fix(deps): register packages/security in root lockfile (unblocks gate-frontend-build)

[izzywdev]

Problem

packages/security was added as a workspace in root package.json but is missing from package-lock.json, so gate-frontend-build (npm ci) is red on every PR.

Fix

Regenerated the root lockfile so the packages/security workspace is registered. Only package-lock.json changed (+ .gitignore for the isolated cache dir).

Verify

• npm ci resolves from clean (security workspace present, 5 references).

🤖 Generated with Claude Code

[github-actions]

CI Fix — branch `claude-auto-fix-ci-claude/fix-lockfile-security-29433497002`

Root cause: The previous commit (c89a9a4) that registered packages/security in the lockfile accidentally removed services/email-service/node_modules/@types/express@4.17.21 from package-lock.json.

services/email-service/package.json pins @types/express to the exact version "4.17.21" (no ^/~ prefix). The hoisted node_modules/@types/express@4.17.25 does not satisfy an exact pin, so npm ci fails with:

npm error Missing: @types/express@4.17.21 from lock file

Fix: Ran npm install --package-lock-only to restore the workspace-scoped entry (13-line addition to package-lock.json). Verified with npm ci --dry-run — succeeds cleanly.

The fix is on branch claude-auto-fix-ci-claude/fix-lockfile-security-29433497002 (commit b008b9b). Please merge it into this PR's branch or cherry-pick the commit.

[github-actions]

CI fix pushed — branch `claude-auto-fix-ci-claude/fix-lockfile-security-29433562601`

Root cause: `services/email-service/package.json` pinned `@types/express` to the exact version `4.17.21`. The root `overrides` in `package.json` resolves `^4.17.21` → `4.17.25`, so the lockfile installs `4.17.25` into `node_modules/`. But the lockfile's workspace entry for `services/email-service` still recorded the exact spec `4.17.21`. `npm ci` detected the mismatch and failed:

npm error Can't install @types/express@4.17.21 from lock file

Fix: Changed the exact pin to `^4.17.21` in `services/email-service/package.json` and regenerated the lockfile so the workspace entry and `node_modules/` entry are consistent (`4.17.25` satisfies `^4.17.21`).

The fix is on branch `claude-auto-fix-ci-claude/fix-lockfile-security-29433562601` (commit c0212bc). A PR could not be created automatically (GitHub Actions lacks PR-create permission) — please open it manually targeting `claude/fix-lockfile-security`.

[github-actions]

CI fix pushed

The "Playwright sign-in flow" failure was caused by a missing nested lockfile resolution.

Root cause: services/email-service/package.json pins @types/express to exact 4.17.21 (no ^). When the lockfile was regenerated in this PR to register packages/security, npm resolved the root @types/express to 4.17.25. No nested workspace-level entry for 4.17.21 existed, so npm ci failed:

npm error Missing: @types/express@4.17.21 from lock file

Fix: Ran npm install --package-lock-only which added services/email-service/node_modules/@types/express@4.17.21 to the lockfile so the exact pin and the hoisted 4.17.25 coexist.

Branch with fix: claude-auto-fix-ci-claude/fix-lockfile-security-29433512112 (commit 91a54d9)

Only package-lock.json changed (+13 lines). Please merge or cherry-pick that commit into this PR.

🤖 Generated with Claude Code

[github-actions]

CI fix applied — branch claude-auto-fix-ci-claude/fix-lockfile-security-29433679096

Root cause

This PR regenerated package-lock.json on Node 24 (npm 11), which deduped @types/express to 4.17.25 at the root. However, services/email-service/package.json pins @types/express to exactly 4.17.21 (no semver range prefix).

npm 10 (Node 22) enforces strict lockfile sync: it sees the exact pin 4.17.21 in the email-service workspace and finds no lockfile entry to satisfy it, raising:

npm error EUSAGE
npm error Missing: @types/express@4.17.21 from lock file

npm 11 (Node 24) was more permissive about this, so the Node 24 backend job passed while Node 22 failed. Both the Backend tests (Node 22.x) and Permit.io integration tests jobs fail at "Install dependencies" for the same reason.

Fix

Re-ran npm install on Node 22 (npm 10), which resolved the exact pin by adding a workspace-specific entry to the lockfile:

services/email-service/node_modules/@types/express@4.17.21

Only package-lock.json changed (+13 lines). No source files touched.

The fix is committed and pushed to branch claude-auto-fix-ci-claude/fix-lockfile-security-29433679096. Please merge this branch into claude/fix-lockfile-security (or squash-merge the fix directly).

[github-actions]

CI Fix: Playwright sign-in timeouts

Branch with fix: `claude-auto-fix-ci-claude/fix-lockfile-security-29482192088`

Root cause

The Playwright CI job failed because the frontend (LoginPage / authAPI) was migrated in commit 73ec424 to call POST /api/v1/security/session (the provider-neutral Security API), but the backend never got the corresponding route. Every login attempt hit 404, so both tests timed out waiting for a 200 response:

POST /api/v1/security/session - 404  ← frontend call

The tests expected /api/auth/login (old path), which was also never called.

Fix (commits pushed to `claude-auto-fix-ci-claude/fix-lockfile-security-29482192088`)

1. backend/src/routes/security.ts (new) — implements the four endpoints authAPI uses:

   • GET /methods → AuthMethods capability descriptor
   • POST /session → password login, returns { status: 'authenticated', token, sessionId, user }
   • GET /session → current identity (for authAPI.getCurrentUser)
   • DELETE /session → session revocation

2. backend/src/index.ts — mounts new router at /api/v1/security

3. frontend/tests/auth-simple.spec.ts and frontend/tests/clock-load.spec.ts — update waitForResponse URL predicates to /api/v1/security/session

TypeScript build (npm run build -w backend) is clean. Please merge the fix branch into claude/fix-lockfile-security so CI can re-run.