@noodleseed/one 0.63.0 → 0.64.0

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-postgres.js

@@ -0,0 +1,355 @@
+import { createHash } from 'node:crypto';
+import { PostgresPlatformAuthLegacyInventorySources } from './platform-auth-inventory-legacy-sources-postgres.js';
+import { PostgresPlatformAuthInventoryLocalFreezer } from './platform-auth-inventory-local-postgres.js';
+import { compareInventoryText, completedInventory, inventoryProgress, PLATFORM_AUTH_INVENTORY_REMOTE_PAGE_SIZE, } from './platform-auth-inventory-paging.js';
+import { PostgresPlatformAuthInventoryProgressStore } from './platform-auth-inventory-progress-postgres.js';
+import { PlatformAuthMigrationError, } from './platform-auth-migration.js';
+import { normalizePlatformIdentityEmail } from './platform-identity.js';
+export { PLATFORM_AUTH_INVENTORY_SOURCES, } from './platform-auth-inventory-sources.js';
+/**
+ * Authoritative, repeatable-read inventory. Internal frozen rows retain the source universe for later fences;
+ * this boundary returns aggregate counts and digests only.
+ */
+export class PostgresPlatformAuthInventoryStore {
+    #pool;
+    #googleRealm;
+    #workosRealmFingerprint;
+    #loadWorkosUsers;
+    #workosPageSource;
+    #progressStore;
+    #localFreezer;
+    #legacySources;
+    constructor(pool, options = {}) {
+        this.#pool = pool;
+        this.#googleRealm = options.googleRealm ?? 'accounts.google.com';
+        this.#workosRealmFingerprint = hash(options.workosRealm ?? 'default');
+        const workosUsers = options.workosUsers ?? [];
+        this.#loadWorkosUsers =
+            typeof workosUsers === 'function' ? workosUsers : () => Promise.resolve(workosUsers);
+        this.#workosPageSource = options.workosPageSource;
+        const excludedSubjects = options.excludedSubjects ?? [];
+        this.#progressStore = new PostgresPlatformAuthInventoryProgressStore(pool);
+        this.#localFreezer = new PostgresPlatformAuthInventoryLocalFreezer(pool, {
+            googleRealm: this.#googleRealm,
+            workosRealmFingerprint: this.#workosRealmFingerprint,
+            ...(options.sourceAvailability === undefined
+                ? {}
+                : { sourceAvailability: options.sourceAvailability }),
+            excludedSubjects,
+        });
+        this.#legacySources = new PostgresPlatformAuthLegacyInventorySources({
+            googleRealm: this.#googleRealm,
+            ...(options.sourceAvailability === undefined
+                ? {}
+                : { sourceAvailability: options.sourceAvailability }),
+            excludedSubjects,
+        });
+    }
+    async inspect(runId) {
+        if (this.#workosPageSource !== undefined) {
+            const advanced = await this.advance(runId);
+            if (advanced.state !== 'completed' || advanced.checksum === null)
+                throw new PlatformAuthMigrationError('inventory_unavailable');
+            return {
+                candidateCount: advanced.candidateCount,
+                excludedCount: advanced.excludedCount,
+                blockers: advanced.blockers,
+                checksum: advanced.checksum,
+            };
+        }
+        return this.#inspectLegacy(runId);
+    }
+    async advance(runId) {
+        if (this.#workosPageSource === undefined) {
+            const completed = await this.#inspectLegacy(runId);
+            return {
+                state: 'completed',
+                phase: 'completed',
+                remotePages: 0,
+                remoteUsers: 0,
+                localSubjects: completed.candidateCount + completed.excludedCount,
+                candidateCount: completed.candidateCount,
+                excludedCount: completed.excludedCount,
+                blockers: completed.blockers,
+                checksum: completed.checksum,
+            };
+        }
+        await this.#bindPagedRun(runId);
+        const completed = await this.#completed(runId);
+        if (completed !== undefined)
+            return completed;
+        let claim;
+        try {
+            claim = await this.#progressStore.claim(runId);
+        }
+        catch {
+            throw new PlatformAuthMigrationError('inventory_unavailable');
+        }
+        if (claim.kind === 'terminal')
+            throw new PlatformAuthMigrationError('inventory_unavailable');
+        if (claim.kind === 'busy')
+            return inventoryProgress(claim.progress);
+        if (claim.lease.progress.phase === 'local')
+            return this.#advanceLocal(runId, claim.lease.token);
+        if (claim.lease.progress.phase === 'completed')
+            return (await this.#completed(runId)) ?? inventoryProgress(claim.lease.progress);
+        const after = claim.lease.progress.remote_after ?? undefined;
+        let page;
+        try {
+            page = await this.#workosPageSource.listPage({
+                limit: PLATFORM_AUTH_INVENTORY_REMOTE_PAGE_SIZE,
+                ...(after === undefined ? {} : { after }),
+            });
+        }
+        catch {
+            await this.#progressStore.release(runId, claim.lease.token).catch(() => undefined);
+            throw new PlatformAuthMigrationError('inventory_unavailable');
+        }
+        let committed;
+        try {
+            committed = await this.#progressStore.commitRemotePage({
+                runId,
+                leaseToken: claim.lease.token,
+                ...(after === undefined ? {} : { after }),
+                users: page.users,
+                ...(page.nextAfter === undefined ? {} : { nextAfter: page.nextAfter }),
+            });
+        }
+        catch (error) {
+            if (error instanceof Error && error.message === 'invalid_remote_inventory_page')
+                await this.#progressStore.markTerminal(runId, claim.lease.token).catch(() => undefined);
+            else
+                await this.#progressStore.release(runId, claim.lease.token).catch(() => undefined);
+            throw new PlatformAuthMigrationError('inventory_unavailable');
+        }
+        if (committed.terminal)
+            throw new PlatformAuthMigrationError('inventory_unavailable');
+        if (committed.progress.phase !== 'local')
+            return inventoryProgress(committed.progress);
+        const localClaim = await this.#progressStore.claim(runId).catch(() => undefined);
+        if (localClaim?.kind !== 'leased')
+            return inventoryProgress(committed.progress);
+        return this.#advanceLocal(runId, localClaim.lease.token);
+    }
+    async #advanceLocal(runId, leaseToken) {
+        try {
+            const result = await this.#localFreezer.advance({ runId, leaseToken });
+            return inventoryProgress(result.progress, result.checksum);
+        }
+        catch (error) {
+            await this.#progressStore.release(runId, leaseToken).catch(() => undefined);
+            if (error instanceof PlatformAuthMigrationError)
+                throw error;
+            throw new PlatformAuthMigrationError('inventory_unavailable');
+        }
+    }
+    async #completed(runId) {
+        const result = await this.#pool.query("SELECT state, frozen_checksum, safe_result FROM identity_migration_runs WHERE id = $1 AND kind = 'inventory'", [runId]);
+        const row = result.rows[0];
+        if (row?.state !== 'completed')
+            return undefined;
+        const completed = completedInventory(row.safe_result, row.frozen_checksum);
+        const progress = await this.#progressStore.read(runId);
+        return progress === undefined
+            ? {
+                state: 'completed',
+                phase: 'completed',
+                remotePages: 0,
+                remoteUsers: 0,
+                localSubjects: completed.candidateCount + completed.excludedCount,
+                candidateCount: completed.candidateCount,
+                excludedCount: completed.excludedCount,
+                blockers: completed.blockers,
+                checksum: completed.checksum,
+            }
+            : inventoryProgress(progress, completed.checksum);
+    }
+    async #bindPagedRun(runId) {
+        const current = await this.#pool.query("SELECT state, workos_realm_fingerprint FROM identity_migration_runs WHERE id = $1 AND kind = 'inventory'", [runId]);
+        const row = current.rows[0];
+        if (row?.workos_realm_fingerprint === this.#workosRealmFingerprint)
+            return;
+        if (row?.state !== 'running' || row.workos_realm_fingerprint !== null)
+            throw new PlatformAuthMigrationError('inventory_unavailable');
+        const result = await this.#pool.query(`UPDATE identity_migration_runs SET workos_realm_fingerprint = $2
+        WHERE id = $1 AND kind = 'inventory' AND state = 'running'
+          AND workos_realm_fingerprint IS NULL
+      RETURNING workos_realm_fingerprint`, [runId, this.#workosRealmFingerprint]);
+        if (result.rows[0]?.workos_realm_fingerprint !== this.#workosRealmFingerprint)
+            throw new PlatformAuthMigrationError('inventory_unavailable');
+    }
+    async #inspectLegacy(runId) {
+        const existing = await this.#pool.query("SELECT state, frozen_checksum, safe_result FROM identity_migration_runs WHERE id = $1 AND kind = 'inventory' AND state IN ('running', 'completed')", [runId]);
+        const existingRun = existing.rows[0];
+        if (existingRun === undefined)
+            throw new PlatformAuthMigrationError('inventory_unavailable');
+        if (existingRun.state === 'completed') {
+            return completedInventory(existingRun.safe_result, existingRun.frozen_checksum);
+        }
+        let workosUsers;
+        try {
+            workosUsers = await this.#loadWorkosUsers();
+        }
+        catch {
+            throw new PlatformAuthMigrationError('inventory_unavailable');
+        }
+        // Build the remote lookup once. A migration may legitimately approach the documented
+        // 200,000-user coordination threshold, so scanning the complete WorkOS snapshot once per
+        // candidate would turn inventory into an accidental O(local users x remote users) operation.
+        const workosIndex = indexWorkosUsers(workosUsers);
+        const workosSnapshotFingerprint = hash(workosIndex.fingerprintRows);
+        const connection = this.#pool.connect === undefined ? this.#pool : await this.#pool.connect();
+        try {
+            await connection.query('BEGIN ISOLATION LEVEL REPEATABLE READ');
+            await connection.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [
+                'platform-auth-inventory:v1',
+            ]);
+            const run = await connection.query("SELECT id, state, frozen_checksum, safe_result FROM identity_migration_runs WHERE id = $1 AND kind = 'inventory' AND state IN ('running', 'completed') FOR UPDATE", [runId]);
+            const runRow = run.rows[0];
+            if (runRow === undefined)
+                throw new PlatformAuthMigrationError('inventory_unavailable');
+            if (runRow.state === 'completed') {
+                const safe = completedInventory(runRow.safe_result, runRow.frozen_checksum);
+                await connection.query('COMMIT');
+                return safe;
+            }
+            await this.#legacySources.assertManifest(connection);
+            const discovered = await this.#legacySources.discover(connection);
+            const sources = discovered.sources;
+            const emails = await this.#legacySources.emails(connection, [...sources.values()]);
+            const emailOwners = await this.#legacySources.emailOwners(connection);
+            const blockers = {};
+            const checksumEntries = [];
+            for (const source of [...sources.values()].sort((a, b) => compareInventoryText(a.subject, b.subject))) {
+                const currentEmails = [...new Set(emails.get(source.subject) ?? [])].sort(compareInventoryText);
+                const codes = [];
+                if (source.identityDrift || source.excludedEvidence)
+                    codes.push('ambiguous_platform_customer_evidence');
+                if (currentEmails.length === 0)
+                    codes.push('missing_verified_email');
+                if (currentEmails.length > 1)
+                    codes.push('multiple_current_verified_emails');
+                if (source.subject.length > 64)
+                    codes.push('external_id_too_long');
+                if (currentEmails.some((email) => (emailOwners.get(email)?.size ?? 0) > 1))
+                    codes.push('shared_verified_email');
+                if (currentEmails.some((email) => workosConflict(workosIndex, source.subject, email)))
+                    codes.push('conflicting_workos_user');
+                for (const code of codes)
+                    blockers[code] = (blockers[code] ?? 0) + 1;
+                const provenance = [...source.provenance].sort();
+                const sourceFingerprint = hash({
+                    subject: source.subject,
+                    realm: source.realm,
+                    provenance,
+                });
+                const email = currentEmails.length === 1 ? currentEmails[0] : undefined;
+                const candidateFingerprint = hash({
+                    sourceFingerprint,
+                    principalFingerprint: source.principalId === undefined ? undefined : hash(source.principalId),
+                    emailFingerprint: email === undefined ? undefined : hash(email),
+                    provenance,
+                    blockerCodes: codes,
+                });
+                await connection.query(`INSERT INTO platform_auth_inventory_candidates
+             (migration_run_id, source_subject, source_realm, principal_id, normalized_email, email_fingerprint, provenance, blocker_codes, source_fingerprint, candidate_fingerprint)
+           VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
+           ON CONFLICT (migration_run_id, source_subject) DO NOTHING`, [
+                    runId,
+                    source.subject,
+                    source.realm ?? this.#googleRealm,
+                    source.principalId ?? null,
+                    email ?? null,
+                    email === undefined ? null : hash(email),
+                    provenance,
+                    codes,
+                    sourceFingerprint,
+                    candidateFingerprint,
+                ]);
+                checksumEntries.push({
+                    sourceFingerprint,
+                    emailFingerprint: email === undefined ? undefined : hash(email),
+                    provenance,
+                    blockerCodes: codes,
+                    candidateFingerprint,
+                });
+            }
+            const safe = {
+                candidateCount: sources.size,
+                excludedCount: discovered.excludedCount,
+                blockers,
+            };
+            // The existing opaque evidence column now commits to both excluded actors and the complete remote
+            // snapshot. Downstream lineage recomputes the inventory checksum from this frozen digest without
+            // retaining provider identifiers or emails.
+            const inventoryEvidenceFingerprint = hash({
+                excluded: discovered.excludedFingerprint,
+                workosSnapshot: workosSnapshotFingerprint,
+            });
+            const checksum = hash({
+                algorithm: 'inventory-v1',
+                googleRealm: this.#googleRealm,
+                workosRealm: this.#workosRealmFingerprint,
+                safe,
+                excludedFingerprint: inventoryEvidenceFingerprint,
+                candidates: checksumEntries,
+            });
+            const completed = await connection.query(`UPDATE identity_migration_runs
+            SET frozen_checksum = $2, source_fingerprint = $3, excluded_fingerprint = $4,
+                workos_realm_fingerprint = $5, google_realm = $6,
+                inventory_format = 'v1', safe_result = $7, state = 'completed', completed_at = now()
+          WHERE id = $1 AND state = 'running' RETURNING id`, [
+                runId,
+                checksum,
+                hash(checksumEntries),
+                inventoryEvidenceFingerprint,
+                this.#workosRealmFingerprint,
+                this.#googleRealm,
+                JSON.stringify(safe),
+            ]);
+            if (completed.rows[0] === undefined)
+                throw new PlatformAuthMigrationError('inventory_unavailable');
+            await connection.query('COMMIT');
+            return { ...safe, checksum };
+        }
+        catch (error) {
+            await connection.query('ROLLBACK').catch(() => undefined);
+            throw error;
+        }
+        finally {
+            connection.release?.();
+        }
+    }
+}
+function indexWorkosUsers(users) {
+    const byEmail = new Map();
+    const byExternalId = new Map();
+    const fingerprintRows = users.map((user) => {
+        const normalizedEmail = normalizePlatformIdentityEmail(user.normalizedEmail);
+        const normalized = { ...user, normalizedEmail };
+        const emailUsers = byEmail.get(normalizedEmail) ?? [];
+        emailUsers.push(normalized);
+        byEmail.set(normalizedEmail, emailUsers);
+        if (user.externalId !== undefined) {
+            const externalUsers = byExternalId.get(user.externalId) ?? [];
+            externalUsers.push(normalized);
+            byExternalId.set(user.externalId, externalUsers);
+        }
+        return { externalId: user.externalId, normalizedEmail, verified: user.verified };
+    });
+    fingerprintRows.sort((a, b) => compareInventoryText(a.externalId ?? '', b.externalId ?? '') ||
+        compareInventoryText(a.normalizedEmail, b.normalizedEmail) ||
+        Number(a.verified) - Number(b.verified));
+    return { byEmail, byExternalId, fingerprintRows };
+}
+function workosConflict(index, subject, email) {
+    const matches = index.byEmail.get(email) ?? [];
+    const externalMatches = index.byExternalId.get(subject) ?? [];
+    return (matches.length > 1 ||
+        matches.some((user) => !user.verified || user.externalId !== subject) ||
+        externalMatches.some((user) => !user.verified || user.normalizedEmail !== email));
+}
+function hash(value) {
+    return createHash('sha256').update(JSON.stringify(value)).digest('hex');
+}
+//# sourceMappingURL=platform-auth-inventory-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-inventory-postgres.js","sourceRoot":"","sources":["../src/platform-auth-inventory-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,0CAA0C,EAAE,MAAM,sDAAsD,CAAC;AAClH,OAAO,EAAE,yCAAyC,EAAE,MAAM,6CAA6C,CAAC;AACxG,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,wCAAwC,GAGzC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,0CAA0C,EAAE,MAAM,gDAAgD,CAAC;AAE5G,OAAO,EAGL,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAOxE,OAAO,EACL,+BAA+B,GAGhC,MAAM,sCAAsC,CAAC;AAI9C;;;GAGG;AACH,MAAM,OAAO,kCAAkC;IACpC,KAAK,CAAO;IACZ,YAAY,CAAS;IACrB,uBAAuB,CAAS;IAChC,gBAAgB,CAAgD;IAChE,iBAAiB,CAA8C;IAC/D,cAAc,CAA6C;IAC3D,aAAa,CAA4C;IACzD,cAAc,CAA6C;IACpE,YACE,IAAU,EACV,UAcI,EAAE;QAEN,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;QACjE,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC,CAAC;QACtE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,gBAAgB;YACnB,OAAO,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACvF,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QAClD,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC,cAAc,GAAG,IAAI,0CAA0C,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,CAAC,aAAa,GAAG,IAAI,yCAAyC,CAAC,IAAI,EAAE;YACvE,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,sBAAsB,EAAE,IAAI,CAAC,uBAAuB;YACpD,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACvD,gBAAgB;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,IAAI,0CAA0C,CAAC;YACnE,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACvD,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,QAAQ,CAAC,KAAK,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI;gBAC9D,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;YAChE,OAAO;gBACL,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YACnD,OAAO;gBACL,KAAK,EAAE,WAAW;gBAClB,KAAK,EAAE,WAAW;gBAClB,WAAW,EAAE,CAAC;gBACd,WAAW,EAAE,CAAC;gBACd,aAAa,EAAE,SAAS,CAAC,cAAc,GAAG,SAAS,CAAC,aAAa;gBACjE,cAAc,EAAE,SAAS,CAAC,cAAc;gBACxC,aAAa,EAAE,SAAS,CAAC,aAAa;gBACtC,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,QAAQ,EAAE,SAAS,CAAC,QAAQ;aAC7B,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC9C,IAAI,KAA+E,CAAC;QACpF,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;YAAE,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;QAC7F,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpE,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChG,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,KAAK,WAAW;YAC5C,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,IAAI,SAAS,CAAC;QAC7D,IAAI,IAAsE,CAAC;QAC3E,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;gBAC3C,KAAK,EAAE,wCAAwC;gBAC/C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACnF,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,SAEH,CAAC;QACF,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC;gBACrD,KAAK;gBACL,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK;gBAC7B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;gBACzC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;aACvE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,+BAA+B;gBAC7E,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;;gBACrF,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACxF,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,SAAS,CAAC,QAAQ;YAAE,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;QACtF,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,KAAK,OAAO;YAAE,OAAO,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACjF,IAAI,UAAU,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,UAAkB;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;YACvE,OAAO,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5E,IAAI,KAAK,YAAY,0BAA0B;gBAAE,MAAM,KAAK,CAAC;YAC7D,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa;QAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAKnC,8GAA8G,EAC9G,CAAC,KAAK,CAAC,CACR,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,GAAG,EAAE,KAAK,KAAK,WAAW;YAAE,OAAO,SAAS,CAAC;QACjD,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,OAAO,QAAQ,KAAK,SAAS;YAC3B,CAAC,CAAC;gBACE,KAAK,EAAE,WAAW;gBAClB,KAAK,EAAE,WAAW;gBAClB,WAAW,EAAE,CAAC;gBACd,WAAW,EAAE,CAAC;gBACd,aAAa,EAAE,SAAS,CAAC,cAAc,GAAG,SAAS,CAAC,aAAa;gBACjE,cAAc,EAAE,SAAS,CAAC,cAAc;gBACxC,aAAa,EAAE,SAAS,CAAC,aAAa;gBACtC,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,QAAQ,EAAE,SAAS,CAAC,QAAQ;aAC7B;YACH,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAIpC,0GAA0G,EAC1G,CAAC,KAAK,CAAC,CACR,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,GAAG,EAAE,wBAAwB,KAAK,IAAI,CAAC,uBAAuB;YAAE,OAAO;QAC3E,IAAI,GAAG,EAAE,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,wBAAwB,KAAK,IAAI;YACnE,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACnC;;;yCAGmC,EACnC,CAAC,KAAK,EAAE,IAAI,CAAC,uBAAuB,CAAC,CACtC,CAAC;QACF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,wBAAwB,KAAK,IAAI,CAAC,uBAAuB;YAC3E,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAKrC,oJAAoJ,EACpJ,CAAC,KAAK,CAAC,CACR,CAAC;QACF,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,WAAW,KAAK,SAAS;YAAE,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;QAC7F,IAAI,WAAW,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YACtC,OAAO,kBAAkB,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,eAAe,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,WAA2C,CAAC;QAChD,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;QAChE,CAAC;QACD,qFAAqF;QACrF,yFAAyF;QACzF,6FAA6F;QAC7F,MAAM,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,yBAAyB,GAAG,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;QACpE,MAAM,UAAU,GACd,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7E,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAChE,MAAM,UAAU,CAAC,KAAK,CAAC,uDAAuD,EAAE;gBAC9E,4BAA4B;aAC7B,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,KAAK,CAMhC,mKAAmK,EACnK,CAAC,KAAK,CAAC,CACR,CAAC;YACF,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;YACxF,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;gBAC5E,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACjC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;YACrD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACnF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAqD,EAAE,CAAC;YACtE,MAAM,eAAe,GAAc,EAAE,CAAC;YACtC,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACvD,oBAAoB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAC3C,EAAE,CAAC;gBACF,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CACvE,oBAAoB,CACrB,CAAC;gBACF,MAAM,KAAK,GAA8B,EAAE,CAAC;gBAC5C,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,gBAAgB;oBACjD,KAAK,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;gBACrD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;gBACrE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;gBAC7E,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE;oBAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;gBACnE,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;oBACxE,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;gBACtC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBACnF,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;gBACxC,KAAK,MAAM,IAAI,IAAI,KAAK;oBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBACrE,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;gBACjD,MAAM,iBAAiB,GAAG,IAAI,CAAC;oBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,UAAU;iBACX,CAAC,CAAC;gBACH,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACxE,MAAM,oBAAoB,GAAG,IAAI,CAAC;oBAChC,iBAAiB;oBACjB,oBAAoB,EAClB,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;oBACzE,gBAAgB,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;oBAC/D,UAAU;oBACV,YAAY,EAAE,KAAK;iBACpB,CAAC,CAAC;gBACH,MAAM,UAAU,CAAC,KAAK,CACpB;;;qEAG2D,EAC3D;oBACE,KAAK;oBACL,MAAM,CAAC,OAAO;oBACd,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY;oBACjC,MAAM,CAAC,WAAW,IAAI,IAAI;oBAC1B,KAAK,IAAI,IAAI;oBACb,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;oBACxC,UAAU;oBACV,KAAK;oBACL,iBAAiB;oBACjB,oBAAoB;iBACrB,CACF,CAAC;gBACF,eAAe,CAAC,IAAI,CAAC;oBACnB,iBAAiB;oBACjB,gBAAgB,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;oBAC/D,UAAU;oBACV,YAAY,EAAE,KAAK;oBACnB,oBAAoB;iBACrB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,GAAG;gBACX,cAAc,EAAE,OAAO,CAAC,IAAI;gBAC5B,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,QAAQ;aACT,CAAC;YACF,kGAAkG;YAClG,iGAAiG;YACjG,4CAA4C;YAC5C,MAAM,4BAA4B,GAAG,IAAI,CAAC;gBACxC,QAAQ,EAAE,UAAU,CAAC,mBAAmB;gBACxC,cAAc,EAAE,yBAAyB;aAC1C,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC;gBACpB,SAAS,EAAE,cAAc;gBACzB,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,WAAW,EAAE,IAAI,CAAC,uBAAuB;gBACzC,IAAI;gBACJ,mBAAmB,EAAE,4BAA4B;gBACjD,UAAU,EAAE,eAAe;aAC5B,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,KAAK,CACtC;;;;2DAImD,EACnD;gBACE,KAAK;gBACL,QAAQ;gBACR,IAAI,CAAC,eAAe,CAAC;gBACrB,4BAA4B;gBAC5B,IAAI,CAAC,uBAAuB;gBAC5B,IAAI,CAAC,YAAY;gBACjB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aACrB,CACF,CAAC;YACF,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;gBACjC,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;YAChE,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1D,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;CACF;AAkBD,SAAS,gBAAgB,CAAC,KAAqC;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiC,CAAC;IACzD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAiC,CAAC;IAC9D,MAAM,eAAe,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACzC,MAAM,eAAe,GAAG,8BAA8B,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7E,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACtD,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC9D,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC/B,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IACnF,CAAC,CAAC,CAAC;IACH,eAAe,CAAC,IAAI,CAClB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,oBAAoB,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;QAC5D,oBAAoB,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC;QAC1D,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAC1C,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,cAAc,CAAC,KAA2B,EAAE,OAAe,EAAE,KAAa;IACjF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC/C,MAAM,eAAe,GAAG,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9D,OAAO,CACL,OAAO,CAAC,MAAM,GAAG,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO,CAAC;QACrE,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,eAAe,KAAK,KAAK,CAAC,CACjF,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-progress-postgres.d.ts

@@ -0,0 +1,41 @@
+import { type InventoryLease, type InventoryProgressRow, type PlatformAuthInventoryRemoteUser } from './platform-auth-inventory-paging.js';
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+type Connection = PlatformIdentityQueryable & {
+    release?: () => void;
+};
+type Pool = PlatformIdentityQueryable & {
+    connect?: () => Promise<Connection>;
+};
+export type InventoryLeaseClaim = {
+    readonly kind: 'leased';
+    readonly lease: InventoryLease;
+} | {
+    readonly kind: 'busy';
+    readonly progress: InventoryProgressRow;
+} | {
+    readonly kind: 'terminal';
+    readonly progress: InventoryProgressRow;
+};
+export declare class PostgresPlatformAuthInventoryProgressStore {
+    #private;
+    constructor(pool: Pool);
+    claim(runId: string): Promise<InventoryLeaseClaim>;
+    release(runId: string, leaseToken: string): Promise<void>;
+    markTerminal(runId: string, leaseToken: string): Promise<InventoryProgressRow>;
+    commitRemotePage(input: {
+        readonly runId: string;
+        readonly leaseToken: string;
+        readonly after?: string;
+        readonly users: readonly PlatformAuthInventoryRemoteUser[];
+        readonly nextAfter?: string;
+    }): Promise<{
+        readonly progress: InventoryProgressRow;
+        readonly terminal: boolean;
+    }>;
+    read(runId: string): Promise<InventoryProgressRow | undefined>;
+}
+export declare const PROGRESS_COLUMNS = "phase, remote_after, remote_page_count, remote_user_count,\n  remote_chain_hash, local_after_subject, local_source_epoch, local_snapshot_at,\n  local_subject_count, candidate_count, excluded_count, candidate_chain_hash,\n  excluded_chain_hash, artifact_counts, blocker_counts, terminal_error, lease_token_hash,\n  lease_expires_at";
+export declare function markPlatformAuthInventoryTerminal(pool: PlatformIdentityQueryable, runId: string, leaseToken: string): Promise<InventoryProgressRow>;
+export declare function lockPlatformAuthInventoryLocalProgress(pool: PlatformIdentityQueryable, runId: string, leaseToken: string): Promise<InventoryProgressRow>;
+export {};
+//# sourceMappingURL=platform-auth-inventory-progress-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-progress-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-inventory-progress-postgres.d.ts","sourceRoot":"","sources":["../src/platform-auth-inventory-progress-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,oBAAoB,EAQzB,KAAK,+BAA+B,EACrC,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,KAAK,UAAU,GAAG,yBAAyB,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE,CAAC;AACvE,KAAK,IAAI,GAAG,yBAAyB,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAA;CAAE,CAAC;AAEhF,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAA;CAAE,GAClE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAE3E,qBAAa,0CAA0C;;gBAGzC,IAAI,EAAE,IAAI;IAIhB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAuClD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASzD,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAI9E,gBAAgB,CAAC,KAAK,EAAE;QAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,+BAA+B,EAAE,CAAC;QAC3D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAsH9E,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;CAsCrE;AAED,eAAO,MAAM,gBAAgB,+UAIV,CAAC;AAEpB,wBAAsB,iCAAiC,CACrD,IAAI,EAAE,yBAAyB,EAC/B,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,oBAAoB,CAAC,CAY/B;AAED,wBAAsB,sCAAsC,CAC1D,IAAI,EAAE,yBAAyB,EAC/B,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,oBAAoB,CAAC,CAiB/B"}

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-progress-postgres.js

@@ -0,0 +1,230 @@
+import { inventoryChain, inventoryChainSeed, inventoryHash, newInventoryLeaseToken, PLATFORM_AUTH_INVENTORY_LEASE_SECONDS, PLATFORM_AUTH_INVENTORY_REMOTE_PAGE_SIZE, PLATFORM_AUTH_INVENTORY_REMOTE_USER_LIMIT, } from './platform-auth-inventory-paging.js';
+import { normalizePlatformIdentityEmail } from './platform-identity.js';
+export class PostgresPlatformAuthInventoryProgressStore {
+    #pool;
+    constructor(pool) {
+        this.#pool = pool;
+    }
+    async claim(runId) {
+        return this.#transaction(async (connection) => {
+            const run = await connection.query("SELECT state FROM identity_migration_runs WHERE id = $1 AND kind = 'inventory' FOR UPDATE", [runId]);
+            if (run.rows[0]?.state !== 'running')
+                throw new Error('inventory_run_unavailable');
+            await connection.query(`INSERT INTO platform_auth_inventory_progress
+           (migration_run_id, phase, remote_chain_hash, candidate_chain_hash, excluded_chain_hash)
+         VALUES ($1, 'remote', $2, $3, $4)
+         ON CONFLICT (migration_run_id) DO NOTHING`, [
+                runId,
+                inventoryChainSeed('remote'),
+                inventoryChainSeed('candidate'),
+                inventoryChainSeed('excluded'),
+            ]);
+            const progress = await this.#lockedProgress(connection, runId);
+            if (progress.terminal_error !== null)
+                return { kind: 'terminal', progress };
+            const token = newInventoryLeaseToken();
+            const claimed = await connection.query(`UPDATE platform_auth_inventory_progress
+            SET lease_token_hash = $2,
+                lease_expires_at = now() + ($3::text || ' seconds')::interval,
+                updated_at = now()
+          WHERE migration_run_id = $1
+            AND (lease_token_hash IS NULL OR lease_expires_at <= now())
+        RETURNING ${PROGRESS_COLUMNS}`, [runId, inventoryHash(token), PLATFORM_AUTH_INVENTORY_LEASE_SECONDS]);
+            const row = claimed.rows[0];
+            return row === undefined
+                ? { kind: 'busy', progress }
+                : { kind: 'leased', lease: { token, progress: row } };
+        });
+    }
+    async release(runId, leaseToken) {
+        await this.#pool.query(`UPDATE platform_auth_inventory_progress
+          SET lease_token_hash = NULL, lease_expires_at = NULL, updated_at = now()
+        WHERE migration_run_id = $1 AND lease_token_hash = $2`, [runId, inventoryHash(leaseToken)]);
+    }
+    async markTerminal(runId, leaseToken) {
+        return markPlatformAuthInventoryTerminal(this.#pool, runId, leaseToken);
+    }
+    async commitRemotePage(input) {
+        const normalized = normalizeRemotePage(input.users);
+        return this.#transaction(async (connection) => {
+            const progress = await this.#lockedProgress(connection, input.runId);
+            assertLease(progress, input.leaseToken, 'remote');
+            if ((progress.remote_after ?? undefined) !== input.after)
+                throw new Error('stale_inventory_lease');
+            const inputCursorFingerprint = inventoryHash(input.after ?? null);
+            const nextCursorFingerprint = input.nextAfter === undefined ? undefined : inventoryHash(input.nextAfter);
+            const invalidShape = normalized.length > PLATFORM_AUTH_INVENTORY_REMOTE_PAGE_SIZE ||
+                (normalized.length === 0 && input.nextAfter !== undefined) ||
+                (input.nextAfter !== undefined && input.nextAfter === input.after) ||
+                progress.remote_user_count + normalized.length >
+                    PLATFORM_AUTH_INVENTORY_REMOTE_USER_LIMIT ||
+                (progress.remote_user_count + normalized.length >=
+                    PLATFORM_AUTH_INVENTORY_REMOTE_USER_LIMIT &&
+                    input.nextAfter !== undefined);
+            const seenCursor = nextCursorFingerprint === undefined
+                ? false
+                : (await connection.query(`SELECT 1 FROM platform_auth_inventory_remote_pages
+                  WHERE migration_run_id = $1 AND input_cursor_fingerprint = $2 LIMIT 1`, [input.runId, nextCursorFingerprint])).rows[0] !== undefined;
+            const duplicateRemote = normalized.length === 0
+                ? false
+                : (await connection.query(`SELECT 1 FROM platform_auth_inventory_remote_users
+                  WHERE migration_run_id = $1 AND remote_user_id = ANY($2::text[]) LIMIT 1`, [input.runId, normalized.map((user) => user.id)])).rows[0] !== undefined;
+            if (invalidShape || seenCursor || duplicateRemote || duplicateIds(normalized)) {
+                const terminal = await connection.query(`UPDATE platform_auth_inventory_progress
+              SET terminal_error = 'inventory_unavailable', lease_token_hash = NULL,
+                  lease_expires_at = NULL, updated_at = now()
+            WHERE migration_run_id = $1 AND lease_token_hash = $2
+          RETURNING ${PROGRESS_COLUMNS}`, [input.runId, inventoryHash(input.leaseToken)]);
+                const row = terminal.rows[0];
+                if (row === undefined)
+                    throw new Error('stale_inventory_lease');
+                return { progress: row, terminal: true };
+            }
+            const pageNumber = progress.remote_page_count;
+            const pageFingerprint = inventoryHash({
+                inputCursorFingerprint,
+                nextCursorFingerprint,
+                users: normalized.map(remoteFingerprintEntry),
+            });
+            await connection.query(`INSERT INTO platform_auth_inventory_remote_pages
+           (migration_run_id, page_number, input_cursor_fingerprint, next_cursor,
+            next_cursor_fingerprint, row_count, page_fingerprint)
+         VALUES ($1, $2, $3, $4, $5, $6, $7)`, [
+                input.runId,
+                pageNumber,
+                inputCursorFingerprint,
+                input.nextAfter ?? null,
+                nextCursorFingerprint ?? null,
+                normalized.length,
+                pageFingerprint,
+            ]);
+            if (normalized.length > 0) {
+                await connection.query(`INSERT INTO platform_auth_inventory_remote_users
+             (migration_run_id, remote_user_id, external_id, normalized_email, verified,
+              page_number, ordinal, row_fingerprint)
+           SELECT $1, remote.id, remote.external_id, remote.email, remote.verified,
+                  $2, remote.ordinal, remote.row_fingerprint
+             FROM unnest($3::text[], $4::text[], $5::text[], $6::boolean[], $7::integer[], $8::text[])
+               AS remote(id, external_id, email, verified, ordinal, row_fingerprint)`, [
+                    input.runId,
+                    pageNumber,
+                    normalized.map((user) => user.id),
+                    normalized.map((user) => user.externalId ?? null),
+                    normalized.map((user) => user.normalizedEmail),
+                    normalized.map((user) => user.verified),
+                    normalized.map((_, ordinal) => ordinal),
+                    normalized.map((user) => inventoryHash(remoteFingerprintEntry(user))),
+                ]);
+            }
+            let chain = progress.remote_chain_hash;
+            for (const user of normalized)
+                chain = inventoryChain(chain, remoteFingerprintEntry(user));
+            const updated = await connection.query(`UPDATE platform_auth_inventory_progress
+            SET phase = $3, remote_after = $4, remote_page_count = remote_page_count + 1,
+                remote_user_count = remote_user_count + $5, remote_chain_hash = $6,
+                lease_token_hash = NULL, lease_expires_at = NULL, updated_at = now()
+          WHERE migration_run_id = $1 AND lease_token_hash = $2
+        RETURNING ${PROGRESS_COLUMNS}`, [
+                input.runId,
+                inventoryHash(input.leaseToken),
+                input.nextAfter === undefined ? 'local' : 'remote',
+                input.nextAfter ?? null,
+                normalized.length,
+                chain,
+            ]);
+            const row = updated.rows[0];
+            if (row === undefined)
+                throw new Error('stale_inventory_lease');
+            return { progress: row, terminal: false };
+        });
+    }
+    async read(runId) {
+        const result = await this.#pool.query(`SELECT ${PROGRESS_COLUMNS} FROM platform_auth_inventory_progress
+        WHERE migration_run_id = $1`, [runId]);
+        return result.rows[0];
+    }
+    async #lockedProgress(connection, runId) {
+        const result = await connection.query(`SELECT ${PROGRESS_COLUMNS} FROM platform_auth_inventory_progress
+        WHERE migration_run_id = $1 FOR UPDATE`, [runId]);
+        const row = result.rows[0];
+        if (row === undefined)
+            throw new Error('inventory_progress_unavailable');
+        return row;
+    }
+    async #transaction(task) {
+        const connection = this.#pool.connect === undefined ? this.#pool : await this.#pool.connect();
+        try {
+            await connection.query('BEGIN');
+            const result = await task(connection);
+            await connection.query('COMMIT');
+            return result;
+        }
+        catch (error) {
+            await connection.query('ROLLBACK').catch(() => undefined);
+            throw error;
+        }
+        finally {
+            connection.release?.();
+        }
+    }
+}
+export const PROGRESS_COLUMNS = `phase, remote_after, remote_page_count, remote_user_count,
+  remote_chain_hash, local_after_subject, local_source_epoch, local_snapshot_at,
+  local_subject_count, candidate_count, excluded_count, candidate_chain_hash,
+  excluded_chain_hash, artifact_counts, blocker_counts, terminal_error, lease_token_hash,
+  lease_expires_at`;
+export async function markPlatformAuthInventoryTerminal(pool, runId, leaseToken) {
+    const result = await pool.query(`UPDATE platform_auth_inventory_progress
+        SET terminal_error = 'inventory_unavailable', lease_token_hash = NULL,
+            lease_expires_at = NULL, updated_at = now()
+      WHERE migration_run_id = $1 AND lease_token_hash = $2
+    RETURNING ${PROGRESS_COLUMNS}`, [runId, inventoryHash(leaseToken)]);
+    const row = result.rows[0];
+    if (row === undefined)
+        throw new Error('stale_inventory_lease');
+    return row;
+}
+export async function lockPlatformAuthInventoryLocalProgress(pool, runId, leaseToken) {
+    const result = await pool.query(`SELECT ${PROGRESS_COLUMNS} FROM platform_auth_inventory_progress
+      WHERE migration_run_id = $1 FOR UPDATE`, [runId]);
+    const row = result.rows[0];
+    if (row === undefined ||
+        row.phase !== 'local' ||
+        row.terminal_error !== null ||
+        row.lease_token_hash !== inventoryHash(leaseToken) ||
+        row.lease_expires_at === null ||
+        new Date(row.lease_expires_at).getTime() <= Date.now())
+        throw new Error('stale_inventory_lease');
+    return row;
+}
+function normalizeRemotePage(users) {
+    return users.map((user) => {
+        if (user.id.trim() !== user.id ||
+            user.id.length === 0 ||
+            user.id.length > 256 ||
+            (user.externalId !== undefined &&
+                (user.externalId.trim() !== user.externalId || user.externalId.length === 0)))
+            throw new Error('invalid_remote_inventory_page');
+        return { ...user, normalizedEmail: normalizePlatformIdentityEmail(user.normalizedEmail) };
+    });
+}
+function remoteFingerprintEntry(user) {
+    return {
+        idFingerprint: inventoryHash(user.id),
+        externalId: user.externalId,
+        normalizedEmail: user.normalizedEmail,
+        verified: user.verified,
+    };
+}
+function duplicateIds(users) {
+    return new Set(users.map((user) => user.id)).size !== users.length;
+}
+function assertLease(progress, leaseToken, phase) {
+    if (progress.phase !== phase ||
+        progress.terminal_error !== null ||
+        progress.lease_token_hash !== inventoryHash(leaseToken) ||
+        progress.lease_expires_at === null ||
+        new Date(progress.lease_expires_at).getTime() <= Date.now())
+        throw new Error('stale_inventory_lease');
+}
+//# sourceMappingURL=platform-auth-inventory-progress-postgres.js.map