@noodleseed/one 0.63.0 → 0.64.0

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-legacy-sources-postgres.js

@@ -0,0 +1,231 @@
+import { createHash } from 'node:crypto';
+import { compareInventoryText } from './platform-auth-inventory-paging.js';
+import { PLATFORM_AUTH_INVENTORY_NON_AUTHORITY_SOURCES, PLATFORM_AUTH_INVENTORY_SOURCE_COLUMNS, PLATFORM_AUTH_INVENTORY_SOURCES, } from './platform-auth-inventory-sources.js';
+import { PlatformAuthMigrationError } from './platform-auth-migration.js';
+/** Source discovery retained only for compatibility tests and pre-paged inventory runs. */
+export class PostgresPlatformAuthLegacyInventorySources {
+    #googleRealm;
+    #manifest;
+    #excludedSubjects;
+    constructor(options) {
+        this.#googleRealm = options.googleRealm;
+        this.#manifest = options.sourceAvailability;
+        this.#excludedSubjects = options.excludedSubjects;
+    }
+    async discover(pool) {
+        const sources = new Map();
+        const excluded = new Set();
+        const suspended = new Set();
+        const suspendedWithAuthority = new Set();
+        const add = (input) => {
+            if (input.subject.length === 0)
+                return;
+            const previous = sources.get(input.subject);
+            const principalId = previous?.principalId ?? input.principalId;
+            const realm = previous?.realm ?? input.realm;
+            sources.set(input.subject, {
+                subject: input.subject,
+                provenance: new Set([...(previous?.provenance ?? []), input.provenance]),
+                identityDrift: previous?.identityDrift === true || input.identityDrift === true,
+                excludedEvidence: previous?.excludedEvidence === true || input.excludedEvidence === true,
+                ...(principalId === undefined ? {} : { principalId }),
+                realm: realm ?? this.#googleRealm,
+            });
+        };
+        const principalLinks = await pool.query(`SELECT p.principal_id, l.external_id, l.realm, p.status, p.billing_identity_issuer,
+              p.billing_subject, l.disabled_at FROM platform_principals p
+        JOIN platform_identity_links l ON l.principal_id = p.principal_id
+       WHERE l.provider = 'google' AND l.realm = $1`, [this.#googleRealm]);
+        for (const row of principalLinks.rows) {
+            if (row.status === 'suspended') {
+                suspended.add(row.external_id);
+                continue;
+            }
+            const identityDrift = !(row.disabled_at === null &&
+                row.principal_id === row.external_id &&
+                row.billing_identity_issuer === 'https://accounts.google.com' &&
+                row.billing_subject === row.external_id);
+            add({
+                subject: row.external_id,
+                provenance: 'principal',
+                principalId: row.principal_id,
+                realm: row.realm,
+                identityDrift,
+            });
+            add({
+                subject: row.external_id,
+                provenance: 'google_link',
+                principalId: row.principal_id,
+                realm: row.realm,
+                identityDrift,
+            });
+        }
+        await this.#addRoots(pool, add);
+        const excludedRows = [
+            ...(await this.#rows(pool, 'oauth_refresh_tokens', "SELECT owner_subject AS subject FROM oauth_refresh_tokens WHERE identity_kind = 'customer'")),
+            ...(await this.#rows(pool, 'oauth_device_authorizations', "SELECT owner_subject AS subject FROM oauth_device_authorizations WHERE owner_subject IS NOT NULL AND identity_kind = 'customer'")),
+            ...(await this.#rows(pool, 'oauth_delegated_credentials', 'SELECT subject FROM oauth_delegated_credentials')),
+        ];
+        for (const row of excludedRows)
+            excluded.add(row.subject);
+        for (const subject of excluded) {
+            const existing = sources.get(subject);
+            if (existing !== undefined)
+                add({
+                    subject,
+                    provenance: [...existing.provenance][0] ?? 'principal',
+                    excludedEvidence: true,
+                });
+        }
+        for (const subject of suspended) {
+            if (sources.has(subject))
+                suspendedWithAuthority.add(subject);
+            excluded.add(subject);
+            sources.delete(subject);
+        }
+        const configuredExclusions = new Map();
+        for (const entry of this.#excludedSubjects) {
+            configuredExclusions.set(entry.subject, entry.kind);
+            excluded.add(entry.subject);
+            sources.delete(entry.subject);
+        }
+        const artifactEvidence = {
+            nonAuthoritySources: PLATFORM_AUTH_INVENTORY_NON_AUTHORITY_SOURCES.filter((source) => this.#manifest?.[source] === 'configured'),
+        };
+        return {
+            sources,
+            excludedCount: [...excluded].filter((subject) => !sources.has(subject)).length,
+            excludedFingerprint: legacyHash({
+                subjects: [...excluded].sort(compareInventoryText).map((subject) => ({
+                    subjectFingerprint: legacyHash(subject),
+                    kind: configuredExclusions.get(subject) ??
+                        (suspendedWithAuthority.has(subject)
+                            ? 'suspended_principal_with_authority'
+                            : suspended.has(subject)
+                                ? 'suspended_principal'
+                                : 'non_platform_identity'),
+                })),
+                artifactEvidence,
+            }),
+        };
+    }
+    async assertManifest(pool) {
+        const manifest = this.#manifest;
+        if (manifest === undefined ||
+            Object.keys(manifest).length !== PLATFORM_AUTH_INVENTORY_SOURCES.length ||
+            PLATFORM_AUTH_INVENTORY_SOURCES.some((source) => manifest[source] !== 'configured' && manifest[source] !== 'not_applicable') ||
+            new Set(this.#excludedSubjects.map((entry) => entry.subject)).size !==
+                this.#excludedSubjects.length ||
+            this.#excludedSubjects.some((entry) => entry.subject.trim() !== entry.subject ||
+                entry.subject.length === 0 ||
+                entry.subject.length > 256) ||
+            ((manifest.billing_account_members === 'configured' ||
+                manifest.billing_account_defaults === 'configured') &&
+                manifest.billing_accounts !== 'configured'))
+            throw new PlatformAuthMigrationError('inventory_unavailable');
+        for (const source of PLATFORM_AUTH_INVENTORY_SOURCES) {
+            if (manifest[source] !== 'configured')
+                continue;
+            const columns = await pool.query(`SELECT attribute.attname AS name,
+                format_type(attribute.atttypid, attribute.atttypmod) AS type
+           FROM pg_attribute attribute
+          WHERE attribute.attrelid = to_regclass($1)
+            AND attribute.attnum > 0 AND NOT attribute.attisdropped`, [source]);
+            const actual = new Map(columns.rows.map((column) => [column.name, column.type]));
+            if (columns.rows.length === 0 ||
+                PLATFORM_AUTH_INVENTORY_SOURCE_COLUMNS[source].some(([name, type]) => actual.get(name) !== type))
+                throw new PlatformAuthMigrationError('inventory_unavailable');
+        }
+    }
+    async emails(pool, sources) {
+        const rows = await pool.query(`SELECT l.external_id, e.normalized_email FROM platform_identity_links l
+        JOIN platform_verified_emails e ON e.principal_id = l.principal_id
+         AND e.provider = 'google' AND e.realm = l.realm
+       WHERE l.provider = 'google' AND l.realm = $1
+         AND l.disabled_at IS NULL AND e.status = 'active'`, [this.#googleRealm]);
+        const known = new Set(sources.map((source) => source.subject));
+        const result = new Map();
+        for (const row of rows.rows) {
+            if (!known.has(row.external_id))
+                continue;
+            const emails = result.get(row.external_id) ?? [];
+            if (!emails.includes(row.normalized_email))
+                emails.push(row.normalized_email);
+            result.set(row.external_id, emails.sort(compareInventoryText));
+        }
+        return result;
+    }
+    async emailOwners(pool) {
+        const rows = await pool.query(`SELECT principal_id, normalized_email FROM platform_verified_emails
+        WHERE provider = 'google' AND realm = $1 AND status = 'active'`, [this.#googleRealm]);
+        const result = new Map();
+        for (const row of rows.rows) {
+            const owners = result.get(row.normalized_email) ?? new Set();
+            owners.add(row.principal_id);
+            result.set(row.normalized_email, owners);
+        }
+        return result;
+    }
+    async #addRoots(pool, add) {
+        const roots = [
+            ['org_members', 'org_membership', 'SELECT subject FROM org_members'],
+            [
+                'billing_account_members',
+                'google_billing',
+                `SELECT member.subject FROM billing_account_members member JOIN billing_accounts account ON account.id = member.billing_account_id WHERE member.identity_issuer = 'https://accounts.google.com' AND member.role = 'owner' AND account.state = 'active'`,
+            ],
+            [
+                'billing_account_defaults',
+                'google_billing',
+                `SELECT defaults.subject FROM billing_account_defaults defaults JOIN billing_accounts account ON account.id = defaults.billing_account_id JOIN billing_account_members member ON member.billing_account_id = defaults.billing_account_id AND member.identity_issuer = defaults.identity_issuer AND member.subject = defaults.subject WHERE defaults.identity_issuer = 'https://accounts.google.com' AND member.role = 'owner' AND account.state = 'active'`,
+            ],
+            [
+                'oauth_refresh_tokens',
+                'refresh_family',
+                `SELECT owner_subject AS subject FROM oauth_refresh_tokens WHERE identity_kind IS DISTINCT FROM 'customer' AND expires_at > now() AND rotated_at IS NULL AND superseded_by IS NULL`,
+            ],
+            [
+                'developer_access_grants',
+                'developer_grant',
+                'SELECT subject FROM developer_access_grants WHERE revoked_at IS NULL AND (expires_at IS NULL OR expires_at > now())',
+            ],
+            [
+                'deploy_records',
+                'owner_only_deployer',
+                `SELECT created_by_subject AS subject FROM deploy_records WHERE active = true AND access_mode = 'owner-only' AND created_by_subject IS NOT NULL AND deployment_source IS DISTINCT FROM 'github' AND archived_at IS NULL`,
+            ],
+            [
+                'oauth_consent_grants',
+                'consent_grant',
+                'SELECT owner_subject AS subject FROM oauth_consent_grants',
+            ],
+            [
+                'oauth_device_authorizations',
+                'device_authorization',
+                `SELECT owner_subject AS subject FROM oauth_device_authorizations WHERE owner_subject IS NOT NULL AND identity_kind IS DISTINCT FROM 'customer' AND status IN ('pending', 'approved') AND expires_at > now()`,
+            ],
+            [
+                'welcome_email_outbox',
+                'welcome_provisioning',
+                'SELECT subject FROM welcome_email_outbox',
+            ],
+        ];
+        for (const [source, provenance, query] of roots)
+            for (const row of await this.#rows(pool, source, query))
+                add({ subject: row.subject, provenance });
+    }
+    async #rows(pool, source, query) {
+        if (this.#manifest?.[source] !== 'configured')
+            return [];
+        try {
+            return (await pool.query(query)).rows;
+        }
+        catch {
+            throw new PlatformAuthMigrationError('inventory_unavailable');
+        }
+    }
+}
+function legacyHash(value) {
+    return createHash('sha256').update(JSON.stringify(value)).digest('hex');
+}
+//# sourceMappingURL=platform-auth-inventory-legacy-sources-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-legacy-sources-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-inventory-legacy-sources-postgres.js","sourceRoot":"","sources":["../src/platform-auth-inventory-legacy-sources-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EACL,6CAA6C,EAC7C,sCAAsC,EACtC,+BAA+B,GAGhC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAwB1E,2FAA2F;AAC3F,MAAM,OAAO,0CAA0C;IAC5C,YAAY,CAAS;IACrB,SAAS,CAAkD;IAC3D,iBAAiB,CAGtB;IAEJ,YAAY,OAOX;QACC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAC5C,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAA+B;QAK5C,MAAM,OAAO,GAAG,IAAI,GAAG,EAA6C,CAAC;QACrE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAC;QACjD,MAAM,GAAG,GAAG,CAAC,KAOZ,EAAE,EAAE;YACH,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,WAAW,GAAG,QAAQ,EAAE,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC;YAC/D,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE;gBACzB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;gBACxE,aAAa,EAAE,QAAQ,EAAE,aAAa,KAAK,IAAI,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI;gBAC/E,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,KAAK,IAAI,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI;gBACxF,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;gBACrD,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC,YAAY;aAClC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CASrC;;;oDAG8C,EAC9C,CAAC,IAAI,CAAC,YAAY,CAAC,CACpB,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC/B,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC/B,SAAS;YACX,CAAC;YACD,MAAM,aAAa,GAAG,CAAC,CACrB,GAAG,CAAC,WAAW,KAAK,IAAI;gBACxB,GAAG,CAAC,YAAY,KAAK,GAAG,CAAC,WAAW;gBACpC,GAAG,CAAC,uBAAuB,KAAK,6BAA6B;gBAC7D,GAAG,CAAC,eAAe,KAAK,GAAG,CAAC,WAAW,CACxC,CAAC;YACF,GAAG,CAAC;gBACF,OAAO,EAAE,GAAG,CAAC,WAAW;gBACxB,UAAU,EAAE,WAAW;gBACvB,WAAW,EAAE,GAAG,CAAC,YAAY;gBAC7B,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,aAAa;aACd,CAAC,CAAC;YACH,GAAG,CAAC;gBACF,OAAO,EAAE,GAAG,CAAC,WAAW;gBACxB,UAAU,EAAE,aAAa;gBACzB,WAAW,EAAE,GAAG,CAAC,YAAY;gBAC7B,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,aAAa;aACd,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChC,MAAM,YAAY,GAAG;YACnB,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAClB,IAAI,EACJ,sBAAsB,EACtB,4FAA4F,CAC7F,CAAC;YACF,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAClB,IAAI,EACJ,6BAA6B,EAC7B,iIAAiI,CAClI,CAAC;YACF,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAClB,IAAI,EACJ,6BAA6B,EAC7B,iDAAiD,CAClD,CAAC;SACH,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,YAAY;YAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,QAAQ,KAAK,SAAS;gBACxB,GAAG,CAAC;oBACF,OAAO;oBACP,UAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW;oBACtD,gBAAgB,EAAE,IAAI;iBACvB,CAAC,CAAC;QACP,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC9D,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAoC,CAAC;QACzE,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3C,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACpD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,gBAAgB,GAAG;YACvB,mBAAmB,EAAE,6CAA6C,CAAC,MAAM,CACvE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY,CACtD;SACF,CAAC;QACF,OAAO;YACL,OAAO;YACP,aAAa,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YAC9E,mBAAmB,EAAE,UAAU,CAAC;gBAC9B,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBACnE,kBAAkB,EAAE,UAAU,CAAC,OAAO,CAAC;oBACvC,IAAI,EACF,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC;wBACjC,CAAC,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC;4BAClC,CAAC,CAAC,oCAAoC;4BACtC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;gCACtB,CAAC,CAAC,qBAAqB;gCACvB,CAAC,CAAC,uBAAuB,CAAC;iBACjC,CAAC,CAAC;gBACH,gBAAgB;aACjB,CAAC;SACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAA+B;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IACE,QAAQ,KAAK,SAAS;YACtB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,+BAA+B,CAAC,MAAM;YACvE,+BAA+B,CAAC,IAAI,CAClC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,gBAAgB,CACvF;YACD,IAAI,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;gBAChE,IAAI,CAAC,iBAAiB,CAAC,MAAM;YAC/B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,OAAO;gBACtC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,CAC7B;YACD,CAAC,CAAC,QAAQ,CAAC,uBAAuB,KAAK,YAAY;gBACjD,QAAQ,CAAC,wBAAwB,KAAK,YAAY,CAAC;gBACnD,QAAQ,CAAC,gBAAgB,KAAK,YAAY,CAAC;YAE7C,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;QAChE,KAAK,MAAM,MAAM,IAAI,+BAA+B,EAAE,CAAC;YACrD,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,YAAY;gBAAE,SAAS;YAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAC9B;;;;oEAI4D,EAC5D,CAAC,MAAM,CAAC,CACT,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjF,IACE,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBACzB,sCAAsC,CAAC,MAAM,CAAC,CAAC,IAAI,CACjD,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAC5C;gBAED,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAA+B,EAC/B,OAAqD;QAErD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAI3B;;;;2DAIqD,EACrD,CAAC,IAAI,CAAC,YAAY,CAAC,CACpB,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;YAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC9E,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAA+B;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAI3B;uEACiE,EACjE,CAAC,IAAI,CAAC,YAAY,CAAC,CACpB,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YACrE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,SAAS,CACb,IAA+B,EAC/B,GAGU;QAEV,MAAM,KAAK,GACT;YACE,CAAC,aAAa,EAAE,gBAAgB,EAAE,iCAAiC,CAAC;YACpE;gBACE,yBAAyB;gBACzB,gBAAgB;gBAChB,uPAAuP;aACxP;YACD;gBACE,0BAA0B;gBAC1B,gBAAgB;gBAChB,2bAA2b;aAC5b;YACD;gBACE,sBAAsB;gBACtB,gBAAgB;gBAChB,mLAAmL;aACpL;YACD;gBACE,yBAAyB;gBACzB,iBAAiB;gBACjB,qHAAqH;aACtH;YACD;gBACE,gBAAgB;gBAChB,qBAAqB;gBACrB,wNAAwN;aACzN;YACD;gBACE,sBAAsB;gBACtB,eAAe;gBACf,2DAA2D;aAC5D;YACD;gBACE,6BAA6B;gBAC7B,sBAAsB;gBACtB,6MAA6M;aAC9M;YACD;gBACE,sBAAsB;gBACtB,sBAAsB;gBACtB,0CAA0C;aAC3C;SACF,CAAC;QACJ,KAAK,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,KAAK;YAC7C,KAAK,MAAM,GAAG,IAAI,MAAM,IAAI,CAAC,KAAK,CAA+B,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC;gBACnF,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,KAAK,CACT,IAA+B,EAC/B,MAAmC,EACnC,KAAa;QAEb,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY;YAAE,OAAO,EAAE,CAAC;QACzD,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;CACF;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-local-postgres.d.ts

@@ -0,0 +1,29 @@
+import { type InventoryProgressRow } from './platform-auth-inventory-paging.js';
+import type { PlatformAuthInventorySourceManifest } from './platform-auth-inventory-sources.js';
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+type Pool = PlatformIdentityQueryable & {
+    connect?: () => Promise<PlatformIdentityQueryable & {
+        release?: () => void;
+    }>;
+};
+export declare class PostgresPlatformAuthInventoryLocalFreezer {
+    #private;
+    constructor(pool: Pool, options: {
+        readonly googleRealm: string;
+        readonly workosRealmFingerprint: string;
+        readonly sourceAvailability?: PlatformAuthInventorySourceManifest;
+        readonly excludedSubjects: readonly {
+            readonly subject: string;
+            readonly kind: 'workload' | 'synthetic';
+        }[];
+    });
+    advance(input: {
+        readonly runId: string;
+        readonly leaseToken: string;
+    }): Promise<{
+        readonly progress: InventoryProgressRow;
+        readonly checksum: string | null;
+    }>;
+}
+export {};
+//# sourceMappingURL=platform-auth-inventory-local-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-local-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-inventory-local-postgres.d.ts","sourceRoot":"","sources":["../src/platform-auth-inventory-local-postgres.ts"],"names":[],"mappings":"AAOA,OAAO,EAEL,KAAK,oBAAoB,EAK1B,MAAM,qCAAqC,CAAC;AAU7C,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAIhG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,KAAK,IAAI,GAAG,yBAAyB,GAAG;IACtC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,yBAAyB,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC,CAAC;CAC/E,CAAC;AACF,qBAAa,yCAAyC;;gBAQlD,IAAI,EAAE,IAAI,EACV,OAAO,EAAE;QACP,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;QACxC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,mCAAmC,CAAC;QAClE,QAAQ,CAAC,gBAAgB,EAAE,SAAS;YAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;YACzB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAAC;SACzC,EAAE,CAAC;KACL;IAeG,OAAO,CAAC,KAAK,EAAE;QACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAua3F"}

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-local-postgres.js

@@ -0,0 +1,350 @@
+import { PostgresPlatformAuthInventoryLocalSubjects, } from './platform-auth-inventory-local-subjects-postgres.js';
+import { blockerCounts, inventoryChain, inventoryHash, inventoryHasLocalWork, PLATFORM_AUTH_INVENTORY_LOCAL_BATCH_SIZE, } from './platform-auth-inventory-paging.js';
+import { lockPlatformAuthInventoryLocalProgress, markPlatformAuthInventoryTerminal, PROGRESS_COLUMNS, } from './platform-auth-inventory-progress-postgres.js';
+import { readPlatformAuthInventorySourceEpoch, runPlatformAuthInventorySourceFenceTransaction, } from './platform-auth-inventory-source-fence-postgres.js';
+import { PLATFORM_AUTH_INVENTORY_NON_AUTHORITY_SOURCES } from './platform-auth-inventory-sources.js';
+import { PlatformAuthMigrationError } from './platform-auth-migration.js';
+export class PostgresPlatformAuthInventoryLocalFreezer {
+    #pool;
+    #googleRealm;
+    #workosRealmFingerprint;
+    #sourceManifest;
+    #subjects;
+    constructor(pool, options) {
+        this.#pool = pool;
+        this.#googleRealm = options.googleRealm;
+        this.#workosRealmFingerprint = options.workosRealmFingerprint;
+        this.#sourceManifest = options.sourceAvailability;
+        this.#subjects = new PostgresPlatformAuthInventoryLocalSubjects({
+            googleRealm: this.#googleRealm,
+            ...(options.sourceAvailability === undefined
+                ? {}
+                : { sourceAvailability: options.sourceAvailability }),
+            excludedSubjects: options.excludedSubjects,
+        });
+    }
+    async advance(input) {
+        const outcome = await runPlatformAuthInventorySourceFenceTransaction(this.#pool, async (connection) => {
+            let progress = await lockPlatformAuthInventoryLocalProgress(connection, input.runId, input.leaseToken);
+            await this.#subjects.assertManifest(connection);
+            const sourceEpoch = await readPlatformAuthInventorySourceEpoch(connection);
+            if (progress.local_source_epoch === null) {
+                if (inventoryHasLocalWork(progress)) {
+                    return {
+                        terminal: true,
+                        progress: await markPlatformAuthInventoryTerminal(connection, input.runId, input.leaseToken),
+                        checksum: null,
+                    };
+                }
+                const captured = await connection.query(`UPDATE platform_auth_inventory_progress
+              SET local_source_epoch = $3, local_snapshot_at = transaction_timestamp(),
+                  updated_at = now()
+            WHERE migration_run_id = $1 AND lease_token_hash = $2
+          RETURNING ${PROGRESS_COLUMNS}`, [input.runId, inventoryHash(input.leaseToken), sourceEpoch]);
+                const row = captured.rows[0];
+                if (row === undefined)
+                    throw new Error('stale_inventory_lease');
+                progress = row;
+            }
+            else if (progress.local_source_epoch !== sourceEpoch) {
+                return {
+                    terminal: true,
+                    progress: await markPlatformAuthInventoryTerminal(connection, input.runId, input.leaseToken),
+                    checksum: null,
+                };
+            }
+            if (progress.local_snapshot_at === null)
+                throw new PlatformAuthMigrationError('inventory_unavailable');
+            const batch = await this.#subjects.nextBatch(connection, progress.local_after_subject ?? undefined, PLATFORM_AUTH_INVENTORY_LOCAL_BATCH_SIZE, progress.local_snapshot_at);
+            const { candidates, exclusions } = await this.#freezeBatch(connection, input.runId, batch);
+            await this.#insertCandidates(connection, input.runId, candidates);
+            await this.#insertExclusions(connection, input.runId, exclusions);
+            let candidateChain = progress.candidate_chain_hash;
+            for (const candidate of candidates)
+                candidateChain = inventoryChain(candidateChain, candidate.chainEntry);
+            let excludedChain = progress.excluded_chain_hash;
+            for (const exclusion of exclusions)
+                excludedChain = inventoryChain(excludedChain, exclusion.chainEntry);
+            const counts = blockerCounts(progress.blocker_counts);
+            for (const candidate of candidates)
+                for (const code of candidate.blockerCodes)
+                    counts[code] = (counts[code] ?? 0) + 1;
+            const localSubjectCount = progress.local_subject_count + batch.subjects.length;
+            const candidateCount = progress.candidate_count + candidates.length;
+            const excludedCount = progress.excluded_count + exclusions.length;
+            if ((await readPlatformAuthInventorySourceEpoch(connection)) !== progress.local_source_epoch) {
+                return {
+                    terminal: true,
+                    progress: await markPlatformAuthInventoryTerminal(connection, input.runId, input.leaseToken),
+                    checksum: null,
+                };
+            }
+            if (batch.hasMore) {
+                const updated = await connection.query(`UPDATE platform_auth_inventory_progress
+              SET local_after_subject = $3, local_subject_count = $4,
+                  candidate_count = $5, excluded_count = $6,
+                  candidate_chain_hash = $7, excluded_chain_hash = $8,
+                  blocker_counts = $9::jsonb, lease_token_hash = NULL,
+                  lease_expires_at = NULL, updated_at = now()
+            WHERE migration_run_id = $1 AND lease_token_hash = $2
+          RETURNING ${PROGRESS_COLUMNS}`, [
+                    input.runId,
+                    inventoryHash(input.leaseToken),
+                    batch.subjects.at(-1)?.subject ?? progress.local_after_subject,
+                    localSubjectCount,
+                    candidateCount,
+                    excludedCount,
+                    candidateChain,
+                    excludedChain,
+                    JSON.stringify(counts),
+                ]);
+                const row = updated.rows[0];
+                if (row === undefined)
+                    throw new Error('stale_inventory_lease');
+                return { terminal: false, progress: row, checksum: null };
+            }
+            const artifactEvidence = {
+                nonAuthoritySources: PLATFORM_AUTH_INVENTORY_NON_AUTHORITY_SOURCES.filter((source) => this.#sourceManifest?.[source] === 'configured'),
+            };
+            const safe = { candidateCount, excludedCount, blockers: counts };
+            const excludedFingerprint = inventoryHash({
+                excludedChain,
+                artifactEvidence,
+                workosSnapshot: progress.remote_chain_hash,
+            });
+            const checksum = inventoryHash({
+                algorithm: 'inventory-v2',
+                googleRealm: this.#googleRealm,
+                workosRealm: this.#workosRealmFingerprint,
+                safe,
+                excludedFingerprint,
+                candidateChain,
+            });
+            const completed = await connection.query(`UPDATE identity_migration_runs
+            SET frozen_checksum = $3, source_fingerprint = $4,
+                excluded_fingerprint = $5, google_realm = $6,
+                inventory_format = 'v2', safe_result = $7::jsonb,
+                state = 'completed', completed_at = now()
+          WHERE id = $1 AND kind = 'inventory' AND state = 'running'
+            AND workos_realm_fingerprint = $2
+        RETURNING id`, [
+                input.runId,
+                this.#workosRealmFingerprint,
+                checksum,
+                candidateChain,
+                excludedFingerprint,
+                this.#googleRealm,
+                JSON.stringify(safe),
+            ]);
+            if (completed.rows[0] === undefined)
+                throw new PlatformAuthMigrationError('inventory_unavailable');
+            const updated = await connection.query(`UPDATE platform_auth_inventory_progress
+            SET phase = 'completed', local_after_subject = $3,
+                local_subject_count = $4, candidate_count = $5, excluded_count = $6,
+                candidate_chain_hash = $7, excluded_chain_hash = $8,
+                artifact_counts = $9::jsonb, blocker_counts = $10::jsonb,
+                lease_token_hash = NULL, lease_expires_at = NULL, updated_at = now()
+          WHERE migration_run_id = $1 AND lease_token_hash = $2
+        RETURNING ${PROGRESS_COLUMNS}`, [
+                input.runId,
+                inventoryHash(input.leaseToken),
+                batch.subjects.at(-1)?.subject ?? progress.local_after_subject,
+                localSubjectCount,
+                candidateCount,
+                excludedCount,
+                candidateChain,
+                excludedChain,
+                JSON.stringify(artifactEvidence),
+                JSON.stringify(counts),
+            ]);
+            const row = updated.rows[0];
+            if (row === undefined)
+                throw new Error('stale_inventory_lease');
+            return { terminal: false, progress: row, checksum };
+        });
+        if (outcome.terminal)
+            throw new PlatformAuthMigrationError('inventory_unavailable');
+        return { progress: outcome.progress, checksum: outcome.checksum };
+    }
+    async #freezeBatch(pool, runId, batch) {
+        const candidates = batch.subjects.filter((subject) => subject.provenance.size > 0 &&
+            (subject.exclusionKind === undefined || subject.exclusionKind === 'non_platform_identity'));
+        const emails = await this.#verifiedEmails(pool, candidates.map((subject) => subject.subject));
+        const ownerCounts = await this.#emailOwnerCounts(pool, [...emails.values()]
+            .filter((email) => email.count === 1 && email.normalizedEmail !== null)
+            .map((email) => email.normalizedEmail));
+        const conflictSubjects = await this.#remoteConflicts(pool, runId, candidates.flatMap((subject) => {
+            const email = emails.get(subject.subject);
+            return email?.count === 1 && email.normalizedEmail !== null
+                ? [{ subject: subject.subject, email: email.normalizedEmail }]
+                : [];
+        }));
+        const frozenCandidates = candidates.map((source) => {
+            const emailEvidence = emails.get(source.subject) ?? { count: 0, normalizedEmail: null };
+            const codes = [];
+            if (source.identityDrift || source.excludedEvidence)
+                codes.push('ambiguous_platform_customer_evidence');
+            if (emailEvidence.count === 0)
+                codes.push('missing_verified_email');
+            if (emailEvidence.count > 1)
+                codes.push('multiple_current_verified_emails');
+            if (source.subject.length > 64)
+                codes.push('external_id_too_long');
+            if (emailEvidence.normalizedEmail !== null &&
+                (ownerCounts.get(emailEvidence.normalizedEmail) ?? 0) > 1)
+                codes.push('shared_verified_email');
+            if (conflictSubjects.has(source.subject))
+                codes.push('conflicting_workos_user');
+            const provenance = [...source.provenance].sort();
+            const sourceRealm = source.realm ?? this.#googleRealm;
+            const sourceFingerprint = inventoryHash({
+                subject: source.subject,
+                realm: sourceRealm,
+                provenance,
+            });
+            const normalizedEmail = emailEvidence.count === 1 ? emailEvidence.normalizedEmail : null;
+            const emailFingerprint = normalizedEmail === null ? null : inventoryHash(normalizedEmail);
+            const candidateFingerprint = inventoryHash({
+                sourceFingerprint,
+                principalFingerprint: source.principalId === undefined ? undefined : inventoryHash(source.principalId),
+                emailFingerprint: emailFingerprint ?? undefined,
+                provenance,
+                blockerCodes: codes,
+            });
+            const chainEntry = {
+                sourceFingerprint,
+                emailFingerprint: emailFingerprint ?? undefined,
+                provenance,
+                blockerCodes: codes,
+                candidateFingerprint,
+            };
+            return {
+                sourceSubject: source.subject,
+                sourceRealm,
+                principalId: source.principalId ?? null,
+                normalizedEmail,
+                emailFingerprint,
+                provenance,
+                blockerCodes: codes,
+                sourceFingerprint,
+                candidateFingerprint,
+                chainEntry,
+            };
+        });
+        const exclusions = batch.subjects
+            .filter((subject) => subject.exclusionKind !== undefined &&
+            (subject.exclusionKind !== 'non_platform_identity' || subject.provenance.size === 0))
+            .map((subject) => {
+            const kind = subject.exclusionKind;
+            const subjectFingerprint = inventoryHash(subject.subject);
+            const chainEntry = { subjectFingerprint, kind };
+            return {
+                subjectFingerprint,
+                kind,
+                entryFingerprint: inventoryHash(chainEntry),
+                chainEntry,
+            };
+        });
+        return { candidates: frozenCandidates, exclusions };
+    }
+    async #verifiedEmails(pool, subjects) {
+        if (subjects.length === 0)
+            return new Map();
+        const rows = await pool.query(`SELECT link.external_id AS subject, count(DISTINCT email.normalized_email)::text AS count,
+              min(email.normalized_email) AS normalized_email
+         FROM platform_identity_links link
+         LEFT JOIN platform_verified_emails email
+           ON email.principal_id = link.principal_id AND email.provider = 'google'
+          AND email.realm = link.realm AND email.status = 'active'
+        WHERE link.provider = 'google' AND link.realm = $1
+          AND link.disabled_at IS NULL AND link.external_id = ANY($2::text[])
+        GROUP BY link.external_id`, [this.#googleRealm, subjects]);
+        return new Map(rows.rows.map((row) => [
+            row.subject,
+            { count: Number(row.count), normalizedEmail: row.normalized_email },
+        ]));
+    }
+    async #emailOwnerCounts(pool, emails) {
+        if (emails.length === 0)
+            return new Map();
+        const rows = await pool.query(`SELECT normalized_email, count(DISTINCT principal_id)::text AS count
+         FROM platform_verified_emails
+        WHERE provider = 'google' AND realm = $1 AND status = 'active'
+          AND normalized_email = ANY($2::text[])
+        GROUP BY normalized_email`, [this.#googleRealm, emails]);
+        return new Map(rows.rows.map((row) => [row.normalized_email, Number(row.count)]));
+    }
+    async #remoteConflicts(pool, runId, candidates) {
+        if (candidates.length === 0)
+            return new Set();
+        const rows = await pool.query(`WITH candidate(subject, email) AS (
+         SELECT * FROM unnest($2::text[], $3::text[])
+       )
+       SELECT candidate.subject FROM candidate
+        WHERE (SELECT count(*) FROM platform_auth_inventory_remote_users remote
+                WHERE remote.migration_run_id = $1
+                  AND remote.normalized_email = candidate.email) > 1
+           OR EXISTS (
+                SELECT 1 FROM platform_auth_inventory_remote_users remote
+                 WHERE remote.migration_run_id = $1
+                   AND remote.normalized_email = candidate.email
+                   AND (NOT remote.verified OR remote.external_id IS DISTINCT FROM candidate.subject)
+              )
+           OR EXISTS (
+                SELECT 1 FROM platform_auth_inventory_remote_users remote
+                 WHERE remote.migration_run_id = $1 AND remote.external_id = candidate.subject
+                   AND (NOT remote.verified OR remote.normalized_email <> candidate.email)
+              )`, [
+            runId,
+            candidates.map((candidate) => candidate.subject),
+            candidates.map((candidate) => candidate.email),
+        ]);
+        return new Set(rows.rows.map((row) => row.subject));
+    }
+    async #insertCandidates(pool, runId, candidates) {
+        if (candidates.length === 0)
+            return;
+        await pool.query(`INSERT INTO platform_auth_inventory_candidates
+         (migration_run_id, source_subject, source_realm, principal_id, normalized_email,
+          email_fingerprint, provenance, blocker_codes, source_fingerprint, candidate_fingerprint)
+       SELECT $1, candidate.source_subject, candidate.source_realm, candidate.principal_id,
+              candidate.normalized_email, candidate.email_fingerprint,
+              ARRAY(SELECT jsonb_array_elements_text(candidate.provenance)),
+              ARRAY(SELECT jsonb_array_elements_text(candidate.blocker_codes)),
+              candidate.source_fingerprint, candidate.candidate_fingerprint
+         FROM jsonb_to_recordset($2::jsonb) AS candidate(
+           source_subject text, source_realm text, principal_id text, normalized_email text,
+           email_fingerprint text, provenance jsonb, blocker_codes jsonb,
+           source_fingerprint text, candidate_fingerprint text)`, [
+            runId,
+            JSON.stringify(candidates.map((candidate) => ({
+                source_subject: candidate.sourceSubject,
+                source_realm: candidate.sourceRealm,
+                principal_id: candidate.principalId,
+                normalized_email: candidate.normalizedEmail,
+                email_fingerprint: candidate.emailFingerprint,
+                provenance: candidate.provenance,
+                blocker_codes: candidate.blockerCodes,
+                source_fingerprint: candidate.sourceFingerprint,
+                candidate_fingerprint: candidate.candidateFingerprint,
+            }))),
+        ]);
+    }
+    async #insertExclusions(pool, runId, exclusions) {
+        if (exclusions.length === 0)
+            return;
+        await pool.query(`INSERT INTO platform_auth_inventory_exclusions
+         (migration_run_id, subject_fingerprint, exclusion_kind, entry_fingerprint)
+       SELECT $1, subject_fingerprint, exclusion_kind, entry_fingerprint
+         FROM jsonb_to_recordset($2::jsonb)
+           AS exclusion(subject_fingerprint text, exclusion_kind text, entry_fingerprint text)`, [
+            runId,
+            JSON.stringify(exclusions.map((exclusion) => ({
+                subject_fingerprint: exclusion.subjectFingerprint,
+                exclusion_kind: exclusion.kind,
+                entry_fingerprint: exclusion.entryFingerprint,
+            }))),
+        ]);
+    }
+}
+//# sourceMappingURL=platform-auth-inventory-local-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-local-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-inventory-local-postgres.js","sourceRoot":"","sources":["../src/platform-auth-inventory-local-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,0CAA0C,GAE3C,MAAM,sDAAsD,CAAC;AAC9D,OAAO,EACL,aAAa,EAEb,cAAc,EACd,aAAa,EACb,qBAAqB,EACrB,wCAAwC,GACzC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,sCAAsC,EACtC,iCAAiC,EACjC,gBAAgB,GACjB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,oCAAoC,EACpC,8CAA8C,GAC/C,MAAM,oDAAoD,CAAC;AAE5D,OAAO,EAAE,6CAA6C,EAAE,MAAM,sCAAsC,CAAC;AAErG,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAM1E,MAAM,OAAO,yCAAyC;IAC3C,KAAK,CAAO;IACZ,YAAY,CAAS;IACrB,uBAAuB,CAAS;IAChC,eAAe,CAAkD;IACjE,SAAS,CAA6C;IAE/D,YACE,IAAU,EACV,OAQC;QAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;QAC9D,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,IAAI,0CAA0C,CAAC;YAC9D,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACvD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAGb;QACC,MAAM,OAAO,GAAG,MAAM,8CAA8C,CAClE,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,UAAU,EAAE,EAAE;YACnB,IAAI,QAAQ,GAAG,MAAM,sCAAsC,CACzD,UAAU,EACV,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,UAAU,CACjB,CAAC;YACF,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;YAChD,MAAM,WAAW,GAAG,MAAM,oCAAoC,CAAC,UAAU,CAAC,CAAC;YAC3E,IAAI,QAAQ,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;gBACzC,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACpC,OAAO;wBACL,QAAQ,EAAE,IAAa;wBACvB,QAAQ,EAAE,MAAM,iCAAiC,CAC/C,UAAU,EACV,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,UAAU,CACjB;wBACD,QAAQ,EAAE,IAAI;qBACf,CAAC;gBACJ,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CACrC;;;;sBAIU,gBAAgB,EAAE,EAC5B,CAAC,KAAK,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,CAC5D,CAAC;gBACF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC7B,IAAI,GAAG,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBAChE,QAAQ,GAAG,GAAG,CAAC;YACjB,CAAC;iBAAM,IAAI,QAAQ,CAAC,kBAAkB,KAAK,WAAW,EAAE,CAAC;gBACvD,OAAO;oBACL,QAAQ,EAAE,IAAa;oBACvB,QAAQ,EAAE,MAAM,iCAAiC,CAC/C,UAAU,EACV,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,UAAU,CACjB;oBACD,QAAQ,EAAE,IAAI;iBACf,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,iBAAiB,KAAK,IAAI;gBACrC,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;YAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAC1C,UAAU,EACV,QAAQ,CAAC,mBAAmB,IAAI,SAAS,EACzC,wCAAwC,EACxC,QAAQ,CAAC,iBAAiB,CAC3B,CAAC;YACF,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC3F,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAClE,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAClE,IAAI,cAAc,GAAG,QAAQ,CAAC,oBAAoB,CAAC;YACnD,KAAK,MAAM,SAAS,IAAI,UAAU;gBAChC,cAAc,GAAG,cAAc,CAAC,cAAc,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;YACxE,IAAI,aAAa,GAAG,QAAQ,CAAC,mBAAmB,CAAC;YACjD,KAAK,MAAM,SAAS,IAAI,UAAU;gBAChC,aAAa,GAAG,cAAc,CAAC,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;YACtE,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YACtD,KAAK,MAAM,SAAS,IAAI,UAAU;gBAChC,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,YAAY;oBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACpF,MAAM,iBAAiB,GAAG,QAAQ,CAAC,mBAAmB,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC/E,MAAM,cAAc,GAAG,QAAQ,CAAC,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC;YACpE,MAAM,aAAa,GAAG,QAAQ,CAAC,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC;YAClE,IACE,CAAC,MAAM,oCAAoC,CAAC,UAAU,CAAC,CAAC,KAAK,QAAQ,CAAC,kBAAkB,EACxF,CAAC;gBACD,OAAO;oBACL,QAAQ,EAAE,IAAa;oBACvB,QAAQ,EAAE,MAAM,iCAAiC,CAC/C,UAAU,EACV,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,UAAU,CACjB;oBACD,QAAQ,EAAE,IAAI;iBACf,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CACpC;;;;;;;sBAOU,gBAAgB,EAAE,EAC5B;oBACE,KAAK,CAAC,KAAK;oBACX,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;oBAC/B,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,QAAQ,CAAC,mBAAmB;oBAC9D,iBAAiB;oBACjB,cAAc;oBACd,aAAa;oBACb,cAAc;oBACd,aAAa;oBACb,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;iBACvB,CACF,CAAC;gBACF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC5B,IAAI,GAAG,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBAChE,OAAO,EAAE,QAAQ,EAAE,KAAc,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACrE,CAAC;YACD,MAAM,gBAAgB,GAAG;gBACvB,mBAAmB,EAAE,6CAA6C,CAAC,MAAM,CACvE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY,CAC5D;aACF,CAAC;YACF,MAAM,IAAI,GAAG,EAAE,cAAc,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YACjE,MAAM,mBAAmB,GAAG,aAAa,CAAC;gBACxC,aAAa;gBACb,gBAAgB;gBAChB,cAAc,EAAE,QAAQ,CAAC,iBAAiB;aAC3C,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,aAAa,CAAC;gBAC7B,SAAS,EAAE,cAAc;gBACzB,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,WAAW,EAAE,IAAI,CAAC,uBAAuB;gBACzC,IAAI;gBACJ,mBAAmB;gBACnB,cAAc;aACf,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,KAAK,CACtC;;;;;;;qBAOW,EACX;gBACE,KAAK,CAAC,KAAK;gBACX,IAAI,CAAC,uBAAuB;gBAC5B,QAAQ;gBACR,cAAc;gBACd,mBAAmB;gBACnB,IAAI,CAAC,YAAY;gBACjB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aACrB,CACF,CAAC;YACF,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;gBACjC,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;YAChE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CACpC;;;;;;;oBAOU,gBAAgB,EAAE,EAC5B;gBACE,KAAK,CAAC,KAAK;gBACX,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;gBAC/B,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,QAAQ,CAAC,mBAAmB;gBAC9D,iBAAiB;gBACjB,cAAc;gBACd,aAAa;gBACb,cAAc;gBACd,aAAa;gBACb,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC;gBAChC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;aACvB,CACF,CAAC;YACF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,GAAG,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAChE,OAAO,EAAE,QAAQ,EAAE,KAAc,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QAC/D,CAAC,CACF,CAAC;QACF,IAAI,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;QACpF,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,IAA+B,EAC/B,KAAa,EACb,KAAwD;QAKxD,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CACtC,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC;YAC3B,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,aAAa,KAAK,uBAAuB,CAAC,CAC7F,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CACvC,IAAI,EACJ,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAC7C,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAC9C,IAAI,EACJ,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;aACjB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC;aACtE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAyB,CAAC,CACnD,CAAC;QACF,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAClD,IAAI,EACJ,KAAK,EACL,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1C,OAAO,KAAK,EAAE,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI;gBACzD,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;gBAC9D,CAAC,CAAC,EAAE,CAAC;QACT,CAAC,CAAC,CACH,CAAC;QACF,MAAM,gBAAgB,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAmB,EAAE;YAClE,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;YACxF,MAAM,KAAK,GAA8B,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,gBAAgB;gBACjD,KAAK,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACrD,IAAI,aAAa,CAAC,KAAK,KAAK,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACpE,IAAI,aAAa,CAAC,KAAK,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;YAC5E,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACnE,IACE,aAAa,CAAC,eAAe,KAAK,IAAI;gBACtC,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;gBAEzD,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACtC,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YAChF,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;YACjD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC;YACtD,MAAM,iBAAiB,GAAG,aAAa,CAAC;gBACtC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK,EAAE,WAAW;gBAClB,UAAU;aACX,CAAC,CAAC;YACH,MAAM,eAAe,GAAG,aAAa,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;YACzF,MAAM,gBAAgB,GAAG,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;YAC1F,MAAM,oBAAoB,GAAG,aAAa,CAAC;gBACzC,iBAAiB;gBACjB,oBAAoB,EAClB,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC;gBAClF,gBAAgB,EAAE,gBAAgB,IAAI,SAAS;gBAC/C,UAAU;gBACV,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;YACH,MAAM,UAAU,GAAG;gBACjB,iBAAiB;gBACjB,gBAAgB,EAAE,gBAAgB,IAAI,SAAS;gBAC/C,UAAU;gBACV,YAAY,EAAE,KAAK;gBACnB,oBAAoB;aACrB,CAAC;YACF,OAAO;gBACL,aAAa,EAAE,MAAM,CAAC,OAAO;gBAC7B,WAAW;gBACX,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;gBACvC,eAAe;gBACf,gBAAgB;gBAChB,UAAU;gBACV,YAAY,EAAE,KAAK;gBACnB,iBAAiB;gBACjB,oBAAoB;gBACpB,UAAU;aACX,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ;aAC9B,MAAM,CACL,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,aAAa,KAAK,SAAS;YACnC,CAAC,OAAO,CAAC,aAAa,KAAK,uBAAuB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC,CACvF;aACA,GAAG,CAAC,CAAC,OAAO,EAAmB,EAAE;YAChC,MAAM,IAAI,GAAG,OAAO,CAAC,aAA8B,CAAC;YACpD,MAAM,kBAAkB,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1D,MAAM,UAAU,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;YAChD,OAAO;gBACL,kBAAkB;gBAClB,IAAI;gBACJ,gBAAgB,EAAE,aAAa,CAAC,UAAU,CAAC;gBAC3C,UAAU;aACX,CAAC;QACJ,CAAC,CAAC,CAAC;QACL,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,IAA+B,EAC/B,QAA2B;QAE3B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAK3B;;;;;;;;kCAQ4B,EAC5B,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAC9B,CAAC;QACF,OAAO,IAAI,GAAG,CACZ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;YACrB,GAAG,CAAC,OAAO;YACX,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,gBAAgB,EAAE;SACpE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,IAA+B,EAC/B,MAAyB;QAEzB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAC3B;;;;kCAI4B,EAC5B,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAC5B,CAAC;QACF,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,IAA+B,EAC/B,KAAa,EACb,UAA2E;QAE3E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAC3B;;;;;;;;;;;;;;;;;gBAiBU,EACV;YACE,KAAK;YACL,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC;YAChD,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC;SAC/C,CACF,CAAC;QACF,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,IAA+B,EAC/B,KAAa,EACb,UAAsC;QAEtC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACpC,MAAM,IAAI,CAAC,KAAK,CACd;;;;;;;;;;;gEAW0D,EAC1D;YACE,KAAK;YACL,IAAI,CAAC,SAAS,CACZ,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC7B,cAAc,EAAE,SAAS,CAAC,aAAa;gBACvC,YAAY,EAAE,SAAS,CAAC,WAAW;gBACnC,YAAY,EAAE,SAAS,CAAC,WAAW;gBACnC,gBAAgB,EAAE,SAAS,CAAC,eAAe;gBAC3C,iBAAiB,EAAE,SAAS,CAAC,gBAAgB;gBAC7C,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,aAAa,EAAE,SAAS,CAAC,YAAY;gBACrC,kBAAkB,EAAE,SAAS,CAAC,iBAAiB;gBAC/C,qBAAqB,EAAE,SAAS,CAAC,oBAAoB;aACtD,CAAC,CAAC,CACJ;SACF,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,IAA+B,EAC/B,KAAa,EACb,UAAsC;QAEtC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACpC,MAAM,IAAI,CAAC,KAAK,CACd;;;;+FAIyF,EACzF;YACE,KAAK;YACL,IAAI,CAAC,SAAS,CACZ,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC7B,mBAAmB,EAAE,SAAS,CAAC,kBAAkB;gBACjD,cAAc,EAAE,SAAS,CAAC,IAAI;gBAC9B,iBAAiB,EAAE,SAAS,CAAC,gBAAgB;aAC9C,CAAC,CAAC,CACJ;SACF,CACF,CAAC;IACJ,CAAC;CACF"}