIndex}-${environmentIndex}`;
+    const selected = active && environment === 'dev';
+    const note = environmentNote(environment);
+    return `<label class="developer-environment" for="${id}">
+      <input id="${id}" type="checkbox" name="environment" value="${escapeHtml(environment)}"${selected ? ' checked' : ''}${active ? '' : ' disabled'} />
+      <span class="developer-environment-card">
+        <span class="developer-checkbox" aria-hidden="true">✓</span>
+        <span><span class="developer-environment-name">${escapeHtml(environment)}</span><span class="developer-environment-note${environment === 'prod' ? ' is-production' : ''}">${note}</span></span>
+      </span>
+    </label>`;
+}
+function orderedEnvironments(environments) {
+    return [...new Set(environments)].sort((left, right) => {
+        const leftPriority = ENVIRONMENT_PRIORITY[left] ?? 2;
+        const rightPriority = ENVIRONMENT_PRIORITY[right] ?? 2;
+        return leftPriority - rightPriority || left.localeCompare(right);
+    });
+}
+function environmentNote(environment) {
+    if (environment === 'dev')
+        return 'Recommended';
+    if (environment === 'prod')
+        return 'Can affect live users';
+    return 'Optional';
+}
+function capabilitySummary(capabilities) {
+    const actions = [];
+    if (capabilities.includes('cloud:read'))
+        actions.push('read cloud state');
+    if (capabilities.includes('deployments:write'))
+        actions.push('build and deploy apps');
+    if (capabilities.includes('deployments:rollback'))
+        actions.push('roll back deployments');
+    if (actions.length === 0)
+        return 'use its assigned capabilities';
+    if (actions.length === 1)
+        return actions[0] ?? 'use its assigned capabilities';
+    return `${actions.slice(0, -1).join(', ')} and ${actions.at(-1)}`;
 }
 function escapeHtml(value) {
     return value

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-page.js.map

@@ -1 +1 @@
-{"version":3,"file":"developer-grant-page.js","sourceRoot":"","sources":["../../src/oauth/developer-grant-page.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAahD,MAAM,eAAe,GAAkD;IACrE,YAAY,EAAE,gEAAgE;IAC9E,mBAAmB,EAAE,oDAAoD;IACzE,sBAAsB,EAAE,uBAAuB;CAChD,CAAC;AAEF,MAAM,UAAU,wBAAwB,CAAC,KAA8B;IACrE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzD,MAAM,QAAQ,GACZ,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QACxB,CAAC,CAAC,yEAAyE;QAC3E,CAAC,CAAC,GAAG,OAAO;;;aAGL,CAAC;IACZ,MAAM,WAAW,GAAG,8BAA8B,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;;kEAEd,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;kEAC3B,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC;kEAC9B,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC;;kCAE9D,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;uDACR,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;QAC3E,QAAQ;YACJ,CAAC;IACX,OAAO,eAAe,CAAC;QACrB,KAAK,EAAE,0CAA0C;QACjD,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,gDAAgD;QACzD,WAAW;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,MAA4B,EAAE,KAAa;IAC/D,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY;SACrC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;QACnB,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,cAAc,GAClB,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,2DAA2D,OAAO,QAAQ,OAAO,GAAG,cAAc,UAAU,CAAC;IACtH,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY;SACrC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;SAC1E,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO;6DACoD,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK;;aAEhG,YAAY;;YAEb,YAAY;gBACR,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"developer-grant-page.js","sourceRoot":"","sources":["../../src/oauth/developer-grant-page.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAahD,MAAM,eAAe,GAAkD;IACrE,YAAY,EAAE,gEAAgE;IAC9E,mBAAmB,EAAE,oDAAoD;IACzE,sBAAsB,EAAE,uBAAuB;CAChD,CAAC;AAEF,MAAM,oBAAoB,GAAqC;IAC7D,GAAG,EAAE,CAAC;IACN,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgD9B,CAAC;AAEF,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA6DrB,CAAC;AAEX,MAAM,UAAU,wBAAwB,CAAC,KAA8B;IACrE,MAAM,QAAQ,GACZ,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QACxB,CAAC,CAAC,qGAAqG;QACvG,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,WAAW,GAAG,qEAAqE,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;;yEAE9C,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;yEAC3D,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC;yEACjE,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC;;kCAExG,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,oEAAoE,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;uDACxG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;QAC3E,QAAQ;YACJ,CAAC;IACX,OAAO,eAAe,CAAC;QACrB,KAAK,EAAE,0CAA0C;QACjD,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,gDAAgD;QACzD,WAAW;QACX,gBAAgB,EAAE,sBAAsB;QACxC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAC;KAC9E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,KAA8B;IACpD,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,kBAAkB,GAAG,KAAK,EAAE,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAChG,MAAM,cAAc,GAClB,KAAK,KAAK,SAAS,IAAI,kBAAkB,KAAK,SAAS;QACrD,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,QAAQ,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,GAAG,QAAQ,kBAAkB,GAAG;QACpI,CAAC,CAAC,8CAA8C,CAAC;IACrD,OAAO;;;wCAG+B,aAAa;;WAE1C,MAAM;;;iEAGgD,UAAU,CAAC,cAAc,CAAC;;;;;;WAMhF,CAAC;AACZ,CAAC;AAED,SAAS,wBAAwB,CAAC,MAA4B,EAAE,KAAa;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QACjE,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,kBAAkB,CAAC;IACvB,OAAO;8CACqC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,sBAAsB,KAAK,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;;iDAE/E,UAAU,CAAC,KAAK,CAAC,6CAA6C,MAAM;;;aAGxG,CAAC;AACd,CAAC;AAED,SAAS,sBAAsB,CAAC,MAA4B,EAAE,WAAmB;IAC/E,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC;SAC1D,GAAG,CAAC,CAAC,WAAW,EAAE,gBAAgB,EAAE,EAAE,CACrC,iBAAiB,CAAC,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,KAAK,CAAC,CAAC,CACjF;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY;SACrC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;SAC1E,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC;IAC/C,OAAO,sDAAsD,WAAW,oBAAoB,UAAU,CAAC,KAAK,CAAC,8BAA8B,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;;;gDAGrL,YAAY;;;cAG9C,YAAY;;eAEX,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CACxB,WAAmB,EACnB,WAAmB,EACnB,gBAAwB,EACxB,MAAe;IAEf,MAAM,EAAE,GAAG,yBAAyB,WAAW,IAAI,gBAAgB,EAAE,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,WAAW,KAAK,KAAK,CAAC;IACjD,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC1C,OAAO,6CAA6C,EAAE;mBACrC,EAAE,+CAA+C,UAAU,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW;;;yDAG5F,UAAU,CAAC,WAAW,CAAC,iDAAiD,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI;;aAE3K,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,YAA+B;IAC1D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACrD,MAAM,YAAY,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,aAAa,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvD,OAAO,YAAY,GAAG,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,WAAmB;IAC1C,IAAI,WAAW,KAAK,KAAK;QAAE,OAAO,aAAa,CAAC;IAChD,IAAI,WAAW,KAAK,MAAM;QAAE,OAAO,uBAAuB,CAAC;IAC3D,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,iBAAiB,CAAC,YAA4C;IACrE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC1E,IAAI,YAAY,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACtF,IAAI,YAAY,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACzF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,+BAA+B,CAAC;IACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,+BAA+B,CAAC;IAC/E,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/first-party-client.d.ts

@@ -0,0 +1,13 @@
+import type { OAuthClientInformationFull } from '@modelcontextprotocol/sdk/shared/auth.js';
+import type { OAuthStore } from './store.js';
+export interface ConsoleOAuthClientInput {
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly resource: string;
+}
+/** Build the one exact public client used by the hosted Console's server-side PKCE flow. */
+export declare function resolveConsoleOAuthClient(input: ConsoleOAuthClientInput): OAuthClientInformationFull;
+/** Idempotently repairs only the reserved Console client; dynamic MCP registrations remain untouched. */
+export declare function reconcileConsoleOAuthClient(store: Pick<OAuthStore, 'putFirstPartyClient'>, input: ConsoleOAuthClientInput): Promise<OAuthClientInformationFull>;
+export declare function reconcileConfiguredConsoleOAuthClient(store: Pick<OAuthStore, 'putFirstPartyClient'>, input: Omit<ConsoleOAuthClientInput, 'resource'> | undefined, resource: string): Promise<void>;
+//# sourceMappingURL=first-party-client.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/first-party-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"first-party-client.d.ts","sourceRoot":"","sources":["../../src/oauth/first-party-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AAC3F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAK7C,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,4FAA4F;AAC5F,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,uBAAuB,GAC7B,0BAA0B,CAwB5B;AAED,yGAAyG;AACzG,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,qBAAqB,CAAC,EAC9C,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,0BAA0B,CAAC,CAGrC;AAED,wBAAsB,qCAAqC,CACzD,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,qBAAqB,CAAC,EAC9C,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,UAAU,CAAC,GAAG,SAAS,EAC5D,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAGf"}

package/node_modules/@noodle-borg/service/dist/oauth/first-party-client.js

@@ -0,0 +1,62 @@
+const CLIENT_ID_PATTERN = /^[A-Za-z0-9._~-]{1,200}$/;
+const CONSOLE_CALLBACK_PATH = '/api/console/auth/callback';
+/** Build the one exact public client used by the hosted Console's server-side PKCE flow. */
+export function resolveConsoleOAuthClient(input) {
+    const clientId = input.clientId.trim();
+    if (!CLIENT_ID_PATTERN.test(clientId))
+        throw invalidClient();
+    const redirect = safeUrl(input.redirectUri, true);
+    const resource = safeUrl(input.resource, false);
+    if (redirect.pathname !== CONSOLE_CALLBACK_PATH ||
+        resource.pathname !== '/' ||
+        redirect.search !== '' ||
+        redirect.hash !== '' ||
+        resource.search !== '' ||
+        resource.hash !== '') {
+        throw invalidClient();
+    }
+    return {
+        client_id: clientId,
+        client_name: 'Noodle Console',
+        redirect_uris: [redirect.href],
+        token_endpoint_auth_method: 'none',
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        default_resource: resource.href,
+    };
+}
+/** Idempotently repairs only the reserved Console client; dynamic MCP registrations remain untouched. */
+export async function reconcileConsoleOAuthClient(store, input) {
+    const client = resolveConsoleOAuthClient(input);
+    return store.putFirstPartyClient('console', client);
+}
+export async function reconcileConfiguredConsoleOAuthClient(store, input, resource) {
+    if (input === undefined)
+        return;
+    await reconcileConsoleOAuthClient(store, { ...input, resource });
+}
+function safeUrl(value, callback) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw invalidClient();
+    }
+    const loopback = isLoopback(url.hostname);
+    if (url.username !== '' ||
+        url.password !== '' ||
+        (url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback)) ||
+        (!callback && url.pathname !== '/')) {
+        throw invalidClient();
+    }
+    return url;
+}
+function isLoopback(hostname) {
+    const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    return normalized === 'localhost' || normalized === '::1' || normalized.startsWith('127.');
+}
+function invalidClient() {
+    return new Error('Console OAuth client configuration is invalid');
+}
+//# sourceMappingURL=first-party-client.js.map

package/node_modules/@noodle-borg/service/dist/oauth/first-party-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"first-party-client.js","sourceRoot":"","sources":["../../src/oauth/first-party-client.ts"],"names":[],"mappings":"AAGA,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AACrD,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAQ3D,4FAA4F;AAC5F,MAAM,UAAU,yBAAyB,CACvC,KAA8B;IAE9B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,aAAa,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChD,IACE,QAAQ,CAAC,QAAQ,KAAK,qBAAqB;QAC3C,QAAQ,CAAC,QAAQ,KAAK,GAAG;QACzB,QAAQ,CAAC,MAAM,KAAK,EAAE;QACtB,QAAQ,CAAC,IAAI,KAAK,EAAE;QACpB,QAAQ,CAAC,MAAM,KAAK,EAAE;QACtB,QAAQ,CAAC,IAAI,KAAK,EAAE,EACpB,CAAC;QACD,MAAM,aAAa,EAAE,CAAC;IACxB,CAAC;IACD,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,WAAW,EAAE,gBAAgB;QAC7B,aAAa,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC9B,0BAA0B,EAAE,MAAM;QAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACpD,cAAc,EAAE,CAAC,MAAM,CAAC;QACxB,gBAAgB,EAAE,QAAQ,CAAC,IAAI;KACF,CAAC;AAClC,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAA8C,EAC9C,KAA8B;IAE9B,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAA8C,EAC9C,KAA4D,EAC5D,QAAgB;IAEhB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,MAAM,2BAA2B,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,QAAiB;IAC/C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,aAAa,EAAE,CAAC;IACxB,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,IACE,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,CAAC;QACtE,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,EACnC,CAAC;QACD,MAAM,aAAa,EAAE,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;AACpE,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/metadata.d.ts

@@ -0,0 +1,4 @@
+import type { OAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/provider.js';
+/** RFC 8414 metadata with the Noodle device-flow and canonical issuer additions. */
+export declare function noodleOAuthMetadata(provider: OAuthServerProvider, issuer: string, deviceGrant: string): Record<string, unknown>;
+//# sourceMappingURL=metadata.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../src/oauth/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AAG7F,oFAAoF;AACpF,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,mBAAmB,EAC7B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBzB"}

package/node_modules/@noodle-borg/service/dist/oauth/metadata.js

@@ -0,0 +1,20 @@
+import { createOAuthMetadata } from '@modelcontextprotocol/sdk/server/auth/router.js';
+/** RFC 8414 metadata with the Noodle device-flow and canonical issuer additions. */
+export function noodleOAuthMetadata(provider, issuer, deviceGrant) {
+    const base = createOAuthMetadata({ provider, issuerUrl: new URL(issuer) });
+    // The SDK emits `issuer` as `URL.href`, which appends a trailing slash for a path-less origin
+    // (`https://h` → `https://h/`). RFC 8414 §3.3 requires the metadata `issuer` to be identical to the
+    // issuer used to build the well-known URL, and our token `iss` + the PRM `authorization_servers` entry
+    // use the no-slash form — so normalize it back for consistency across all three.
+    const grants = Array.isArray(base.grant_types_supported)
+        ? base.grant_types_supported
+        : ['authorization_code', 'refresh_token'];
+    return {
+        ...base,
+        issuer,
+        grant_types_supported: [...new Set([...grants, deviceGrant])],
+        device_authorization_endpoint: `${issuer}/device_authorization`,
+        jwks_uri: `${issuer}/.well-known/jwks.json`,
+    };
+}
+//# sourceMappingURL=metadata.js.map

package/node_modules/@noodle-borg/service/dist/oauth/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../src/oauth/metadata.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAEtF,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CACjC,QAA6B,EAC7B,MAAc,EACd,WAAmB;IAEnB,MAAM,IAAI,GAAG,mBAAmB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3E,8FAA8F;IAC9F,oGAAoG;IACpG,uGAAuG;IACvG,iFAAiF;IACjF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC;QACtD,CAAC,CAAC,IAAI,CAAC,qBAAqB;QAC5B,CAAC,CAAC,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;IAC5C,OAAO;QACL,GAAG,IAAI;QACP,MAAM;QACN,qBAAqB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;QAC7D,6BAA6B,EAAE,GAAG,MAAM,uBAAuB;QAC/D,QAAQ,EAAE,GAAG,MAAM,wBAAwB;KAC5C,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/oauth/paths.ts"],"names":[],"mappings":"AAuBA,2GAA2G;AAC3G,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE1D"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/oauth/paths.ts"],"names":[],"mappings":"AAyBA,2GAA2G;AAC3G,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE1D"}

package/node_modules/@noodle-borg/service/dist/oauth/paths.js

@@ -11,6 +11,8 @@ const AUTH_SERVER_PATHS = new Set([
     '/revoke',
     '/register',
     '/oauth/google/callback',
+    '/oauth/workos/callback',
+    '/oauth/upstream/continue',
     '/oauth/device/callback',
     '/oauth/consent',
     '/oauth/developer-grant',

package/node_modules/@noodle-borg/service/dist/oauth/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/oauth/paths.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,YAAY;IACZ,uBAAuB;IACvB,SAAS;IACT,QAAQ;IACR,SAAS;IACT,WAAW;IACX,wBAAwB;IACxB,wBAAwB;IACxB,gBAAgB;IAChB,wBAAwB;IACxB,oCAAoC;IACpC,mCAAmC;IACnC,oCAAoC;IACpC,yCAAyC;IACzC,wBAAwB;CACzB,CAAC,CAAC;AAEH,2GAA2G;AAC3G,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/oauth/paths.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,YAAY;IACZ,uBAAuB;IACvB,SAAS;IACT,QAAQ;IACR,SAAS;IACT,WAAW;IACX,wBAAwB;IACxB,wBAAwB;IACxB,0BAA0B;IAC1B,wBAAwB;IACxB,gBAAgB;IAChB,wBAAwB;IACxB,oCAAoC;IACpC,mCAAmC;IACnC,oCAAoC;IACpC,yCAAyC;IACzC,wBAAwB;CACzB,CAAC,CAAC;AAEH,2GAA2G;AAC3G,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACzC,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/platform-principal-guard.d.ts

@@ -0,0 +1,15 @@
+import type { OAuthClientInformationFull } from '@modelcontextprotocol/sdk/shared/auth.js';
+import type { OwnerTokenVerifier } from '@noodle-borg/transport-http';
+import { type PlatformPrincipalResolver } from '../platform-identity.js';
+import type { GoogleIdentity } from './google.js';
+import type { OAuthStore } from './store.js';
+/** Enforce canonical-principal suspension on every platform access-token authorization. */
+export declare function guardPlatformAccessTokenVerifier(verifier: OwnerTokenVerifier, resolver: PlatformPrincipalResolver): OwnerTokenVerifier;
+/** Resolve a verified Google human before its subject can reach consent or token issuance. */
+export declare function resolveGooglePlatformPrincipal(resolver: PlatformPrincipalResolver | undefined, identity: GoogleIdentity): Promise<boolean>;
+/** Fail before rotation so suspending a principal cannot mint a successor refresh token. */
+export declare function assertPlatformRefreshPrincipal(store: OAuthStore, resolver: PlatformPrincipalResolver | undefined, input: {
+    readonly oldTokenHash: string;
+    readonly client: OAuthClientInformationFull;
+}): Promise<void>;
+//# sourceMappingURL=platform-principal-guard.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/platform-principal-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-principal-guard.d.ts","sourceRoot":"","sources":["../../src/oauth/platform-principal-guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AAC3F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAyB,KAAK,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,2FAA2F;AAC3F,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,kBAAkB,EAC5B,QAAQ,EAAE,yBAAyB,GAClC,kBAAkB,CAapB;AAED,8FAA8F;AAC9F,wBAAsB,8BAA8B,CAClD,QAAQ,EAAE,yBAAyB,GAAG,SAAS,EAC/C,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,OAAO,CAAC,CAclB;AAED,4FAA4F;AAC5F,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,yBAAyB,GAAG,SAAS,EAC/C,KAAK,EAAE;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAA;CAAE,GACpF,OAAO,CAAC,IAAI,CAAC,CAkBf"}

package/node_modules/@noodle-borg/service/dist/oauth/platform-principal-guard.js

@@ -0,0 +1,58 @@
+import { InvalidGrantError } from '@modelcontextprotocol/sdk/server/auth/errors.js';
+import { PlatformIdentityError } from '../platform-identity.js';
+/** Enforce canonical-principal suspension on every platform access-token authorization. */
+export function guardPlatformAccessTokenVerifier(verifier, resolver) {
+    return async (token, resource) => {
+        const identity = await verifier(token, resource);
+        if (identity === null || identity.identityKind === 'customer')
+            return identity;
+        try {
+            // Missing principals are pre-backfill legacy identities and remain compatible; the durable resolver
+            // throws only for a known suspended principal. Any persistence failure still fails authorization closed.
+            await resolver.resolveExisting(identity.subject);
+            return identity;
+        }
+        catch {
+            return null;
+        }
+    };
+}
+/** Resolve a verified Google human before its subject can reach consent or token issuance. */
+export async function resolveGooglePlatformPrincipal(resolver, identity) {
+    if (resolver === undefined)
+        return true;
+    try {
+        const resolved = await resolver.resolve({
+            provider: 'google',
+            realm: 'accounts.google.com',
+            subject: identity.subject,
+            email: identity.email,
+            emailVerified: true,
+        });
+        return resolved.subject === identity.subject;
+    }
+    catch {
+        return false;
+    }
+}
+/** Fail before rotation so suspending a principal cannot mint a successor refresh token. */
+export async function assertPlatformRefreshPrincipal(store, resolver, input) {
+    if (resolver === undefined)
+        return;
+    const current = await store.getRefreshToken(input.oldTokenHash);
+    if (current === undefined ||
+        current.clientId !== input.client.client_id ||
+        current.identityKind === 'customer') {
+        return;
+    }
+    try {
+        await resolver.resolveExisting(current.ownerSubject);
+    }
+    catch (error) {
+        if (error instanceof PlatformIdentityError && error.code === 'principal_suspended') {
+            throw new InvalidGrantError('invalid refresh token');
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=platform-principal-guard.js.map

package/node_modules/@noodle-borg/service/dist/oauth/platform-principal-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-principal-guard.js","sourceRoot":"","sources":["../../src/oauth/platform-principal-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAGpF,OAAO,EAAE,qBAAqB,EAAkC,MAAM,yBAAyB,CAAC;AAIhG,2FAA2F;AAC3F,MAAM,UAAU,gCAAgC,CAC9C,QAA4B,EAC5B,QAAmC;IAEnC,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACjD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,YAAY,KAAK,UAAU;YAAE,OAAO,QAAQ,CAAC;QAC/E,IAAI,CAAC;YACH,oGAAoG;YACpG,yGAAyG;YACzG,MAAM,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACjD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,QAA+C,EAC/C,QAAwB;IAExB,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;YACtC,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAiB,EACjB,QAA+C,EAC/C,KAAqF;IAErF,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO;IACnC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAChE,IACE,OAAO,KAAK,SAAS;QACrB,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,CAAC,SAAS;QAC3C,OAAO,CAAC,YAAY,KAAK,UAAU,EACnC,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;YACnF,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/platform-principal-postgres.d.ts

@@ -0,0 +1,8 @@
+import type { Pool, PoolClient } from 'pg';
+export declare function ensurePlatformPrincipalSuspensionRefreshTrigger(pool: Pool): Promise<void>;
+/** Serialize a platform refresh with suspension, but leave missing legacy principals compatible. */
+export declare function lockAndAssertPlatformRefreshPrincipal(client: PoolClient, input: {
+    readonly oldTokenHash: string;
+    readonly clientId: string;
+}): Promise<'continue' | 'unknown' | 'suspended'>;
+//# sourceMappingURL=platform-principal-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/platform-principal-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-principal-postgres.d.ts","sourceRoot":"","sources":["../../src/oauth/platform-principal-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAO3C,wBAAsB,+CAA+C,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B/F;AAED,oGAAoG;AACpG,wBAAsB,qCAAqC,CACzD,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAClE,OAAO,CAAC,UAAU,GAAG,SAAS,GAAG,WAAW,CAAC,CA6B/C"}

package/node_modules/@noodle-borg/service/dist/oauth/platform-principal-postgres.js

@@ -0,0 +1,49 @@
+export async function ensurePlatformPrincipalSuspensionRefreshTrigger(pool) {
+    await pool.query(`
+    CREATE OR REPLACE FUNCTION platform_principal_suspension_revokes_refresh_tokens() RETURNS trigger AS $$
+    BEGIN
+      IF OLD.status = 'active' AND NEW.status = 'suspended' THEN
+        DELETE FROM oauth_refresh_tokens
+          WHERE owner_subject = NEW.principal_id AND identity_kind IS DISTINCT FROM 'customer';
+      END IF;
+      RETURN NEW;
+    END;
+    $$ LANGUAGE plpgsql
+  `);
+    await pool.query(`
+    DO $platform_principal_refresh_trigger$
+    BEGIN
+      IF NOT EXISTS (SELECT 1 FROM pg_trigger
+        WHERE tgname = 'platform_principal_suspension_revokes_refresh_tokens_trigger'
+          AND tgrelid = 'platform_principals'::regclass AND NOT tgisinternal) THEN
+        CREATE TRIGGER platform_principal_suspension_revokes_refresh_tokens_trigger
+          AFTER UPDATE OF status ON platform_principals
+          FOR EACH ROW EXECUTE FUNCTION platform_principal_suspension_revokes_refresh_tokens();
+      END IF;
+    EXCEPTION WHEN duplicate_object THEN NULL;
+    END
+    $platform_principal_refresh_trigger$
+  `);
+}
+/** Serialize a platform refresh with suspension, but leave missing legacy principals compatible. */
+export async function lockAndAssertPlatformRefreshPrincipal(client, input) {
+    const hinted = await client.query('SELECT owner_subject, identity_kind FROM oauth_refresh_tokens WHERE token = $1 AND client_id = $2', [input.oldTokenHash, input.clientId]);
+    const hint = hinted.rows[0];
+    if (hint === undefined || hint.identity_kind === 'customer')
+        return 'continue';
+    await client.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [
+        `platform-principal:${hint.owner_subject}`,
+    ]);
+    const current = await client.query('SELECT owner_subject, identity_kind FROM oauth_refresh_tokens WHERE token = $1 AND client_id = $2 FOR UPDATE', [input.oldTokenHash, input.clientId]);
+    if (current.rows[0] === undefined)
+        return 'unknown';
+    const relation = await client.query("SELECT to_regclass('platform_principals')::text AS relation");
+    if (relation.rows[0]?.relation === null)
+        return 'continue';
+    const principal = await client.query('SELECT status FROM platform_principals WHERE principal_id = $1 FOR SHARE', [hint.owner_subject]);
+    if (principal.rows[0]?.status !== 'suspended')
+        return 'continue';
+    await client.query("DELETE FROM oauth_refresh_tokens WHERE owner_subject = $1 AND identity_kind IS DISTINCT FROM 'customer'", [hint.owner_subject]);
+    return 'suspended';
+}
+//# sourceMappingURL=platform-principal-postgres.js.map

package/node_modules/@noodle-borg/service/dist/oauth/platform-principal-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-principal-postgres.js","sourceRoot":"","sources":["../../src/oauth/platform-principal-postgres.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,KAAK,UAAU,+CAA+C,CAAC,IAAU;IAC9E,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;GAUhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;GAahB,CAAC,CAAC;AACL,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,MAAkB,EAClB,KAAmE;IAEnE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,mGAAmG,EACnG,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CACrC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IAC/E,MAAM,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE;QAC1E,sBAAsB,IAAI,CAAC,aAAa,EAAE;KAC3C,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC,8GAA8G,EAC9G,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CACrC,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,6DAA6D,CAC9D,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,0EAA0E,EAC1E,CAAC,IAAI,CAAC,aAAa,CAAC,CACrB,CAAC;IACF,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,WAAW;QAAE,OAAO,UAAU,CAAC;IACjE,MAAM,MAAM,CAAC,KAAK,CAChB,yGAAyG,EACzG,CAAC,IAAI,CAAC,aAAa,CAAC,CACrB,CAAC;IACF,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/postgres-time.d.ts

@@ -0,0 +1,3 @@
+export declare function postgresEpochSeconds(date: Date): number;
+export declare function postgresTimestampIsLive(expiresAt: Date): boolean;
+//# sourceMappingURL=postgres-time.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/postgres-time.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-time.d.ts","sourceRoot":"","sources":["../../src/oauth/postgres-time.ts"],"names":[],"mappings":"AAAA,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAEvD;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,IAAI,GAAG,OAAO,CAEhE"}

package/node_modules/@noodle-borg/service/dist/oauth/postgres-time.js

@@ -0,0 +1,7 @@
+export function postgresEpochSeconds(date) {
+    return Math.floor(new Date(date).getTime() / 1000);
+}
+export function postgresTimestampIsLive(expiresAt) {
+    return new Date(expiresAt).getTime() > Date.now();
+}
+//# sourceMappingURL=postgres-time.js.map

package/node_modules/@noodle-borg/service/dist/oauth/postgres-time.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-time.js","sourceRoot":"","sources":["../../src/oauth/postgres-time.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,oBAAoB,CAAC,IAAU;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,SAAe;IACrD,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACpD,CAAC"}