@noodleseed/one 0.63.1 → 0.64.0

package/node_modules/@noodle-borg/service/dist/oauth/upstream-consent.d.ts

@@ -0,0 +1,21 @@
+import type { Response } from 'express';
+import type { ConsentClaims } from './consent-claims.js';
+import { type DeveloperGrantOAuthFlow } from './developer-grant-flow.js';
+import type { OAuthStore, PendingAuthorizationRecord } from './store.js';
+import type { OAuthTokenIssuer } from './token-issuer.js';
+export declare function renderUpstreamConsent(input: {
+    readonly pending: PendingAuthorizationRecord;
+    readonly identity: {
+        readonly email: string;
+        readonly locale?: string;
+        readonly timeZone?: string;
+    };
+    readonly ownerSubject: string;
+    readonly issuer: string;
+    readonly store: OAuthStore;
+    readonly tokenIssuer: OAuthTokenIssuer;
+    readonly developerGrantFlow?: DeveloperGrantOAuthFlow;
+    readonly signConsent: (claims: ConsentClaims) => Promise<string>;
+    readonly res: Response;
+}): Promise<void>;
+//# sourceMappingURL=upstream-consent.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-consent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-consent.d.ts","sourceRoot":"","sources":["../../src/oauth/upstream-consent.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,KAAK,EAAE,UAAU,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IACtD,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;CACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8DhB"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-consent.js

@@ -0,0 +1,56 @@
+import { renderConsentPage } from './consent.js';
+import { isDeveloperResourceForIssuer, } from './developer-grant-flow.js';
+import { storedOAuthOwnerPreferences } from './identity-preferences.js';
+import { hostOf } from './provider-util.js';
+export async function renderUpstreamConsent(input) {
+    const preferences = storedOAuthOwnerPreferences(input.identity);
+    if (isDeveloperResourceForIssuer(input.pending.resource, input.issuer)) {
+        if (input.developerGrantFlow === undefined) {
+            input.res.status(400).type('text/plain').send('developer access is not configured');
+            return;
+        }
+        await input.developerGrantFlow.renderSelection(input.pending, { subject: input.ownerSubject, email: input.identity.email, ...preferences }, input.res);
+        return;
+    }
+    if (await input.store.hasConsentGrant(input.pending.clientId, input.ownerSubject, input.pending.resource)) {
+        await input.tokenIssuer.issueAuthorizationCode(input.res, {
+            clientId: input.pending.clientId,
+            codeChallenge: input.pending.codeChallenge,
+            redirectUri: input.pending.redirectUri,
+            resource: input.pending.resource,
+            ownerSubject: input.ownerSubject,
+            ownerEmail: input.identity.email,
+            ...preferences,
+            ...(input.pending.clientState !== undefined
+                ? { clientState: input.pending.clientState }
+                : {}),
+            ...(input.pending.scope !== undefined ? { scope: input.pending.scope } : {}),
+        });
+        return;
+    }
+    const consentToken = await input.signConsent({
+        kind: 'consent',
+        clientId: input.pending.clientId,
+        redirectUri: input.pending.redirectUri,
+        codeChallenge: input.pending.codeChallenge,
+        resource: input.pending.resource,
+        ownerSubject: input.ownerSubject,
+        ownerEmail: input.identity.email,
+        ...preferences,
+        ...(input.pending.clientState !== undefined ? { clientState: input.pending.clientState } : {}),
+        ...(input.pending.scope !== undefined ? { scope: input.pending.scope } : {}),
+    });
+    const client = await input.store.getClient(input.pending.clientId);
+    input.res
+        .status(200)
+        .type('html')
+        .send(renderConsentPage({
+        clientName: client?.client_name ?? input.pending.clientId,
+        resourceHost: hostOf(input.pending.resource),
+        redirectHost: hostOf(input.pending.redirectUri),
+        userEmail: input.identity.email,
+        consentToken,
+        consentAction: '/oauth/consent',
+    }));
+}
+//# sourceMappingURL=upstream-consent.js.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-consent.js","sourceRoot":"","sources":["../../src/oauth/upstream-consent.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAEL,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAI5C,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAc3C;IACC,MAAM,WAAW,GAAG,2BAA2B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC3C,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC,kBAAkB,CAAC,eAAe,CAC5C,KAAK,CAAC,OAAO,EACb,EAAE,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,WAAW,EAAE,EAC5E,KAAK,CAAC,GAAG,CACV,CAAC;QACF,OAAO;IACT,CAAC;IACD,IACE,MAAM,KAAK,CAAC,KAAK,CAAC,eAAe,CAC/B,KAAK,CAAC,OAAO,CAAC,QAAQ,EACtB,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,OAAO,CAAC,QAAQ,CACvB,EACD,CAAC;QACD,MAAM,KAAK,CAAC,WAAW,CAAC,sBAAsB,CAAC,KAAK,CAAC,GAAG,EAAE;YACxD,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;YAChC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa;YAC1C,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW;YACtC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;YAChC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;YAChC,GAAG,WAAW;YACd,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7E,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;QAC3C,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;QAChC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW;QACtC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa;QAC1C,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAChC,GAAG,WAAW;QACd,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnE,KAAK,CAAC,GAAG;SACN,MAAM,CAAC,GAAG,CAAC;SACX,IAAI,CAAC,MAAM,CAAC;SACZ,IAAI,CACH,iBAAiB,CAAC;QAChB,UAAU,EAAE,MAAM,EAAE,WAAW,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ;QACzD,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC5C,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAC/C,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC/B,YAAY;QACZ,aAAa,EAAE,gBAAgB;KAChC,CAAC,CACH,CAAC;AACN,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-federation.d.ts

@@ -0,0 +1,30 @@
+import type { ControlPlaneSignupMode, SignupAuthorizer } from '../auth/deploy-gate.js';
+import { type PlatformPrincipalResolver, type UpstreamHumanIdentity } from '../platform-identity.js';
+import type { GoogleAuthenticator } from './google.js';
+import type { UpstreamHumanOAuthAuthenticator, UpstreamHumanProvider } from './upstream-human.js';
+export declare function upstreamAuthorizationUrl(input: {
+    readonly provider: UpstreamHumanProvider;
+    readonly google?: GoogleAuthenticator;
+    readonly workos?: UpstreamHumanOAuthAuthenticator;
+    readonly state: string;
+}): string;
+export declare function exchangeUpstreamHumanIdentity(input: {
+    readonly provider: UpstreamHumanProvider;
+    readonly code: string;
+    readonly google?: GoogleAuthenticator;
+    readonly workos?: UpstreamHumanOAuthAuthenticator;
+}): Promise<UpstreamHumanIdentity & {
+    readonly locale?: string;
+    readonly timeZone?: string;
+}>;
+export declare function resolveUpstreamHumanPrincipal(input: {
+    readonly provider: UpstreamHumanProvider;
+    readonly identity: UpstreamHumanIdentity;
+    readonly resolver?: PlatformPrincipalResolver;
+    readonly signupAuthorizer?: SignupAuthorizer;
+    readonly allowedEmailDomain?: string;
+    readonly signupMode?: ControlPlaneSignupMode;
+    readonly deniedSignupDomains?: readonly string[];
+    readonly deniedSignupSubjects?: readonly string[];
+}): Promise<string>;
+//# sourceMappingURL=upstream-federation.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-federation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-federation.d.ts","sourceRoot":"","sources":["../../src/oauth/upstream-federation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EAAE,+BAA+B,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAElG,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,+BAA+B,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GAAG,MAAM,CAMT;AAED,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IACzD,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,+BAA+B,CAAC;CACnD,GAAG,OAAO,CAAC,qBAAqB,GAAG;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAoB5F;AAED,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IACzD,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,sBAAsB,CAAC;IAC7C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnD,GAAG,OAAO,CAAC,MAAM,CAAC,CA6ClB"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-federation.js

@@ -0,0 +1,94 @@
+import { PlatformIdentityError, } from '../platform-identity.js';
+export function upstreamAuthorizationUrl(input) {
+    if (input.provider === 'google') {
+        if (input.google === undefined)
+            throw new Error('Google authenticator is unavailable');
+        return input.google.authorizationUrl(input.state);
+    }
+    return input.workos?.authorizationUrl(input.state) ?? '';
+}
+export async function exchangeUpstreamHumanIdentity(input) {
+    if (input.provider === 'workos') {
+        if (input.workos === undefined)
+            throw new Error('WorkOS authenticator is unavailable');
+        const identity = await input.workos.exchange(input.code);
+        if (identity.provider !== input.workos.provider || identity.realm !== input.workos.realm) {
+            throw new Error('WorkOS identity provider or realm mismatch');
+        }
+        return identity;
+    }
+    if (input.google === undefined)
+        throw new Error('Google authenticator is unavailable');
+    const identity = await input.google.exchange(input.code);
+    return {
+        provider: 'google',
+        realm: 'accounts.google.com',
+        subject: identity.subject,
+        email: identity.email,
+        emailVerified: true,
+        ...(identity.locale !== undefined ? { locale: identity.locale } : {}),
+        ...(identity.timeZone !== undefined ? { timeZone: identity.timeZone } : {}),
+    };
+}
+export async function resolveUpstreamHumanPrincipal(input) {
+    if (input.provider === 'google') {
+        // Admission is evaluated against the verified Google identity before creating canonical state or
+        // enqueueing WorkOS synchronization. Rejected callbacks must be side-effect free.
+        assertIdentityIsNotDenied(input, input.identity.subject);
+        if ((input.signupMode ?? 'restricted') === 'restricted' &&
+            input.allowedEmailDomain !== undefined &&
+            !emailMatchesDomain(input.identity.email, input.allowedEmailDomain) &&
+            !(await input.signupAuthorizer?.isSignupAllowed({
+                subject: input.identity.subject,
+                email: input.identity.email.toLowerCase(),
+            }))) {
+            throw new PlatformIdentityError('identity_link_required');
+        }
+        return input.resolver === undefined
+            ? input.identity.subject
+            : (await input.resolver.resolve(input.identity)).subject;
+    }
+    if (input.resolver === undefined)
+        throw new PlatformIdentityError('identity_link_required');
+    const existing = await input.resolver.resolveLinked(input.identity);
+    // Linked identities are still observed through the resolver so a newer verified WorkOS email becomes the
+    // sole current provider/realm evidence. This is not email linking: the immutable WorkOS ID was resolved first.
+    if (existing !== undefined) {
+        assertIdentityIsNotDenied(input, existing.subject);
+        return (await input.resolver.resolve(input.identity)).subject;
+    }
+    if (await input.resolver.hasVerifiedEmailEvidence(input.identity.email)) {
+        throw new PlatformIdentityError('identity_link_required');
+    }
+    assertIdentityIsNotDenied(input);
+    if ((input.signupMode ?? 'restricted') === 'public') {
+        return (await input.resolver.resolve(input.identity)).subject;
+    }
+    const signupAllowed = await input.signupAuthorizer?.isSignupAllowed({
+        subject: input.identity.subject,
+        email: input.identity.email.toLowerCase(),
+    });
+    const domainAllowed = input.allowedEmailDomain !== undefined &&
+        emailMatchesDomain(input.identity.email, input.allowedEmailDomain);
+    if (!domainAllowed && signupAllowed !== true)
+        throw new PlatformIdentityError('identity_link_required');
+    return (await input.resolver.resolve(input.identity)).subject;
+}
+function assertIdentityIsNotDenied(input, canonicalSubject) {
+    const subjects = new Set((input.deniedSignupSubjects ?? []).map((subject) => subject.trim().toLowerCase()));
+    const externalSubject = input.identity.subject.toLowerCase();
+    const canonical = canonicalSubject?.toLowerCase();
+    const deniedDomain = (input.deniedSignupDomains ?? []).some((domain) => emailMatchesDomain(input.identity.email, domain));
+    if (subjects.has(externalSubject) ||
+        (canonical !== undefined && subjects.has(canonical)) ||
+        deniedDomain) {
+        throw new PlatformIdentityError('identity_signup_denied');
+    }
+}
+function emailMatchesDomain(email, configuredDomain) {
+    const domain = configuredDomain.trim().toLowerCase();
+    if (domain.length === 0)
+        return false;
+    return email.toLowerCase().endsWith(domain.startsWith('@') ? domain : `@${domain}`);
+}
+//# sourceMappingURL=upstream-federation.js.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-federation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-federation.js","sourceRoot":"","sources":["../../src/oauth/upstream-federation.ts"],"names":[],"mappings":"AACA,OAAO,EACL,qBAAqB,GAGtB,MAAM,yBAAyB,CAAC;AAIjC,MAAM,UAAU,wBAAwB,CAAC,KAKxC;IACC,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACvF,OAAO,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAKnD;IACC,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACzF,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACvF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzD,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,qBAAqB;QAC5B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,aAAa,EAAE,IAAI;QACnB,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KASnD;IACC,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,iGAAiG;QACjG,kFAAkF;QAClF,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzD,IACE,CAAC,KAAK,CAAC,UAAU,IAAI,YAAY,CAAC,KAAK,YAAY;YACnD,KAAK,CAAC,kBAAkB,KAAK,SAAS;YACtC,CAAC,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC;YACnE,CAAC,CAAC,MAAM,KAAK,CAAC,gBAAgB,EAAE,eAAe,CAAC;gBAC9C,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;gBAC/B,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE;aAC1C,CAAC,CAAC,EACH,CAAC;YACD,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS;YACjC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO;YACxB,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7D,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpE,yGAAyG;IACzG,+GAA+G;IAC/G,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,yBAAyB,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnD,OAAO,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;IAC5D,CAAC;IACD,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,YAAY,CAAC,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE,eAAe,CAAC;QAClE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;QAC/B,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE;KAC1C,CAAC,CAAC;IACH,MAAM,aAAa,GACjB,KAAK,CAAC,kBAAkB,KAAK,SAAS;QACtC,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACrE,IAAI,CAAC,aAAa,IAAI,aAAa,KAAK,IAAI;QAC1C,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;IAC5D,OAAO,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAED,SAAS,yBAAyB,CAChC,KAIC,EACD,gBAAyB;IAEzB,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAClF,CAAC;IACF,MAAM,eAAe,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IAC7D,MAAM,SAAS,GAAG,gBAAgB,EAAE,WAAW,EAAE,CAAC;IAClD,MAAM,YAAY,GAAG,CAAC,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACrE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CACjD,CAAC;IACF,IACE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;QAC7B,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpD,YAAY,EACZ,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,gBAAwB;IACjE,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;AACtF,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-human.d.ts

@@ -0,0 +1,33 @@
+import type { UpstreamHumanIdentity } from '../platform-identity.js';
+export type UpstreamHumanProvider = 'google' | 'workos';
+/**
+ * The OAuth-facing federation boundary. Implementations receive an authorization code and return identity
+ * claims only: upstream access and refresh credentials are deliberately discarded at this boundary.
+ */
+export interface UpstreamHumanOAuthAuthenticator {
+    readonly provider: UpstreamHumanProvider;
+    readonly realm: string;
+    authorizationUrl(state: string): string;
+    exchange(code: string): Promise<UpstreamHumanIdentity & {
+        readonly locale?: string;
+        readonly timeZone?: string;
+    }>;
+}
+export interface UpstreamHumanRollout {
+    readonly workosPercentage: number;
+    readonly workosCanaryClientIds: readonly string[];
+    /** Recovery clients remain WorkOS-routed while the normal percentage is rolled back to zero. */
+    readonly workosRecoveryClientIds?: readonly string[];
+    /**
+     * Server-owned rollback state may offer an explicit browser choice to use WorkOS even when this
+     * transaction's normal rollout selection is Google. OAuth clients cannot set this value.
+     */
+    readonly allowUserSelectedWorkosRecovery?: boolean;
+}
+export declare const GOOGLE_ONLY_UPSTREAM_ROLLOUT: UpstreamHumanRollout;
+/** Select once at authorization creation; callbacks must use the stored result, never recalculate rollout. */
+export declare function selectUpstreamHumanProvider(input: {
+    readonly clientId: string;
+    readonly transactionNonce: string;
+}, rollout?: UpstreamHumanRollout): UpstreamHumanProvider;
+//# sourceMappingURL=upstream-human.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-human.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-human.d.ts","sourceRoot":"","sources":["../../src/oauth/upstream-human.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExD;;;GAGG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACxC,QAAQ,CACN,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,qBAAqB,GAAG;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9F;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,gGAAgG;IAChG,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrD;;;OAGG;IACH,QAAQ,CAAC,+BAA+B,CAAC,EAAE,OAAO,CAAC;CACpD;AAED,eAAO,MAAM,4BAA4B,EAAE,oBAK1C,CAAC;AAEF,8GAA8G;AAC9G,wBAAgB,2BAA2B,CACzC,KAAK,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,EACvE,OAAO,GAAE,oBAAmD,GAC3D,qBAAqB,CAavB"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-human.js

@@ -0,0 +1,27 @@
+import { createHash } from 'node:crypto';
+export const GOOGLE_ONLY_UPSTREAM_ROLLOUT = {
+    workosPercentage: 0,
+    workosCanaryClientIds: [],
+    workosRecoveryClientIds: [],
+    allowUserSelectedWorkosRecovery: false,
+};
+/** Select once at authorization creation; callbacks must use the stored result, never recalculate rollout. */
+export function selectUpstreamHumanProvider(input, rollout = GOOGLE_ONLY_UPSTREAM_ROLLOUT) {
+    if (rollout.workosRecoveryClientIds?.includes(input.clientId) === true)
+        return 'workos';
+    if (rollout.workosPercentage <= 0)
+        return 'google';
+    if (rollout.workosCanaryClientIds.includes(input.clientId))
+        return 'workos';
+    if (rollout.workosPercentage >= 100)
+        return 'workos';
+    const digest = createHash('sha256')
+        .update(`${input.clientId}:${input.transactionNonce}`)
+        .digest();
+    // Map a full uint32 into the exact [0, 2^32) range rather than reducing one byte modulo 100, whose
+    // uneven buckets bias an intermediate rollout. The threshold form needs no rejection sampling.
+    const bucket = digest.readUInt32BE(0);
+    const threshold = (rollout.workosPercentage / 100) * 0x1_0000_0000;
+    return bucket < threshold ? 'workos' : 'google';
+}
+//# sourceMappingURL=upstream-human.js.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-human.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-human.js","sourceRoot":"","sources":["../../src/oauth/upstream-human.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA8BzC,MAAM,CAAC,MAAM,4BAA4B,GAAyB;IAChE,gBAAgB,EAAE,CAAC;IACnB,qBAAqB,EAAE,EAAE;IACzB,uBAAuB,EAAE,EAAE;IAC3B,+BAA+B,EAAE,KAAK;CACvC,CAAC;AAEF,8GAA8G;AAC9G,MAAM,UAAU,2BAA2B,CACzC,KAAuE,EACvE,UAAgC,4BAA4B;IAE5D,IAAI,OAAO,CAAC,uBAAuB,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACxF,IAAI,OAAO,CAAC,gBAAgB,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACnD,IAAI,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5E,IAAI,OAAO,CAAC,gBAAgB,IAAI,GAAG;QAAE,OAAO,QAAQ,CAAC;IACrD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;SACrD,MAAM,EAAE,CAAC;IACZ,mGAAmG;IACnG,+FAA+F;IAC/F,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,gBAAgB,GAAG,GAAG,CAAC,GAAG,aAAa,CAAC;IACnE,OAAO,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClD,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-provider-choice.d.ts

@@ -0,0 +1,13 @@
+import type { Request, Response } from 'express';
+import type { GoogleAuthenticator } from './google.js';
+import type { OAuthStore } from './store.js';
+import type { UpstreamHumanOAuthAuthenticator } from './upstream-human.js';
+export declare function renderUpstreamProviderChoice(state: string): string;
+export declare function continueUpstreamProviderChoice(input: {
+    readonly req: Request;
+    readonly res: Response;
+    readonly store: OAuthStore;
+    readonly google?: GoogleAuthenticator;
+    readonly workos?: UpstreamHumanOAuthAuthenticator;
+}): Promise<void>;
+//# sourceMappingURL=upstream-provider-choice.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-provider-choice.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-provider-choice.d.ts","sourceRoot":"","sources":["../../src/oauth/upstream-provider-choice.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAA8B,MAAM,YAAY,CAAC;AAGzE,OAAO,KAAK,EAAE,+BAA+B,EAAyB,MAAM,qBAAqB,CAAC;AAElG,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAalE;AAED,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAC1D,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,+BAA+B,CAAC;CACnD,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BhB"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-provider-choice.js

@@ -0,0 +1,63 @@
+import { renderOAuthPage } from './branding.js';
+import { hashToken, randomToken } from './tokens.js';
+import { upstreamAuthorizationUrl } from './upstream-federation.js';
+export function renderUpstreamProviderChoice(state) {
+    const escapedState = escapeHtml(state);
+    return renderOAuthPage({
+        title: 'Choose how to sign in — Noodle Seed',
+        kicker: 'Sign in',
+        heading: 'Choose how to continue',
+        contentHtml: `<p class="ns-lede">Google remains the default while authentication is in recovery mode. If your account uses email or another sign-in method, continue securely through WorkOS.</p>
+<form method="post" action="/oauth/upstream/continue">
+  <input type="hidden" name="choice_state" value="${escapedState}" />
+  <div class="btn-glow"><button class="btn btn-primary" type="submit" name="provider" value="google">Continue with Google</button></div>
+  <div class="btn-glow"><button class="btn" type="submit" name="provider" value="workos">Use email or another sign-in method</button></div>
+</form>`,
+    });
+}
+export async function continueUpstreamProviderChoice(input) {
+    const body = (input.req.body ?? {});
+    const state = typeof body.choice_state === 'string' ? body.choice_state : undefined;
+    const provider = selectedProvider(body.provider);
+    if (state === undefined || provider === undefined) {
+        input.res.status(400).type('text/plain').send('invalid sign-in choice');
+        return;
+    }
+    if ((provider === 'google' && input.google === undefined) ||
+        (provider === 'workos' && input.workos === undefined)) {
+        input.res.status(503).set('Retry-After', '5').type('text/plain').send('sign-in unavailable');
+        return;
+    }
+    const choice = await input.store.consumePendingAuthorization(hashToken(state), 'upstream_choice');
+    if (choice === undefined) {
+        input.res.status(400).type('text/plain').send('unknown or expired authorization request');
+        return;
+    }
+    const nonce = randomToken();
+    await input.store.createPendingAuthorization(finalPending(choice, nonce, provider));
+    input.res.redirect(302, upstreamAuthorizationUrl({
+        provider,
+        ...(input.google === undefined ? {} : { google: input.google }),
+        ...(input.workos === undefined ? {} : { workos: input.workos }),
+        state: nonce,
+    }));
+}
+function finalPending(choice, nonce, provider) {
+    return {
+        ...choice,
+        state: hashToken(nonce),
+        upstreamProvider: provider,
+    };
+}
+function selectedProvider(value) {
+    return value === 'google' || value === 'workos' ? value : undefined;
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+//# sourceMappingURL=upstream-provider-choice.js.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-provider-choice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-provider-choice.js","sourceRoot":"","sources":["../../src/oauth/upstream-provider-choice.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGhD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAGpE,MAAM,UAAU,4BAA4B,CAAC,KAAa;IACxD,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,eAAe,CAAC;QACrB,KAAK,EAAE,qCAAqC;QAC5C,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,wBAAwB;QACjC,WAAW,EAAE;;oDAEmC,YAAY;;;QAGxD;KACL,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAMpD;IACC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IAC/D,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IACD,IACE,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC;QACrD,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,EACrD,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC7F,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,2BAA2B,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAClG,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC1F,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,MAAM,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpF,KAAK,CAAC,GAAG,CAAC,QAAQ,CAChB,GAAG,EACH,wBAAwB,CAAC;QACvB,QAAQ;QACR,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/D,KAAK,EAAE,KAAK;KACb,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,MAAkC,EAClC,KAAa,EACb,QAA+B;IAE/B,OAAO;QACL,GAAG,MAAM;QACT,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC;QACvB,gBAAgB,EAAE,QAAQ;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-rollout-store.d.ts

@@ -0,0 +1,20 @@
+import type { Pool } from 'pg';
+import { type WorkOSConfigurationIdentity } from '../platform-auth-configuration.js';
+import { type UpstreamHumanRollout } from './upstream-human.js';
+/** Server-owned rollout state: callers select once, then persist the result in pending OAuth state. */
+export interface UpstreamHumanRolloutStore {
+    get(): Promise<UpstreamHumanRollout>;
+}
+export interface DurableUpstreamHumanRollout extends UpstreamHumanRollout {
+    readonly lifecycle: 'google' | 'workos' | 'finalized';
+    readonly allowUserSelectedWorkosRecovery: boolean;
+}
+/** Reads only additive Task 1 rollout state. Task 3 owns mutations and operator APIs. */
+export declare class PostgresUpstreamHumanRolloutStore implements UpstreamHumanRolloutStore {
+    #private;
+    constructor(pool: Pool, options?: {
+        readonly workos?: WorkOSConfigurationIdentity;
+    });
+    get(): Promise<DurableUpstreamHumanRollout>;
+}
+//# sourceMappingURL=upstream-rollout-store.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-rollout-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-rollout-store.d.ts","sourceRoot":"","sources":["../../src/oauth/upstream-rollout-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAgC,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE9F,uGAAuG;AACvG,MAAM,WAAW,yBAAyB;IACxC,GAAG,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,2BAA4B,SAAQ,oBAAoB;IACvE,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;IACtD,QAAQ,CAAC,+BAA+B,EAAE,OAAO,CAAC;CACnD;AAED,yFAAyF;AACzF,qBAAa,iCAAkC,YAAW,yBAAyB;;gBAIrE,IAAI,EAAE,IAAI,EAAE,OAAO,GAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,2BAA2B,CAAA;KAAO;IAKjF,GAAG,IAAI,OAAO,CAAC,2BAA2B,CAAC;CAyClD"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-rollout-store.js

@@ -0,0 +1,40 @@
+import { assertWorkOSRolloutConfigurationContinuity, } from '../platform-auth-configuration.js';
+import { GOOGLE_ONLY_UPSTREAM_ROLLOUT } from './upstream-human.js';
+/** Reads only additive Task 1 rollout state. Task 3 owns mutations and operator APIs. */
+export class PostgresUpstreamHumanRolloutStore {
+    #pool;
+    #workos;
+    constructor(pool, options = {}) {
+        this.#pool = pool;
+        this.#workos = options.workos;
+    }
+    async get() {
+        const result = await this.#pool.query(`SELECT workos_percentage, workos_canary_client_ids, workos_recovery_client_ids,
+              workos_recovery_enabled,
+              lifecycle, workos_client_fingerprint, workos_realm_fingerprint
+       FROM platform_auth_rollout_state WHERE singleton = true`);
+        const row = result.rows[0];
+        if (row === undefined)
+            return {
+                ...GOOGLE_ONLY_UPSTREAM_ROLLOUT,
+                lifecycle: 'google',
+                allowUserSelectedWorkosRecovery: false,
+            };
+        assertWorkOSRolloutConfigurationContinuity({
+            workosPercentage: row.workos_percentage,
+            workosRecoveryClientIds: row.workos_recovery_client_ids,
+            workosRecoveryEnabled: row.workos_recovery_enabled,
+            lifecycle: row.lifecycle,
+            workosClientFingerprint: row.workos_client_fingerprint,
+            workosRealmFingerprint: row.workos_realm_fingerprint,
+        }, this.#workos);
+        return {
+            workosPercentage: row.workos_percentage,
+            workosCanaryClientIds: row.workos_canary_client_ids,
+            workosRecoveryClientIds: row.workos_recovery_client_ids,
+            allowUserSelectedWorkosRecovery: row.workos_recovery_enabled,
+            lifecycle: row.lifecycle,
+        };
+    }
+}
+//# sourceMappingURL=upstream-rollout-store.js.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-rollout-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-rollout-store.js","sourceRoot":"","sources":["../../src/oauth/upstream-rollout-store.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0CAA0C,GAE3C,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,4BAA4B,EAA6B,MAAM,qBAAqB,CAAC;AAY9F,yFAAyF;AACzF,MAAM,OAAO,iCAAiC;IACnC,KAAK,CAAO;IACZ,OAAO,CAA0C;IAE1D,YAAY,IAAU,EAAE,UAA6D,EAAE;QACrF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,GAAG;QACP,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CASnC;;;+DAGyD,CAC1D,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS;YACnB,OAAO;gBACL,GAAG,4BAA4B;gBAC/B,SAAS,EAAE,QAAQ;gBACnB,+BAA+B,EAAE,KAAK;aACvC,CAAC;QACJ,0CAA0C,CACxC;YACE,gBAAgB,EAAE,GAAG,CAAC,iBAAiB;YACvC,uBAAuB,EAAE,GAAG,CAAC,0BAA0B;YACvD,qBAAqB,EAAE,GAAG,CAAC,uBAAuB;YAClD,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,uBAAuB,EAAE,GAAG,CAAC,yBAAyB;YACtD,sBAAsB,EAAE,GAAG,CAAC,wBAAwB;SACrD,EACD,IAAI,CAAC,OAAO,CACb,CAAC;QACF,OAAO;YACL,gBAAgB,EAAE,GAAG,CAAC,iBAAiB;YACvC,qBAAqB,EAAE,GAAG,CAAC,wBAAwB;YACnD,uBAAuB,EAAE,GAAG,CAAC,0BAA0B;YACvD,+BAA+B,EAAE,GAAG,CAAC,uBAAuB;YAC5D,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;IACJ,CAAC;CACF"}

package/node_modules/@noodle-borg/service/dist/oauth/workos-events.d.ts

@@ -0,0 +1,115 @@
+import type { Pool } from 'pg';
+declare const WORKOS_EVENT_TYPES: readonly ["user.created", "user.updated", "user.deleted", "session.revoked"];
+type WorkOSRelevantEventType = (typeof WORKOS_EVENT_TYPES)[number];
+/** Ordered subset of the WorkOS Events API used for upstream human-account reconciliation. */
+export interface WorkOSPlatformEvent {
+    readonly id: string;
+    readonly event: string;
+    readonly data: Readonly<Record<string, unknown>>;
+}
+export interface WorkOSEventsClient {
+    listEvents(input: {
+        readonly events: readonly WorkOSRelevantEventType[];
+        readonly order: 'asc';
+        readonly after?: string;
+    }): Promise<{
+        readonly data: readonly WorkOSPlatformEvent[];
+        readonly listMetadata: {
+            readonly after?: string;
+        };
+    }>;
+}
+export interface WorkOSIdentityEventStore {
+    getCursor(): Promise<string | undefined>;
+    /** Atomically applies one effect and records its event ID as the next `after` cursor. */
+    applyAndAdvance(input: {
+        readonly event: WorkOSPlatformEvent;
+        readonly realm: string;
+        readonly expectedCursor?: string;
+    }): Promise<WorkOSIdentityEventApplyResult>;
+}
+export interface WorkOSIdentityEventApplyResult {
+    /** The event effect changed durable identity state. */
+    readonly applied: boolean;
+    /** The worker observed a newer cursor and must refetch instead of skipping ahead. */
+    readonly stale: boolean;
+}
+export interface WorkOSSdkEventsPort {
+    listEvents(input: {
+        readonly events: WorkOSRelevantEventType[];
+        readonly order: 'asc';
+        readonly after?: string | undefined;
+    }): Promise<{
+        readonly data: readonly {
+            readonly id: string;
+            readonly event: string;
+            readonly data: object;
+        }[];
+        readonly listMetadata: {
+            readonly after?: string | null;
+        };
+    }>;
+}
+/** Official SDK boundary for Events API reads; it has no mutation capability. */
+export declare class WorkOSEventsSdkClient implements WorkOSEventsClient {
+    #private;
+    constructor(apiKey: string, events?: WorkOSSdkEventsPort);
+    listEvents(input: {
+        readonly events: readonly WorkOSRelevantEventType[];
+        readonly order: 'asc';
+        readonly after?: string;
+    }): Promise<{
+        readonly data: readonly WorkOSPlatformEvent[];
+        readonly listMetadata: {
+            readonly after?: string;
+        };
+    }>;
+}
+/** Explicit job boundary — this is never a live poller and makes no upstream mutation. */
+export declare class WorkOSEventProcessor {
+    #private;
+    constructor(input: {
+        readonly client: WorkOSEventsClient;
+        readonly store: WorkOSIdentityEventStore;
+        readonly realm: string;
+        readonly maxPages?: number;
+    });
+    processOnce(): Promise<{
+        readonly processed: number;
+        readonly cursor?: string;
+        readonly caughtUp: true;
+    }>;
+}
+/** Test/local durable-behavior model. The Postgres implementation below is the production persistence port. */
+export declare class InMemoryWorkOSIdentityEventStore implements WorkOSIdentityEventStore {
+    #private;
+    getCursor(): Promise<string | undefined>;
+    /** Convenience for focused store tests; production workers use `applyAndAdvance`. */
+    apply(event: WorkOSPlatformEvent, realm: string): Promise<boolean>;
+    applyAndAdvance(input: {
+        readonly event: WorkOSPlatformEvent;
+        readonly realm: string;
+        readonly expectedCursor?: string;
+    }): Promise<WorkOSIdentityEventApplyResult>;
+    appliedEvents(): readonly string[];
+    user(id: string): {
+        readonly email: string;
+        readonly status: 'active' | 'suspended';
+    } | undefined;
+}
+/** Durable Task 2 event store. Receipt, effect, freshness, and cursor move in one transaction. */
+export declare class PostgresWorkOSIdentityEventStore implements WorkOSIdentityEventStore {
+    #private;
+    constructor(pool: Pool, options?: {
+        readonly stream?: string;
+    });
+    getCursor(): Promise<string | undefined>;
+    apply(event: WorkOSPlatformEvent, realm: string): Promise<boolean>;
+    applyAndAdvance(input: {
+        readonly event: WorkOSPlatformEvent;
+        readonly realm: string;
+        readonly expectedCursor?: string;
+    }): Promise<WorkOSIdentityEventApplyResult>;
+}
+export {};
+//# sourceMappingURL=workos-events.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/workos-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos-events.d.ts","sourceRoot":"","sources":["../../src/oauth/workos-events.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAC;AAG3C,QAAA,MAAM,kBAAkB,8EAKd,CAAC;AAEX,KAAK,uBAAuB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE,8FAA8F;AAC9F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,KAAK,EAAE;QAChB,QAAQ,CAAC,MAAM,EAAE,SAAS,uBAAuB,EAAE,CAAC;QACpD,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;QACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC;QACV,QAAQ,CAAC,IAAI,EAAE,SAAS,mBAAmB,EAAE,CAAC;QAC9C,QAAQ,CAAC,YAAY,EAAE;YAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACpD,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,yFAAyF;IACzF,eAAe,CAAC,KAAK,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;QACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;KAClC,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,8BAA8B;IAC7C,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,KAAK,EAAE;QAChB,QAAQ,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC;QAC3C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;QACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACrC,GAAG,OAAO,CAAC;QACV,QAAQ,CAAC,IAAI,EAAE,SAAS;YACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;YACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;SACvB,EAAE,CAAC;QACJ,QAAQ,CAAC,YAAY,EAAE;YAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;KAC3D,CAAC,CAAC;CACJ;AAED,iFAAiF;AACjF,qBAAa,qBAAsB,YAAW,kBAAkB;;gBAGlD,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,mBAAmB;IAgBlD,UAAU,CAAC,KAAK,EAAE;QACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,uBAAuB,EAAE,CAAC;QACpD,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;QACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC;QACV,QAAQ,CAAC,IAAI,EAAE,SAAS,mBAAmB,EAAE,CAAC;QAC9C,QAAQ,CAAC,YAAY,EAAE;YAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACpD,CAAC;CAcH;AAED,0FAA0F;AAC1F,qBAAa,oBAAoB;;gBAMnB,KAAK,EAAE;QACjB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;QACpC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;QACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;KAC5B;IAUK,WAAW,IAAI,OAAO,CAAC;QAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;KACzB,CAAC;CA+BH;AAED,+GAA+G;AAC/G,qBAAa,gCAAiC,YAAW,wBAAwB;;IAQ/E,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAIxC,qFAAqF;IAC/E,KAAK,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWlE,eAAe,CAAC,KAAK,EAAE;QAC3B,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;QACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;KAClC,GAAG,OAAO,CAAC,8BAA8B,CAAC;IA4B3C,aAAa,IAAI,SAAS,MAAM,EAAE;IAIlC,IAAI,CACF,EAAE,EAAE,MAAM,GACT;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,WAAW,CAAA;KAAE,GAAG,SAAS;CAInF;AAED,kGAAkG;AAClG,qBAAa,gCAAiC,YAAW,wBAAwB;;gBAInE,IAAI,EAAE,IAAI,EAAE,OAAO,GAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAK5D,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IASxC,KAAK,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUlE,eAAe,CAAC,KAAK,EAAE;QAC3B,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;QACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;KAClC,GAAG,OAAO,CAAC,8BAA8B,CAAC;CA2C5C"}