@noodleseed/one 0.63.0 → 0.64.0

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-local-subjects-postgres.d.ts

@@ -0,0 +1,50 @@
+import { type PlatformAuthInventorySourceManifest } from './platform-auth-inventory-sources.js';
+import { type PlatformAuthBlockerCode } from './platform-auth-migration.js';
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+export type InventoryLocalProvenance = 'principal' | 'google_link' | 'google_billing' | 'org_membership' | 'refresh_family' | 'developer_grant' | 'owner_only_deployer' | 'consent_grant' | 'device_authorization' | 'welcome_provisioning';
+export type InventoryLocalExclusionKind = 'non_platform_identity' | 'suspended_principal' | 'suspended_principal_with_authority' | 'workload' | 'synthetic';
+export interface InventoryLocalSubjectEvidence {
+    readonly subject: string;
+    readonly provenance: Set<InventoryLocalProvenance>;
+    principalId?: string;
+    realm?: string;
+    identityDrift: boolean;
+    excludedEvidence: boolean;
+    exclusionKind?: InventoryLocalExclusionKind;
+}
+export interface InventoryFrozenCandidate {
+    readonly sourceSubject: string;
+    readonly sourceRealm: string;
+    readonly principalId: string | null;
+    readonly normalizedEmail: string | null;
+    readonly emailFingerprint: string | null;
+    readonly provenance: readonly InventoryLocalProvenance[];
+    readonly blockerCodes: readonly PlatformAuthBlockerCode[];
+    readonly sourceFingerprint: string;
+    readonly candidateFingerprint: string;
+    readonly chainEntry: object;
+}
+export interface InventoryFrozenExclusion {
+    readonly subjectFingerprint: string;
+    readonly kind: InventoryLocalExclusionKind;
+    readonly entryFingerprint: string;
+    readonly chainEntry: object;
+}
+/** Keyset-pages the union of platform authority roots and explicit non-human/customer exclusions. */
+export declare class PostgresPlatformAuthInventoryLocalSubjects {
+    #private;
+    constructor(options: {
+        readonly googleRealm: string;
+        readonly sourceAvailability?: PlatformAuthInventorySourceManifest;
+        readonly excludedSubjects: readonly {
+            readonly subject: string;
+            readonly kind: 'workload' | 'synthetic';
+        }[];
+    });
+    nextBatch(pool: PlatformIdentityQueryable, after: string | undefined, limit: number, snapshotAt: Date | string): Promise<{
+        readonly subjects: readonly InventoryLocalSubjectEvidence[];
+        readonly hasMore: boolean;
+    }>;
+    assertManifest(pool: PlatformIdentityQueryable): Promise<void>;
+}
+//# sourceMappingURL=platform-auth-inventory-local-subjects-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-local-subjects-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-inventory-local-subjects-postgres.d.ts","sourceRoot":"","sources":["../src/platform-auth-inventory-local-subjects-postgres.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,mCAAmC,EACzC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,MAAM,MAAM,wBAAwB,GAChC,WAAW,GACX,aAAa,GACb,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,qBAAqB,GACrB,eAAe,GACf,sBAAsB,GACtB,sBAAsB,CAAC;AAC3B,MAAM,MAAM,2BAA2B,GACnC,uBAAuB,GACvB,qBAAqB,GACrB,oCAAoC,GACpC,UAAU,GACV,WAAW,CAAC;AAChB,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,2BAA2B,CAAC;CAC7C;AACD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,SAAS,wBAAwB,EAAE,CAAC;IACzD,QAAQ,CAAC,YAAY,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAC1D,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AACD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,qGAAqG;AACrG,qBAAa,0CAA0C;;gBAQzC,OAAO,EAAE;QACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,mCAAmC,CAAC;QAClE,QAAQ,CAAC,gBAAgB,EAAE,SAAS;YAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;YACzB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAAC;SACzC,EAAE,CAAC;KACL;IAMK,SAAS,CACb,IAAI,EAAE,yBAAyB,EAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,IAAI,GAAG,MAAM,GACxB,OAAO,CAAC;QACT,QAAQ,CAAC,QAAQ,EAAE,SAAS,6BAA6B,EAAE,CAAC;QAC5D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;KAC3B,CAAC;IAwFI,cAAc,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;CA6LrE"}

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-local-subjects-postgres.js

@@ -0,0 +1,239 @@
+import { assertPlatformAuthInventorySourceFence } from './platform-auth-inventory-source-fence-postgres.js';
+import { PLATFORM_AUTH_INVENTORY_SOURCE_COLUMNS, } from './platform-auth-inventory-sources.js';
+import { PlatformAuthMigrationError, } from './platform-auth-migration.js';
+/** Keyset-pages the union of platform authority roots and explicit non-human/customer exclusions. */
+export class PostgresPlatformAuthInventoryLocalSubjects {
+    #googleRealm;
+    #manifest;
+    #excludedSubjects;
+    constructor(options) {
+        this.#googleRealm = options.googleRealm;
+        this.#manifest = options.sourceAvailability;
+        this.#excludedSubjects = options.excludedSubjects;
+    }
+    async nextBatch(pool, after, limit, snapshotAt) {
+        const evidence = new Map();
+        const add = (input) => {
+            if (input.subject.length === 0)
+                return;
+            const prior = evidence.get(input.subject) ?? {
+                subject: input.subject,
+                provenance: new Set(),
+                identityDrift: false,
+                excludedEvidence: false,
+            };
+            if (input.provenance !== undefined)
+                prior.provenance.add(input.provenance);
+            if (prior.principalId === undefined && input.principalId !== undefined)
+                prior.principalId = input.principalId;
+            if (prior.realm === undefined && input.realm !== undefined)
+                prior.realm = input.realm;
+            prior.identityDrift ||= input.identityDrift === true;
+            prior.excludedEvidence ||= input.excludedEvidence === true;
+            const exclusionKind = strongerExclusion(prior.exclusionKind, input.exclusionKind);
+            if (exclusionKind !== undefined)
+                prior.exclusionKind = exclusionKind;
+            evidence.set(input.subject, prior);
+        };
+        const pageSize = limit + 1;
+        const principals = await pool.query(`SELECT link.external_id COLLATE "C" AS subject, link.principal_id, link.realm,
+              principal.status,
+              (link.disabled_at IS NULL AND link.principal_id = link.external_id
+               AND principal.billing_identity_issuer = 'https://accounts.google.com'
+               AND principal.billing_subject = link.external_id) AS canonical
+         FROM platform_identity_links link
+         JOIN platform_principals principal ON principal.principal_id = link.principal_id
+        WHERE link.provider = 'google' AND link.realm = $1
+          AND link.external_id COLLATE "C" > $2 COLLATE "C"
+        ORDER BY subject LIMIT $3`, [this.#googleRealm, after ?? '', pageSize]);
+        for (const row of principals.rows) {
+            if (row.status === 'suspended') {
+                add({ subject: row.subject, exclusionKind: 'suspended_principal' });
+                continue;
+            }
+            add({
+                subject: row.subject,
+                provenance: 'principal',
+                principalId: row.principal_id,
+                realm: row.realm,
+                identityDrift: !row.canonical,
+            });
+            add({
+                subject: row.subject,
+                provenance: 'google_link',
+                principalId: row.principal_id,
+                realm: row.realm,
+                identityDrift: !row.canonical,
+            });
+        }
+        await this.#addConfiguredRoots(pool, after, pageSize, snapshotAt, add);
+        await this.#addExcludedIdentities(pool, after, pageSize, snapshotAt, add);
+        await this.#addConfiguredExclusions(pool, after, pageSize, add);
+        const order = await pool.query(`SELECT value AS subject FROM unnest($1::text[]) AS value
+        ORDER BY value COLLATE "C"`, [[...evidence.keys()]]);
+        const ordered = order.rows.flatMap((row) => {
+            const entry = evidence.get(row.subject);
+            return entry === undefined ? [] : [entry];
+        });
+        const subjects = ordered.slice(0, limit);
+        for (const subject of subjects) {
+            if (subject.exclusionKind?.startsWith('suspended') && subject.provenance.size > 0)
+                subject.exclusionKind = 'suspended_principal_with_authority';
+        }
+        return { subjects, hasMore: ordered.length > limit };
+    }
+    async assertManifest(pool) {
+        if (this.#manifest === undefined ||
+            Object.keys(this.#manifest).length !==
+                Object.keys(PLATFORM_AUTH_INVENTORY_SOURCE_COLUMNS).length ||
+            Object.keys(PLATFORM_AUTH_INVENTORY_SOURCE_COLUMNS).some((source) => this.#manifest?.[source] !== 'configured' &&
+                this.#manifest?.[source] !== 'not_applicable') ||
+            new Set(this.#excludedSubjects.map((entry) => entry.subject)).size !==
+                this.#excludedSubjects.length)
+            throw new PlatformAuthMigrationError('inventory_unavailable');
+        for (const [source, expected] of Object.entries(PLATFORM_AUTH_INVENTORY_SOURCE_COLUMNS)) {
+            if (this.#manifest[source] !== 'configured')
+                continue;
+            const columns = await pool.query(`SELECT attribute.attname AS name,
+                format_type(attribute.atttypid, attribute.atttypmod) AS type
+           FROM pg_attribute attribute
+          WHERE attribute.attrelid = to_regclass($1)
+            AND attribute.attnum > 0 AND NOT attribute.attisdropped`, [source]);
+            const actual = new Map(columns.rows.map((column) => [column.name, column.type]));
+            if (columns.rows.length === 0 || expected.some(([name, type]) => actual.get(name) !== type))
+                throw new PlatformAuthMigrationError('inventory_unavailable');
+        }
+        await assertPlatformAuthInventorySourceFence(pool, this.#manifest);
+    }
+    async #addConfiguredRoots(pool, after, limit, snapshotAt, add) {
+        const roots = [
+            [
+                'org_members',
+                'org_membership',
+                'SELECT DISTINCT subject COLLATE "C" AS subject FROM org_members WHERE subject COLLATE "C" > $1 COLLATE "C" ORDER BY subject LIMIT $2',
+            ],
+            [
+                'billing_account_members',
+                'google_billing',
+                `SELECT DISTINCT member.subject COLLATE "C" AS subject FROM billing_account_members member JOIN billing_accounts account ON account.id = member.billing_account_id WHERE member.identity_issuer = 'https://accounts.google.com' AND member.role = 'owner' AND account.state = 'active' AND member.subject COLLATE "C" > $1 COLLATE "C" ORDER BY subject LIMIT $2`,
+            ],
+            [
+                'billing_account_defaults',
+                'google_billing',
+                `SELECT DISTINCT defaults.subject COLLATE "C" AS subject FROM billing_account_defaults defaults JOIN billing_accounts account ON account.id = defaults.billing_account_id JOIN billing_account_members member ON member.billing_account_id = defaults.billing_account_id AND member.identity_issuer = defaults.identity_issuer AND member.subject = defaults.subject WHERE defaults.identity_issuer = 'https://accounts.google.com' AND member.role = 'owner' AND account.state = 'active' AND defaults.subject COLLATE "C" > $1 COLLATE "C" ORDER BY subject LIMIT $2`,
+            ],
+            [
+                'oauth_refresh_tokens',
+                'refresh_family',
+                `SELECT DISTINCT owner_subject COLLATE "C" AS subject FROM oauth_refresh_tokens WHERE identity_kind IS DISTINCT FROM 'customer' AND expires_at > $3::timestamptz AND rotated_at IS NULL AND superseded_by IS NULL AND owner_subject COLLATE "C" > $1 COLLATE "C" ORDER BY subject LIMIT $2`,
+                true,
+            ],
+            [
+                'developer_access_grants',
+                'developer_grant',
+                `SELECT DISTINCT subject COLLATE "C" AS subject FROM developer_access_grants WHERE revoked_at IS NULL AND (expires_at IS NULL OR expires_at > $3::timestamptz) AND subject COLLATE "C" > $1 COLLATE "C" ORDER BY subject LIMIT $2`,
+                true,
+            ],
+            [
+                'deploy_records',
+                'owner_only_deployer',
+                `SELECT DISTINCT created_by_subject COLLATE "C" AS subject FROM deploy_records WHERE active = true AND access_mode = 'owner-only' AND created_by_subject IS NOT NULL AND deployment_source IS DISTINCT FROM 'github' AND archived_at IS NULL AND created_by_subject COLLATE "C" > $1 COLLATE "C" ORDER BY subject LIMIT $2`,
+            ],
+            [
+                'oauth_consent_grants',
+                'consent_grant',
+                'SELECT DISTINCT owner_subject COLLATE "C" AS subject FROM oauth_consent_grants WHERE owner_subject COLLATE "C" > $1 COLLATE "C" ORDER BY subject LIMIT $2',
+            ],
+            [
+                'oauth_device_authorizations',
+                'device_authorization',
+                `SELECT DISTINCT owner_subject COLLATE "C" AS subject FROM oauth_device_authorizations WHERE owner_subject IS NOT NULL AND identity_kind IS DISTINCT FROM 'customer' AND status IN ('pending', 'approved') AND expires_at > $3::timestamptz AND owner_subject COLLATE "C" > $1 COLLATE "C" ORDER BY subject LIMIT $2`,
+                true,
+            ],
+            [
+                'welcome_email_outbox',
+                'welcome_provisioning',
+                'SELECT DISTINCT subject COLLATE "C" AS subject FROM welcome_email_outbox WHERE subject COLLATE "C" > $1 COLLATE "C" ORDER BY subject LIMIT $2',
+            ],
+        ];
+        for (const [source, provenance, query, usesSnapshot] of roots) {
+            if (this.#manifest?.[source] !== 'configured')
+                continue;
+            const rows = await this.#safeRows(pool, query, [
+                after ?? '',
+                limit,
+                ...(usesSnapshot === true ? [snapshotAt] : []),
+            ]);
+            for (const row of rows)
+                add({ subject: row.subject, provenance });
+        }
+    }
+    async #addExcludedIdentities(pool, after, limit, snapshotAt, add) {
+        const queries = [
+            [
+                'oauth_refresh_tokens',
+                'SELECT DISTINCT owner_subject COLLATE "C" AS subject FROM oauth_refresh_tokens WHERE identity_kind = \'customer\' AND expires_at > $3::timestamptz AND owner_subject COLLATE "C" > $1 COLLATE "C" ORDER BY subject LIMIT $2',
+                true,
+            ],
+            [
+                'oauth_device_authorizations',
+                'SELECT DISTINCT owner_subject COLLATE "C" AS subject FROM oauth_device_authorizations WHERE owner_subject IS NOT NULL AND identity_kind = \'customer\' AND expires_at > $3::timestamptz AND owner_subject COLLATE "C" > $1 COLLATE "C" ORDER BY subject LIMIT $2',
+                true,
+            ],
+            [
+                'oauth_delegated_credentials',
+                'SELECT DISTINCT subject COLLATE "C" AS subject FROM oauth_delegated_credentials WHERE subject COLLATE "C" > $1 COLLATE "C" ORDER BY subject LIMIT $2',
+            ],
+        ];
+        for (const [source, query, usesSnapshot] of queries) {
+            if (this.#manifest?.[source] !== 'configured')
+                continue;
+            const rows = await this.#safeRows(pool, query, [
+                after ?? '',
+                limit,
+                ...(usesSnapshot === true ? [snapshotAt] : []),
+            ]);
+            for (const row of rows)
+                add({
+                    subject: row.subject,
+                    excludedEvidence: true,
+                    exclusionKind: 'non_platform_identity',
+                });
+        }
+    }
+    async #addConfiguredExclusions(pool, after, limit, add) {
+        if (this.#excludedSubjects.length === 0)
+            return;
+        const rows = await pool.query(`SELECT excluded.subject, excluded.kind
+         FROM unnest($1::text[], $2::text[]) AS excluded(subject, kind)
+        WHERE excluded.subject COLLATE "C" > $3 COLLATE "C"
+        ORDER BY excluded.subject COLLATE "C" LIMIT $4`, [
+            this.#excludedSubjects.map((entry) => entry.subject),
+            this.#excludedSubjects.map((entry) => entry.kind),
+            after ?? '',
+            limit,
+        ]);
+        for (const row of rows.rows)
+            add({ subject: row.subject, exclusionKind: row.kind });
+    }
+    async #safeRows(pool, query, values) {
+        try {
+            return (await pool.query(query, values)).rows;
+        }
+        catch {
+            throw new PlatformAuthMigrationError('inventory_unavailable');
+        }
+    }
+}
+function strongerExclusion(current, next) {
+    if (current === 'workload' || current === 'synthetic')
+        return current;
+    if (next === 'workload' || next === 'synthetic')
+        return next;
+    if (current?.startsWith('suspended'))
+        return current;
+    if (next?.startsWith('suspended'))
+        return next;
+    return current ?? next;
+}
+//# sourceMappingURL=platform-auth-inventory-local-subjects-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-local-subjects-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-inventory-local-subjects-postgres.js","sourceRoot":"","sources":["../src/platform-auth-inventory-local-subjects-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sCAAsC,EAAE,MAAM,oDAAoD,CAAC;AAC5G,OAAO,EACL,sCAAsC,GAGvC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAEL,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AAgDtC,qGAAqG;AACrG,MAAM,OAAO,0CAA0C;IAC5C,YAAY,CAAS;IACrB,SAAS,CAAkD;IAC3D,iBAAiB,CAGtB;IAEJ,YAAY,OAOX;QACC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAC5C,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,SAAS,CACb,IAA+B,EAC/B,KAAyB,EACzB,KAAa,EACb,UAAyB;QAKzB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyC,CAAC;QAClE,MAAM,GAAG,GAAG,CAAC,KAQZ,EAAE,EAAE;YACH,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI;gBAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,IAAI,GAAG,EAA4B;gBAC/C,aAAa,EAAE,KAAK;gBACpB,gBAAgB,EAAE,KAAK;aACxB,CAAC;YACF,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC3E,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;gBACpE,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;YACxC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;gBAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YACtF,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC;YACrD,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,gBAAgB,KAAK,IAAI,CAAC;YAC3D,MAAM,aAAa,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;YAClF,IAAI,aAAa,KAAK,SAAS;gBAAE,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;YACrE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC;QAC3B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAOjC;;;;;;;;;kCAS4B,EAC5B,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE,EAAE,QAAQ,CAAC,CAC3C,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC/B,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBACpE,SAAS;YACX,CAAC;YACD,GAAG,CAAC;gBACF,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,UAAU,EAAE,WAAW;gBACvB,WAAW,EAAE,GAAG,CAAC,YAAY;gBAC7B,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,aAAa,EAAE,CAAC,GAAG,CAAC,SAAS;aAC9B,CAAC,CAAC;YACH,GAAG,CAAC;gBACF,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,UAAU,EAAE,aAAa;gBACzB,WAAW,EAAE,GAAG,CAAC,YAAY;gBAC7B,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,aAAa,EAAE,CAAC,GAAG,CAAC,SAAS;aAC9B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;QACvE,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;QAC1E,MAAM,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAC5B;mCAC6B,EAC7B,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CACvB,CAAC;QACF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACzC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC;gBAC/E,OAAO,CAAC,aAAa,GAAG,oCAAoC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAA+B;QAClD,IACE,IAAI,CAAC,SAAS,KAAK,SAAS;YAC5B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM;gBAChC,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC,MAAM;YAC5D,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC,IAAI,CACtD,CAAC,MAAM,EAAE,EAAE,CACT,IAAI,CAAC,SAAS,EAAE,CAAC,MAAqC,CAAC,KAAK,YAAY;gBACxE,IAAI,CAAC,SAAS,EAAE,CAAC,MAAqC,CAAC,KAAK,gBAAgB,CAC/E;YACD,IAAI,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;gBAChE,IAAI,CAAC,iBAAiB,CAAC,MAAM;YAE/B,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;QAChE,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sCAAsC,CAAC,EAAE,CAAC;YACxF,IAAI,IAAI,CAAC,SAAS,CAAC,MAAqC,CAAC,KAAK,YAAY;gBAAE,SAAS;YACrF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAC9B;;;;oEAI4D,EAC5D,CAAC,MAAM,CAAC,CACT,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjF,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;gBACzF,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,sCAAsC,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,IAA+B,EAC/B,KAAyB,EACzB,KAAa,EACb,UAAyB,EACzB,GAGU;QAEV,MAAM,KAAK,GAKL;YACJ;gBACE,aAAa;gBACb,gBAAgB;gBAChB,sIAAsI;aACvI;YACD;gBACE,yBAAyB;gBACzB,gBAAgB;gBAChB,iWAAiW;aAClW;YACD;gBACE,0BAA0B;gBAC1B,gBAAgB;gBAChB,uiBAAuiB;aACxiB;YACD;gBACE,sBAAsB;gBACtB,gBAAgB;gBAChB,2RAA2R;gBAC3R,IAAI;aACL;YACD;gBACE,yBAAyB;gBACzB,iBAAiB;gBACjB,kOAAkO;gBAClO,IAAI;aACL;YACD;gBACE,gBAAgB;gBAChB,qBAAqB;gBACrB,2TAA2T;aAC5T;YACD;gBACE,sBAAsB;gBACtB,eAAe;gBACf,2JAA2J;aAC5J;YACD;gBACE,6BAA6B;gBAC7B,sBAAsB;gBACtB,qTAAqT;gBACrT,IAAI;aACL;YACD;gBACE,sBAAsB;gBACtB,sBAAsB;gBACtB,+IAA+I;aAChJ;SACF,CAAC;QACF,KAAK,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,KAAK,EAAE,CAAC;YAC9D,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY;gBAAE,SAAS;YACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;gBAC7C,KAAK,IAAI,EAAE;gBACX,KAAK;gBACL,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/C,CAAC,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,IAAI;gBAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,IAA+B,EAC/B,KAAyB,EACzB,KAAa,EACb,UAAyB,EACzB,GAIU;QAEV,MAAM,OAAO,GAA+D;YAC1E;gBACE,sBAAsB;gBACtB,6NAA6N;gBAC7N,IAAI;aACL;YACD;gBACE,6BAA6B;gBAC7B,kQAAkQ;gBAClQ,IAAI;aACL;YACD;gBACE,6BAA6B;gBAC7B,sJAAsJ;aACvJ;SACF,CAAC;QACF,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,OAAO,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY;gBAAE,SAAS;YACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;gBAC7C,KAAK,IAAI,EAAE;gBACX,KAAK;gBACL,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/C,CAAC,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,IAAI;gBACpB,GAAG,CAAC;oBACF,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,gBAAgB,EAAE,IAAI;oBACtB,aAAa,EAAE,uBAAuB;iBACvC,CAAC,CAAC;QACP,CAAC;IACH,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC5B,IAA+B,EAC/B,KAAyB,EACzB,KAAa,EACb,GAGU;QAEV,IAAI,IAAI,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAI3B;;;uDAGiD,EACjD;YACE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;YACpD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;YACjD,KAAK,IAAI,EAAE;YACX,KAAK;SACN,CACF,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI;YAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,SAAS,CACb,IAA+B,EAC/B,KAAa,EACb,MAA0B;QAE1B,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAA+B,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;CACF;AAED,SAAS,iBAAiB,CACxB,OAAgD,EAChD,IAA6C;IAE7C,IAAI,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,OAAO,CAAC;IACtE,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,OAAO,IAAI,IAAI,CAAC;AACzB,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-paging.d.ts

@@ -0,0 +1,66 @@
+import { type PlatformAuthBlockerCode, type PlatformAuthInventory } from './platform-auth-migration.js';
+export declare const PLATFORM_AUTH_INVENTORY_REMOTE_PAGE_SIZE = 100;
+export declare const PLATFORM_AUTH_INVENTORY_LOCAL_BATCH_SIZE = 100;
+export declare const PLATFORM_AUTH_INVENTORY_REMOTE_USER_LIMIT = 200000;
+export declare const PLATFORM_AUTH_INVENTORY_LEASE_SECONDS = 30;
+export interface PlatformAuthInventoryRemoteUser {
+    readonly id: string;
+    readonly externalId: string | undefined;
+    readonly normalizedEmail: string;
+    readonly verified: boolean;
+}
+export interface PlatformAuthInventoryPageSource {
+    listPage(input: {
+        readonly after?: string;
+        readonly limit: number;
+    }): Promise<{
+        readonly users: readonly PlatformAuthInventoryRemoteUser[];
+        readonly nextAfter?: string;
+    }>;
+}
+export interface PlatformAuthInventoryAdvance {
+    readonly state: 'running' | 'completed';
+    readonly phase: 'remote' | 'local' | 'completed';
+    readonly remotePages: number;
+    readonly remoteUsers: number;
+    readonly localSubjects: number;
+    readonly candidateCount: number;
+    readonly excludedCount: number;
+    readonly blockers: Readonly<Partial<Record<PlatformAuthBlockerCode, number>>>;
+    readonly checksum: string | null;
+}
+export interface InventoryProgressRow {
+    readonly phase: 'remote' | 'local' | 'completed';
+    readonly remote_after: string | null;
+    readonly remote_page_count: number;
+    readonly remote_user_count: number;
+    readonly remote_chain_hash: string;
+    readonly local_after_subject: string | null;
+    readonly local_source_epoch: string | null;
+    readonly local_snapshot_at: Date | string | null;
+    readonly local_subject_count: number;
+    readonly candidate_count: number;
+    readonly excluded_count: number;
+    readonly candidate_chain_hash: string;
+    readonly excluded_chain_hash: string;
+    readonly artifact_counts: unknown;
+    readonly blocker_counts: unknown;
+    readonly terminal_error: 'inventory_unavailable' | null;
+    readonly lease_token_hash: string | null;
+    readonly lease_expires_at: Date | string | null;
+}
+export interface InventoryLease {
+    readonly token: string;
+    readonly progress: InventoryProgressRow;
+}
+export declare function inventoryHash(value: unknown): string;
+/** Matches PostgreSQL `COLLATE "C"` for bounded in-memory evidence lists. */
+export declare function compareInventoryText(left: string, right: string): number;
+export declare function inventoryChainSeed(kind: 'remote' | 'candidate' | 'excluded'): string;
+export declare function inventoryChain(previous: string, entry: unknown): string;
+export declare function newInventoryLeaseToken(): string;
+export declare function inventoryProgress(row: InventoryProgressRow, checksum?: string | null): PlatformAuthInventoryAdvance;
+export declare function inventoryHasLocalWork(row: InventoryProgressRow): boolean;
+export declare function blockerCounts(value: unknown): Partial<Record<PlatformAuthBlockerCode, number>>;
+export declare function completedInventory(value: unknown, checksum: string | null): PlatformAuthInventory;
+//# sourceMappingURL=platform-auth-inventory-paging.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-paging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-inventory-paging.d.ts","sourceRoot":"","sources":["../src/platform-auth-inventory-paging.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAE3B,MAAM,8BAA8B,CAAC;AAEtC,eAAO,MAAM,wCAAwC,MAAM,CAAC;AAC5D,eAAO,MAAM,wCAAwC,MAAM,CAAC;AAC5D,eAAO,MAAM,yCAAyC,SAAU,CAAC;AACjE,eAAO,MAAM,qCAAqC,KAAK,CAAC;AAExD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAC5E,QAAQ,CAAC,KAAK,EAAE,SAAS,+BAA+B,EAAE,CAAC;QAC3D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,WAAW,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAC;IACjD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9E,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAC;IACjD,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IACjD,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACxD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;CACjD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;CACzC;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,QAAQ,GAAG,WAAW,GAAG,UAAU,GAAG,MAAM,CAEpF;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAEvE;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,oBAAoB,EACzB,QAAQ,GAAE,MAAM,GAAG,IAAW,GAC7B,4BAA4B,CAY9B;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAOxE;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAQ9F;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,qBAAqB,CAiBjG"}

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-paging.js

@@ -0,0 +1,77 @@
+import { Buffer } from 'node:buffer';
+import { createHash, randomUUID } from 'node:crypto';
+import { PlatformAuthMigrationError, } from './platform-auth-migration.js';
+export const PLATFORM_AUTH_INVENTORY_REMOTE_PAGE_SIZE = 100;
+export const PLATFORM_AUTH_INVENTORY_LOCAL_BATCH_SIZE = 100;
+export const PLATFORM_AUTH_INVENTORY_REMOTE_USER_LIMIT = 200_000;
+export const PLATFORM_AUTH_INVENTORY_LEASE_SECONDS = 30;
+export function inventoryHash(value) {
+    return createHash('sha256').update(JSON.stringify(value)).digest('hex');
+}
+/** Matches PostgreSQL `COLLATE "C"` for bounded in-memory evidence lists. */
+export function compareInventoryText(left, right) {
+    return Buffer.compare(Buffer.from(left, 'utf8'), Buffer.from(right, 'utf8'));
+}
+export function inventoryChainSeed(kind) {
+    return inventoryHash({ algorithm: 'platform-auth-inventory-chain-v1', kind });
+}
+export function inventoryChain(previous, entry) {
+    return inventoryHash({ previous, entry });
+}
+export function newInventoryLeaseToken() {
+    return randomUUID();
+}
+export function inventoryProgress(row, checksum = null) {
+    return {
+        state: row.phase === 'completed' ? 'completed' : 'running',
+        phase: row.phase,
+        remotePages: row.remote_page_count,
+        remoteUsers: row.remote_user_count,
+        localSubjects: row.local_subject_count,
+        candidateCount: row.candidate_count,
+        excludedCount: row.excluded_count,
+        blockers: blockerCounts(row.blocker_counts),
+        checksum,
+    };
+}
+export function inventoryHasLocalWork(row) {
+    return (row.local_after_subject !== null ||
+        row.local_subject_count !== 0 ||
+        row.candidate_count !== 0 ||
+        row.excluded_count !== 0);
+}
+export function blockerCounts(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return {};
+    const result = {};
+    for (const [code, count] of Object.entries(value)) {
+        if (inventoryBlocker(code) && Number.isInteger(count) && count >= 0 && count !== 0)
+            result[code] = count;
+    }
+    return result;
+}
+export function completedInventory(value, checksum) {
+    if (typeof value !== 'object' || value === null || checksum === null)
+        throw new PlatformAuthMigrationError('inventory_unavailable');
+    const candidate = value;
+    if (typeof candidate.candidateCount !== 'number' ||
+        typeof candidate.excludedCount !== 'number' ||
+        typeof candidate.blockers !== 'object' ||
+        candidate.blockers === null)
+        throw new PlatformAuthMigrationError('inventory_unavailable');
+    return {
+        candidateCount: candidate.candidateCount,
+        excludedCount: candidate.excludedCount,
+        blockers: candidate.blockers,
+        checksum,
+    };
+}
+function inventoryBlocker(value) {
+    return (value === 'missing_verified_email' ||
+        value === 'multiple_current_verified_emails' ||
+        value === 'shared_verified_email' ||
+        value === 'external_id_too_long' ||
+        value === 'conflicting_workos_user' ||
+        value === 'ambiguous_platform_customer_evidence');
+}
+//# sourceMappingURL=platform-auth-inventory-paging.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-paging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-inventory-paging.js","sourceRoot":"","sources":["../src/platform-auth-inventory-paging.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAGL,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,CAAC,MAAM,wCAAwC,GAAG,GAAG,CAAC;AAC5D,MAAM,CAAC,MAAM,wCAAwC,GAAG,GAAG,CAAC;AAC5D,MAAM,CAAC,MAAM,yCAAyC,GAAG,OAAO,CAAC;AACjE,MAAM,CAAC,MAAM,qCAAqC,GAAG,EAAE,CAAC;AAsDxD,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,KAAa;IAC9D,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAyC;IAC1E,OAAO,aAAa,CAAC,EAAE,SAAS,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,KAAc;IAC7D,OAAO,aAAa,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,GAAyB,EACzB,WAA0B,IAAI;IAE9B,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAC1D,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,WAAW,EAAE,GAAG,CAAC,iBAAiB;QAClC,WAAW,EAAE,GAAG,CAAC,iBAAiB;QAClC,aAAa,EAAE,GAAG,CAAC,mBAAmB;QACtC,cAAc,EAAE,GAAG,CAAC,eAAe;QACnC,aAAa,EAAE,GAAG,CAAC,cAAc;QACjC,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC;QAC3C,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAyB;IAC7D,OAAO,CACL,GAAG,CAAC,mBAAmB,KAAK,IAAI;QAChC,GAAG,CAAC,mBAAmB,KAAK,CAAC;QAC7B,GAAG,CAAC,eAAe,KAAK,CAAC;QACzB,GAAG,CAAC,cAAc,KAAK,CAAC,CACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnF,MAAM,MAAM,GAAqD,EAAE,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC;YAC5F,MAAM,CAAC,IAAI,CAAC,GAAG,KAAe,CAAC;IACnC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,QAAuB;IACxE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;QAClE,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,KAAuC,CAAC;IAC1D,IACE,OAAO,SAAS,CAAC,cAAc,KAAK,QAAQ;QAC5C,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ;QAC3C,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ;QACtC,SAAS,CAAC,QAAQ,KAAK,IAAI;QAE3B,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;IAChE,OAAO;QACL,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,CACL,KAAK,KAAK,wBAAwB;QAClC,KAAK,KAAK,kCAAkC;QAC5C,KAAK,KAAK,uBAAuB;QACjC,KAAK,KAAK,sBAAsB;QAChC,KAAK,KAAK,yBAAyB;QACnC,KAAK,KAAK,sCAAsC,CACjD,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-postgres.d.ts

@@ -0,0 +1,40 @@
+import { type PlatformAuthInventoryAdvance, type PlatformAuthInventoryPageSource } from './platform-auth-inventory-paging.js';
+import type { PlatformAuthInventorySourceManifest } from './platform-auth-inventory-sources.js';
+import { type PlatformAuthInventory } from './platform-auth-migration.js';
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+export type { PlatformAuthInventoryAdvance, PlatformAuthInventoryPageSource, } from './platform-auth-inventory-paging.js';
+export { PLATFORM_AUTH_INVENTORY_SOURCES, type PlatformAuthInventorySource, type PlatformAuthInventorySourceManifest, } from './platform-auth-inventory-sources.js';
+type Connection = PlatformIdentityQueryable & {
+    release?: () => void;
+};
+type Pool = PlatformIdentityQueryable & {
+    connect?: () => Promise<Connection>;
+};
+/**
+ * Authoritative, repeatable-read inventory. Internal frozen rows retain the source universe for later fences;
+ * this boundary returns aggregate counts and digests only.
+ */
+export declare class PostgresPlatformAuthInventoryStore {
+    #private;
+    constructor(pool: Pool, options?: {
+        readonly googleRealm?: string;
+        readonly workosRealm?: string;
+        readonly workosUsers?: readonly WorkOSInventoryUser[] | (() => Promise<readonly WorkOSInventoryUser[]>);
+        readonly workosPageSource?: PlatformAuthInventoryPageSource;
+        /** A configured relation must exist; an unavailable relation fails inventory rather than silently narrowing roots. */
+        readonly sourceAvailability?: PlatformAuthInventorySourceManifest;
+        /** Exact non-human Google subjects supplied by trusted deployment configuration. */
+        readonly excludedSubjects?: readonly {
+            readonly subject: string;
+            readonly kind: 'workload' | 'synthetic';
+        }[];
+    });
+    inspect(runId: string): Promise<PlatformAuthInventory>;
+    advance(runId: string): Promise<PlatformAuthInventoryAdvance>;
+}
+interface WorkOSInventoryUser {
+    readonly externalId?: string | undefined;
+    readonly normalizedEmail: string;
+    readonly verified: boolean;
+}
+//# sourceMappingURL=platform-auth-inventory-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-inventory-postgres.d.ts","sourceRoot":"","sources":["../src/platform-auth-inventory-postgres.ts"],"names":[],"mappings":"AAGA,OAAO,EAKL,KAAK,4BAA4B,EACjC,KAAK,+BAA+B,EACrC,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAChG,OAAO,EAEL,KAAK,qBAAqB,EAE3B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,YAAY,EACV,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,+BAA+B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,mCAAmC,GACzC,MAAM,sCAAsC,CAAC;AAE9C,KAAK,UAAU,GAAG,yBAAyB,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE,CAAC;AACvE,KAAK,IAAI,GAAG,yBAAyB,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAA;CAAE,CAAC;AAChF;;;GAGG;AACH,qBAAa,kCAAkC;;gBAU3C,IAAI,EAAE,IAAI,EACV,OAAO,GAAE;QACP,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,WAAW,CAAC,EACjB,SAAS,mBAAmB,EAAE,GAC9B,CAAC,MAAM,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAC,CAAC;QACpD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,+BAA+B,CAAC;QAC5D,sHAAsH;QACtH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,mCAAmC,CAAC;QAClE,oFAAoF;QACpF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS;YACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;YACzB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAAC;SACzC,EAAE,CAAC;KACA;IA4BF,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAetD,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,CAAC;CA8RpE;AAED,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B"}