@noodleseed/one 0.63.0 → 0.64.0

package/node_modules/@noodle-borg/service/dist/oauth/upstream-provider-choice.js

@@ -0,0 +1,63 @@
+import { renderOAuthPage } from './branding.js';
+import { hashToken, randomToken } from './tokens.js';
+import { upstreamAuthorizationUrl } from './upstream-federation.js';
+export function renderUpstreamProviderChoice(state) {
+    const escapedState = escapeHtml(state);
+    return renderOAuthPage({
+        title: 'Choose how to sign in — Noodle Seed',
+        kicker: 'Sign in',
+        heading: 'Choose how to continue',
+        contentHtml: `<p class="ns-lede">Google remains the default while authentication is in recovery mode. If your account uses email or another sign-in method, continue securely through WorkOS.</p>
+<form method="post" action="/oauth/upstream/continue">
+  <input type="hidden" name="choice_state" value="${escapedState}" />
+  <div class="btn-glow"><button class="btn btn-primary" type="submit" name="provider" value="google">Continue with Google</button></div>
+  <div class="btn-glow"><button class="btn" type="submit" name="provider" value="workos">Use email or another sign-in method</button></div>
+</form>`,
+    });
+}
+export async function continueUpstreamProviderChoice(input) {
+    const body = (input.req.body ?? {});
+    const state = typeof body.choice_state === 'string' ? body.choice_state : undefined;
+    const provider = selectedProvider(body.provider);
+    if (state === undefined || provider === undefined) {
+        input.res.status(400).type('text/plain').send('invalid sign-in choice');
+        return;
+    }
+    if ((provider === 'google' && input.google === undefined) ||
+        (provider === 'workos' && input.workos === undefined)) {
+        input.res.status(503).set('Retry-After', '5').type('text/plain').send('sign-in unavailable');
+        return;
+    }
+    const choice = await input.store.consumePendingAuthorization(hashToken(state), 'upstream_choice');
+    if (choice === undefined) {
+        input.res.status(400).type('text/plain').send('unknown or expired authorization request');
+        return;
+    }
+    const nonce = randomToken();
+    await input.store.createPendingAuthorization(finalPending(choice, nonce, provider));
+    input.res.redirect(302, upstreamAuthorizationUrl({
+        provider,
+        ...(input.google === undefined ? {} : { google: input.google }),
+        ...(input.workos === undefined ? {} : { workos: input.workos }),
+        state: nonce,
+    }));
+}
+function finalPending(choice, nonce, provider) {
+    return {
+        ...choice,
+        state: hashToken(nonce),
+        upstreamProvider: provider,
+    };
+}
+function selectedProvider(value) {
+    return value === 'google' || value === 'workos' ? value : undefined;
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+//# sourceMappingURL=upstream-provider-choice.js.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-provider-choice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-provider-choice.js","sourceRoot":"","sources":["../../src/oauth/upstream-provider-choice.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGhD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAGpE,MAAM,UAAU,4BAA4B,CAAC,KAAa;IACxD,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,eAAe,CAAC;QACrB,KAAK,EAAE,qCAAqC;QAC5C,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,wBAAwB;QACjC,WAAW,EAAE;;oDAEmC,YAAY;;;QAGxD;KACL,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAMpD;IACC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IAC/D,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IACD,IACE,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC;QACrD,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,EACrD,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC7F,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,2BAA2B,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAClG,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC1F,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,MAAM,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpF,KAAK,CAAC,GAAG,CAAC,QAAQ,CAChB,GAAG,EACH,wBAAwB,CAAC;QACvB,QAAQ;QACR,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/D,KAAK,EAAE,KAAK;KACb,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,MAAkC,EAClC,KAAa,EACb,QAA+B;IAE/B,OAAO;QACL,GAAG,MAAM;QACT,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC;QACvB,gBAAgB,EAAE,QAAQ;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-rollout-store.d.ts

@@ -0,0 +1,20 @@
+import type { Pool } from 'pg';
+import { type WorkOSConfigurationIdentity } from '../platform-auth-configuration.js';
+import { type UpstreamHumanRollout } from './upstream-human.js';
+/** Server-owned rollout state: callers select once, then persist the result in pending OAuth state. */
+export interface UpstreamHumanRolloutStore {
+    get(): Promise<UpstreamHumanRollout>;
+}
+export interface DurableUpstreamHumanRollout extends UpstreamHumanRollout {
+    readonly lifecycle: 'google' | 'workos' | 'finalized';
+    readonly allowUserSelectedWorkosRecovery: boolean;
+}
+/** Reads only additive Task 1 rollout state. Task 3 owns mutations and operator APIs. */
+export declare class PostgresUpstreamHumanRolloutStore implements UpstreamHumanRolloutStore {
+    #private;
+    constructor(pool: Pool, options?: {
+        readonly workos?: WorkOSConfigurationIdentity;
+    });
+    get(): Promise<DurableUpstreamHumanRollout>;
+}
+//# sourceMappingURL=upstream-rollout-store.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-rollout-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-rollout-store.d.ts","sourceRoot":"","sources":["../../src/oauth/upstream-rollout-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAgC,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE9F,uGAAuG;AACvG,MAAM,WAAW,yBAAyB;IACxC,GAAG,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,2BAA4B,SAAQ,oBAAoB;IACvE,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;IACtD,QAAQ,CAAC,+BAA+B,EAAE,OAAO,CAAC;CACnD;AAED,yFAAyF;AACzF,qBAAa,iCAAkC,YAAW,yBAAyB;;gBAIrE,IAAI,EAAE,IAAI,EAAE,OAAO,GAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,2BAA2B,CAAA;KAAO;IAKjF,GAAG,IAAI,OAAO,CAAC,2BAA2B,CAAC;CAyClD"}

package/node_modules/@noodle-borg/service/dist/oauth/upstream-rollout-store.js

@@ -0,0 +1,40 @@
+import { assertWorkOSRolloutConfigurationContinuity, } from '../platform-auth-configuration.js';
+import { GOOGLE_ONLY_UPSTREAM_ROLLOUT } from './upstream-human.js';
+/** Reads only additive Task 1 rollout state. Task 3 owns mutations and operator APIs. */
+export class PostgresUpstreamHumanRolloutStore {
+    #pool;
+    #workos;
+    constructor(pool, options = {}) {
+        this.#pool = pool;
+        this.#workos = options.workos;
+    }
+    async get() {
+        const result = await this.#pool.query(`SELECT workos_percentage, workos_canary_client_ids, workos_recovery_client_ids,
+              workos_recovery_enabled,
+              lifecycle, workos_client_fingerprint, workos_realm_fingerprint
+       FROM platform_auth_rollout_state WHERE singleton = true`);
+        const row = result.rows[0];
+        if (row === undefined)
+            return {
+                ...GOOGLE_ONLY_UPSTREAM_ROLLOUT,
+                lifecycle: 'google',
+                allowUserSelectedWorkosRecovery: false,
+            };
+        assertWorkOSRolloutConfigurationContinuity({
+            workosPercentage: row.workos_percentage,
+            workosRecoveryClientIds: row.workos_recovery_client_ids,
+            workosRecoveryEnabled: row.workos_recovery_enabled,
+            lifecycle: row.lifecycle,
+            workosClientFingerprint: row.workos_client_fingerprint,
+            workosRealmFingerprint: row.workos_realm_fingerprint,
+        }, this.#workos);
+        return {
+            workosPercentage: row.workos_percentage,
+            workosCanaryClientIds: row.workos_canary_client_ids,
+            workosRecoveryClientIds: row.workos_recovery_client_ids,
+            allowUserSelectedWorkosRecovery: row.workos_recovery_enabled,
+            lifecycle: row.lifecycle,
+        };
+    }
+}
+//# sourceMappingURL=upstream-rollout-store.js.map

package/node_modules/@noodle-borg/service/dist/oauth/upstream-rollout-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-rollout-store.js","sourceRoot":"","sources":["../../src/oauth/upstream-rollout-store.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0CAA0C,GAE3C,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,4BAA4B,EAA6B,MAAM,qBAAqB,CAAC;AAY9F,yFAAyF;AACzF,MAAM,OAAO,iCAAiC;IACnC,KAAK,CAAO;IACZ,OAAO,CAA0C;IAE1D,YAAY,IAAU,EAAE,UAA6D,EAAE;QACrF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,GAAG;QACP,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CASnC;;;+DAGyD,CAC1D,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS;YACnB,OAAO;gBACL,GAAG,4BAA4B;gBAC/B,SAAS,EAAE,QAAQ;gBACnB,+BAA+B,EAAE,KAAK;aACvC,CAAC;QACJ,0CAA0C,CACxC;YACE,gBAAgB,EAAE,GAAG,CAAC,iBAAiB;YACvC,uBAAuB,EAAE,GAAG,CAAC,0BAA0B;YACvD,qBAAqB,EAAE,GAAG,CAAC,uBAAuB;YAClD,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,uBAAuB,EAAE,GAAG,CAAC,yBAAyB;YACtD,sBAAsB,EAAE,GAAG,CAAC,wBAAwB;SACrD,EACD,IAAI,CAAC,OAAO,CACb,CAAC;QACF,OAAO;YACL,gBAAgB,EAAE,GAAG,CAAC,iBAAiB;YACvC,qBAAqB,EAAE,GAAG,CAAC,wBAAwB;YACnD,uBAAuB,EAAE,GAAG,CAAC,0BAA0B;YACvD,+BAA+B,EAAE,GAAG,CAAC,uBAAuB;YAC5D,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;IACJ,CAAC;CACF"}

package/node_modules/@noodle-borg/service/dist/oauth/workos-events.d.ts

@@ -0,0 +1,115 @@
+import type { Pool } from 'pg';
+declare const WORKOS_EVENT_TYPES: readonly ["user.created", "user.updated", "user.deleted", "session.revoked"];
+type WorkOSRelevantEventType = (typeof WORKOS_EVENT_TYPES)[number];
+/** Ordered subset of the WorkOS Events API used for upstream human-account reconciliation. */
+export interface WorkOSPlatformEvent {
+    readonly id: string;
+    readonly event: string;
+    readonly data: Readonly<Record<string, unknown>>;
+}
+export interface WorkOSEventsClient {
+    listEvents(input: {
+        readonly events: readonly WorkOSRelevantEventType[];
+        readonly order: 'asc';
+        readonly after?: string;
+    }): Promise<{
+        readonly data: readonly WorkOSPlatformEvent[];
+        readonly listMetadata: {
+            readonly after?: string;
+        };
+    }>;
+}
+export interface WorkOSIdentityEventStore {
+    getCursor(): Promise<string | undefined>;
+    /** Atomically applies one effect and records its event ID as the next `after` cursor. */
+    applyAndAdvance(input: {
+        readonly event: WorkOSPlatformEvent;
+        readonly realm: string;
+        readonly expectedCursor?: string;
+    }): Promise<WorkOSIdentityEventApplyResult>;
+}
+export interface WorkOSIdentityEventApplyResult {
+    /** The event effect changed durable identity state. */
+    readonly applied: boolean;
+    /** The worker observed a newer cursor and must refetch instead of skipping ahead. */
+    readonly stale: boolean;
+}
+export interface WorkOSSdkEventsPort {
+    listEvents(input: {
+        readonly events: WorkOSRelevantEventType[];
+        readonly order: 'asc';
+        readonly after?: string | undefined;
+    }): Promise<{
+        readonly data: readonly {
+            readonly id: string;
+            readonly event: string;
+            readonly data: object;
+        }[];
+        readonly listMetadata: {
+            readonly after?: string | null;
+        };
+    }>;
+}
+/** Official SDK boundary for Events API reads; it has no mutation capability. */
+export declare class WorkOSEventsSdkClient implements WorkOSEventsClient {
+    #private;
+    constructor(apiKey: string, events?: WorkOSSdkEventsPort);
+    listEvents(input: {
+        readonly events: readonly WorkOSRelevantEventType[];
+        readonly order: 'asc';
+        readonly after?: string;
+    }): Promise<{
+        readonly data: readonly WorkOSPlatformEvent[];
+        readonly listMetadata: {
+            readonly after?: string;
+        };
+    }>;
+}
+/** Explicit job boundary — this is never a live poller and makes no upstream mutation. */
+export declare class WorkOSEventProcessor {
+    #private;
+    constructor(input: {
+        readonly client: WorkOSEventsClient;
+        readonly store: WorkOSIdentityEventStore;
+        readonly realm: string;
+        readonly maxPages?: number;
+    });
+    processOnce(): Promise<{
+        readonly processed: number;
+        readonly cursor?: string;
+        readonly caughtUp: true;
+    }>;
+}
+/** Test/local durable-behavior model. The Postgres implementation below is the production persistence port. */
+export declare class InMemoryWorkOSIdentityEventStore implements WorkOSIdentityEventStore {
+    #private;
+    getCursor(): Promise<string | undefined>;
+    /** Convenience for focused store tests; production workers use `applyAndAdvance`. */
+    apply(event: WorkOSPlatformEvent, realm: string): Promise<boolean>;
+    applyAndAdvance(input: {
+        readonly event: WorkOSPlatformEvent;
+        readonly realm: string;
+        readonly expectedCursor?: string;
+    }): Promise<WorkOSIdentityEventApplyResult>;
+    appliedEvents(): readonly string[];
+    user(id: string): {
+        readonly email: string;
+        readonly status: 'active' | 'suspended';
+    } | undefined;
+}
+/** Durable Task 2 event store. Receipt, effect, freshness, and cursor move in one transaction. */
+export declare class PostgresWorkOSIdentityEventStore implements WorkOSIdentityEventStore {
+    #private;
+    constructor(pool: Pool, options?: {
+        readonly stream?: string;
+    });
+    getCursor(): Promise<string | undefined>;
+    apply(event: WorkOSPlatformEvent, realm: string): Promise<boolean>;
+    applyAndAdvance(input: {
+        readonly event: WorkOSPlatformEvent;
+        readonly realm: string;
+        readonly expectedCursor?: string;
+    }): Promise<WorkOSIdentityEventApplyResult>;
+}
+export {};
+//# sourceMappingURL=workos-events.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/workos-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos-events.d.ts","sourceRoot":"","sources":["../../src/oauth/workos-events.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAC;AAG3C,QAAA,MAAM,kBAAkB,8EAKd,CAAC;AAEX,KAAK,uBAAuB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE,8FAA8F;AAC9F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,KAAK,EAAE;QAChB,QAAQ,CAAC,MAAM,EAAE,SAAS,uBAAuB,EAAE,CAAC;QACpD,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;QACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC;QACV,QAAQ,CAAC,IAAI,EAAE,SAAS,mBAAmB,EAAE,CAAC;QAC9C,QAAQ,CAAC,YAAY,EAAE;YAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACpD,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,yFAAyF;IACzF,eAAe,CAAC,KAAK,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;QACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;KAClC,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,8BAA8B;IAC7C,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,KAAK,EAAE;QAChB,QAAQ,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC;QAC3C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;QACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACrC,GAAG,OAAO,CAAC;QACV,QAAQ,CAAC,IAAI,EAAE,SAAS;YACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;YACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;SACvB,EAAE,CAAC;QACJ,QAAQ,CAAC,YAAY,EAAE;YAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;KAC3D,CAAC,CAAC;CACJ;AAED,iFAAiF;AACjF,qBAAa,qBAAsB,YAAW,kBAAkB;;gBAGlD,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,mBAAmB;IAgBlD,UAAU,CAAC,KAAK,EAAE;QACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,uBAAuB,EAAE,CAAC;QACpD,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;QACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC;QACV,QAAQ,CAAC,IAAI,EAAE,SAAS,mBAAmB,EAAE,CAAC;QAC9C,QAAQ,CAAC,YAAY,EAAE;YAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACpD,CAAC;CAcH;AAED,0FAA0F;AAC1F,qBAAa,oBAAoB;;gBAMnB,KAAK,EAAE;QACjB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;QACpC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;QACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;KAC5B;IAUK,WAAW,IAAI,OAAO,CAAC;QAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;KACzB,CAAC;CA+BH;AAED,+GAA+G;AAC/G,qBAAa,gCAAiC,YAAW,wBAAwB;;IAQ/E,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAIxC,qFAAqF;IAC/E,KAAK,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWlE,eAAe,CAAC,KAAK,EAAE;QAC3B,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;QACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;KAClC,GAAG,OAAO,CAAC,8BAA8B,CAAC;IA4B3C,aAAa,IAAI,SAAS,MAAM,EAAE;IAIlC,IAAI,CACF,EAAE,EAAE,MAAM,GACT;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,WAAW,CAAA;KAAE,GAAG,SAAS;CAInF;AAED,kGAAkG;AAClG,qBAAa,gCAAiC,YAAW,wBAAwB;;gBAInE,IAAI,EAAE,IAAI,EAAE,OAAO,GAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAK5D,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IASxC,KAAK,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUlE,eAAe,CAAC,KAAK,EAAE;QAC3B,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;QACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;KAClC,GAAG,OAAO,CAAC,8BAA8B,CAAC;CA2C5C"}

package/node_modules/@noodle-borg/service/dist/oauth/workos-events.js

@@ -0,0 +1,310 @@
+import { WorkOS } from '@workos-inc/node';
+import { normalizePlatformIdentityEmail } from '../platform-identity.js';
+const WORKOS_EVENT_TYPES = [
+    'user.created',
+    'user.updated',
+    'user.deleted',
+    'session.revoked',
+];
+/** Official SDK boundary for Events API reads; it has no mutation capability. */
+export class WorkOSEventsSdkClient {
+    #events;
+    constructor(apiKey, events) {
+        if (events !== undefined) {
+            this.#events = events;
+            return;
+        }
+        const sdkEvents = new WorkOS(apiKey).events;
+        this.#events = {
+            listEvents: async (input) => sdkEvents.listEvents(input.after === undefined
+                ? { events: input.events, order: input.order }
+                : { events: input.events, order: input.order, after: input.after }),
+        };
+    }
+    async listEvents(input) {
+        const page = await this.#events.listEvents({ ...input, events: [...input.events] });
+        return {
+            data: page.data.map((event) => ({
+                id: event.id,
+                event: event.event,
+                data: event.data,
+            })),
+            listMetadata: page.listMetadata.after === null || page.listMetadata.after === undefined
+                ? {}
+                : { after: page.listMetadata.after },
+        };
+    }
+}
+/** Explicit job boundary — this is never a live poller and makes no upstream mutation. */
+export class WorkOSEventProcessor {
+    #client;
+    #store;
+    #realm;
+    #maxPages;
+    constructor(input) {
+        const maxPages = input.maxPages ?? 10;
+        if (!Number.isInteger(maxPages) || maxPages < 1 || maxPages > 100)
+            throw new Error('WorkOS Events max pages must be between 1 and 100');
+        this.#client = input.client;
+        this.#store = input.store;
+        this.#realm = input.realm;
+        this.#maxPages = maxPages;
+    }
+    async processOnce() {
+        let cursor = await this.#store.getCursor();
+        let processed = 0;
+        let after = cursor;
+        const pageCursors = new Set();
+        for (let pageNumber = 0; pageNumber < this.#maxPages; pageNumber += 1) {
+            const page = await this.#client.listEvents({
+                events: WORKOS_EVENT_TYPES,
+                order: 'asc',
+                ...(after === undefined ? {} : { after }),
+            });
+            for (const event of page.data) {
+                const result = await this.#store.applyAndAdvance({
+                    event,
+                    realm: this.#realm,
+                    ...(cursor === undefined ? {} : { expectedCursor: cursor }),
+                });
+                if (result.stale)
+                    throw new Error('WorkOS Events catch-up incomplete');
+                cursor = event.id;
+                if (result.applied)
+                    processed += 1;
+            }
+            const next = page.listMetadata.after;
+            if (next === undefined)
+                return { processed, ...(cursor === undefined ? {} : { cursor }), caughtUp: true };
+            if (page.data.length === 0 || next === after || pageCursors.has(next))
+                throw new Error('WorkOS Events catch-up incomplete');
+            pageCursors.add(next);
+            after = next;
+        }
+        throw new Error('WorkOS Events catch-up incomplete');
+    }
+}
+/** Test/local durable-behavior model. The Postgres implementation below is the production persistence port. */
+export class InMemoryWorkOSIdentityEventStore {
+    #events = new Set();
+    #users = new Map();
+    #cursor;
+    getCursor() {
+        return Promise.resolve(this.#cursor);
+    }
+    /** Convenience for focused store tests; production workers use `applyAndAdvance`. */
+    async apply(event, realm) {
+        const cursor = this.#cursor;
+        return (await this.applyAndAdvance({
+            event,
+            realm,
+            ...(cursor === undefined ? {} : { expectedCursor: cursor }),
+        })).applied;
+    }
+    async applyAndAdvance(input) {
+        if (this.#cursor !== input.expectedCursor)
+            return { applied: false, stale: true };
+        const parsed = parseEvent(input.event);
+        if (parsed === undefined)
+            throw new Error('malformed WorkOS event');
+        const duplicate = this.#events.has(input.event.id);
+        let applied = false;
+        if (!duplicate && parsed.kind === 'user.deleted') {
+            const prior = this.#users.get(parsed.user.id);
+            if (prior !== undefined) {
+                this.#users.set(parsed.user.id, { ...prior, status: 'suspended' });
+                applied = true;
+            }
+        }
+        else if (!duplicate && parsed.kind !== 'session.revoked') {
+            const prior = this.#users.get(parsed.user.id);
+            if (prior === undefined || prior.updatedAt < parsed.user.updatedAt) {
+                this.#users.set(parsed.user.id, {
+                    email: parsed.user.email,
+                    status: parsed.kind === 'user.deleted' ? 'suspended' : 'active',
+                    updatedAt: parsed.user.updatedAt,
+                });
+                applied = true;
+            }
+        }
+        this.#events.add(input.event.id);
+        this.#cursor = input.event.id;
+        return { applied, stale: false };
+    }
+    appliedEvents() {
+        return [...this.#events].sort();
+    }
+    user(id) {
+        const user = this.#users.get(id);
+        return user === undefined ? undefined : { email: user.email, status: user.status };
+    }
+}
+/** Durable Task 2 event store. Receipt, effect, freshness, and cursor move in one transaction. */
+export class PostgresWorkOSIdentityEventStore {
+    #pool;
+    #stream;
+    constructor(pool, options = {}) {
+        this.#pool = pool;
+        this.#stream = options.stream ?? 'authkit-users';
+    }
+    async getCursor() {
+        const result = await this.#pool.query(`SELECT cursor FROM platform_identity_event_cursors
+       WHERE provider = 'workos' AND stream = $1`, [this.#stream]);
+        return result.rows[0]?.cursor;
+    }
+    async apply(event, realm) {
+        const cursor = await this.getCursor();
+        const result = await this.applyAndAdvance({
+            event,
+            realm,
+            ...(cursor === undefined ? {} : { expectedCursor: cursor }),
+        });
+        return result.applied;
+    }
+    async applyAndAdvance(input) {
+        const parsed = parseEvent(input.event);
+        if (parsed === undefined)
+            throw new Error('malformed WorkOS event');
+        const client = await this.#pool.connect();
+        try {
+            await client.query('BEGIN');
+            await client.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [
+                `workos-event-stream:${this.#stream}`,
+            ]);
+            const cursor = await client.query(`SELECT cursor FROM platform_identity_event_cursors
+         WHERE provider = 'workos' AND stream = $1 FOR UPDATE`, [this.#stream]);
+            if (cursor.rows[0]?.cursor !== input.expectedCursor) {
+                await client.query('COMMIT');
+                return { applied: false, stale: true };
+            }
+            const receipt = await client.query(`INSERT INTO platform_identity_event_receipts (provider, event_id, occurred_at)
+         VALUES ('workos', $1, $2::timestamptz)
+         ON CONFLICT (provider, event_id) DO NOTHING RETURNING event_id`, [input.event.id, parsed.updatedAt]);
+            let applied = false;
+            if (receipt.rows.length > 0)
+                applied = await applyWorkOSEventEffect(client, parsed, input.realm);
+            await client.query(`INSERT INTO platform_identity_event_cursors (provider, stream, cursor, updated_at)
+         VALUES ('workos', $1, $2, now())
+         ON CONFLICT (provider, stream)
+           DO UPDATE SET cursor = EXCLUDED.cursor, updated_at = EXCLUDED.updated_at`, [this.#stream, input.event.id]);
+            await client.query('COMMIT');
+            return { applied, stale: false };
+        }
+        catch (error) {
+            await client.query('ROLLBACK').catch(() => undefined);
+            throw error;
+        }
+        finally {
+            client.release();
+        }
+    }
+}
+function parseEvent(event) {
+    if (event.event === 'session.revoked') {
+        const userId = stringField(event.data, 'user_id', 'userId');
+        const updatedAt = timestampField(event.data);
+        return userId === undefined || updatedAt === undefined
+            ? undefined
+            : { kind: 'session.revoked', userId, updatedAt };
+    }
+    if (event.event !== 'user.created' &&
+        event.event !== 'user.updated' &&
+        event.event !== 'user.deleted')
+        return undefined;
+    const id = stringField(event.data, 'id');
+    const email = stringField(event.data, 'email');
+    const emailVerified = booleanField(event.data, 'email_verified', 'emailVerified');
+    const updatedAt = timestampField(event.data);
+    return id === undefined ||
+        email === undefined ||
+        emailVerified === undefined ||
+        updatedAt === undefined
+        ? undefined
+        : { kind: event.event, user: { id, email, emailVerified, updatedAt }, updatedAt };
+}
+async function applyWorkOSEventEffect(client, event, realm) {
+    const externalId = event.kind === 'session.revoked' ? event.userId : event.user.id;
+    // Session revocation and account deletion are receipt-idempotent security events, not profile updates.
+    // A newer `user.updated_at` watermark must never mask either effect.
+    if (event.kind === 'session.revoked' || event.kind === 'user.deleted') {
+        const link = await client.query(`SELECT principal_id FROM platform_identity_links
+       WHERE provider = 'workos' AND realm = $1 AND external_id = $2 AND disabled_at IS NULL FOR UPDATE`, [realm, externalId]);
+        const principalId = link.rows[0]?.principal_id;
+        if (principalId === undefined)
+            return false;
+        await client.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [
+            `platform-principal:${principalId}`,
+        ]);
+        if (event.kind === 'user.deleted') {
+            await client.query(`UPDATE platform_identity_links
+         SET disabled_at = now()
+         WHERE provider = 'workos' AND realm = $1 AND external_id = $2
+           AND principal_id = $3 AND disabled_at IS NULL`, [realm, externalId, principalId]);
+            await client.query(`UPDATE platform_verified_emails SET status = 'superseded', observed_at = now()
+         WHERE principal_id = $1 AND provider = 'workos' AND realm = $2 AND status = 'active'`, [principalId, realm]);
+            await client.query(`UPDATE platform_principals
+         SET status = 'suspended', suspended_at = now()
+         WHERE principal_id = $1 AND status = 'active'`, [principalId]);
+        }
+        await revokePlatformRefreshFamilies(client, principalId);
+        return true;
+    }
+    const version = await client.query(`INSERT INTO platform_identity_upstream_versions
+       (provider, realm, external_id, upstream_updated_at)
+     VALUES ('workos', $1, $2, $3::timestamptz)
+     ON CONFLICT (provider, realm, external_id) DO UPDATE
+       SET upstream_updated_at = EXCLUDED.upstream_updated_at
+     WHERE platform_identity_upstream_versions.upstream_updated_at < EXCLUDED.upstream_updated_at
+     RETURNING external_id`, [realm, externalId, event.updatedAt]);
+    if (version.rows.length === 0)
+        return false;
+    const link = await client.query(`SELECT principal_id FROM platform_identity_links
+     WHERE provider = 'workos' AND realm = $1 AND external_id = $2 AND disabled_at IS NULL FOR UPDATE`, [realm, externalId]);
+    const principalId = link.rows[0]?.principal_id;
+    if (principalId === undefined)
+        return false;
+    await client.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [
+        `platform-principal:${principalId}`,
+    ]);
+    if (!event.user.emailVerified) {
+        await client.query(`UPDATE platform_verified_emails SET status = 'superseded', observed_at = now()
+       WHERE principal_id = $1 AND provider = 'workos' AND realm = $2 AND status = 'active'`, [principalId, realm]);
+        await revokePlatformRefreshFamilies(client, principalId);
+        return true;
+    }
+    const normalizedEmail = normalizePlatformIdentityEmail(event.user.email);
+    await client.query(`UPDATE platform_verified_emails SET status = 'superseded', observed_at = now()
+     WHERE principal_id = $1 AND provider = 'workos' AND realm = $2
+       AND status = 'active' AND normalized_email <> $3`, [principalId, realm, normalizedEmail]);
+    await client.query(`INSERT INTO platform_verified_emails
+       (principal_id, original_email, normalized_email, provider, realm, status, verified_at, observed_at)
+     VALUES ($1, $2, $3, 'workos', $4, 'active', now(), now())
+     ON CONFLICT (principal_id, normalized_email, provider, realm)
+       DO UPDATE SET original_email = EXCLUDED.original_email, status = 'active', observed_at = EXCLUDED.observed_at`, [principalId, event.user.email, normalizedEmail, realm]);
+    return true;
+}
+async function revokePlatformRefreshFamilies(client, principalId) {
+    const relation = await client.query("SELECT to_regclass('oauth_refresh_tokens')::text AS relation");
+    if (relation.rows[0]?.relation !== null) {
+        await client.query("DELETE FROM oauth_refresh_tokens WHERE owner_subject = $1 AND identity_kind IS DISTINCT FROM 'customer'", [principalId]);
+    }
+}
+function stringField(data, ...names) {
+    for (const name of names) {
+        const value = data[name];
+        if (typeof value === 'string' && value.length > 0)
+            return value;
+    }
+    return undefined;
+}
+function booleanField(data, ...names) {
+    for (const name of names)
+        if (typeof data[name] === 'boolean')
+            return data[name];
+    return undefined;
+}
+function timestampField(data) {
+    const value = stringField(data, 'updated_at', 'updatedAt');
+    return value === undefined || Number.isNaN(Date.parse(value)) ? undefined : value;
+}
+//# sourceMappingURL=workos-events.js.map

package/node_modules/@noodle-borg/service/dist/oauth/workos-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos-events.js","sourceRoot":"","sources":["../../src/oauth/workos-events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AAEzE,MAAM,kBAAkB,GAAG;IACzB,cAAc;IACd,cAAc;IACd,cAAc;IACd,iBAAiB;CACT,CAAC;AAsDX,iFAAiF;AACjF,MAAM,OAAO,qBAAqB;IACvB,OAAO,CAAsB;IAEtC,YAAY,MAAc,EAAE,MAA4B;QACtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QAC5C,IAAI,CAAC,OAAO,GAAG;YACb,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAC1B,SAAS,CAAC,UAAU,CAClB,KAAK,CAAC,KAAK,KAAK,SAAS;gBACvB,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBAC9C,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACrE;SACJ,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAIhB;QAIC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpF,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC9B,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,IAAyC;aACtD,CAAC,CAAC;YACH,YAAY,EACV,IAAI,CAAC,YAAY,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,KAAK,SAAS;gBACvE,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE;SACzC,CAAC;IACJ,CAAC;CACF;AAED,0FAA0F;AAC1F,MAAM,OAAO,oBAAoB;IACtB,OAAO,CAAqB;IAC5B,MAAM,CAA2B;IACjC,MAAM,CAAS;IACf,SAAS,CAAS;IAE3B,YAAY,KAKX;QACC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,GAAG;YAC/D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,WAAW;QAKf,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3C,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,KAAK,GAAG,MAAM,CAAC;QACnB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,KAAK,IAAI,UAAU,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,IAAI,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;gBACzC,MAAM,EAAE,kBAAkB;gBAC1B,KAAK,EAAE,KAAK;gBACZ,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;aAC1C,CAAC,CAAC;YACH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;oBAC/C,KAAK;oBACL,KAAK,EAAE,IAAI,CAAC,MAAM;oBAClB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;iBAC5D,CAAC,CAAC;gBACH,IAAI,MAAM,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBACvE,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC;gBAClB,IAAI,MAAM,CAAC,OAAO;oBAAE,SAAS,IAAI,CAAC,CAAC;YACrC,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;YACrC,IAAI,IAAI,KAAK,SAAS;gBACpB,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACpF,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;gBACnE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACvD,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtB,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;CACF;AAED,+GAA+G;AAC/G,MAAM,OAAO,gCAAgC;IAClC,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5B,MAAM,GAAG,IAAI,GAAG,EAGtB,CAAC;IACJ,OAAO,CAAqB;IAE5B,SAAS;QACP,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,KAAK,CAAC,KAA0B,EAAE,KAAa;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,OAAO,CACL,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,KAAK;YACL,KAAK;YACL,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;SAC5D,CAAC,CACH,CAAC,OAAO,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAIrB;QACC,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,cAAc;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAClF,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;gBACnE,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE;oBAC9B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;oBACxB,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;oBAC/D,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;iBACjC,CAAC,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,aAAa;QACX,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,CACF,EAAU;QAEV,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACrF,CAAC;CACF;AAED,kGAAkG;AAClG,MAAM,OAAO,gCAAgC;IAClC,KAAK,CAAO;IACZ,OAAO,CAAS;IAEzB,YAAY,IAAU,EAAE,UAAwC,EAAE;QAChE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACnC;iDAC2C,EAC3C,CAAC,IAAI,CAAC,OAAO,CAAC,CACf,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAA0B,EAAE,KAAa;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC;YACxC,KAAK;YACL,KAAK;YACL,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;SAC5D,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAIrB;QACC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5B,MAAM,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE;gBAC1E,uBAAuB,IAAI,CAAC,OAAO,EAAE;aACtC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B;8DACsD,EACtD,CAAC,IAAI,CAAC,OAAO,CAAC,CACf,CAAC;YACF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;gBACpD,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACzC,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC;;wEAEgE,EAChE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CACnC,CAAC;YACF,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;gBACzB,OAAO,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,MAAM,CAAC,KAAK,CAChB;;;oFAG4E,EAC5E,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAC/B,CAAC;YACF,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;CACF;AAiBD,SAAS,UAAU,CAAC,KAA0B;IAC5C,IAAI,KAAK,CAAC,KAAK,KAAK,iBAAiB,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,MAAM,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;YACpD,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACrD,CAAC;IACD,IACE,KAAK,CAAC,KAAK,KAAK,cAAc;QAC9B,KAAK,CAAC,KAAK,KAAK,cAAc;QAC9B,KAAK,CAAC,KAAK,KAAK,cAAc;QAE9B,OAAO,SAAS,CAAC;IACnB,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,EAAE,KAAK,SAAS;QACrB,KAAK,KAAK,SAAS;QACnB,aAAa,KAAK,SAAS;QAC3B,SAAS,KAAK,SAAS;QACvB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC;AACtF,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,MAAkB,EAClB,KAAwB,EACxB,KAAa;IAEb,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IACnF,uGAAuG;IACvG,qEAAqE;IACrE,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAC7B;wGACkG,EAClG,CAAC,KAAK,EAAE,UAAU,CAAC,CACpB,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC;QAC/C,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC5C,MAAM,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE;YAC1E,sBAAsB,WAAW,EAAE;SACpC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAClC,MAAM,MAAM,CAAC,KAAK,CAChB;;;yDAGiD,EACjD,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,CAAC,CACjC,CAAC;YACF,MAAM,MAAM,CAAC,KAAK,CAChB;8FACsF,EACtF,CAAC,WAAW,EAAE,KAAK,CAAC,CACrB,CAAC;YACF,MAAM,MAAM,CAAC,KAAK,CAChB;;uDAE+C,EAC/C,CAAC,WAAW,CAAC,CACd,CAAC;QACJ,CAAC;QACD,MAAM,6BAA6B,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC;;;;;;2BAMuB,EACvB,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CACrC,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAC7B;sGACkG,EAClG,CAAC,KAAK,EAAE,UAAU,CAAC,CACpB,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC;IAC/C,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE;QAC1E,sBAAsB,WAAW,EAAE;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9B,MAAM,MAAM,CAAC,KAAK,CAChB;4FACsF,EACtF,CAAC,WAAW,EAAE,KAAK,CAAC,CACrB,CAAC;QACF,MAAM,6BAA6B,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,eAAe,GAAG,8BAA8B,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzE,MAAM,MAAM,CAAC,KAAK,CAChB;;wDAEoD,EACpD,CAAC,WAAW,EAAE,KAAK,EAAE,eAAe,CAAC,CACtC,CAAC;IACF,MAAM,MAAM,CAAC,KAAK,CAChB;;;;qHAIiH,EACjH,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,CACxD,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,MAAkB,EAClB,WAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,8DAA8D,CAC/D,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,MAAM,CAAC,KAAK,CAChB,yGAAyG,EACzG,CAAC,WAAW,CAAC,CACd,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,IAAuC,EACvC,GAAG,KAAwB;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAClE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CACnB,IAAuC,EACvC,GAAG,KAAwB;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,IAAI,CAAY,CAAC;IAC5F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,IAAuC;IAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IAC3D,OAAO,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACpF,CAAC"}