@noodleseed/one 0.63.0 → 0.64.0

package/node_modules/@noodle-borg/service/dist/oauth/workos.d.ts

@@ -0,0 +1,65 @@
+import type { UpstreamHumanOAuthAuthenticator } from './upstream-human.js';
+export interface WorkOSUser {
+    readonly id: string;
+    readonly email: string;
+    readonly emailVerified: boolean;
+    readonly locale: string | null;
+}
+/** Narrow injectable SDK port; tests exercise the credential-disposal boundary without a live WorkOS call. */
+export interface WorkOSUserManagementClient {
+    getAuthorizationUrl(input: {
+        readonly provider: 'authkit';
+        readonly clientId: string;
+        readonly redirectUri: string;
+        readonly state: string;
+    }): string;
+    authenticateWithCode(input: {
+        readonly code: string;
+        readonly clientId: string;
+    }): Promise<{
+        readonly user: WorkOSUser;
+        readonly accessToken: string;
+        readonly refreshToken: string;
+        readonly authenticationMethod?: string;
+        readonly impersonator?: unknown;
+    }>;
+}
+export interface WorkOSHumanAuthenticatorConfig {
+    readonly clientId: string;
+    readonly apiKey: string;
+    readonly redirectUri: string;
+    /** Stable WorkOS environment/connection realm used by immutable local identity links. */
+    readonly realm: string;
+    /** Explicit rollout gate. Launch defaults to Google + Magic Auth; later methods require a release change. */
+    readonly allowedAuthenticationMethods?: readonly WorkOSPlatformAuthenticationMethod[];
+}
+export type WorkOSPlatformAuthenticationMethod = 'GoogleOAuth' | 'MagicAuth' | 'GitHubOAuth' | 'Password' | 'SSO';
+/** Operator input is deliberately separate from the derived callback URL. */
+export interface WorkOSRuntimeConfig {
+    readonly clientId?: string;
+    readonly apiKey?: string;
+    readonly realm?: string;
+    readonly allowedAuthenticationMethods?: readonly WorkOSPlatformAuthenticationMethod[];
+}
+/**
+ * Validates the optional WorkOS unit as one all-or-nothing production setting. Constructing the SDK is local;
+ * no WorkOS network request is made during service boot.
+ */
+export declare function createConfiguredWorkOSHumanAuthenticator(issuer: string, config: WorkOSRuntimeConfig | undefined): WorkOSHumanAuthenticator | undefined;
+/** WorkOS AuthKit adapter. It intentionally exposes identity claims only, never upstream credentials. */
+export declare class WorkOSHumanAuthenticator implements UpstreamHumanOAuthAuthenticator {
+    #private;
+    readonly provider: "workos";
+    readonly realm: string;
+    constructor(config: WorkOSHumanAuthenticatorConfig, userManagement?: WorkOSUserManagementClient);
+    authorizationUrl(state: string): string;
+    exchange(code: string): Promise<{
+        readonly provider: 'workos';
+        readonly realm: string;
+        readonly subject: string;
+        readonly email: string;
+        readonly emailVerified: boolean;
+        readonly locale?: string;
+    }>;
+}
+//# sourceMappingURL=workos.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/workos.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos.d.ts","sourceRoot":"","sources":["../../src/oauth/workos.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AAE3E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,8GAA8G;AAC9G,MAAM,WAAW,0BAA0B;IACzC,mBAAmB,CAAC,KAAK,EAAE;QACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,GAAG,MAAM,CAAC;IACX,oBAAoB,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACzF,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;QAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;QACvC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;KACjC,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yFAAyF;IACzF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,6GAA6G;IAC7G,QAAQ,CAAC,4BAA4B,CAAC,EAAE,SAAS,kCAAkC,EAAE,CAAC;CACvF;AAED,MAAM,MAAM,kCAAkC,GAC1C,aAAa,GACb,WAAW,GACX,aAAa,GACb,UAAU,GACV,KAAK,CAAC;AAEV,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,4BAA4B,CAAC,EAAE,SAAS,kCAAkC,EAAE,CAAC;CACvF;AAED;;;GAGG;AACH,wBAAgB,wCAAwC,CACtD,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,mBAAmB,GAAG,SAAS,GACtC,wBAAwB,GAAG,SAAS,CActC;AAED,yGAAyG;AACzG,qBAAa,wBAAyB,YAAW,+BAA+B;;IAC9E,QAAQ,CAAC,QAAQ,EAAG,QAAQ,CAAU;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAQrB,MAAM,EAAE,8BAA8B,EACtC,cAAc,GAAE,0BAGC;IAYnB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IASjC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QACpC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;QAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CAyBH"}

package/node_modules/@noodle-borg/service/dist/oauth/workos.js

@@ -0,0 +1,85 @@
+import { WorkOS } from '@workos-inc/node';
+/**
+ * Validates the optional WorkOS unit as one all-or-nothing production setting. Constructing the SDK is local;
+ * no WorkOS network request is made during service boot.
+ */
+export function createConfiguredWorkOSHumanAuthenticator(issuer, config) {
+    if (config === undefined)
+        return undefined;
+    const clientId = requiredWorkOSConfig('client id', config.clientId);
+    const apiKey = requiredWorkOSConfig('api key', config.apiKey);
+    const realm = requiredWorkOSConfig('realm', config.realm);
+    return new WorkOSHumanAuthenticator({
+        clientId,
+        apiKey,
+        realm,
+        redirectUri: `${issuer.replace(/\/+$/, '')}/oauth/workos/callback`,
+        ...(config.allowedAuthenticationMethods === undefined
+            ? {}
+            : { allowedAuthenticationMethods: config.allowedAuthenticationMethods }),
+    });
+}
+/** WorkOS AuthKit adapter. It intentionally exposes identity claims only, never upstream credentials. */
+export class WorkOSHumanAuthenticator {
+    provider = 'workos';
+    realm;
+    #clientId;
+    #redirectUri;
+    #realm;
+    #userManagement;
+    #allowedAuthenticationMethods;
+    constructor(config, userManagement = new WorkOS({
+        apiKey: config.apiKey,
+        clientId: config.clientId,
+    }).userManagement) {
+        this.#clientId = config.clientId;
+        this.#redirectUri = config.redirectUri;
+        this.#realm = requiredWorkOSConfig('realm', config.realm);
+        this.realm = this.#realm;
+        this.#userManagement = userManagement;
+        this.#allowedAuthenticationMethods = new Set(config.allowedAuthenticationMethods ?? ['GoogleOAuth', 'MagicAuth']);
+    }
+    authorizationUrl(state) {
+        return this.#userManagement.getAuthorizationUrl({
+            provider: 'authkit',
+            clientId: this.#clientId,
+            redirectUri: this.#redirectUri,
+            state,
+        });
+    }
+    async exchange(code) {
+        const { user, authenticationMethod, impersonator } = await this.#userManagement.authenticateWithCode({
+            code,
+            clientId: this.#clientId,
+        });
+        if (authenticationMethod === undefined ||
+            !this.#allowedAuthenticationMethods.has(authenticationMethod) ||
+            impersonator !== undefined ||
+            user.emailVerified !== true) {
+            throw new Error('WorkOS authentication method is not permitted');
+        }
+        const subject = requiredWorkOSIdentityValue('user ID', user.id);
+        const email = requiredWorkOSIdentityValue('email', user.email);
+        return {
+            provider: 'workos',
+            realm: this.#realm,
+            subject,
+            email,
+            emailVerified: user.emailVerified,
+            ...(user.locale !== null ? { locale: user.locale } : {}),
+        };
+    }
+}
+function requiredWorkOSConfig(name, value) {
+    const normalized = value?.trim();
+    if (normalized === undefined || normalized.length === 0)
+        throw new Error(`WorkOS client id, api key, and realm must be configured together (missing ${name})`);
+    return normalized;
+}
+function requiredWorkOSIdentityValue(name, value) {
+    const normalized = value.trim();
+    if (normalized.length === 0)
+        throw new Error(`WorkOS ${name} is invalid`);
+    return normalized;
+}
+//# sourceMappingURL=workos.js.map

package/node_modules/@noodle-borg/service/dist/oauth/workos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos.js","sourceRoot":"","sources":["../../src/oauth/workos.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAoD1C;;;GAGG;AACH,MAAM,UAAU,wCAAwC,CACtD,MAAc,EACd,MAAuC;IAEvC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,IAAI,wBAAwB,CAAC;QAClC,QAAQ;QACR,MAAM;QACN,KAAK;QACL,WAAW,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB;QAClE,GAAG,CAAC,MAAM,CAAC,4BAA4B,KAAK,SAAS;YACnD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,4BAA4B,EAAE,MAAM,CAAC,4BAA4B,EAAE,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,yGAAyG;AACzG,MAAM,OAAO,wBAAwB;IAC1B,QAAQ,GAAG,QAAiB,CAAC;IAC7B,KAAK,CAAS;IACd,SAAS,CAAS;IAClB,YAAY,CAAS;IACrB,MAAM,CAAS;IACf,eAAe,CAA6B;IAC5C,6BAA6B,CAAsB;IAE5D,YACE,MAAsC,EACtC,iBAA6C,IAAI,MAAM,CAAC;QACtD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC,cAAc;QAEjB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QACzB,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;QACtC,IAAI,CAAC,6BAA6B,GAAG,IAAI,GAAG,CAC1C,MAAM,CAAC,4BAA4B,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CACpE,CAAC;IACJ,CAAC;IAED,gBAAgB,CAAC,KAAa;QAC5B,OAAO,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC;YAC9C,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QAQzB,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,YAAY,EAAE,GAChD,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC;YAC9C,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,SAAS;SACzB,CAAC,CAAC;QACL,IACE,oBAAoB,KAAK,SAAS;YAClC,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,oBAAoB,CAAC;YAC7D,YAAY,KAAK,SAAS;YAC1B,IAAI,CAAC,aAAa,KAAK,IAAI,EAC3B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,OAAO,GAAG,2BAA2B,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,OAAO;YACL,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,OAAO;YACP,KAAK;YACL,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,KAAyB;IACnE,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACjC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,6EAA6E,IAAI,GAAG,CACrF,CAAC;IACJ,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAY,EAAE,KAAa;IAC9D,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC;IAC1E,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/node_modules/@noodle-borg/service/dist/options.d.ts

@@ -24,6 +24,8 @@ import type { FeedbackIssueClient } from './github/feedback-issues.js';
 import type { PendingGithubInstallationStore } from './github/pending-installations.js';
 import type { LoadedServiceModule } from './modules/host.js';
 import type { DeveloperGrantStore } from './oauth/developer-grant.js';
+import type { PlatformAuthOperator } from './platform-auth-operator.js';
+import type { PlatformIdentityStore } from './platform-identity.js';
 import type { PolicyAssignmentStore, PolicyCounterStore } from './policy.js';
 import type { AlertRuleStore } from './store/alert-rules.js';
 import type { AuditSink } from './store/audit.js';
@@ -62,6 +64,10 @@ export interface ServiceOptions {
      * PostgreSQL persistence owns this store and rejects a separately injected control-plane backend.
      */
     readonly controlPlaneStore?: ControlPlaneStore;
+    /** Optional canonical-human store. When absent, control-plane authentication remains direct Google. */
+    readonly platformIdentityStore?: PlatformIdentityStore;
+    /** Durable PostgreSQL-backed platform-human migration operator. No in-memory fallback is permitted. */
+    readonly platformAuthOperator?: PlatformAuthOperator;
     /**
      * Durable atomic store for the one-time existing-organization billing preparation. No in-memory
      * default is provided because owner, app, policy, and billing revalidation must share one transaction.
@@ -213,7 +219,7 @@ export interface ServiceOptions {
     /**
      * The self-hosted authorization-server Express sub-app (OA-2). When set, the front-door delegates the AS
      * paths ({@link isAuthServerPath}: `/authorize`, `/token`, `/register`, the AS metadata + JWKS, and the
-     * Google callback + generic/developer grant consent routes) to it. Built by {@link serveService} from the
+     * upstream-human callbacks + generic/developer grant consent routes) to it. Built by {@link serveService} from the
      * `oauth` config.
      */
     readonly authServerApp?: (req: IncomingMessage, res: ServerResponse) => void;
@@ -230,7 +236,7 @@ export interface ServiceOptions {
     readonly controlPlaneSignupMode?: ControlPlaneSignupMode;
     /** Public-signup denylist domains. Takes effect before domain/allowlist/public admission. */
     readonly deniedSignupDomains?: readonly string[];
-    /** Public-signup denylist Google/Noodle subjects. Takes effect before domain/allowlist/public admission. */
+    /** Public-signup denylist external/canonical subjects. Applied before domain/allowlist/public admission. */
     readonly deniedSignupSubjects?: readonly string[];
     /** Boot-initialized service modules. Dynamic loading is owned by serveService, never request handlers. */
     readonly loadedModules?: readonly LoadedServiceModule[];
@@ -287,6 +293,9 @@ export interface ServiceOptions {
      * here before receiving run-scoped and GitHub installation credentials.
      */
     readonly githubBuilder?: {
+        /** Immutable Google `sub` for the exact Cloud Run builder service account. */
+        readonly subject: string;
+        /** Informational service-account email used by deployment configuration, never authorization. */
         readonly serviceAccountEmail: string;
         readonly audience: string;
         readonly verifier?: GithubBuilderIdentityVerifier;

package/node_modules/@noodle-borg/service/dist/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,KAAK,EACV,aAAa,EACb,MAAM,EACN,kBAAkB,EAClB,UAAU,EACX,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC/F,OAAO,KAAK,EAAE,2CAA2C,EAAE,MAAM,gDAAgD,CAAC;AAClH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAC7F,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AAC7F,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EACV,WAAW,EACX,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEpF,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,iGAAiG;IACjG,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IACnD,oGAAoG;IACpG,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC,qFAAqF;IACrF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,KAAK,CAAC;IAC5C,mGAAmG;IACnG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAC1B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,kEAAkE;IAClE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,0GAA0G;IAC1G,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,2BAA2B,CAAC;IAC7D,wGAAwG;IACxG,QAAQ,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC;IACzE,iGAAiG;IACjG,QAAQ,CAAC,iCAAiC,CAAC,EAAE,iCAAiC,CAAC;IAC/E;;;OAGG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IACjE,wGAAwG;IACxG,QAAQ,CAAC,gCAAgC,CAAC,EAAE,gCAAgC,CAAC;IAC7E;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,kCAAkC,CAAC,EAAE,kCAAkC,CAAC;IACjF,iGAAiG;IACjG,QAAQ,CAAC,2CAA2C,CAAC,EAAE,2CAA2C,CAAC;IACnG,uGAAuG;IACvG,QAAQ,CAAC,sBAAsB,CAAC,EAAE,mCAAmC,CAAC;IACtE,oGAAoG;IACpG,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD,sGAAsG;IACtG,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD,yGAAyG;IACzG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,qGAAqG;IACrG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD,uEAAuE;IACvE,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAC3C,kGAAkG;IAClG,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,kGAAkG;IAClG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,yGAAyG;IACzG,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,wFAAwF;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,sCAAsC,CAAC,EAAE,OAAO,CAAC;IAC1D;;;OAGG;IACH,QAAQ,CAAC,4BAA4B,CAAC,EAAE,aAAa,CAAC;IACtD,yFAAyF;IACzF,QAAQ,CAAC,+BAA+B,CAAC,EAAE,MAAM,CAAC;IAClD,qFAAqF;IACrF,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IAC7C,uFAAuF;IACvF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,uEAAuE;IACvE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,iGAAiG;IACjG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAClE;;;OAGG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;IAC7E;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;IAC9E,0FAA0F;IAC1F,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C,4GAA4G;IAC5G,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACjD,sGAAsG;IACtG,QAAQ,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IACzD,6FAA6F;IAC7F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,4GAA4G;IAC5G,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,0GAA0G;IAC1G,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,mBAAmB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC;IACzE;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IAC/C,mGAAmG;IACnG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,6FAA6F;IAC7F,QAAQ,CAAC,gCAAgC,CAAC,EAAE,MAAM,CAAC;IACnD;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,6BAA6B,CAAC;KACnD,CAAC;CACH"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,KAAK,EACV,aAAa,EACb,MAAM,EACN,kBAAkB,EAClB,UAAU,EACX,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC/F,OAAO,KAAK,EAAE,2CAA2C,EAAE,MAAM,gDAAgD,CAAC;AAClH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAC7F,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AAC7F,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EACV,WAAW,EACX,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEpF,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,iGAAiG;IACjG,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IACnD,oGAAoG;IACpG,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC,qFAAqF;IACrF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,KAAK,CAAC;IAC5C,mGAAmG;IACnG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAC1B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,kEAAkE;IAClE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,0GAA0G;IAC1G,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,uGAAuG;IACvG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD,uGAAuG;IACvG,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;OAGG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,2BAA2B,CAAC;IAC7D,wGAAwG;IACxG,QAAQ,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC;IACzE,iGAAiG;IACjG,QAAQ,CAAC,iCAAiC,CAAC,EAAE,iCAAiC,CAAC;IAC/E;;;OAGG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IACjE,wGAAwG;IACxG,QAAQ,CAAC,gCAAgC,CAAC,EAAE,gCAAgC,CAAC;IAC7E;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,kCAAkC,CAAC,EAAE,kCAAkC,CAAC;IACjF,iGAAiG;IACjG,QAAQ,CAAC,2CAA2C,CAAC,EAAE,2CAA2C,CAAC;IACnG,uGAAuG;IACvG,QAAQ,CAAC,sBAAsB,CAAC,EAAE,mCAAmC,CAAC;IACtE,oGAAoG;IACpG,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD,sGAAsG;IACtG,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD,yGAAyG;IACzG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,qGAAqG;IACrG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD,uEAAuE;IACvE,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAC3C,kGAAkG;IAClG,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,kGAAkG;IAClG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,yGAAyG;IACzG,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,wFAAwF;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,sCAAsC,CAAC,EAAE,OAAO,CAAC;IAC1D;;;OAGG;IACH,QAAQ,CAAC,4BAA4B,CAAC,EAAE,aAAa,CAAC;IACtD,yFAAyF;IACzF,QAAQ,CAAC,+BAA+B,CAAC,EAAE,MAAM,CAAC;IAClD,qFAAqF;IACrF,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IAC7C,uFAAuF;IACvF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,uEAAuE;IACvE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,iGAAiG;IACjG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAClE;;;OAGG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;IAC7E;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;IAC9E,0FAA0F;IAC1F,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C,4GAA4G;IAC5G,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACjD,sGAAsG;IACtG,QAAQ,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IACzD,6FAA6F;IAC7F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,4GAA4G;IAC5G,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,0GAA0G;IAC1G,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,mBAAmB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC;IACzE;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IAC/C,mGAAmG;IACnG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,6FAA6F;IAC7F,QAAQ,CAAC,gCAAgC,CAAC,EAAE,MAAM,CAAC;IACnD;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvB,8EAA8E;QAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,iGAAiG;QACjG,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,6BAA6B,CAAC;KACnD,CAAC;CACH"}

package/node_modules/@noodle-borg/service/dist/personal-workspace.d.ts

@@ -6,4 +6,6 @@ export interface PersonalWorkspace {
 }
 export declare function ensurePersonalWorkspace(controlPlane: ControlPlaneStore, identity: ControlPlaneIdentity): Promise<PersonalWorkspace>;
 export declare function personalOrgSlug(identity: Pick<ControlPlaneIdentity, 'subject' | 'email'>): string;
+/** Immutable suffix used to discover and bind legacy email-derived personal organization slugs. */
+export declare function personalOrgSlugSuffix(subject: string): string;
 //# sourceMappingURL=personal-workspace.d.ts.map

package/node_modules/@noodle-borg/service/dist/personal-workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"personal-workspace.d.ts","sourceRoot":"","sources":["../src/personal-workspace.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG/D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,iBAAiB,EAC/B,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CAS5B;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,MAAM,CAKjG"}
+{"version":3,"file":"personal-workspace.d.ts","sourceRoot":"","sources":["../src/personal-workspace.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG/D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,iBAAiB,EAC/B,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CAY5B;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,MAAM,CAIjG;AAED,mGAAmG;AACnG,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE7D"}

package/node_modules/@noodle-borg/service/dist/personal-workspace.js

@@ -5,6 +5,9 @@ export async function ensurePersonalWorkspace(controlPlane, identity) {
     return controlPlane.provisionPersonalWorkspace({
         slug,
         displayName: identity.email,
+        ...(identity.billingIdentity === undefined
+            ? {}
+            : { identityIssuer: identity.billingIdentity.identityIssuer }),
         subject: identity.subject,
         email: identity.email,
         ...(identity.givenName !== undefined ? { firstName: identity.givenName } : {}),
@@ -13,8 +16,11 @@ export async function ensurePersonalWorkspace(controlPlane, identity) {
 export function personalOrgSlug(identity) {
     const localPart = identity.email.split('@')[0] ?? 'user';
     const base = slugPart(localPart).slice(0, 52) || 'user';
-    const hash = createHash('sha256').update(identity.subject).digest('hex').slice(0, 8);
-    return validateSlug('org', `u-${base}-${hash}`);
+    return validateSlug('org', `u-${base}${personalOrgSlugSuffix(identity.subject)}`);
+}
+/** Immutable suffix used to discover and bind legacy email-derived personal organization slugs. */
+export function personalOrgSlugSuffix(subject) {
+    return `-${createHash('sha256').update(subject).digest('hex').slice(0, 8)}`;
 }
 function slugPart(value) {
     return value

package/node_modules/@noodle-borg/service/dist/personal-workspace.js.map

@@ -1 +1 @@
-{"version":3,"file":"personal-workspace.js","sourceRoot":"","sources":["../src/personal-workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAO1C,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAA+B,EAC/B,QAA8B;IAE9B,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,YAAY,CAAC,0BAA0B,CAAC;QAC7C,IAAI;QACJ,WAAW,EAAE,QAAQ,CAAC,KAAK;QAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAyD;IACvF,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrF,OAAO,YAAY,CAAC,KAAK,EAAE,KAAK,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK;SACT,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"personal-workspace.js","sourceRoot":"","sources":["../src/personal-workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAO1C,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAA+B,EAC/B,QAA8B;IAE9B,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,YAAY,CAAC,0BAA0B,CAAC;QAC7C,IAAI;QACJ,WAAW,EAAE,QAAQ,CAAC,KAAK;QAC3B,GAAG,CAAC,QAAQ,CAAC,eAAe,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,eAAe,CAAC,cAAc,EAAE,CAAC;QAChE,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAyD;IACvF,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;IACxD,OAAO,YAAY,CAAC,KAAK,EAAE,KAAK,IAAI,GAAG,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK;SACT,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-configuration.d.ts

@@ -0,0 +1,67 @@
+import { type Aggregate, type DurableState, type Lineage, previewRequest } from './platform-auth-rollout-support.js';
+export interface WorkOSConfigurationIdentity {
+    readonly clientId: string;
+    readonly realm: string;
+}
+export interface DurableWorkOSRolloutConfiguration {
+    readonly workosPercentage: number;
+    readonly workosRecoveryClientIds: readonly string[];
+    readonly workosRecoveryEnabled: boolean;
+    readonly lifecycle: 'google' | 'workos' | 'finalized';
+    readonly workosClientFingerprint: string | null;
+    readonly workosRealmFingerprint: string | null;
+}
+export interface WorkOSConfigurationFingerprints {
+    readonly client: string;
+    readonly realm: string;
+}
+export type StoredWorkOSRolloutState = DurableState & {
+    readonly workosClientFingerprint: string | null;
+    readonly workosRealmFingerprint: string | null;
+};
+interface WorkOSRolloutBindingState {
+    readonly workosPercentage: number;
+    readonly workosRecoveryClientIds: readonly string[];
+    readonly workosRecoveryEnabled: boolean;
+    readonly lifecycle: 'google' | 'workos' | 'finalized';
+    readonly workosClientFingerprint: string | null;
+    readonly workosRealmFingerprint: string | null;
+}
+interface WorkOSRolloutBindingTarget {
+    readonly percentage: number;
+    readonly recoveryClientIds: readonly string[];
+}
+export type WorkOSRolloutBindingResolution = {
+    readonly valid: false;
+} | {
+    readonly valid: true;
+    readonly fingerprints: WorkOSConfigurationFingerprints | undefined;
+};
+/** One-way configuration identity used only for local continuity checks; raw identifiers are never persisted. */
+export declare function platformAuthConfigurationFingerprint(value: string): string;
+/** Fail closed before any transaction can select WorkOS under a different environment configuration. */
+export declare function assertWorkOSRolloutConfigurationContinuity(rollout: DurableWorkOSRolloutConfiguration, configured: WorkOSConfigurationIdentity | undefined): void;
+/** Resolve the immutable fingerprints a rollout mutation must bind without exposing raw configuration. */
+export declare function resolveWorkOSRolloutConfigurationFingerprints(state: WorkOSRolloutBindingState, target: WorkOSRolloutBindingTarget, configured: WorkOSConfigurationIdentity | undefined, requestedRealm: string): WorkOSRolloutBindingResolution;
+export declare function configurationBoundPreviewRequest(state: DurableState, aggregate: Aggregate, lineage: Lineage, input: Parameters<typeof previewRequest>[3], configuration: WorkOSConfigurationFingerprints | undefined): {
+    workosClientFingerprint: string | null;
+    rollbackRehearsalChecksum: string | null;
+    stagingWorkosOnlySmokeChecksum: string | null;
+    state: DurableState;
+    aggregate: Aggregate;
+    lineage: {
+        inventoryRunHash: string;
+        inventoryChecksum: string;
+        importRunHash: string;
+        importLineageChecksum: string;
+        workosRealmFingerprint: string;
+    };
+    operation: "activate" | "rollback" | "finalize";
+    percentage: number;
+    cohortMode: "replace" | "preserve";
+    canaryClientIds: readonly string[];
+    recoveryClientIds: readonly string[];
+    releaseSha: string;
+};
+export {};
+//# sourceMappingURL=platform-auth-configuration.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-configuration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-configuration.d.ts","sourceRoot":"","sources":["../src/platform-auth-configuration.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,OAAO,EACZ,cAAc,EACf,MAAM,oCAAoC,CAAC;AAE5C,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpD,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;IACtD,QAAQ,CAAC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;CAChD;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,wBAAwB,GAAG,YAAY,GAAG;IACpD,QAAQ,CAAC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF,UAAU,yBAAyB;IACjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpD,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;IACtD,QAAQ,CAAC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;CAChD;AAED,UAAU,0BAA0B;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,MAAM,MAAM,8BAA8B,GACtC;IAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACzB;IACE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IACrB,QAAQ,CAAC,YAAY,EAAE,+BAA+B,GAAG,SAAS,CAAC;CACpE,CAAC;AAEN,iHAAiH;AACjH,wBAAgB,oCAAoC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wGAAwG;AACxG,wBAAgB,0CAA0C,CACxD,OAAO,EAAE,iCAAiC,EAC1C,UAAU,EAAE,2BAA2B,GAAG,SAAS,GAClD,IAAI,CAiBN;AAED,0GAA0G;AAC1G,wBAAgB,6CAA6C,CAC3D,KAAK,EAAE,yBAAyB,EAChC,MAAM,EAAE,0BAA0B,EAClC,UAAU,EAAE,2BAA2B,GAAG,SAAS,EACnD,cAAc,EAAE,MAAM,GACrB,8BAA8B,CAyBhC;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,YAAY,EACnB,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,EAC3C,aAAa,EAAE,+BAA+B,GAAG,SAAS;;;;;;;;;;;;;;;;;;;EAM3D"}

package/node_modules/@noodle-borg/service/dist/platform-auth-configuration.js

@@ -0,0 +1,54 @@
+import { createHash } from 'node:crypto';
+import { previewRequest, } from './platform-auth-rollout-support.js';
+/** One-way configuration identity used only for local continuity checks; raw identifiers are never persisted. */
+export function platformAuthConfigurationFingerprint(value) {
+    return createHash('sha256').update(JSON.stringify(value.trim())).digest('hex');
+}
+/** Fail closed before any transaction can select WorkOS under a different environment configuration. */
+export function assertWorkOSRolloutConfigurationContinuity(rollout, configured) {
+    const canRouteWorkOS = rollout.workosPercentage > 0 ||
+        rollout.lifecycle !== 'google' ||
+        rollout.workosRecoveryClientIds.length > 0 ||
+        rollout.workosRecoveryEnabled;
+    if (!canRouteWorkOS)
+        return;
+    if (configured === undefined ||
+        rollout.workosClientFingerprint === null ||
+        rollout.workosRealmFingerprint === null ||
+        rollout.workosClientFingerprint !== platformAuthConfigurationFingerprint(configured.clientId) ||
+        rollout.workosRealmFingerprint !== platformAuthConfigurationFingerprint(configured.realm)) {
+        throw new Error('WorkOS rollout configuration continuity check failed');
+    }
+}
+/** Resolve the immutable fingerprints a rollout mutation must bind without exposing raw configuration. */
+export function resolveWorkOSRolloutConfigurationFingerprints(state, target, configured, requestedRealm) {
+    const wasRouting = state.workosPercentage > 0 ||
+        state.lifecycle !== 'google' ||
+        state.workosRecoveryClientIds.length > 0 ||
+        state.workosRecoveryEnabled;
+    const willRoute = target.percentage > 0 || target.recoveryClientIds.length > 0;
+    if (!wasRouting && !willRoute)
+        return { valid: true, fingerprints: undefined };
+    if (configured === undefined || configured.clientId.trim().length === 0)
+        return { valid: false };
+    const fingerprints = {
+        client: platformAuthConfigurationFingerprint(configured.clientId),
+        realm: platformAuthConfigurationFingerprint(configured.realm),
+    };
+    if (configured.realm.trim() !== requestedRealm.trim() ||
+        (wasRouting &&
+            (state.workosClientFingerprint === null || state.workosRealmFingerprint === null)) ||
+        (state.workosClientFingerprint !== null &&
+            state.workosClientFingerprint !== fingerprints.client) ||
+        (state.workosRealmFingerprint !== null && state.workosRealmFingerprint !== fingerprints.realm)) {
+        return { valid: false };
+    }
+    return { valid: true, fingerprints };
+}
+export function configurationBoundPreviewRequest(state, aggregate, lineage, input, configuration) {
+    return {
+        ...previewRequest(state, aggregate, lineage, input),
+        workosClientFingerprint: configuration?.client ?? null,
+    };
+}
+//# sourceMappingURL=platform-auth-configuration.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-configuration.js","sourceRoot":"","sources":["../src/platform-auth-configuration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAIL,cAAc,GACf,MAAM,oCAAoC,CAAC;AA+C5C,iHAAiH;AACjH,MAAM,UAAU,oCAAoC,CAAC,KAAa;IAChE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjF,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,0CAA0C,CACxD,OAA0C,EAC1C,UAAmD;IAEnD,MAAM,cAAc,GAClB,OAAO,CAAC,gBAAgB,GAAG,CAAC;QAC5B,OAAO,CAAC,SAAS,KAAK,QAAQ;QAC9B,OAAO,CAAC,uBAAuB,CAAC,MAAM,GAAG,CAAC;QAC1C,OAAO,CAAC,qBAAqB,CAAC;IAChC,IAAI,CAAC,cAAc;QAAE,OAAO;IAE5B,IACE,UAAU,KAAK,SAAS;QACxB,OAAO,CAAC,uBAAuB,KAAK,IAAI;QACxC,OAAO,CAAC,sBAAsB,KAAK,IAAI;QACvC,OAAO,CAAC,uBAAuB,KAAK,oCAAoC,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC7F,OAAO,CAAC,sBAAsB,KAAK,oCAAoC,CAAC,UAAU,CAAC,KAAK,CAAC,EACzF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,6CAA6C,CAC3D,KAAgC,EAChC,MAAkC,EAClC,UAAmD,EACnD,cAAsB;IAEtB,MAAM,UAAU,GACd,KAAK,CAAC,gBAAgB,GAAG,CAAC;QAC1B,KAAK,CAAC,SAAS,KAAK,QAAQ;QAC5B,KAAK,CAAC,uBAAuB,CAAC,MAAM,GAAG,CAAC;QACxC,KAAK,CAAC,qBAAqB,CAAC;IAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,GAAG,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/E,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;IAC/E,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAEjG,MAAM,YAAY,GAAG;QACnB,MAAM,EAAE,oCAAoC,CAAC,UAAU,CAAC,QAAQ,CAAC;QACjE,KAAK,EAAE,oCAAoC,CAAC,UAAU,CAAC,KAAK,CAAC;KAC9D,CAAC;IACF,IACE,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,cAAc,CAAC,IAAI,EAAE;QACjD,CAAC,UAAU;YACT,CAAC,KAAK,CAAC,uBAAuB,KAAK,IAAI,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,CAAC,CAAC;QACpF,CAAC,KAAK,CAAC,uBAAuB,KAAK,IAAI;YACrC,KAAK,CAAC,uBAAuB,KAAK,YAAY,CAAC,MAAM,CAAC;QACxD,CAAC,KAAK,CAAC,sBAAsB,KAAK,IAAI,IAAI,KAAK,CAAC,sBAAsB,KAAK,YAAY,CAAC,KAAK,CAAC,EAC9F,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAAmB,EACnB,SAAoB,EACpB,OAAgB,EAChB,KAA2C,EAC3C,aAA0D;IAE1D,OAAO;QACL,GAAG,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC;QACnD,uBAAuB,EAAE,aAAa,EAAE,MAAM,IAAI,IAAI;KACvD,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-frozen-candidate-postgres.d.ts

@@ -0,0 +1,25 @@
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+export interface BoundFrozenImportCandidate {
+    readonly source_realm: string;
+    readonly principal_id: string | null;
+    readonly normalized_email: string;
+    readonly email_fingerprint: string;
+    readonly provenance: readonly string[];
+    readonly blocker_codes: readonly string[];
+    readonly source_fingerprint: string;
+    readonly candidate_fingerprint: string;
+}
+/**
+ * Loads one candidate through the frozen inventory primary key. Completed inventory/candidate rows are
+ * append-only, so validating their persisted aggregate lineage is constant work after inventory finalization.
+ */
+export declare function loadBoundFrozenImportCandidate(pool: PlatformIdentityQueryable, input: {
+    readonly inventoryRunId: string;
+    readonly inventoryChecksum: string;
+    readonly releaseSha: string;
+    readonly workosRealmFingerprint: string;
+    readonly lineageChecksum: string;
+    readonly principalId: string;
+    readonly normalizedEmail: string;
+}): Promise<BoundFrozenImportCandidate>;
+//# sourceMappingURL=platform-auth-frozen-candidate-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-frozen-candidate-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-frozen-candidate-postgres.d.ts","sourceRoot":"","sources":["../src/platform-auth-frozen-candidate-postgres.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;CACxC;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,yBAAyB,EAC/B,KAAK,EAAE;IACL,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,GACA,OAAO,CAAC,0BAA0B,CAAC,CA2ErC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-frozen-candidate-postgres.js

@@ -0,0 +1,61 @@
+import { PlatformAuthMigrationError } from './platform-auth-migration.js';
+import { candidateDigest, migrationHash } from './platform-auth-migration-runs-postgres.js';
+/**
+ * Loads one candidate through the frozen inventory primary key. Completed inventory/candidate rows are
+ * append-only, so validating their persisted aggregate lineage is constant work after inventory finalization.
+ */
+export async function loadBoundFrozenImportCandidate(pool, input) {
+    const result = await pool.query(`SELECT candidate.source_subject, candidate.source_realm, candidate.principal_id,
+            candidate.normalized_email, candidate.email_fingerprint, candidate.provenance,
+            candidate.blocker_codes, candidate.source_fingerprint,
+            candidate.candidate_fingerprint, inventory.frozen_checksum,
+            inventory.source_fingerprint AS source_set_fingerprint,
+            inventory.excluded_fingerprint, inventory.release_sha,
+            inventory.workos_realm_fingerprint, inventory.google_realm,
+            inventory.inventory_format
+       FROM platform_auth_inventory_candidates candidate
+       JOIN identity_migration_runs inventory ON inventory.id = candidate.migration_run_id
+      WHERE candidate.migration_run_id = $1 AND candidate.source_subject = $2
+        AND inventory.kind = 'inventory' AND inventory.state = 'completed'
+      FOR SHARE OF candidate, inventory`, [input.inventoryRunId, input.principalId]);
+    const candidate = result.rows[0];
+    const expectedSourceFingerprint = migrationHash({
+        subject: input.principalId,
+        realm: candidate?.source_realm,
+        provenance: candidate?.provenance,
+    });
+    const legacySourceFingerprint = migrationHash({
+        subject: input.principalId,
+        provenance: candidate?.provenance,
+    });
+    if (candidate === undefined ||
+        candidate.frozen_checksum !== input.inventoryChecksum ||
+        candidate.release_sha !== input.releaseSha ||
+        candidate.workos_realm_fingerprint !== input.workosRealmFingerprint ||
+        candidate.google_realm === null ||
+        candidate.source_realm !== candidate.google_realm ||
+        candidate.source_set_fingerprint === null ||
+        (candidate.inventory_format !== 'v2' &&
+            candidate.inventory_format !== 'v1' &&
+            candidate.inventory_format !== 'legacy_v0') ||
+        (candidate.inventory_format !== 'legacy_v0' && candidate.excluded_fingerprint === null) ||
+        (candidate.source_fingerprint !== expectedSourceFingerprint &&
+            (candidate.inventory_format !== 'legacy_v0' ||
+                candidate.source_fingerprint !== legacySourceFingerprint)) ||
+        input.lineageChecksum !==
+            migrationHash({
+                inventoryRunHash: migrationHash(input.inventoryRunId),
+                inventoryChecksum: input.inventoryChecksum,
+                candidateSetChecksum: candidate.source_set_fingerprint,
+                workosRealmFingerprint: input.workosRealmFingerprint,
+                releaseSha: input.releaseSha,
+            }) ||
+        (candidate.principal_id !== null && candidate.principal_id !== input.principalId) ||
+        candidate.normalized_email !== input.normalizedEmail ||
+        candidate.email_fingerprint !== migrationHash(input.normalizedEmail) ||
+        candidate.blocker_codes.length !== 0 ||
+        candidate.candidate_fingerprint !== candidateDigest(candidate))
+        throw new PlatformAuthMigrationError('reconciliation_drift');
+    return candidate;
+}
+//# sourceMappingURL=platform-auth-frozen-candidate-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-frozen-candidate-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-frozen-candidate-postgres.js","sourceRoot":"","sources":["../src/platform-auth-frozen-candidate-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,4CAA4C,CAAC;AAc5F;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,IAA+B,EAC/B,KAQC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAkB7B;;;;;;;;;;;;wCAYoC,EACpC,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAC1C,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,yBAAyB,GAAG,aAAa,CAAC;QAC9C,OAAO,EAAE,KAAK,CAAC,WAAW;QAC1B,KAAK,EAAE,SAAS,EAAE,YAAY;QAC9B,UAAU,EAAE,SAAS,EAAE,UAAU;KAClC,CAAC,CAAC;IACH,MAAM,uBAAuB,GAAG,aAAa,CAAC;QAC5C,OAAO,EAAE,KAAK,CAAC,WAAW;QAC1B,UAAU,EAAE,SAAS,EAAE,UAAU;KAClC,CAAC,CAAC;IACH,IACE,SAAS,KAAK,SAAS;QACvB,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,iBAAiB;QACrD,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,UAAU;QAC1C,SAAS,CAAC,wBAAwB,KAAK,KAAK,CAAC,sBAAsB;QACnE,SAAS,CAAC,YAAY,KAAK,IAAI;QAC/B,SAAS,CAAC,YAAY,KAAK,SAAS,CAAC,YAAY;QACjD,SAAS,CAAC,sBAAsB,KAAK,IAAI;QACzC,CAAC,SAAS,CAAC,gBAAgB,KAAK,IAAI;YAClC,SAAS,CAAC,gBAAgB,KAAK,IAAI;YACnC,SAAS,CAAC,gBAAgB,KAAK,WAAW,CAAC;QAC7C,CAAC,SAAS,CAAC,gBAAgB,KAAK,WAAW,IAAI,SAAS,CAAC,oBAAoB,KAAK,IAAI,CAAC;QACvF,CAAC,SAAS,CAAC,kBAAkB,KAAK,yBAAyB;YACzD,CAAC,SAAS,CAAC,gBAAgB,KAAK,WAAW;gBACzC,SAAS,CAAC,kBAAkB,KAAK,uBAAuB,CAAC,CAAC;QAC9D,KAAK,CAAC,eAAe;YACnB,aAAa,CAAC;gBACZ,gBAAgB,EAAE,aAAa,CAAC,KAAK,CAAC,cAAc,CAAC;gBACrD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,oBAAoB,EAAE,SAAS,CAAC,sBAAsB;gBACtD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;gBACpD,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC;QACJ,CAAC,SAAS,CAAC,YAAY,KAAK,IAAI,IAAI,SAAS,CAAC,YAAY,KAAK,KAAK,CAAC,WAAW,CAAC;QACjF,SAAS,CAAC,gBAAgB,KAAK,KAAK,CAAC,eAAe;QACpD,SAAS,CAAC,iBAAiB,KAAK,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC;QACpE,SAAS,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QACpC,SAAS,CAAC,qBAAqB,KAAK,eAAe,CAAC,SAAS,CAAC;QAE9D,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;IAC/D,OAAO,SAAuC,CAAC;AACjD,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-legacy-sources-postgres.d.ts

@@ -0,0 +1,32 @@
+import { type PlatformAuthInventorySourceManifest } from './platform-auth-inventory-sources.js';
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+export type PlatformAuthInventoryProvenance = 'principal' | 'google_link' | 'google_billing' | 'org_membership' | 'refresh_family' | 'developer_grant' | 'owner_only_deployer' | 'consent_grant' | 'device_authorization' | 'welcome_provisioning';
+export interface PlatformAuthLegacyInventorySource {
+    readonly subject: string;
+    readonly provenance: ReadonlySet<PlatformAuthInventoryProvenance>;
+    readonly principalId?: string;
+    readonly realm?: string;
+    readonly identityDrift: boolean;
+    readonly excludedEvidence: boolean;
+}
+/** Source discovery retained only for compatibility tests and pre-paged inventory runs. */
+export declare class PostgresPlatformAuthLegacyInventorySources {
+    #private;
+    constructor(options: {
+        readonly googleRealm: string;
+        readonly sourceAvailability?: PlatformAuthInventorySourceManifest;
+        readonly excludedSubjects: readonly {
+            readonly subject: string;
+            readonly kind: 'workload' | 'synthetic';
+        }[];
+    });
+    discover(pool: PlatformIdentityQueryable): Promise<{
+        readonly sources: Map<string, PlatformAuthLegacyInventorySource>;
+        readonly excludedCount: number;
+        readonly excludedFingerprint: string;
+    }>;
+    assertManifest(pool: PlatformIdentityQueryable): Promise<void>;
+    emails(pool: PlatformIdentityQueryable, sources: readonly PlatformAuthLegacyInventorySource[]): Promise<Map<string, readonly string[]>>;
+    emailOwners(pool: PlatformIdentityQueryable): Promise<Map<string, Set<string>>>;
+}
+//# sourceMappingURL=platform-auth-inventory-legacy-sources-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-legacy-sources-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-inventory-legacy-sources-postgres.d.ts","sourceRoot":"","sources":["../src/platform-auth-inventory-legacy-sources-postgres.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,mCAAmC,EACzC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,MAAM,MAAM,+BAA+B,GACvC,WAAW,GACX,aAAa,GACb,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,qBAAqB,GACrB,eAAe,GACf,sBAAsB,GACtB,sBAAsB,CAAC;AAE3B,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,+BAA+B,CAAC,CAAC;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED,2FAA2F;AAC3F,qBAAa,0CAA0C;;gBAQzC,OAAO,EAAE;QACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,mCAAmC,CAAC;QAClE,QAAQ,CAAC,gBAAgB,EAAE,SAAS;YAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;YACzB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAAC;SACzC,EAAE,CAAC;KACL;IAMK,QAAQ,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC;QACvD,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;QACjE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;KACtC,CAAC;IAkII,cAAc,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IA0C9D,MAAM,CACV,IAAI,EAAE,yBAAyB,EAC/B,OAAO,EAAE,SAAS,iCAAiC,EAAE,GACpD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IAuBpC,WAAW,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;CAsFtF"}