@noodleseed/one 0.38.1 → 0.40.0

package/node_modules/@noodle-borg/service/dist/billing/migration-apply.js

@@ -0,0 +1,194 @@
+import { z } from 'zod';
+import { legacyBillingMigrationMappingChecksum, parseLegacyBillingMigrationRequest, } from './migration.js';
+import { billingContentChecksum } from './model.js';
+export class LegacyBillingMigrationConflictError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'LegacyBillingMigrationConflictError';
+        this.code = code;
+    }
+}
+const scalarSchema = (label, max) => z
+    .string()
+    .trim()
+    .min(1, `${label} is required`)
+    .max(max, `${label} must be ${max} characters or fewer`)
+    .refine((value) => !hasControlCharacters(value), `${label} cannot contain control characters`);
+const serviceSchema = z
+    .string()
+    .url()
+    .max(2048)
+    .refine(isBillingServiceOrigin, 'service must be an HTTP(S) origin without credentials or a path')
+    .transform(normalizeBillingMigrationServiceUrl);
+const planProjectionSchema = z.strictObject({
+    org: scalarSchema('organization', 128),
+    response: z.strictObject({
+        ok: z.literal(true),
+        service: serviceSchema,
+        plan: z.strictObject({
+            org: scalarSchema('plan organization', 128),
+            plan: z.literal('free'),
+            state: z.literal('active'),
+            source: z.literal('default'),
+        }),
+    }),
+});
+const planEvidenceSchema = z.strictObject({
+    schemaVersion: z.literal(1),
+    service: serviceSchema,
+    capturedAt: z.iso.datetime({ offset: true }).transform((value) => new Date(value).toISOString()),
+    authoritativeOrganizationCount: z.number().int().nonnegative(),
+    projections: z.array(planProjectionSchema),
+    reconciliation: z.strictObject({
+        complete: z.literal(true),
+        treatment: z.literal('preserve_as_free'),
+        counts: z.strictObject({
+            freeActiveDefault: z.number().int().nonnegative(),
+            exceptions: z.literal(0),
+        }),
+    }),
+});
+const applyEnvelopeSchema = z.strictObject({
+    schemaVersion: z.literal(1),
+    mode: z.literal('shadow'),
+    mappings: z.array(z.unknown()),
+    expectedPreviewChecksum: z
+        .string()
+        .regex(/^[0-9a-f]{64}$/, 'expectedPreviewChecksum must be a lowercase SHA-256 checksum'),
+    legacyPlanEvidence: z.unknown(),
+    idempotencyKey: scalarSchema('idempotencyKey', 256),
+    reason: scalarSchema('reason', 512),
+    confirmed: z.literal(true),
+});
+export function parseLegacyBillingMigrationPlanEvidence(value) {
+    const result = planEvidenceSchema.safeParse(value);
+    if (!result.success) {
+        throw new Error(`invalid billing migration plan evidence: ${z.prettifyError(result.error)}`);
+    }
+    const evidence = result.data;
+    if (evidence.authoritativeOrganizationCount !== evidence.projections.length) {
+        throw new Error('invalid billing migration plan evidence: authoritativeOrganizationCount must equal projections length');
+    }
+    if (evidence.reconciliation.counts.freeActiveDefault !== evidence.projections.length ||
+        evidence.reconciliation.counts.exceptions !== 0) {
+        throw new Error('invalid billing migration plan evidence: reconciliation counts do not match projections');
+    }
+    const organizations = new Set();
+    for (const projection of evidence.projections) {
+        if (organizations.has(projection.org)) {
+            throw new Error(`invalid billing migration plan evidence: duplicate organization ${projection.org}`);
+        }
+        organizations.add(projection.org);
+        if (projection.response.plan.org !== projection.org) {
+            throw new Error(`invalid billing migration plan evidence: plan organization does not match ${projection.org}`);
+        }
+        if (projection.response.service !== evidence.service ||
+            projection.response.plan.source !== 'default' ||
+            projection.response.plan.plan !== 'free' ||
+            projection.response.plan.state !== 'active') {
+            throw new Error(`invalid billing migration plan evidence: ${projection.org} is not default Free and active`);
+        }
+    }
+    return evidence;
+}
+export function parseLegacyBillingMigrationApplyRequest(value) {
+    const envelope = applyEnvelopeSchema.safeParse(value);
+    if (!envelope.success) {
+        throw new Error(`invalid billing migration apply: ${z.prettifyError(envelope.error)}`);
+    }
+    let mappingRequest;
+    let legacyPlanEvidence;
+    try {
+        mappingRequest = parseLegacyBillingMigrationRequest({
+            schemaVersion: envelope.data.schemaVersion,
+            mappings: envelope.data.mappings,
+        });
+        legacyPlanEvidence = parseLegacyBillingMigrationPlanEvidence(envelope.data.legacyPlanEvidence);
+    }
+    catch (error) {
+        throw new Error(`invalid billing migration apply: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return {
+        schemaVersion: 1,
+        mode: 'shadow',
+        mappings: mappingRequest.mappings ?? [],
+        expectedPreviewChecksum: envelope.data.expectedPreviewChecksum,
+        legacyPlanEvidence,
+        idempotencyKey: envelope.data.idempotencyKey,
+        reason: envelope.data.reason,
+        confirmed: true,
+    };
+}
+export function legacyBillingMigrationPlanEvidenceChecksum(evidence) {
+    return billingContentChecksum({
+        ...evidence,
+        projections: [...evidence.projections].sort((a, b) => a.org.localeCompare(b.org)),
+    });
+}
+export function legacyBillingMigrationRequestFingerprint(request, actor, service) {
+    return billingContentChecksum({
+        schemaVersion: request.schemaVersion,
+        mode: request.mode,
+        mappingChecksum: legacyBillingMigrationMappingChecksum(request.mappings),
+        expectedPreviewChecksum: request.expectedPreviewChecksum,
+        planEvidenceChecksum: legacyBillingMigrationPlanEvidenceChecksum(request.legacyPlanEvidence),
+        reason: request.reason,
+        confirmed: request.confirmed,
+        service: normalizeBillingMigrationServiceUrl(service),
+        actor: { subject: actor.subject, email: actor.email },
+    });
+}
+export function legacyBillingMigrationSuccessAudit(result, actor) {
+    return {
+        eventType: 'billing.migration.apply',
+        org: 'platform',
+        actorSubject: actor.subject,
+        actorEmail: actor.email,
+        decision: 'allow',
+        status: result.replayed ? 200 : 201,
+        details: {
+            replayed: result.replayed,
+            mode: result.mode,
+            state: result.state,
+            organizations: result.counts.organizations,
+            accountsCreated: result.counts.accountsCreated,
+            accountsReused: result.counts.accountsReused,
+            linksCreated: result.counts.linksCreated,
+            linksPreserved: result.counts.linksPreserved,
+            productionApps: result.counts.productionApps,
+            grantCandidateFundingSets: result.counts.grantCandidateFundingSets,
+            mappingChecksum: result.mappingChecksum,
+            previewChecksum: result.previewChecksum,
+            planEvidenceChecksum: result.planEvidenceChecksum,
+        },
+    };
+}
+export function normalizeBillingMigrationServiceUrl(value) {
+    const parsed = new URL(value);
+    if ((parsed.protocol !== 'https:' && parsed.protocol !== 'http:') ||
+        parsed.username !== '' ||
+        parsed.password !== '' ||
+        parsed.pathname !== '/' ||
+        parsed.search !== '' ||
+        parsed.hash !== '') {
+        throw new Error('billing migration service must be an HTTP(S) origin');
+    }
+    return parsed.origin;
+}
+function hasControlCharacters(value) {
+    return [...value].some((character) => {
+        const code = character.charCodeAt(0);
+        return code <= 0x1f || code === 0x7f;
+    });
+}
+function isBillingServiceOrigin(value) {
+    try {
+        normalizeBillingMigrationServiceUrl(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=migration-apply.js.map

package/node_modules/@noodle-borg/service/dist/billing/migration-apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-apply.js","sourceRoot":"","sources":["../../src/billing/migration-apply.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAGL,qCAAqC,EACrC,kCAAkC,GACnC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAkGpD,MAAM,OAAO,mCAAoC,SAAQ,KAAK;IACnD,IAAI,CAAqC;IAElD,YAAY,IAAwC,EAAE,OAAe;QACnE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qCAAqC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,EAAE,CAClD,CAAC;KACE,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,EAAE,GAAG,KAAK,cAAc,CAAC;KAC9B,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,YAAY,GAAG,sBAAsB,CAAC;KACvD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,oCAAoC,CAAC,CAAC;AAEnG,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,EAAE;KACR,GAAG,EAAE;KACL,GAAG,CAAC,IAAI,CAAC;KACT,MAAM,CAAC,sBAAsB,EAAE,iEAAiE,CAAC;KACjG,SAAS,CAAC,mCAAmC,CAAC,CAAC;AAClD,MAAM,oBAAoB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,GAAG,EAAE,YAAY,CAAC,cAAc,EAAE,GAAG,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC;QACvB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACnB,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC;YACnB,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC;YAC3C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;YACvB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC1B,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;SAC7B,CAAC;KACH,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,CAAC,YAAY,CAAC;IACxC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,aAAa;IACtB,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAChG,8BAA8B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC9D,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;IAC1C,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC;QAC7B,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACzB,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACxC,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC;YACrB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YACjD,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;SACzB,CAAC;KACH,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,CAAC,YAAY,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC9B,uBAAuB,EAAE,CAAC;SACvB,MAAM,EAAE;SACR,KAAK,CAAC,gBAAgB,EAAE,8DAA8D,CAAC;IAC1F,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC/B,cAAc,EAAE,YAAY,CAAC,gBAAgB,EAAE,GAAG,CAAC;IACnD,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC;IACnC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,UAAU,uCAAuC,CAAC,KAAc;IACpE,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;IAC7B,IAAI,QAAQ,CAAC,8BAA8B,KAAK,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,iBAAiB,KAAK,QAAQ,CAAC,WAAW,CAAC,MAAM;QAChF,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,KAAK,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,mEAAmE,UAAU,CAAC,GAAG,EAAE,CACpF,CAAC;QACJ,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,CAAC,GAAG,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CACb,6EAA6E,UAAU,CAAC,GAAG,EAAE,CAC9F,CAAC;QACJ,CAAC;QACD,IACE,UAAU,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;YAChD,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS;YAC7C,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM;YACxC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,EAC3C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,4CAA4C,UAAU,CAAC,GAAG,iCAAiC,CAC5F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,KAAc;IAEd,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,cAA6C,CAAC;IAClD,IAAI,kBAA6C,CAAC;IAClD,IAAI,CAAC;QACH,cAAc,GAAG,kCAAkC,CAAC;YAClD,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa;YAC1C,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ;SACjC,CAAC,CAAC;QACH,kBAAkB,GAAG,uCAAuC,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,cAAc,CAAC,QAAQ,IAAI,EAAE;QACvC,uBAAuB,EAAE,QAAQ,CAAC,IAAI,CAAC,uBAAuB;QAC9D,kBAAkB;QAClB,cAAc,EAAE,QAAQ,CAAC,IAAI,CAAC,cAAc;QAC5C,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM;QAC5B,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0CAA0C,CACxD,QAAmC;IAEnC,OAAO,sBAAsB,CAAC;QAC5B,GAAG,QAAQ;QACX,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;KAClF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,OAA2C,EAC3C,KAAsD,EACtD,OAAe;IAEf,OAAO,sBAAsB,CAAC;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,eAAe,EAAE,qCAAqC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACxE,uBAAuB,EAAE,OAAO,CAAC,uBAAuB;QACxD,oBAAoB,EAAE,0CAA0C,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAC5F,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,mCAAmC,CAAC,OAAO,CAAC;QACrD,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;KACtD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,MAAyC,EACzC,KAAsD;IAEtD,OAAO;QACL,SAAS,EAAE,yBAAyB;QACpC,GAAG,EAAE,UAAU;QACf,YAAY,EAAE,KAAK,CAAC,OAAO;QAC3B,UAAU,EAAE,KAAK,CAAC,KAAK;QACvB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;QACnC,OAAO,EAAE;YACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa;YAC1C,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe;YAC9C,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc;YAC5C,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY;YACxC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc;YAC5C,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc;YAC5C,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,yBAAyB;YAClE,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;SAClD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,KAAa;IAC/D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,IACE,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;QAC7D,MAAM,CAAC,QAAQ,KAAK,EAAE;QACtB,MAAM,CAAC,QAAQ,KAAK,EAAE;QACtB,MAAM,CAAC,QAAQ,KAAK,GAAG;QACvB,MAAM,CAAC,MAAM,KAAK,EAAE;QACpB,MAAM,CAAC,IAAI,KAAK,EAAE,EAClB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,IAAI,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/node_modules/@noodle-borg/service/dist/billing/migration-contract.d.ts

@@ -0,0 +1,79 @@
+import { type BillingIdentityRef, type GOOGLE_CONTROL_PLANE_ISSUER } from './model.js';
+export interface LegacyProductionAppIdentity {
+    readonly app: string;
+    readonly createdAt: string;
+}
+export interface LegacyUnlinkedOrganizationMapping {
+    readonly org: string;
+    readonly linkState: 'unlinked';
+    readonly defaultBillingOwnerSubject: string;
+    readonly productionApps: readonly LegacyProductionAppIdentity[];
+}
+export interface LegacyLinkedOrganizationMapping {
+    readonly org: string;
+    readonly linkState: 'linked';
+    readonly expectedBillingAccountId: string;
+    readonly expectedLinkVersion: number;
+    readonly productionApps: readonly LegacyProductionAppIdentity[];
+}
+export type LegacyBillingMigrationMapping = LegacyUnlinkedOrganizationMapping | LegacyLinkedOrganizationMapping;
+export interface LegacyBillingMigrationRequest {
+    readonly schemaVersion: 1;
+    readonly mappings?: readonly LegacyBillingMigrationMapping[];
+}
+export type LegacyBillingMigrationBlockerCode = 'duplicate_org_mapping' | 'duplicate_production_app' | 'existing_link_conflict' | 'linked_organization_not_linked' | 'owner_mapping_required' | 'owner_billing_identity_invalid' | 'owner_billing_identity_conflict' | 'owner_not_org_owner' | 'owner_subject_unknown' | 'organization_not_found' | 'production_app_not_active' | 'production_app_not_found' | 'production_classification_required';
+export interface LegacyBillingMigrationBlocker {
+    readonly code: LegacyBillingMigrationBlockerCode;
+    readonly org: string;
+    readonly message: string;
+}
+export interface LegacyBillingMigrationPreview {
+    readonly schemaVersion: 1;
+    readonly ready: boolean;
+    readonly organizations: readonly {
+        readonly org: string;
+        readonly ownerCandidates: readonly {
+            readonly subject: string;
+            readonly email: string;
+        }[];
+        readonly mappedOwnerSubject?: string;
+        readonly productionApps?: readonly LegacyProductionAppIdentity[];
+    }[];
+    readonly linkedOrganizations: readonly {
+        readonly org: string;
+        readonly billingAccountId: string;
+        readonly homeFreeBillingAccountId: string;
+        readonly homeOwner: BillingIdentityRef;
+        readonly fallbackBillingAccountId: string;
+        readonly version: number;
+        readonly productionApps?: readonly LegacyProductionAppIdentity[];
+    }[];
+    readonly fundingSets: readonly {
+        readonly destination: {
+            readonly kind: 'existing';
+            readonly billingAccountId: string;
+        } | {
+            readonly kind: 'proposed_default';
+            readonly identityIssuer: typeof GOOGLE_CONTROL_PLANE_ISSUER;
+            readonly subject: string;
+        };
+        readonly organizations: readonly string[];
+        readonly productionApps: readonly (LegacyProductionAppIdentity & {
+            readonly org: string;
+        })[];
+        readonly missingProductionClassifications: readonly string[];
+    }[];
+    readonly blockers: readonly LegacyBillingMigrationBlocker[];
+    readonly grantPolicy: {
+        readonly durationDays: 90;
+        readonly startsAt: 'billing_enforcement_cutover';
+        readonly expiresAt: null;
+        readonly eligibility: 'account_cohort_above_capacity';
+    };
+    /** Canonical SHA-256 over the complete preview except this self-referential field. */
+    readonly previewChecksum: string;
+}
+export declare function parseLegacyBillingMigrationRequest(value: unknown): LegacyBillingMigrationRequest;
+export declare function legacyBillingMigrationPreviewChecksum(preview: Omit<LegacyBillingMigrationPreview, 'previewChecksum'> | LegacyBillingMigrationPreview): string;
+export declare function legacyBillingMigrationMappingChecksum(mappings: readonly LegacyBillingMigrationMapping[]): string;
+//# sourceMappingURL=migration-contract.d.ts.map

package/node_modules/@noodle-borg/service/dist/billing/migration-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-contract.d.ts","sourceRoot":"","sources":["../../src/billing/migration-contract.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,kBAAkB,EAEvB,KAAK,2BAA2B,EAEjC,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,SAAS,2BAA2B,EAAE,CAAC;CACjE;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC;IAC7B,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,SAAS,2BAA2B,EAAE,CAAC;CACjE;AAED,MAAM,MAAM,6BAA6B,GACrC,iCAAiC,GACjC,+BAA+B,CAAC;AAEpC,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAC;CAC9D;AAED,MAAM,MAAM,iCAAiC,GACzC,uBAAuB,GACvB,0BAA0B,GAC1B,wBAAwB,GACxB,gCAAgC,GAChC,wBAAwB,GACxB,gCAAgC,GAChC,iCAAiC,GACjC,qBAAqB,GACrB,uBAAuB,GACvB,wBAAwB,GACxB,2BAA2B,GAC3B,0BAA0B,GAC1B,oCAAoC,CAAC;AAEzC,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC;IACjD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,SAAS;QAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,eAAe,EAAE,SAAS;YAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC1F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;QACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,2BAA2B,EAAE,CAAC;KAClE,EAAE,CAAC;IACJ,QAAQ,CAAC,mBAAmB,EAAE,SAAS;QACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;QAC1C,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;QACvC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;QAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,2BAA2B,EAAE,CAAC;KAClE,EAAE,CAAC;IACJ,QAAQ,CAAC,WAAW,EAAE,SAAS;QAC7B,QAAQ,CAAC,WAAW,EAChB;YAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;YAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;SAAE,GAChE;YACE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;YAClC,QAAQ,CAAC,cAAc,EAAE,OAAO,2BAA2B,CAAC;YAC5D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;SAC1B,CAAC;QACN,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;QAC1C,QAAQ,CAAC,cAAc,EAAE,SAAS,CAAC,2BAA2B,GAAG;YAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC,EAAE,CAAC;QAC7F,QAAQ,CAAC,gCAAgC,EAAE,SAAS,MAAM,EAAE,CAAC;KAC9D,EAAE,CAAC;IACJ,QAAQ,CAAC,QAAQ,EAAE,SAAS,6BAA6B,EAAE,CAAC;IAC5D,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;QAC1B,QAAQ,CAAC,QAAQ,EAAE,6BAA6B,CAAC;QACjD,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;QACzB,QAAQ,CAAC,WAAW,EAAE,+BAA+B,CAAC;KACvD,CAAC;IACF,sFAAsF;IACtF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AA2CD,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,OAAO,GAAG,6BAA6B,CAehG;AAED,wBAAgB,qCAAqC,CACnD,OAAO,EAAE,IAAI,CAAC,6BAA6B,EAAE,iBAAiB,CAAC,GAAG,6BAA6B,GAC9F,MAAM,CAGR;AAED,wBAAgB,qCAAqC,CACnD,QAAQ,EAAE,SAAS,6BAA6B,EAAE,GACjD,MAAM,CAaR"}

package/node_modules/@noodle-borg/service/dist/billing/migration-contract.js

@@ -0,0 +1,86 @@
+import { z } from 'zod';
+import { validateSlug } from '../store/validate.js';
+import { billingContentChecksum, validateBillingAccountId, } from './model.js';
+const appSlugSchema = z
+    .string()
+    .trim()
+    .refine((value) => isValidSlug('app', value), 'invalid app slug');
+const orgSlugSchema = z
+    .string()
+    .trim()
+    .refine((value) => isValidSlug('org', value), 'invalid organization slug');
+const billingAccountIdSchema = z
+    .string()
+    .trim()
+    .refine(isValidBillingAccountId, 'invalid billing account ID');
+const productionAppIdentitySchema = z.strictObject({
+    app: appSlugSchema,
+    createdAt: z.iso.datetime({ offset: true }).transform((value) => new Date(value).toISOString()),
+});
+const legacyBillingMigrationRequestSchema = z.strictObject({
+    schemaVersion: z.literal(1),
+    mappings: z
+        .array(z.discriminatedUnion('linkState', [
+        z.strictObject({
+            org: orgSlugSchema,
+            linkState: z.literal('unlinked'),
+            defaultBillingOwnerSubject: z.string().trim().min(1).max(512),
+            productionApps: z.array(productionAppIdentitySchema),
+        }),
+        z.strictObject({
+            org: orgSlugSchema,
+            linkState: z.literal('linked'),
+            expectedBillingAccountId: billingAccountIdSchema,
+            expectedLinkVersion: z.number().int().positive(),
+            productionApps: z.array(productionAppIdentitySchema),
+        }),
+    ]))
+        .optional(),
+});
+export function parseLegacyBillingMigrationRequest(value) {
+    const result = legacyBillingMigrationRequestSchema.safeParse(value);
+    if (!result.success) {
+        throw new Error(`invalid billing migration preview: ${z.prettifyError(result.error)}`);
+    }
+    return {
+        schemaVersion: result.data.schemaVersion,
+        ...(result.data.mappings !== undefined
+            ? {
+                mappings: result.data.mappings.map((mapping) => ({
+                    ...mapping,
+                })),
+            }
+            : {}),
+    };
+}
+export function legacyBillingMigrationPreviewChecksum(preview) {
+    const { previewChecksum: _checksum, ...content } = preview;
+    return billingContentChecksum(content);
+}
+export function legacyBillingMigrationMappingChecksum(mappings) {
+    return billingContentChecksum(mappings
+        .map((mapping) => ({
+        ...mapping,
+        productionApps: [...mapping.productionApps].sort((a, b) => a.app.localeCompare(b.app) || a.createdAt.localeCompare(b.createdAt)),
+    }))
+        .sort((a, b) => a.org.localeCompare(b.org) || JSON.stringify(a).localeCompare(JSON.stringify(b))));
+}
+function isValidBillingAccountId(value) {
+    try {
+        validateBillingAccountId(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isValidSlug(kind, value) {
+    try {
+        validateSlug(kind, value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=migration-contract.js.map

package/node_modules/@noodle-borg/service/dist/billing/migration-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-contract.js","sourceRoot":"","sources":["../../src/billing/migration-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAEL,sBAAsB,EAEtB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AA6FpB,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,EAAE;KACR,IAAI,EAAE;KACN,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACpE,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,EAAE;KACR,IAAI,EAAE;KACN,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,2BAA2B,CAAC,CAAC;AAC7E,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,EAAE;KACR,IAAI,EAAE;KACN,MAAM,CAAC,uBAAuB,EAAE,4BAA4B,CAAC,CAAC;AAEjE,MAAM,2BAA2B,GAAG,CAAC,CAAC,YAAY,CAAC;IACjD,GAAG,EAAE,aAAa;IAClB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;CAChG,CAAC,CAAC;AAEH,MAAM,mCAAmC,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,CAAC;SACR,KAAK,CACJ,CAAC,CAAC,kBAAkB,CAAC,WAAW,EAAE;QAChC,CAAC,CAAC,YAAY,CAAC;YACb,GAAG,EAAE,aAAa;YAClB,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;YAChC,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;YAC7D,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC;SACrD,CAAC;QACF,CAAC,CAAC,YAAY,CAAC;YACb,GAAG,EAAE,aAAa;YAClB,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC9B,wBAAwB,EAAE,sBAAsB;YAChD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;YAChD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC;SACrD,CAAC;KACH,CAAC,CACH;SACA,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,UAAU,kCAAkC,CAAC,KAAc;IAC/D,MAAM,MAAM,GAAG,mCAAmC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa;QACxC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS;YACpC,CAAC,CAAC;gBACE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBAC/C,GAAG,OAAO;iBACX,CAAC,CAAC;aACJ;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,OAA+F;IAE/F,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,GAAG,OAAwC,CAAC;IAC5F,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,QAAkD;IAElD,OAAO,sBAAsB,CAC3B,QAAQ;SACL,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACjB,GAAG,OAAO;QACV,cAAc,EAAE,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,IAAI,CAC9C,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAC/E;KACF,CAAC,CAAC;SACF,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAC3F,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,IAAI,CAAC;QACH,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAmB,EAAE,KAAa;IACrD,IAAI,CAAC;QACH,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/node_modules/@noodle-borg/service/dist/billing/migration.d.ts

@@ -1,33 +1,6 @@
 import type { ControlPlaneStore } from '../store.js';
-import { type BillingIdentityRef, GOOGLE_CONTROL_PLANE_ISSUER } from './model.js';
-export interface LegacyProductionAppIdentity {
-    readonly app: string;
-    readonly createdAt: string;
-}
-export interface LegacyUnlinkedOrganizationMapping {
-    readonly org: string;
-    readonly linkState: 'unlinked';
-    readonly defaultBillingOwnerSubject: string;
-    readonly productionApps: readonly LegacyProductionAppIdentity[];
-}
-export interface LegacyLinkedOrganizationMapping {
-    readonly org: string;
-    readonly linkState: 'linked';
-    readonly expectedBillingAccountId: string;
-    readonly expectedLinkVersion: number;
-    readonly productionApps: readonly LegacyProductionAppIdentity[];
-}
-export type LegacyBillingMigrationMapping = LegacyUnlinkedOrganizationMapping | LegacyLinkedOrganizationMapping;
-export interface LegacyBillingMigrationRequest {
-    readonly schemaVersion: 1;
-    readonly mappings?: readonly LegacyBillingMigrationMapping[];
-}
-export type LegacyBillingMigrationBlockerCode = 'duplicate_org_mapping' | 'duplicate_production_app' | 'existing_link_conflict' | 'linked_organization_not_linked' | 'owner_mapping_required' | 'owner_billing_identity_invalid' | 'owner_not_org_owner' | 'owner_subject_unknown' | 'organization_not_found' | 'production_app_not_active' | 'production_app_not_found' | 'production_classification_required';
-export interface LegacyBillingMigrationBlocker {
-    readonly code: LegacyBillingMigrationBlockerCode;
-    readonly org: string;
-    readonly message: string;
-}
+import { type LegacyBillingMigrationPreview, type LegacyBillingMigrationRequest } from './migration-contract.js';
+export { type LegacyBillingMigrationBlocker, type LegacyBillingMigrationBlockerCode, type LegacyBillingMigrationMapping, type LegacyBillingMigrationPreview, type LegacyBillingMigrationRequest, type LegacyLinkedOrganizationMapping, type LegacyProductionAppIdentity, type LegacyUnlinkedOrganizationMapping, legacyBillingMigrationMappingChecksum, legacyBillingMigrationPreviewChecksum, parseLegacyBillingMigrationRequest, } from './migration-contract.js';
 export interface LegacyBillingMigrationInventory {
     getAppIdentity(org: string, app: string): Promise<{
         readonly createdAt: string;
@@ -35,50 +8,6 @@ export interface LegacyBillingMigrationInventory {
         readonly archivedAt?: string;
     } | undefined>;
 }
-export declare function parseLegacyBillingMigrationRequest(value: unknown): LegacyBillingMigrationRequest;
-export interface LegacyBillingMigrationPreview {
-    readonly schemaVersion: 1;
-    readonly ready: boolean;
-    readonly organizations: readonly {
-        readonly org: string;
-        readonly ownerCandidates: readonly {
-            readonly subject: string;
-            readonly email: string;
-        }[];
-        readonly mappedOwnerSubject?: string;
-        readonly productionApps?: readonly LegacyProductionAppIdentity[];
-    }[];
-    readonly linkedOrganizations: readonly {
-        readonly org: string;
-        readonly billingAccountId: string;
-        readonly homeFreeBillingAccountId: string;
-        readonly homeOwner: BillingIdentityRef;
-        readonly fallbackBillingAccountId: string;
-        readonly version: number;
-        readonly productionApps?: readonly LegacyProductionAppIdentity[];
-    }[];
-    readonly fundingSets: readonly {
-        readonly destination: {
-            readonly kind: 'existing';
-            readonly billingAccountId: string;
-        } | {
-            readonly kind: 'proposed_default';
-            readonly identityIssuer: typeof GOOGLE_CONTROL_PLANE_ISSUER;
-            readonly subject: string;
-        };
-        readonly organizations: readonly string[];
-        readonly productionApps: readonly (LegacyProductionAppIdentity & {
-            readonly org: string;
-        })[];
-        readonly missingProductionClassifications: readonly string[];
-    }[];
-    readonly blockers: readonly LegacyBillingMigrationBlocker[];
-    readonly grantPolicy: {
-        readonly durationDays: 90;
-        readonly startsAt: 'billing_enforcement_cutover';
-        readonly expiresAt: null;
-        readonly eligibility: 'account_cohort_above_capacity';
-    };
-}
-export declare function previewLegacyBillingMigration(store: ControlPlaneStore, request: LegacyBillingMigrationRequest, inventory?: LegacyBillingMigrationInventory): Promise<LegacyBillingMigrationPreview>;
+export type LegacyBillingMigrationControlPlane = Pick<ControlPlaneStore, 'listOrgs' | 'listOrgMembers' | 'getOrgBillingLink' | 'getDefaultBillingAccount'>;
+export declare function previewLegacyBillingMigration(store: LegacyBillingMigrationControlPlane, request: LegacyBillingMigrationRequest, inventory?: LegacyBillingMigrationInventory): Promise<LegacyBillingMigrationPreview>;
 //# sourceMappingURL=migration.d.ts.map

package/node_modules/@noodle-borg/service/dist/billing/migration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migration.d.ts","sourceRoot":"","sources":["../../src/billing/migration.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,KAAK,kBAAkB,EACvB,2BAA2B,EAI5B,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,SAAS,2BAA2B,EAAE,CAAC;CACjE;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC;IAC7B,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,SAAS,2BAA2B,EAAE,CAAC;CACjE;AAED,MAAM,MAAM,6BAA6B,GACrC,iCAAiC,GACjC,+BAA+B,CAAC;AAEpC,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAC;CAC9D;AAED,MAAM,MAAM,iCAAiC,GACzC,uBAAuB,GACvB,0BAA0B,GAC1B,wBAAwB,GACxB,gCAAgC,GAChC,wBAAwB,GACxB,gCAAgC,GAChC,qBAAqB,GACrB,uBAAuB,GACvB,wBAAwB,GACxB,2BAA2B,GAC3B,0BAA0B,GAC1B,oCAAoC,CAAC;AAEzC,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC;IACjD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,+BAA+B;IAC9C,cAAc,CACZ,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,OAAO,CACN;QACE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;KAC9B,GACD,SAAS,CACZ,CAAC;CACH;AAoDD,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,OAAO,GAAG,6BAA6B,CAehG;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,SAAS;QAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,eAAe,EAAE,SAAS;YAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC1F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;QACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,2BAA2B,EAAE,CAAC;KAClE,EAAE,CAAC;IACJ,QAAQ,CAAC,mBAAmB,EAAE,SAAS;QACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;QAC1C,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;QACvC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;QAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,2BAA2B,EAAE,CAAC;KAClE,EAAE,CAAC;IACJ,QAAQ,CAAC,WAAW,EAAE,SAAS;QAC7B,QAAQ,CAAC,WAAW,EAChB;YAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;YAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;SAAE,GAChE;YACE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;YAClC,QAAQ,CAAC,cAAc,EAAE,OAAO,2BAA2B,CAAC;YAC5D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;SAC1B,CAAC;QACN,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;QAC1C,QAAQ,CAAC,cAAc,EAAE,SAAS,CAAC,2BAA2B,GAAG;YAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC,EAAE,CAAC;QAC7F,QAAQ,CAAC,gCAAgC,EAAE,SAAS,MAAM,EAAE,CAAC;KAC9D,EAAE,CAAC;IACJ,QAAQ,CAAC,QAAQ,EAAE,SAAS,6BAA6B,EAAE,CAAC;IAC5D,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;QAC1B,QAAQ,CAAC,QAAQ,EAAE,6BAA6B,CAAC;QACjD,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;QACzB,QAAQ,CAAC,WAAW,EAAE,+BAA+B,CAAC;KACvD,CAAC;CACH;AAED,wBAAsB,6BAA6B,CACjD,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,6BAA6B,EACtC,SAAS,CAAC,EAAE,+BAA+B,GAC1C,OAAO,CAAC,6BAA6B,CAAC,CAyMxC"}
+{"version":3,"file":"migration.d.ts","sourceRoot":"","sources":["../../src/billing/migration.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAGL,KAAK,6BAA6B,EAClC,KAAK,6BAA6B,EAGnC,MAAM,yBAAyB,CAAC;AAOjC,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,iCAAiC,EACtC,KAAK,6BAA6B,EAClC,KAAK,6BAA6B,EAClC,KAAK,6BAA6B,EAClC,KAAK,+BAA+B,EACpC,KAAK,2BAA2B,EAChC,KAAK,iCAAiC,EACtC,qCAAqC,EACrC,qCAAqC,EACrC,kCAAkC,GACnC,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,+BAA+B;IAC9C,cAAc,CACZ,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,OAAO,CACN;QACE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;KAC9B,GACD,SAAS,CACZ,CAAC;CACH;AAED,MAAM,MAAM,kCAAkC,GAAG,IAAI,CACnD,iBAAiB,EACjB,UAAU,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,0BAA0B,CACjF,CAAC;AAWF,wBAAsB,6BAA6B,CACjD,KAAK,EAAE,kCAAkC,EACzC,OAAO,EAAE,6BAA6B,EACtC,SAAS,CAAC,EAAE,+BAA+B,GAC1C,OAAO,CAAC,6BAA6B,CAAC,CAuNxC"}

package/node_modules/@noodle-borg/service/dist/billing/migration.js

@@ -1,58 +1,7 @@
-import { z } from 'zod';
-import { isSystemOwnedOrgSlug, validateSlug } from '../store/validate.js';
-import { GOOGLE_CONTROL_PLANE_ISSUER, normalizeBillingEmail, normalizeBillingIdentity, validateBillingAccountId, } from './model.js';
-const appSlugSchema = z
-    .string()
-    .trim()
-    .refine((value) => isValidSlug('app', value), 'invalid app slug');
-const orgSlugSchema = z
-    .string()
-    .trim()
-    .refine((value) => isValidSlug('org', value), 'invalid organization slug');
-const billingAccountIdSchema = z
-    .string()
-    .trim()
-    .refine(isValidBillingAccountId, 'invalid billing account ID');
-const productionAppIdentitySchema = z.strictObject({
-    app: appSlugSchema,
-    createdAt: z.iso.datetime({ offset: true }).transform((value) => new Date(value).toISOString()),
-});
-const legacyBillingMigrationRequestSchema = z.strictObject({
-    schemaVersion: z.literal(1),
-    mappings: z
-        .array(z.discriminatedUnion('linkState', [
-        z.strictObject({
-            org: orgSlugSchema,
-            linkState: z.literal('unlinked'),
-            defaultBillingOwnerSubject: z.string().trim().min(1).max(512),
-            productionApps: z.array(productionAppIdentitySchema),
-        }),
-        z.strictObject({
-            org: orgSlugSchema,
-            linkState: z.literal('linked'),
-            expectedBillingAccountId: billingAccountIdSchema,
-            expectedLinkVersion: z.number().int().positive(),
-            productionApps: z.array(productionAppIdentitySchema),
-        }),
-    ]))
-        .optional(),
-});
-export function parseLegacyBillingMigrationRequest(value) {
-    const result = legacyBillingMigrationRequestSchema.safeParse(value);
-    if (!result.success) {
-        throw new Error(`invalid billing migration preview: ${z.prettifyError(result.error)}`);
-    }
-    return {
-        schemaVersion: result.data.schemaVersion,
-        ...(result.data.mappings !== undefined
-            ? {
-                mappings: result.data.mappings.map((mapping) => ({
-                    ...mapping,
-                })),
-            }
-            : {}),
-    };
-}
+import { isSystemOwnedOrgSlug } from '../store/validate.js';
+import { legacyBillingMigrationPreviewChecksum, } from './migration-contract.js';
+import { GOOGLE_CONTROL_PLANE_ISSUER, normalizeBillingEmail, normalizeBillingIdentity, } from './model.js';
+export { legacyBillingMigrationMappingChecksum, legacyBillingMigrationPreviewChecksum, parseLegacyBillingMigrationRequest, } from './migration-contract.js';
 export async function previewLegacyBillingMigration(store, request, inventory) {
     if (request.schemaVersion !== 1)
         throw new Error('unsupported billing migration schemaVersion');
@@ -73,6 +22,7 @@ export async function previewLegacyBillingMigration(store, request, inventory) {
     const organizations = [];
     const linkedOrganizations = [];
     const fundingSets = new Map();
+    const selectedOwnerEmails = new Map();
     const knownOrgs = new Set();
     for (const org of await store.listOrgs()) {
         if (isSystemOwnedOrgSlug(org.slug))
@@ -167,6 +117,18 @@ export async function previewLegacyBillingMigration(store, request, inventory) {
             });
             continue;
         }
+        const ownerIdentityKey = `${GOOGLE_CONTROL_PLANE_ISSUER}\u0000${selectedSubject}`;
+        const normalizedOwnerEmail = normalizeBillingEmail(selectedOwner.email);
+        const priorOwnerEmail = selectedOwnerEmails.get(ownerIdentityKey);
+        if (priorOwnerEmail !== undefined && priorOwnerEmail !== normalizedOwnerEmail) {
+            blockers.push({
+                code: 'owner_billing_identity_conflict',
+                org: org.slug,
+                message: 'mapped billing owner has conflicting current emails across organizations',
+            });
+            continue;
+        }
+        selectedOwnerEmails.set(ownerIdentityKey, normalizedOwnerEmail);
         const validProductionApps = await validateProductionApps(org.slug, mapping.productionApps, inventory, blockers);
         if (!validProductionApps)
             continue;
@@ -191,7 +153,7 @@ export async function previewLegacyBillingMigration(store, request, inventory) {
             message: 'mapping references an unknown organization',
         });
     }
-    return {
+    const preview = {
         schemaVersion: 1,
         ready: blockers.length === 0 &&
             [...fundingSets.values()].every((set) => set.missingProductionClassifications.length === 0),
@@ -215,6 +177,7 @@ export async function previewLegacyBillingMigration(store, request, inventory) {
             eligibility: 'account_cohort_above_capacity',
         },
     };
+    return { ...preview, previewChecksum: legacyBillingMigrationPreviewChecksum(preview) };
 }
 async function validateProductionApps(org, productionApps, inventory, blockers) {
     let valid = true;
@@ -280,22 +243,4 @@ function fundingDestinationKey(destination) {
         ? `existing:${destination.billingAccountId}`
         : `proposed:${destination.identityIssuer}:${destination.subject}`;
 }
-function isValidBillingAccountId(value) {
-    try {
-        validateBillingAccountId(value);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function isValidSlug(kind, value) {
-    try {
-        validateSlug(kind, value);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
 //# sourceMappingURL=migration.js.map