@noodleseed/one 0.87.0 → 0.89.0

package/node_modules/@noodle-borg/service/dist/oauth/upstream-callback-handler.d.ts

@@ -1,3 +1,4 @@
+import type { SigningKeyProvider } from '@noodle-borg/auth';
 import type { Logger } from '@noodle-borg/transport-http';
 import type { Request, Response } from 'express';
 import type { ControlPlaneSignupMode, SignupAuthorizer } from '../auth/deploy-gate.js';
@@ -14,6 +15,7 @@ export declare function handleUpstreamHumanCallback(input: {
     readonly res: Response;
     readonly store: OAuthStore;
     readonly issuer: string;
+    readonly signer: SigningKeyProvider;
     readonly google?: GoogleAuthenticator;
     readonly workos?: UpstreamHumanOAuthAuthenticator;
     readonly resolver?: PlatformPrincipalResolver;

package/node_modules/@noodle-borg/service/dist/oauth/upstream-callback-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-callback-handler.d.ts","sourceRoot":"","sources":["../../src/oauth/upstream-callback-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAa1D,OAAO,KAAK,EAAE,+BAA+B,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAElG,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,+BAA+B,CAAC;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CACpC,QAAQ,EAAE,wBAAwB,GAAG;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAC5D,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IACtD,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;CAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CAkHhB"}
+{"version":3,"file":"upstream-callback-handler.d.ts","sourceRoot":"","sources":["../../src/oauth/upstream-callback-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAa1D,OAAO,KAAK,EAAE,+BAA+B,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAGlG,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,+BAA+B,CAAC;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CACpC,QAAQ,EAAE,wBAAwB,GAAG;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAC5D,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IACtD,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;CAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CA+HhB"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-callback-handler.js

@@ -5,6 +5,7 @@ import { rejectUnavailableUpstreamCallback } from './upstream-callback-availabil
 import { logUpstreamCallback, redirectPendingAuthorizationError, } from './upstream-callback-support.js';
 import { renderUpstreamConsent } from './upstream-consent.js';
 import { exchangeUpstreamHumanIdentity, resolveUpstreamHumanPrincipal, } from './upstream-federation.js';
+import { setWorkOSSessionCookie, signWorkOSSessionHandle } from './workos-session.js';
 export async function handleUpstreamHumanCallback(input) {
     const startedAt = input.now();
     const record = (outcome, resolutionResult) => logUpstreamCallback({
@@ -95,6 +96,18 @@ export async function handleUpstreamHumanCallback(input) {
                 throw new PlatformIdentityError('identity_link_required');
             await input.provisionPlatformPrincipal({ ...resolved, email: identity.email });
         }
+        const upstreamSession = identity.upstreamSession;
+        if (input.provider === 'workos' && upstreamSession?.provider === 'workos') {
+            setWorkOSSessionCookie({
+                res: input.res,
+                issuer: input.issuer,
+                handle: await signWorkOSSessionHandle({
+                    sessionId: upstreamSession.id,
+                    signer: input.signer,
+                    issuer: input.issuer,
+                }),
+            });
+        }
         await renderUpstreamConsent({
             pending,
             identity,
@@ -106,6 +119,7 @@ export async function handleUpstreamHumanCallback(input) {
                 ? {}
                 : { developerGrantFlow: input.developerGrantFlow }),
             ...(authTime === undefined ? {} : { authTime }),
+            upstreamProvider: input.provider,
             signConsent: input.signConsent,
             res: input.res,
         });

package/node_modules/@noodle-borg/service/dist/oauth/upstream-callback-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-callback-handler.js","sourceRoot":"","sources":["../../src/oauth/upstream-callback-handler.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,qBAAqB,GAGtB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAI9D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AACxF,OAAO,EACL,mBAAmB,EACnB,iCAAiC,GAElC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AAGlC,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAsBjD;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,CACb,OAA4C,EAC5C,gBAAkD,EAC5C,EAAE,CACR,mBAAmB,CAAC;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS;QACT,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE;QACvB,OAAO;QACP,gBAAgB;KACjB,CAAC,CAAC;IACL,MAAM,SAAS,GACb,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC;IACxF,IAAI,iCAAiC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;QAC5D,MAAM,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,MAAM,UAAU,GAAG,MAAM,iCAAiC,CAAC;YACzD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK;YACL,KAAK,EAAE,eAAe;YACtB,YAAY,EAAE,KAAK,CAAC,QAAQ;SAC7B,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACrF,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,2BAA2B,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChG,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC1F,MAAM,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IACD,IAAI,QAAmE,CAAC;IACxE,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,6BAA6B,CAAC;YAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI;YACJ,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAChF,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACpC,OAAO;IACT,CAAC;IACD,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,6BAA6B,CAAC;YACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ;YACR,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAC7F,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACrD,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;SACjD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,qBAAqB,CAAC,EAAE,CAAC;YAC9C,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACvE,MAAM,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,0BAA0B,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC/F,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CACJ,UAAU,EACV,KAAK,CAAC,IAAI,KAAK,0BAA0B,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,iBAAiB,CAC3F,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,2BAA2B,CAAC,OAAO,CAAC,KAAK,CAAC;YACzD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACjC,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,KAAK,CAAC,0BAA0B,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,eAAe,CAAC,YAAY,CAAC,CAAC;YACrE,IAAI,QAAQ,KAAK,SAAS;gBAAE,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;YACtF,MAAM,KAAK,CAAC,0BAA0B,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,qBAAqB,CAAC;YAC1B,OAAO;YACP,QAAQ;YACR,YAAY;YACZ,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACrD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,GAAG,EAAE,KAAK,CAAC,GAAG;SACf,CAAC,CAAC;QACH,MAAM,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QACtC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"upstream-callback-handler.js","sourceRoot":"","sources":["../../src/oauth/upstream-callback-handler.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,qBAAqB,GAGtB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAI9D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AACxF,OAAO,EACL,mBAAmB,EACnB,iCAAiC,GAElC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAEtF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAuBjD;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,CACb,OAA4C,EAC5C,gBAAkD,EAC5C,EAAE,CACR,mBAAmB,CAAC;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS;QACT,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE;QACvB,OAAO;QACP,gBAAgB;KACjB,CAAC,CAAC;IACL,MAAM,SAAS,GACb,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC;IACxF,IAAI,iCAAiC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;QAC5D,MAAM,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,MAAM,UAAU,GAAG,MAAM,iCAAiC,CAAC;YACzD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK;YACL,KAAK,EAAE,eAAe;YACtB,YAAY,EAAE,KAAK,CAAC,QAAQ;SAC7B,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACrF,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,2BAA2B,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChG,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC1F,MAAM,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IACD,IAAI,QAAmE,CAAC;IACxE,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,6BAA6B,CAAC;YAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI;YACJ,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAChF,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACpC,OAAO;IACT,CAAC;IACD,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,6BAA6B,CAAC;YACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ;YACR,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAC7F,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACrD,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;SACjD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,qBAAqB,CAAC,EAAE,CAAC;YAC9C,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACvE,MAAM,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,0BAA0B,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC/F,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CACJ,UAAU,EACV,KAAK,CAAC,IAAI,KAAK,0BAA0B,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,iBAAiB,CAC3F,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,2BAA2B,CAAC,OAAO,CAAC,KAAK,CAAC;YACzD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACjC,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,KAAK,CAAC,0BAA0B,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,eAAe,CAAC,YAAY,CAAC,CAAC;YACrE,IAAI,QAAQ,KAAK,SAAS;gBAAE,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;YACtF,MAAM,KAAK,CAAC,0BAA0B,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;QACjD,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,eAAe,EAAE,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1E,sBAAsB,CAAC;gBACrB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,MAAM,uBAAuB,CAAC;oBACpC,SAAS,EAAE,eAAe,CAAC,EAAE;oBAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,MAAM,qBAAqB,CAAC;YAC1B,OAAO;YACP,QAAQ;YACR,YAAY;YACZ,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACrD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,gBAAgB,EAAE,KAAK,CAAC,QAAQ;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,GAAG,EAAE,KAAK,CAAC,GAAG;SACf,CAAC,CAAC;QACH,MAAM,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QACtC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-consent.d.ts

@@ -3,6 +3,7 @@ import type { ConsentClaims } from './consent-claims.js';
 import { type DeveloperGrantOAuthFlow } from './developer-grant-flow.js';
 import type { OAuthStore, PendingAuthorizationRecord } from './store.js';
 import type { OAuthTokenIssuer } from './token-issuer.js';
+import type { UpstreamHumanProvider } from './upstream-human.js';
 export declare function renderUpstreamConsent(input: {
     readonly pending: PendingAuthorizationRecord;
     readonly identity: {
@@ -16,6 +17,7 @@ export declare function renderUpstreamConsent(input: {
     readonly tokenIssuer: OAuthTokenIssuer;
     readonly developerGrantFlow?: DeveloperGrantOAuthFlow;
     readonly authTime?: number;
+    readonly upstreamProvider?: UpstreamHumanProvider;
     readonly signConsent: (claims: ConsentClaims) => Promise<string>;
     readonly res: Response;
 }): Promise<void>;

package/node_modules/@noodle-borg/service/dist/oauth/upstream-consent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-consent.d.ts","sourceRoot":"","sources":["../../src/oauth/upstream-consent.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,2BAA2B,CAAC;AAInC,OAAO,KAAK,EAAE,UAAU,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;CACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0EhB"}
+{"version":3,"file":"upstream-consent.d.ts","sourceRoot":"","sources":["../../src/oauth/upstream-consent.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,2BAA2B,CAAC;AAInC,OAAO,KAAK,EAAE,UAAU,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IAClD,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;CACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4EhB"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-consent.js

@@ -51,6 +51,7 @@ export async function renderUpstreamConsent(input) {
         ...(input.authTime === undefined ? {} : { authTime: input.authTime }),
         ...(pending.clientState !== undefined ? { clientState: pending.clientState } : {}),
         ...(pending.scope !== undefined ? { scope: pending.scope } : {}),
+        ...(input.upstreamProvider === undefined ? {} : { upstreamProvider: input.upstreamProvider }),
     });
     const client = await input.store.getClient(pending.clientId);
     input.res
@@ -63,6 +64,7 @@ export async function renderUpstreamConsent(input) {
         userEmail: input.identity.email,
         consentToken,
         consentAction: '/oauth/consent',
+        allowAccountSwitch: input.upstreamProvider === 'workos',
     }));
 }
 //# sourceMappingURL=upstream-consent.js.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-consent.js.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-consent.js","sourceRoot":"","sources":["../../src/oauth/upstream-consent.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAEL,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAI5C,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAe3C;IACC,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,mBAAmB,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;IACxE,MAAM,OAAO,GAA+B;QAC1C,GAAG,mBAAmB;QACtB,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;KAC7D,CAAC;IACF,MAAM,WAAW,GAAG,2BAA2B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,4BAA4B,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACjE,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC3C,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC,kBAAkB,CAAC,eAAe,CAC5C,OAAO,EACP;YACE,OAAO,EAAE,KAAK,CAAC,YAAY;YAC3B,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;YAC3B,GAAG,WAAW;YACd,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;SACtE,EACD,KAAK,CAAC,GAAG,CACV,CAAC;QACF,OAAO;IACT,CAAC;IACD,IACE,MAAM,KAAK,CAAC,KAAK,CAAC,eAAe,CAC/B,OAAO,CAAC,QAAQ,EAChB,KAAK,CAAC,YAAY,EAClB,OAAO,CAAC,QAAQ,EAChB,UAAU,CACX,EACD,CAAC;QACD,MAAM,KAAK,CAAC,WAAW,CAAC,sBAAsB,CAAC,KAAK,CAAC,GAAG,EAAE;YACxD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;YAChC,GAAG,WAAW;YACd,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrE,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;QAC3C,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAChC,GAAG,WAAW;QACd,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrE,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7D,KAAK,CAAC,GAAG;SACN,MAAM,CAAC,GAAG,CAAC;SACX,IAAI,CAAC,MAAM,CAAC;SACZ,IAAI,CACH,iBAAiB,CAAC;QAChB,UAAU,EAAE,MAAM,EAAE,WAAW,IAAI,OAAO,CAAC,QAAQ;QACnD,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;QACtC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACzC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC/B,YAAY;QACZ,aAAa,EAAE,gBAAgB;KAChC,CAAC,CACH,CAAC;AACN,CAAC"}
+{"version":3,"file":"upstream-consent.js","sourceRoot":"","sources":["../../src/oauth/upstream-consent.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAEL,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAK5C,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAgB3C;IACC,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,mBAAmB,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;IACxE,MAAM,OAAO,GAA+B;QAC1C,GAAG,mBAAmB;QACtB,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;KAC7D,CAAC;IACF,MAAM,WAAW,GAAG,2BAA2B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,4BAA4B,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACjE,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC3C,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC,kBAAkB,CAAC,eAAe,CAC5C,OAAO,EACP;YACE,OAAO,EAAE,KAAK,CAAC,YAAY;YAC3B,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;YAC3B,GAAG,WAAW;YACd,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;SACtE,EACD,KAAK,CAAC,GAAG,CACV,CAAC;QACF,OAAO;IACT,CAAC;IACD,IACE,MAAM,KAAK,CAAC,KAAK,CAAC,eAAe,CAC/B,OAAO,CAAC,QAAQ,EAChB,KAAK,CAAC,YAAY,EAClB,OAAO,CAAC,QAAQ,EAChB,UAAU,CACX,EACD,CAAC;QACD,MAAM,KAAK,CAAC,WAAW,CAAC,sBAAsB,CAAC,KAAK,CAAC,GAAG,EAAE;YACxD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;YAChC,GAAG,WAAW;YACd,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrE,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;QAC3C,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAChC,GAAG,WAAW;QACd,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrE,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC;KAC9F,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7D,KAAK,CAAC,GAAG;SACN,MAAM,CAAC,GAAG,CAAC;SACX,IAAI,CAAC,MAAM,CAAC;SACZ,IAAI,CACH,iBAAiB,CAAC;QAChB,UAAU,EAAE,MAAM,EAAE,WAAW,IAAI,OAAO,CAAC,QAAQ;QACnD,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;QACtC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACzC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC/B,YAAY;QACZ,aAAa,EAAE,gBAAgB;QAC/B,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,KAAK,QAAQ;KACxD,CAAC,CACH,CAAC;AACN,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-federation.d.ts

@@ -1,7 +1,7 @@
 import type { ControlPlaneSignupMode, SignupAuthorizer } from '../auth/deploy-gate.js';
 import { type PlatformPrincipalResolver, type UpstreamHumanIdentity } from '../platform-identity.js';
 import type { GoogleAuthenticator } from './google.js';
-import type { UpstreamAuthorizationOptions, UpstreamHumanOAuthAuthenticator, UpstreamHumanProvider } from './upstream-human.js';
+import type { UpstreamAuthorizationOptions, UpstreamHumanAuthentication, UpstreamHumanOAuthAuthenticator, UpstreamHumanProvider } from './upstream-human.js';
 export declare function upstreamAuthorizationUrl(input: {
     readonly provider: UpstreamHumanProvider;
     readonly google?: GoogleAuthenticator;
@@ -14,10 +14,7 @@ export declare function exchangeUpstreamHumanIdentity(input: {
     readonly code: string;
     readonly google?: GoogleAuthenticator;
     readonly workos?: UpstreamHumanOAuthAuthenticator;
-}): Promise<UpstreamHumanIdentity & {
-    readonly locale?: string;
-    readonly timeZone?: string;
-}>;
+}): Promise<UpstreamHumanAuthentication>;
 export declare function resolveUpstreamHumanPrincipal(input: {
     readonly provider: UpstreamHumanProvider;
     readonly identity: UpstreamHumanIdentity;

package/node_modules/@noodle-borg/service/dist/oauth/upstream-federation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-federation.d.ts","sourceRoot":"","sources":["../../src/oauth/upstream-federation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAGL,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EACV,4BAA4B,EAC5B,+BAA+B,EAC/B,qBAAqB,EACtB,MAAM,qBAAqB,CAAC;AAE7B,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,+BAA+B,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,4BAA4B,CAAC;CACjD,GAAG,MAAM,CAMT;AAED,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IACzD,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,+BAA+B,CAAC;CACnD,GAAG,OAAO,CAAC,qBAAqB,GAAG;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAoB5F;AAED,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IACzD,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,sBAAsB,CAAC;IAC7C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnD,GAAG,OAAO,CAAC,MAAM,CAAC,CAkDlB"}
+{"version":3,"file":"upstream-federation.d.ts","sourceRoot":"","sources":["../../src/oauth/upstream-federation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAGL,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EACV,4BAA4B,EAC5B,2BAA2B,EAC3B,+BAA+B,EAC/B,qBAAqB,EACtB,MAAM,qBAAqB,CAAC;AAE7B,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,+BAA+B,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,4BAA4B,CAAC;CACjD,GAAG,MAAM,CAMT;AAED,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IACzD,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,+BAA+B,CAAC;CACnD,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAoBvC;AAED,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IACzD,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,sBAAsB,CAAC;IAC7C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnD,GAAG,OAAO,CAAC,MAAM,CAAC,CAkDlB"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-federation.js.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-federation.js","sourceRoot":"","sources":["../../src/oauth/upstream-federation.ts"],"names":[],"mappings":"AACA,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,GAGtB,MAAM,yBAAyB,CAAC;AAQjC,MAAM,UAAU,wBAAwB,CAAC,KAMxC;IACC,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACvF,OAAO,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAKnD;IACC,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACzF,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACvF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzD,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,qBAAqB;QAC5B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,aAAa,EAAE,IAAI;QACnB,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KASnD;IACC,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,iGAAiG;QACjG,kFAAkF;QAClF,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzD,IACE,CAAC,KAAK,CAAC,UAAU,IAAI,YAAY,CAAC,KAAK,YAAY;YACnD,KAAK,CAAC,kBAAkB,KAAK,SAAS;YACtC,CAAC,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC;YACnE,CAAC,CAAC,MAAM,KAAK,CAAC,gBAAgB,EAAE,eAAe,CAAC;gBAC9C,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;gBAC/B,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE;aAC1C,CAAC,CAAC,EACH,CAAC;YACD,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS;YACjC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO;YACxB,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7D,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpE,yGAAyG;IACzG,+GAA+G;IAC/G,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,yBAAyB,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnD,OAAO,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;QACjC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC3B,eAAe,EAAE,8BAA8B,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;KACtE,CAAC,CAAC;IACH,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,YAAY,CAAC,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE,eAAe,CAAC;QAClE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;QAC/B,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE;KAC1C,CAAC,CAAC;IACH,MAAM,aAAa,GACjB,KAAK,CAAC,kBAAkB,KAAK,SAAS;QACtC,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACrE,IAAI,CAAC,aAAa,IAAI,aAAa,KAAK,IAAI;QAC1C,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;IAC5D,OAAO,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAED,SAAS,yBAAyB,CAChC,KAIC,EACD,gBAAyB;IAEzB,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAClF,CAAC;IACF,MAAM,eAAe,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IAC7D,MAAM,SAAS,GAAG,gBAAgB,EAAE,WAAW,EAAE,CAAC;IAClD,MAAM,YAAY,GAAG,CAAC,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACrE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CACjD,CAAC;IACF,IACE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;QAC7B,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpD,YAAY,EACZ,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,gBAAwB;IACjE,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;AACtF,CAAC"}
+{"version":3,"file":"upstream-federation.js","sourceRoot":"","sources":["../../src/oauth/upstream-federation.ts"],"names":[],"mappings":"AACA,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,GAGtB,MAAM,yBAAyB,CAAC;AASjC,MAAM,UAAU,wBAAwB,CAAC,KAMxC;IACC,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACvF,OAAO,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAKnD;IACC,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACzF,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACvF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzD,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,qBAAqB;QAC5B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,aAAa,EAAE,IAAI;QACnB,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KASnD;IACC,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,iGAAiG;QACjG,kFAAkF;QAClF,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzD,IACE,CAAC,KAAK,CAAC,UAAU,IAAI,YAAY,CAAC,KAAK,YAAY;YACnD,KAAK,CAAC,kBAAkB,KAAK,SAAS;YACtC,CAAC,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC;YACnE,CAAC,CAAC,MAAM,KAAK,CAAC,gBAAgB,EAAE,eAAe,CAAC;gBAC9C,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;gBAC/B,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE;aAC1C,CAAC,CAAC,EACH,CAAC;YACD,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS;YACjC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO;YACxB,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7D,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpE,yGAAyG;IACzG,+GAA+G;IAC/G,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,yBAAyB,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnD,OAAO,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;QACjC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC3B,eAAe,EAAE,8BAA8B,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;KACtE,CAAC,CAAC;IACH,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,YAAY,CAAC,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE,eAAe,CAAC;QAClE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;QAC/B,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE;KAC1C,CAAC,CAAC;IACH,MAAM,aAAa,GACjB,KAAK,CAAC,kBAAkB,KAAK,SAAS;QACtC,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACrE,IAAI,CAAC,aAAa,IAAI,aAAa,KAAK,IAAI;QAC1C,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;IAC5D,OAAO,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAED,SAAS,yBAAyB,CAChC,KAIC,EACD,gBAAyB;IAEzB,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAClF,CAAC;IACF,MAAM,eAAe,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IAC7D,MAAM,SAAS,GAAG,gBAAgB,EAAE,WAAW,EAAE,CAAC;IAClD,MAAM,YAAY,GAAG,CAAC,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACrE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CACjD,CAAC;IACF,IACE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;QAC7B,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpD,YAAY,EACZ,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,gBAAwB;IACjE,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;AACtF,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-human.d.ts

@@ -3,6 +3,14 @@ export type UpstreamHumanProvider = 'google' | 'workos';
 export interface UpstreamAuthorizationOptions {
     readonly forceAuthentication?: boolean;
 }
+export interface UpstreamHumanAuthentication extends UpstreamHumanIdentity {
+    readonly locale?: string;
+    readonly timeZone?: string;
+    readonly upstreamSession?: {
+        readonly provider: 'workos';
+        readonly id: string;
+    };
+}
 /**
  * The OAuth-facing federation boundary. Implementations receive an authorization code and return identity
  * claims only: upstream access and refresh credentials are deliberately discarded at this boundary.
@@ -11,10 +19,8 @@ export interface UpstreamHumanOAuthAuthenticator {
     readonly provider: UpstreamHumanProvider;
     readonly realm: string;
     authorizationUrl(state: string, options?: UpstreamAuthorizationOptions): URL;
-    exchange(code: string): Promise<UpstreamHumanIdentity & {
-        readonly locale?: string;
-        readonly timeZone?: string;
-    }>;
+    exchange(code: string): Promise<UpstreamHumanAuthentication>;
+    sessionLogoutUrl?(sessionId: string, returnTo: string): URL;
 }
 export interface UpstreamHumanRollout {
     readonly workosPercentage: number;

package/node_modules/@noodle-borg/service/dist/oauth/upstream-human.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-human.d.ts","sourceRoot":"","sources":["../../src/oauth/upstream-human.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CACxC;AAED;;;GAGG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,4BAA4B,GAAG,GAAG,CAAC;IAC7E,QAAQ,CACN,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,qBAAqB,GAAG;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9F;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,gGAAgG;IAChG,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrD;;;OAGG;IACH,QAAQ,CAAC,+BAA+B,CAAC,EAAE,OAAO,CAAC;CACpD;AAED,eAAO,MAAM,4BAA4B,EAAE,oBAK1C,CAAC;AAEF,8GAA8G;AAC9G,wBAAgB,2BAA2B,CACzC,KAAK,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,EACvE,OAAO,GAAE,oBAAmD,GAC3D,qBAAqB,CAavB"}
+{"version":3,"file":"upstream-human.d.ts","sourceRoot":"","sources":["../../src/oauth/upstream-human.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CACxC;AAED,MAAM,WAAW,2BAA4B,SAAQ,qBAAqB;IACxE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE;QACzB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,4BAA4B,GAAG,GAAG,CAAC;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC7D,gBAAgB,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC;CAC7D;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,gGAAgG;IAChG,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrD;;;OAGG;IACH,QAAQ,CAAC,+BAA+B,CAAC,EAAE,OAAO,CAAC;CACpD;AAED,eAAO,MAAM,4BAA4B,EAAE,oBAK1C,CAAC;AAEF,8GAA8G;AAC9G,wBAAgB,2BAA2B,CACzC,KAAK,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,EACvE,OAAO,GAAE,oBAAmD,GAC3D,qBAAqB,CAavB"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-human.js.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-human.js","sourceRoot":"","sources":["../../src/oauth/upstream-human.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAkCzC,MAAM,CAAC,MAAM,4BAA4B,GAAyB;IAChE,gBAAgB,EAAE,CAAC;IACnB,qBAAqB,EAAE,EAAE;IACzB,uBAAuB,EAAE,EAAE;IAC3B,+BAA+B,EAAE,KAAK;CACvC,CAAC;AAEF,8GAA8G;AAC9G,MAAM,UAAU,2BAA2B,CACzC,KAAuE,EACvE,UAAgC,4BAA4B;IAE5D,IAAI,OAAO,CAAC,uBAAuB,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACxF,IAAI,OAAO,CAAC,gBAAgB,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACnD,IAAI,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5E,IAAI,OAAO,CAAC,gBAAgB,IAAI,GAAG;QAAE,OAAO,QAAQ,CAAC;IACrD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;SACrD,MAAM,EAAE,CAAC;IACZ,mGAAmG;IACnG,+FAA+F;IAC/F,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,gBAAgB,GAAG,GAAG,CAAC,GAAG,aAAa,CAAC;IACnE,OAAO,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClD,CAAC"}
+{"version":3,"file":"upstream-human.js","sourceRoot":"","sources":["../../src/oauth/upstream-human.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA0CzC,MAAM,CAAC,MAAM,4BAA4B,GAAyB;IAChE,gBAAgB,EAAE,CAAC;IACnB,qBAAqB,EAAE,EAAE;IACzB,uBAAuB,EAAE,EAAE;IAC3B,+BAA+B,EAAE,KAAK;CACvC,CAAC;AAEF,8GAA8G;AAC9G,MAAM,UAAU,2BAA2B,CACzC,KAAuE,EACvE,UAAgC,4BAA4B;IAE5D,IAAI,OAAO,CAAC,uBAAuB,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACxF,IAAI,OAAO,CAAC,gBAAgB,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACnD,IAAI,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5E,IAAI,OAAO,CAAC,gBAAgB,IAAI,GAAG;QAAE,OAAO,QAAQ,CAAC;IACrD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;SACrD,MAAM,EAAE,CAAC;IACZ,mGAAmG;IACnG,+FAA+F;IAC/F,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,gBAAgB,GAAG,GAAG,CAAC,GAAG,aAAa,CAAC;IACnE,OAAO,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClD,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/workos-logout.d.ts

@@ -0,0 +1,12 @@
+import type { SigningKeyProvider } from '@noodle-borg/auth';
+import type { Request, Response } from 'express';
+import type { UpstreamHumanOAuthAuthenticator } from './upstream-human.js';
+export declare function handleWorkOSSessionLogout(input: {
+    readonly req: Request;
+    readonly res: Response;
+    readonly issuer: string;
+    readonly signer: SigningKeyProvider;
+    readonly workos?: UpstreamHumanOAuthAuthenticator;
+    readonly returnTo?: string;
+}): Promise<void>;
+//# sourceMappingURL=workos-logout.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/workos-logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos-logout.d.ts","sourceRoot":"","sources":["../../src/oauth/workos-logout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AAQ3E,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,+BAA+B,CAAC;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BhB"}

package/node_modules/@noodle-borg/service/dist/oauth/workos-logout.js

@@ -0,0 +1,52 @@
+import { expireWorkOSSessionCookies, verifyWorkOSSessionHandle, WORKOS_SESSION_COOKIE_LOOPBACK, WORKOS_SESSION_COOKIE_SECURE, } from './workos-session.js';
+export async function handleWorkOSSessionLogout(input) {
+    input.res.setHeader('Cache-Control', 'no-store');
+    input.res.setHeader('Referrer-Policy', 'no-referrer');
+    if (input.workos?.sessionLogoutUrl === undefined || input.returnTo === undefined) {
+        input.res.status(404).json({ error: 'not_found' });
+        return;
+    }
+    const handle = workOSSessionHandle(input.req.headers.cookie);
+    expireWorkOSSessionCookies(input.res);
+    if (handle === undefined) {
+        input.res.redirect(302, input.returnTo);
+        return;
+    }
+    let sessionId;
+    try {
+        sessionId = await verifyWorkOSSessionHandle({
+            handle,
+            signer: input.signer,
+            issuer: input.issuer,
+        });
+    }
+    catch {
+        input.res.redirect(302, input.returnTo);
+        return;
+    }
+    input.res.redirect(302, input.workos.sessionLogoutUrl(sessionId, input.returnTo).href);
+}
+function workOSSessionHandle(cookieHeader) {
+    if (cookieHeader === undefined)
+        return undefined;
+    const values = new Map();
+    for (const pair of cookieHeader.split(';')) {
+        const separator = pair.indexOf('=');
+        if (separator <= 0)
+            continue;
+        const name = pair.slice(0, separator).trim();
+        if (name !== WORKOS_SESSION_COOKIE_SECURE && name !== WORKOS_SESSION_COOKIE_LOOPBACK)
+            continue;
+        const value = pair.slice(separator + 1).trim();
+        values.set(name, [...(values.get(name) ?? []), value]);
+    }
+    for (const name of [WORKOS_SESSION_COOKIE_SECURE, WORKOS_SESSION_COOKIE_LOOPBACK]) {
+        const found = values.get(name);
+        if (found?.length === 1 && found[0]?.length !== 0)
+            return found[0];
+        if (found !== undefined)
+            return undefined;
+    }
+    return undefined;
+}
+//# sourceMappingURL=workos-logout.js.map

package/node_modules/@noodle-borg/service/dist/oauth/workos-logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos-logout.js","sourceRoot":"","sources":["../../src/oauth/workos-logout.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAO/C;IACC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IACjD,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,MAAM,EAAE,gBAAgB,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjF,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACnD,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,0BAA0B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IAED,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,yBAAyB,CAAC;YAC1C,MAAM;YACN,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,mBAAmB,CAAC,YAAgC;IAC3D,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,IAAI,CAAC;YAAE,SAAS;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,IAAI,KAAK,4BAA4B,IAAI,IAAI,KAAK,8BAA8B;YAAE,SAAS;QAC/F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,4BAA4B,EAAE,8BAA8B,CAAC,EAAE,CAAC;QAClF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,EAAE,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/workos-session.d.ts

@@ -0,0 +1,24 @@
+import type { SigningKeyProvider } from '@noodle-borg/auth';
+import type { Response } from 'express';
+export declare const WORKOS_SESSION_COOKIE_SECURE = "__Host-ns_workos_session";
+export declare const WORKOS_SESSION_COOKIE_LOOPBACK = "ns_workos_session";
+export declare function extractWorkOSSessionId(accessToken: string): string;
+export declare function requireWorkOSSessionId(value: unknown): string;
+export declare function signWorkOSSessionHandle(input: {
+    readonly sessionId: string;
+    readonly signer: SigningKeyProvider;
+    readonly issuer: string;
+    readonly ttlSeconds?: number;
+}): Promise<string>;
+export declare function verifyWorkOSSessionHandle(input: {
+    readonly handle: string;
+    readonly signer: SigningKeyProvider;
+    readonly issuer: string;
+}): Promise<string>;
+export declare function setWorkOSSessionCookie(input: {
+    readonly res: Response;
+    readonly issuer: string;
+    readonly handle: string;
+}): void;
+export declare function expireWorkOSSessionCookies(res: Response): void;
+//# sourceMappingURL=workos-session.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/workos-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos-session.d.ts","sourceRoot":"","sources":["../../src/oauth/workos-session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGxC,eAAO,MAAM,4BAA4B,6BAA6B,CAAC;AACvE,eAAO,MAAM,8BAA8B,sBAAsB,CAAC;AAOlE,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAiBlE;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAS7D;AAED,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBlB;AAED,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CAOlB;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GAAG,IAAI,CAcP;AAED,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,CAS9D"}

package/node_modules/@noodle-borg/service/dist/oauth/workos-session.js

@@ -0,0 +1,83 @@
+import { Buffer } from 'node:buffer';
+import { jwtVerify, SignJWT } from 'jose';
+export const WORKOS_SESSION_COOKIE_SECURE = '__Host-ns_workos_session';
+export const WORKOS_SESSION_COOKIE_LOOPBACK = 'ns_workos_session';
+const WORKOS_SESSION_HANDLE_KIND = 'workos-session-logout';
+const WORKOS_SESSION_MAX_AGE_SECONDS = 14 * 24 * 60 * 60;
+const WORKOS_SESSION_ID_PATTERN = /^session_[!-~]+$/;
+const WORKOS_SESSION_ID_MAX_LENGTH = 200;
+export function extractWorkOSSessionId(accessToken) {
+    try {
+        const segments = accessToken.split('.');
+        const payloadSegment = segments[1];
+        if (segments.length !== 3 || payloadSegment === undefined || payloadSegment.length === 0) {
+            throw new Error('invalid JWT');
+        }
+        const payloadJson = Buffer.from(payloadSegment, 'base64url').toString('utf8');
+        if ((payloadJson.match(/"sid"\s*:/g) ?? []).length !== 1)
+            throw new Error('invalid sid count');
+        const payload = JSON.parse(payloadJson);
+        if (payload === null || typeof payload !== 'object' || Array.isArray(payload)) {
+            throw new Error('invalid JWT payload');
+        }
+        return requireWorkOSSessionId(payload.sid);
+    }
+    catch {
+        throw new Error('WorkOS session ID is invalid');
+    }
+}
+export function requireWorkOSSessionId(value) {
+    if (typeof value !== 'string' ||
+        value.length > WORKOS_SESSION_ID_MAX_LENGTH ||
+        !WORKOS_SESSION_ID_PATTERN.test(value)) {
+        throw new Error('WorkOS session ID is invalid');
+    }
+    return value;
+}
+export async function signWorkOSSessionHandle(input) {
+    const key = await input.signer.signingKey();
+    const ttlSeconds = Math.min(input.ttlSeconds ?? WORKOS_SESSION_MAX_AGE_SECONDS, WORKOS_SESSION_MAX_AGE_SECONDS);
+    if (!Number.isSafeInteger(ttlSeconds) || ttlSeconds <= 0) {
+        throw new Error('WorkOS session handle TTL is invalid');
+    }
+    return new SignJWT({
+        kind: WORKOS_SESSION_HANDLE_KIND,
+        sessionId: requireWorkOSSessionId(input.sessionId),
+    })
+        .setProtectedHeader({ alg: key.alg, kid: key.kid })
+        .setIssuer(input.issuer)
+        .setIssuedAt()
+        .setExpirationTime(`${ttlSeconds}s`)
+        .sign(key.privateKey);
+}
+export async function verifyWorkOSSessionHandle(input) {
+    const getKey = await input.signer.verifierKey();
+    const { payload } = await jwtVerify(input.handle, getKey, { issuer: input.issuer });
+    if (payload.kind !== WORKOS_SESSION_HANDLE_KIND) {
+        throw new Error('WorkOS session handle is invalid');
+    }
+    return requireWorkOSSessionId(payload.sessionId);
+}
+export function setWorkOSSessionCookie(input) {
+    const issuer = new URL(input.issuer);
+    const secure = issuer.protocol === 'https:';
+    if (!secure && !isLoopbackHostname(issuer.hostname)) {
+        throw new Error('WorkOS session cookie requires HTTPS or loopback');
+    }
+    const name = secure ? WORKOS_SESSION_COOKIE_SECURE : WORKOS_SESSION_COOKIE_LOOPBACK;
+    input.res.append('Set-Cookie', serializeCookie(name, input.handle, {
+        maxAge: WORKOS_SESSION_MAX_AGE_SECONDS,
+        secure,
+    }));
+}
+export function expireWorkOSSessionCookies(res) {
+    res.append('Set-Cookie', serializeCookie(WORKOS_SESSION_COOKIE_SECURE, '', { maxAge: 0, secure: true }));
+    res.append('Set-Cookie', serializeCookie(WORKOS_SESSION_COOKIE_LOOPBACK, '', { maxAge: 0, secure: false }));
+}
+function serializeCookie(name, value, input) {
+    return `${name}=${value}; Path=/; Max-Age=${input.maxAge}; HttpOnly;${input.secure ? ' Secure;' : ''} SameSite=Lax`;
+}
+function isLoopbackHostname(hostname) {
+    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]';
+}
+//# sourceMappingURL=workos-session.js.map

package/node_modules/@noodle-borg/service/dist/oauth/workos-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos-session.js","sourceRoot":"","sources":["../../src/oauth/workos-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGrC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE1C,MAAM,CAAC,MAAM,4BAA4B,GAAG,0BAA0B,CAAC;AACvE,MAAM,CAAC,MAAM,8BAA8B,GAAG,mBAAmB,CAAC;AAElE,MAAM,0BAA0B,GAAG,uBAAuB,CAAC;AAC3D,MAAM,8BAA8B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACzD,MAAM,yBAAyB,GAAG,kBAAkB,CAAC;AACrD,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEzC,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACxD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,cAAc,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9E,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC/F,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,sBAAsB,CAAE,OAAsC,CAAC,GAAG,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,GAAG,4BAA4B;QAC3C,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAK7C;IACC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CACzB,KAAK,CAAC,UAAU,IAAI,8BAA8B,EAClD,8BAA8B,CAC/B,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,OAAO,CAAC;QACjB,IAAI,EAAE,0BAA0B;QAChC,SAAS,EAAE,sBAAsB,CAAC,KAAK,CAAC,SAAS,CAAC;KACnD,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;SAClD,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;SACvB,WAAW,EAAE;SACb,iBAAiB,CAAC,GAAG,UAAU,GAAG,CAAC;SACnC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAI/C;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,IAAI,KAAK,0BAA0B,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,sBAAsB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAItC;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,8BAA8B,CAAC;IACpF,KAAK,CAAC,GAAG,CAAC,MAAM,CACd,YAAY,EACZ,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE;QAClC,MAAM,EAAE,8BAA8B;QACtC,MAAM;KACP,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,GAAa;IACtD,GAAG,CAAC,MAAM,CACR,YAAY,EACZ,eAAe,CAAC,4BAA4B,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAC/E,CAAC;IACF,GAAG,CAAC,MAAM,CACR,YAAY,EACZ,eAAe,CAAC,8BAA8B,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAClF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,KAAa,EACb,KAA4D;IAE5D,OAAO,GAAG,IAAI,IAAI,KAAK,qBAAqB,KAAK,CAAC,MAAM,cACtD,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAC9B,eAAe,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,CAAC;AACtF,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/workos.d.ts

@@ -1,4 +1,4 @@
-import type { UpstreamAuthorizationOptions, UpstreamHumanOAuthAuthenticator } from './upstream-human.js';
+import type { UpstreamAuthorizationOptions, UpstreamHumanAuthentication, UpstreamHumanOAuthAuthenticator } from './upstream-human.js';
 export interface WorkOSUser {
     readonly id: string;
     readonly email: string;
@@ -15,6 +15,10 @@ export interface WorkOSUserManagementClient {
         readonly maxAge?: number;
         readonly prompt?: string;
     }): string;
+    getLogoutUrl(input: {
+        readonly sessionId: string;
+        readonly returnTo?: string;
+    }): string;
     authenticateWithCode(input: {
         readonly code: string;
         readonly clientId: string;
@@ -55,13 +59,7 @@ export declare class WorkOSHumanAuthenticator implements UpstreamHumanOAuthAuthe
     readonly realm: string;
     constructor(config: WorkOSHumanAuthenticatorConfig, userManagement?: WorkOSUserManagementClient);
     authorizationUrl(state: string, options?: UpstreamAuthorizationOptions): URL;
-    exchange(code: string): Promise<{
-        readonly provider: 'workos';
-        readonly realm: string;
-        readonly subject: string;
-        readonly email: string;
-        readonly emailVerified: boolean;
-        readonly locale?: string;
-    }>;
+    sessionLogoutUrl(sessionId: string, returnTo: string): URL;
+    exchange(code: string): Promise<UpstreamHumanAuthentication>;
 }
 //# sourceMappingURL=workos.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/workos.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workos.d.ts","sourceRoot":"","sources":["../../src/oauth/workos.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,4BAA4B,EAC5B,+BAA+B,EAChC,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,8GAA8G;AAC9G,MAAM,WAAW,0BAA0B;IACzC,mBAAmB,CAAC,KAAK,EAAE;QACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,GAAG,MAAM,CAAC;IACX,oBAAoB,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACzF,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;QAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;QACvC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;KACjC,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yFAAyF;IACzF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,6GAA6G;IAC7G,QAAQ,CAAC,4BAA4B,CAAC,EAAE,SAAS,kCAAkC,EAAE,CAAC;CACvF;AAED,MAAM,MAAM,kCAAkC,GAC1C,aAAa,GACb,WAAW,GACX,aAAa,GACb,UAAU,GACV,KAAK,CAAC;AAEV,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,4BAA4B,CAAC,EAAE,SAAS,kCAAkC,EAAE,CAAC;CACvF;AAED;;;GAGG;AACH,wBAAgB,wCAAwC,CACtD,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,mBAAmB,GAAG,SAAS,GACtC,wBAAwB,GAAG,SAAS,CActC;AAED,yGAAyG;AACzG,qBAAa,wBAAyB,YAAW,+BAA+B;;IAC9E,QAAQ,CAAC,QAAQ,EAAG,QAAQ,CAAU;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAQrB,MAAM,EAAE,8BAA8B,EACtC,cAAc,GAAE,0BAGC;IAYnB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,4BAA4B,GAAG,GAAG;IAatE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QACpC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;QAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CAyBH"}
+{"version":3,"file":"workos.d.ts","sourceRoot":"","sources":["../../src/oauth/workos.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,4BAA4B,EAC5B,2BAA2B,EAC3B,+BAA+B,EAChC,MAAM,qBAAqB,CAAC;AAG7B,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,8GAA8G;AAC9G,MAAM,WAAW,0BAA0B;IACzC,mBAAmB,CAAC,KAAK,EAAE;QACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,GAAG,MAAM,CAAC;IACX,YAAY,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IACxF,oBAAoB,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACzF,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;QAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;QACvC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;KACjC,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yFAAyF;IACzF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,6GAA6G;IAC7G,QAAQ,CAAC,4BAA4B,CAAC,EAAE,SAAS,kCAAkC,EAAE,CAAC;CACvF;AAED,MAAM,MAAM,kCAAkC,GAC1C,aAAa,GACb,WAAW,GACX,aAAa,GACb,UAAU,GACV,KAAK,CAAC;AAEV,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,4BAA4B,CAAC,EAAE,SAAS,kCAAkC,EAAE,CAAC;CACvF;AAED;;;GAGG;AACH,wBAAgB,wCAAwC,CACtD,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,mBAAmB,GAAG,SAAS,GACtC,wBAAwB,GAAG,SAAS,CActC;AAED,yGAAyG;AACzG,qBAAa,wBAAyB,YAAW,+BAA+B;;IAC9E,QAAQ,CAAC,QAAQ,EAAG,QAAQ,CAAU;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAQrB,MAAM,EAAE,8BAA8B,EACtC,cAAc,GAAE,0BAGC;IAYnB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,4BAA4B,GAAG,GAAG;IAa5E,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG;IASpD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;CA8BnE"}

package/node_modules/@noodle-borg/service/dist/oauth/workos.js

@@ -1,4 +1,5 @@
 import { WorkOS } from '@workos-inc/node';
+import { extractWorkOSSessionId, requireWorkOSSessionId } from './workos-session.js';
 /**
  * Validates the optional WorkOS unit as one all-or-nothing production setting. Constructing the SDK is local;
  * no WorkOS network request is made during service boot.
@@ -49,8 +50,14 @@ export class WorkOSHumanAuthenticator {
             ...(forceAuthentication ? { prompt: 'login', maxAge: 0 } : {}),
         }));
     }
+    sessionLogoutUrl(sessionId, returnTo) {
+        return new URL(this.#userManagement.getLogoutUrl({
+            sessionId: requireWorkOSSessionId(sessionId),
+            returnTo,
+        }));
+    }
     async exchange(code) {
-        const { user, authenticationMethod, impersonator } = await this.#userManagement.authenticateWithCode({
+        const { user, accessToken, authenticationMethod, impersonator } = await this.#userManagement.authenticateWithCode({
             code,
             clientId: this.#clientId,
         });
@@ -62,6 +69,7 @@ export class WorkOSHumanAuthenticator {
         }
         const subject = requiredWorkOSIdentityValue('user ID', user.id);
         const email = requiredWorkOSIdentityValue('email', user.email);
+        const sessionId = extractWorkOSSessionId(accessToken);
         return {
             provider: 'workos',
             realm: this.#realm,
@@ -69,6 +77,10 @@ export class WorkOSHumanAuthenticator {
             email,
             emailVerified: user.emailVerified,
             ...(user.locale !== null ? { locale: user.locale } : {}),
+            upstreamSession: {
+                provider: 'workos',
+                id: sessionId,
+            },
         };
     }
 }

package/node_modules/@noodle-borg/service/dist/oauth/workos.js.map

@@ -1 +1 @@
-{"version":3,"file":"workos.js","sourceRoot":"","sources":["../../src/oauth/workos.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAyD1C;;;GAGG;AACH,MAAM,UAAU,wCAAwC,CACtD,MAAc,EACd,MAAuC;IAEvC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,IAAI,wBAAwB,CAAC;QAClC,QAAQ;QACR,MAAM;QACN,KAAK;QACL,WAAW,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB;QAClE,GAAG,CAAC,MAAM,CAAC,4BAA4B,KAAK,SAAS;YACnD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,4BAA4B,EAAE,MAAM,CAAC,4BAA4B,EAAE,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,yGAAyG;AACzG,MAAM,OAAO,wBAAwB;IAC1B,QAAQ,GAAG,QAAiB,CAAC;IAC7B,KAAK,CAAS;IACd,SAAS,CAAS;IAClB,YAAY,CAAS;IACrB,MAAM,CAAS;IACf,eAAe,CAA6B;IAC5C,6BAA6B,CAAsB;IAE5D,YACE,MAAsC,EACtC,iBAA6C,IAAI,MAAM,CAAC;QACtD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC,cAAc;QAEjB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QACzB,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;QACtC,IAAI,CAAC,6BAA6B,GAAG,IAAI,GAAG,CAC1C,MAAM,CAAC,4BAA4B,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CACpE,CAAC;IACJ,CAAC;IAED,gBAAgB,CAAC,KAAa,EAAE,OAAsC;QACpE,MAAM,mBAAmB,GAAG,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC;QAClE,OAAO,IAAI,GAAG,CACZ,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC;YACvC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,KAAK;YACL,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QAQzB,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,YAAY,EAAE,GAChD,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC;YAC9C,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,SAAS;SACzB,CAAC,CAAC;QACL,IACE,oBAAoB,KAAK,SAAS;YAClC,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,oBAAoB,CAAC;YAC7D,YAAY,KAAK,SAAS;YAC1B,IAAI,CAAC,aAAa,KAAK,IAAI,EAC3B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,OAAO,GAAG,2BAA2B,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,OAAO;YACL,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,OAAO;YACP,KAAK;YACL,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,KAAyB;IACnE,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACjC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,6EAA6E,IAAI,GAAG,CACrF,CAAC;IACJ,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAY,EAAE,KAAa;IAC9D,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC;IAC1E,OAAO,UAAU,CAAC;AACpB,CAAC"}
+{"version":3,"file":"workos.js","sourceRoot":"","sources":["../../src/oauth/workos.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAM1C,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAsDrF;;;GAGG;AACH,MAAM,UAAU,wCAAwC,CACtD,MAAc,EACd,MAAuC;IAEvC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,IAAI,wBAAwB,CAAC;QAClC,QAAQ;QACR,MAAM;QACN,KAAK;QACL,WAAW,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB;QAClE,GAAG,CAAC,MAAM,CAAC,4BAA4B,KAAK,SAAS;YACnD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,4BAA4B,EAAE,MAAM,CAAC,4BAA4B,EAAE,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,yGAAyG;AACzG,MAAM,OAAO,wBAAwB;IAC1B,QAAQ,GAAG,QAAiB,CAAC;IAC7B,KAAK,CAAS;IACd,SAAS,CAAS;IAClB,YAAY,CAAS;IACrB,MAAM,CAAS;IACf,eAAe,CAA6B;IAC5C,6BAA6B,CAAsB;IAE5D,YACE,MAAsC,EACtC,iBAA6C,IAAI,MAAM,CAAC;QACtD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC,cAAc;QAEjB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QACzB,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;QACtC,IAAI,CAAC,6BAA6B,GAAG,IAAI,GAAG,CAC1C,MAAM,CAAC,4BAA4B,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CACpE,CAAC;IACJ,CAAC;IAED,gBAAgB,CAAC,KAAa,EAAE,OAAsC;QACpE,MAAM,mBAAmB,GAAG,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC;QAClE,OAAO,IAAI,GAAG,CACZ,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC;YACvC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,KAAK;YACL,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CACH,CAAC;IACJ,CAAC;IAED,gBAAgB,CAAC,SAAiB,EAAE,QAAgB;QAClD,OAAO,IAAI,GAAG,CACZ,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC;YAChC,SAAS,EAAE,sBAAsB,CAAC,SAAS,CAAC;YAC5C,QAAQ;SACT,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,oBAAoB,EAAE,YAAY,EAAE,GAC7D,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC;YAC9C,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,SAAS;SACzB,CAAC,CAAC;QACL,IACE,oBAAoB,KAAK,SAAS;YAClC,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,oBAAoB,CAAC;YAC7D,YAAY,KAAK,SAAS;YAC1B,IAAI,CAAC,aAAa,KAAK,IAAI,EAC3B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,OAAO,GAAG,2BAA2B,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;QACtD,OAAO;YACL,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,OAAO;YACP,KAAK;YACL,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,eAAe,EAAE;gBACf,QAAQ,EAAE,QAAQ;gBAClB,EAAE,EAAE,SAAS;aACd;SACF,CAAC;IACJ,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,KAAyB;IACnE,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACjC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,6EAA6E,IAAI,GAAG,CACrF,CAAC;IACJ,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAY,EAAE,KAAa;IAC9D,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC;IAC1E,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/node_modules/@noodle-borg/service/dist/registry-access.d.ts

@@ -0,0 +1,14 @@
+import type { AccessMode, OwnerTokenVerifier, ServedTarget } from '@noodle-borg/transport-http';
+import { type RegistryStateView } from './registry-state.js';
+import type { AccessUpdateResult } from './registry-types.js';
+import type { TenantAuthConfig, TenantRef } from './store.js';
+export type CustomerVerifierFactory = (auth: TenantAuthConfig) => OwnerTokenVerifier;
+/** Whether a manifest has an expression rooted at the caller's identity object. */
+export declare function manifestUsesUserRoot(manifest: unknown): boolean;
+/**
+ * Atomically validate and persist an access-mode transition for one active deployment. The observed raw
+ * access mode supplies the optimistic guard; in-memory state is reconciled only after the store accepts
+ * the compare-and-set.
+ */
+export declare function updateActiveAccess(state: RegistryStateView, tenant: TenantRef, nextAccessMode: AccessMode, serverVersion: string | undefined, loadServed: (deploymentId: string) => Promise<ServedTarget | undefined>, customerVerifierFactory?: CustomerVerifierFactory): Promise<AccessUpdateResult>;
+//# sourceMappingURL=registry-access.d.ts.map

package/node_modules/@noodle-borg/service/dist/registry-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-access.d.ts","sourceRoot":"","sources":["../src/registry-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChG,OAAO,EAAqC,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAEhG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,KAAK,EAAgB,gBAAgB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5E,MAAM,MAAM,uBAAuB,GAAG,CAAC,IAAI,EAAE,gBAAgB,KAAK,kBAAkB,CAAC;AAErF,mFAAmF;AACnF,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAE/D;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,SAAS,EACjB,cAAc,EAAE,UAAU,EAC1B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,UAAU,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,EACvE,uBAAuB,CAAC,EAAE,uBAAuB,GAChD,OAAO,CAAC,kBAAkB,CAAC,CA6D7B"}