@noodleseed/one 0.63.0 → 0.64.0

package/node_modules/@noodle-borg/service/dist/platform-auth-migration-postgres.js

@@ -0,0 +1,368 @@
+import { randomUUID } from 'node:crypto';
+import { loadBoundFrozenImportCandidate } from './platform-auth-frozen-candidate-postgres.js';
+import { PlatformAuthMigrationError, } from './platform-auth-migration.js';
+import { candidateDigest, migrationHash as hash, PostgresPlatformAuthMigrationRunStore, } from './platform-auth-migration-runs-postgres.js';
+import { normalizePlatformIdentityEmail } from './platform-identity.js';
+/** Durable migration ledger adapter. It deliberately commits claims before calling an upstream directory. */
+export class PostgresPlatformAuthMigrationStore {
+    #pool;
+    #runs;
+    constructor(pool) {
+        this.#pool = pool;
+        this.#runs = new PostgresPlatformAuthMigrationRunStore(pool);
+    }
+    createRun(input) {
+        return this.#runs.createRun(input);
+    }
+    listFrozenCandidates(runId) {
+        return this.#runs.listFrozenCandidates(runId);
+    }
+    listFrozenCandidateBatch(runId, options) {
+        return this.#runs.listFrozenCandidateBatch(runId, options);
+    }
+    completeRun(runId) {
+        return this.#runs.completeRun(runId);
+    }
+    async recordBackfill(input) {
+        if (input.source.provider !== 'google' ||
+            input.source.subject !== input.principalId ||
+            input.runId === undefined ||
+            input.verifiedEmail === undefined)
+            throw new PlatformAuthMigrationError('invalid_import');
+        const connection = this.#pool.connect === undefined ? this.#pool : await this.#pool.connect();
+        try {
+            await connection.query('BEGIN');
+            await connection.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [
+                `platform-backfill-source:${hash(input.source)}`,
+            ]);
+            await connection.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [
+                `platform-backfill-principal:${hash(input.principalId)}`,
+            ]);
+            const email = normalizePlatformIdentityEmail(input.verifiedEmail);
+            await connection.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [
+                `platform-backfill-email:${hash(email)}`,
+            ]);
+            const running = await connection.query(`SELECT inventory_run_id, inventory_checksum, release_sha,
+                workos_realm_fingerprint, lineage_checksum
+           FROM identity_migration_runs
+          WHERE id = $1 AND kind = 'backfill' AND state = 'running' FOR UPDATE`, [input.runId]);
+            const run = running.rows[0];
+            if (run === undefined ||
+                run.inventory_run_id === null ||
+                run.inventory_checksum === null ||
+                run.workos_realm_fingerprint === null ||
+                run.lineage_checksum === null)
+                throw new PlatformAuthMigrationError('invalid_import');
+            const frozen = await connection.query(`SELECT candidate.principal_id, candidate.normalized_email, candidate.email_fingerprint,
+                candidate.provenance, candidate.blocker_codes, candidate.source_fingerprint,
+                candidate.candidate_fingerprint, candidate.source_realm,
+                inventory.frozen_checksum, inventory.release_sha,
+                inventory.workos_realm_fingerprint,
+                inventory.source_fingerprint AS source_set_fingerprint
+           FROM platform_auth_inventory_candidates candidate
+           JOIN identity_migration_runs inventory ON inventory.id = candidate.migration_run_id
+          WHERE candidate.migration_run_id = $1 AND candidate.source_subject = $2
+            AND inventory.kind = 'inventory' AND inventory.state = 'completed'
+          FOR UPDATE`, [run.inventory_run_id, input.source.subject]);
+            const candidate = frozen.rows[0];
+            if (candidate === undefined ||
+                candidate.frozen_checksum !== run.inventory_checksum ||
+                candidate.release_sha !== run.release_sha ||
+                candidate.source_realm !== input.source.realm ||
+                candidate.workos_realm_fingerprint !== run.workos_realm_fingerprint ||
+                candidate.source_set_fingerprint === null ||
+                run.lineage_checksum !==
+                    hash({
+                        inventoryRunHash: hash(run.inventory_run_id),
+                        inventoryChecksum: run.inventory_checksum,
+                        candidateSetChecksum: candidate.source_set_fingerprint,
+                        workosRealmFingerprint: run.workos_realm_fingerprint,
+                        releaseSha: run.release_sha,
+                    }) ||
+                candidate.normalized_email !== email ||
+                candidate.email_fingerprint !== hash(email) ||
+                candidate.blocker_codes.length !== 0 ||
+                candidate.candidate_fingerprint !== candidateDigest(candidate))
+                throw new PlatformAuthMigrationError('invalid_import');
+            const existing = await connection.query(`SELECT principal_id, source_fingerprint, verified_email_fingerprint FROM identity_backfill_ledger
+       WHERE source_provider = $1 AND source_realm = $2 AND source_subject = $3`, [input.source.provider, input.source.realm, input.source.subject]);
+            if (existing.rows[0] !== undefined && existing.rows[0].principal_id !== input.principalId)
+                throw new PlatformAuthMigrationError('source_remap_forbidden');
+            if (existing.rows[0] !== undefined) {
+                // Verified-email evidence is immutable migration lineage. A recovery needs a separately
+                // audited dual-auth/manual-evidence ceremony; a fresh inventory must not reinterpret it.
+                if (existing.rows[0].source_fingerprint !== hash(input.source) ||
+                    existing.rows[0].verified_email_fingerprint !==
+                        hash(normalizePlatformIdentityEmail(input.verifiedEmail)))
+                    throw new PlatformAuthMigrationError('source_remap_forbidden');
+            }
+            await connection.query(`INSERT INTO platform_principals
+           (principal_id, status, billing_identity_issuer, billing_subject)
+         VALUES ($1, 'active', 'https://accounts.google.com', $1)
+         ON CONFLICT (principal_id) DO NOTHING`, [input.principalId]);
+            const principal = await connection.query('SELECT status, billing_identity_issuer, billing_subject FROM platform_principals WHERE principal_id = $1 FOR UPDATE', [input.principalId]);
+            if (principal.rows[0] === undefined ||
+                principal.rows[0].billing_identity_issuer !== 'https://accounts.google.com' ||
+                principal.rows[0].billing_subject !== input.source.subject)
+                throw new PlatformAuthMigrationError('source_remap_forbidden');
+            if (principal.rows[0].status !== 'active')
+                throw new PlatformAuthMigrationError('invalid_import');
+            await connection.query(`INSERT INTO platform_identity_links (provider, realm, external_id, principal_id)
+         VALUES ('google', $1, $2, $3)
+         ON CONFLICT (provider, realm, external_id) DO NOTHING`, [input.source.realm, input.source.subject, input.principalId]);
+            const link = await connection.query(`SELECT principal_id, disabled_at FROM platform_identity_links
+          WHERE provider = 'google' AND realm = $1 AND external_id = $2 FOR UPDATE`, [input.source.realm, input.source.subject]);
+            if (link.rows[0]?.principal_id !== input.principalId || link.rows[0].disabled_at !== null)
+                throw new PlatformAuthMigrationError('source_remap_forbidden');
+            await connection.query(`INSERT INTO platform_verified_emails
+           (principal_id, original_email, normalized_email, provider, realm)
+         VALUES ($1, $2, $3, 'google', $4)
+         ON CONFLICT (principal_id, normalized_email, provider, realm) DO NOTHING`, [input.principalId, input.verifiedEmail, email, input.source.realm]);
+            const emailEvidence = await connection.query(`SELECT
+           (SELECT count(*)::text FROM platform_verified_emails
+             WHERE principal_id = $1 AND provider = 'google' AND realm = $2
+               AND status = 'active') AS current_google,
+           (SELECT count(*)::text FROM platform_verified_emails
+             WHERE principal_id = $1 AND provider = 'google' AND realm = $2
+               AND status = 'active' AND normalized_email = $3) AS exact,
+           (SELECT count(DISTINCT principal_id)::text FROM platform_verified_emails
+             WHERE status = 'active' AND normalized_email = $3) AS global_principals`, [input.principalId, input.source.realm, email]);
+            if (Number(emailEvidence.rows[0]?.current_google ?? 0) !== 1 ||
+                Number(emailEvidence.rows[0]?.exact ?? 0) !== 1 ||
+                Number(emailEvidence.rows[0]?.global_principals ?? 0) !== 1)
+                throw new PlatformAuthMigrationError('source_remap_forbidden');
+            if (existing.rows[0] !== undefined) {
+                await connection.query('COMMIT');
+                return 'already_backfilled';
+            }
+            const inserted = await connection.query(`INSERT INTO identity_backfill_ledger
+        (source_provider, source_realm, source_subject, principal_id, migration_run_id, source_fingerprint, verified_email_fingerprint)
+       VALUES ($1, $2, $3, $4, $5, $6, $7)
+       ON CONFLICT (source_provider, source_realm, source_subject) DO NOTHING RETURNING principal_id`, [
+                input.source.provider,
+                input.source.realm,
+                input.source.subject,
+                input.principalId,
+                input.runId ?? null,
+                hash(input.source),
+                hash(input.verifiedEmail === undefined
+                    ? ''
+                    : normalizePlatformIdentityEmail(input.verifiedEmail)),
+            ]);
+            if (inserted.rows[0] !== undefined) {
+                await connection.query('COMMIT');
+                return 'backfilled';
+            }
+            const raced = await connection.query(`SELECT principal_id FROM identity_backfill_ledger
+       WHERE source_provider = $1 AND source_realm = $2 AND source_subject = $3`, [input.source.provider, input.source.realm, input.source.subject]);
+            if (raced.rows[0]?.principal_id !== input.principalId)
+                throw new PlatformAuthMigrationError('source_remap_forbidden');
+            await connection.query('COMMIT');
+            return 'already_backfilled';
+        }
+        catch (error) {
+            await connection.query('ROLLBACK').catch(() => undefined);
+            throw error;
+        }
+        finally {
+            connection.release?.();
+        }
+    }
+    async claimImport(input, options = {}) {
+        const email = normalizePlatformIdentityEmail(input.verifiedEmail);
+        if (input.principalId.length === 0 ||
+            input.principalId.length > 64 ||
+            input.realm.trim().length === 0)
+            throw new PlatformAuthMigrationError('invalid_import');
+        const leaseToken = randomUUID();
+        const connection = this.#pool.connect === undefined ? this.#pool : await this.#pool.connect();
+        try {
+            await connection.query('BEGIN ISOLATION LEVEL REPEATABLE READ');
+            await connection.query('LOCK TABLE platform_principals, platform_identity_links, platform_verified_emails IN SHARE MODE');
+            const runResult = await connection.query(`SELECT kind, release_sha, workos_realm_fingerprint, inventory_run_id,
+                inventory_checksum, lineage_checksum
+           FROM identity_migration_runs
+          WHERE id = $1 AND kind IN ('import', 'reconcile') AND state = 'running' FOR UPDATE`, [input.runId]);
+            const run = runResult.rows[0];
+            const realm = input.realm.trim();
+            if (run === undefined ||
+                run.inventory_run_id === null ||
+                run.inventory_checksum === null ||
+                run.lineage_checksum === null ||
+                run.workos_realm_fingerprint !== hash(realm))
+                throw new PlatformAuthMigrationError('reconciliation_drift');
+            const candidate = await loadBoundFrozenImportCandidate(connection, {
+                inventoryRunId: run.inventory_run_id,
+                inventoryChecksum: run.inventory_checksum,
+                releaseSha: run.release_sha,
+                workosRealmFingerprint: run.workos_realm_fingerprint,
+                lineageChecksum: run.lineage_checksum,
+                principalId: input.principalId,
+                normalizedEmail: email,
+            });
+            const principal = await connection.query(`SELECT status, billing_identity_issuer, billing_subject
+           FROM platform_principals WHERE principal_id = $1`, [input.principalId]);
+            const exactPrincipal = principal.rows[0];
+            if (exactPrincipal?.status !== 'active' ||
+                exactPrincipal.billing_identity_issuer !== 'https://accounts.google.com' ||
+                exactPrincipal.billing_subject !== input.principalId)
+                throw new PlatformAuthMigrationError('reconciliation_drift');
+            const links = await connection.query(`SELECT count(*) FILTER (WHERE disabled_at IS NULL)::text AS enabled,
+                count(*) FILTER (WHERE disabled_at IS NULL AND realm = $2
+                  AND external_id = $1)::text AS exact
+           FROM platform_identity_links
+          WHERE provider = 'google' AND principal_id = $1`, [input.principalId, candidate.source_realm]);
+            if (Number(links.rows[0]?.enabled ?? 0) !== 1 || Number(links.rows[0]?.exact ?? 0) !== 1)
+                throw new PlatformAuthMigrationError('reconciliation_drift');
+            const emails = await connection.query(`SELECT
+           (SELECT count(*)::text FROM platform_verified_emails
+             WHERE principal_id = $1 AND provider = 'google' AND realm = $2
+               AND status = 'active') AS current_google,
+           (SELECT count(*)::text FROM platform_verified_emails
+             WHERE principal_id = $1 AND provider = 'google' AND realm = $2
+               AND status = 'active' AND normalized_email = $3) AS exact,
+           (SELECT count(DISTINCT principal_id)::text FROM platform_verified_emails
+             WHERE status = 'active' AND normalized_email = $3) AS global_principals`, [input.principalId, candidate.source_realm, email]);
+            if (Number(emails.rows[0]?.current_google ?? 0) !== 1 ||
+                Number(emails.rows[0]?.exact ?? 0) !== 1 ||
+                Number(emails.rows[0]?.global_principals ?? 0) !== 1)
+                throw new PlatformAuthMigrationError('reconciliation_drift');
+            const existing = await connection.query(`SELECT ledger.migration_run_id, ledger.realm, ledger.normalized_email,
+                ledger.email_fingerprint, ledger.external_id, ledger.state, ledger.lease_token,
+                ledger.lease_expires_at, ledger.retry_at, ledger.attempt_count,
+                prior.lineage_checksum
+           FROM workos_import_ledger ledger
+           LEFT JOIN identity_migration_runs prior ON prior.id = ledger.migration_run_id
+          WHERE ledger.principal_id = $1 FOR UPDATE OF ledger`, [input.principalId]);
+            const previous = existing.rows[0];
+            if (previous !== undefined &&
+                (previous.realm !== realm ||
+                    previous.normalized_email !== email ||
+                    previous.email_fingerprint !== hash(email) ||
+                    previous.external_id !== input.principalId ||
+                    (previous.migration_run_id !== input.runId &&
+                        (run.kind !== 'reconcile' || previous.lineage_checksum !== run.lineage_checksum))))
+                throw new PlatformAuthMigrationError('reconciliation_drift');
+            if (previous !== undefined &&
+                (previous.state === 'linked' ||
+                    ((previous.state === 'blocked' || previous.state === 'failed') &&
+                        options.terminalRetry !== 'explicit_operator_reconcile')))
+                throw new PlatformAuthMigrationError('stale_lease');
+            const now = Date.now();
+            if (previous !== undefined &&
+                ((previous.lease_token !== null &&
+                    (previous.lease_expires_at === null || previous.lease_expires_at.getTime() > now)) ||
+                    (previous.retry_at !== null && previous.retry_at.getTime() > now)))
+                throw new PlatformAuthMigrationError('stale_lease');
+            const attempt = (previous?.attempt_count ?? 0) + 1;
+            if (previous === undefined) {
+                await connection.query(`INSERT INTO workos_import_ledger
+             (principal_id, migration_run_id, realm, normalized_email, email_fingerprint,
+              external_id, state, lease_token, lease_expires_at, attempt_count, retry_at, updated_at)
+           VALUES ($1, $2, $3, $4, $5, $1, 'pending', $6,
+                   now() + interval '30 seconds', 1, NULL, now())`, [input.principalId, input.runId, realm, email, hash(email), leaseToken]);
+            }
+            else {
+                await connection.query(`UPDATE workos_import_ledger
+              SET migration_run_id = $2, lease_token = $3,
+                  lease_expires_at = now() + interval '30 seconds',
+                  attempt_count = $4, retry_at = NULL, updated_at = now()
+            WHERE principal_id = $1`, [input.principalId, input.runId, leaseToken, attempt]);
+            }
+            await connection.query('COMMIT');
+            return {
+                key: `${input.runId}\0${realm}\0${input.principalId}`,
+                leaseToken,
+                attempt,
+            };
+        }
+        catch (error) {
+            await connection.query('ROLLBACK').catch(() => undefined);
+            if (postgresCode(error) === '23505')
+                throw new PlatformAuthMigrationError('reconciliation_drift');
+            throw error;
+        }
+        finally {
+            connection.release?.();
+        }
+    }
+    async finishImport(lease, result) {
+        const { runId, realm, principalId } = parseLeaseKey(lease.key);
+        if (result.state === 'linked' && result.remoteUserId === undefined)
+            throw new PlatformAuthMigrationError('invalid_import');
+        if (result.retryAt !== undefined &&
+            (result.state !== 'reconcile_required' || !Number.isFinite(Date.parse(result.retryAt))))
+            throw new PlatformAuthMigrationError('invalid_import');
+        if (result.state === 'linked') {
+            const conflict = await this.#pool.query(`SELECT principal_id FROM platform_identity_links
+         WHERE provider = 'workos' AND realm = $1 AND external_id = $2`, [realm, result.remoteUserId]);
+            if (conflict.rows[0] !== undefined && conflict.rows[0].principal_id !== principalId)
+                throw new PlatformAuthMigrationError('reconciliation_drift');
+            const principalRealm = await this.#pool.query(`SELECT external_id FROM platform_identity_links
+         WHERE provider = 'workos' AND realm = $1 AND principal_id = $2`, [realm, principalId]);
+            if (principalRealm.rows[0] !== undefined &&
+                principalRealm.rows[0].external_id !== result.remoteUserId)
+                throw new PlatformAuthMigrationError('reconciliation_drift');
+        }
+        const row = await this.#pool.query(`WITH existing_link AS (
+         SELECT principal_id FROM platform_identity_links
+          WHERE provider = 'workos' AND realm = $2 AND external_id = $6 AND principal_id = $3
+       ), linked AS (
+         INSERT INTO platform_identity_links (provider, realm, external_id, principal_id)
+         SELECT 'workos', $2, $6, $3 WHERE $5 = 'linked' AND EXISTS (
+           SELECT 1 FROM workos_import_ledger
+            WHERE principal_id = $3 AND realm = $2 AND migration_run_id = $1
+              AND lease_token = $4 AND attempt_count = $7 AND lease_expires_at > now()
+         )
+         ON CONFLICT (provider, realm, external_id) DO NOTHING
+         RETURNING principal_id
+       ), link_ok AS (
+         SELECT principal_id FROM existing_link UNION ALL SELECT principal_id FROM linked
+       ), updated AS (
+         UPDATE workos_import_ledger
+            SET state = $5, remote_user_id = $6,
+                linked_at = CASE WHEN $5 = 'linked' THEN now() ELSE linked_at END,
+                outcome_code = $5,
+                retry_at = CASE WHEN $5 = 'reconcile_required'
+                  THEN COALESCE($10::timestamptz, now()) ELSE NULL END,
+                lease_token = NULL, lease_expires_at = NULL, updated_at = now()
+          WHERE principal_id = $3 AND realm = $2 AND migration_run_id = $1
+            AND lease_token = $4 AND attempt_count = $7 AND lease_expires_at > now()
+            AND ($5 <> 'linked' OR EXISTS (SELECT 1 FROM link_ok WHERE principal_id = $3))
+          RETURNING principal_id, state, attempt_count, email_fingerprint, external_id, retry_at
+       ) INSERT INTO workos_import_attempt_evidence
+          (principal_id, principal_fingerprint, migration_run_id, attempt, outcome_code,
+           external_id_fingerprint, email_fingerprint, retry_at)
+       SELECT NULL, $9, $1, attempt_count, $5, $8, email_fingerprint, retry_at FROM updated
+       RETURNING outcome_code AS state`, [
+            runId,
+            realm,
+            principalId,
+            lease.leaseToken,
+            result.state,
+            result.remoteUserId ?? null,
+            lease.attempt,
+            hash(principalId),
+            hash(principalId),
+            result.retryAt ?? null,
+        ]);
+        if (row.rows[0] === undefined)
+            throw new PlatformAuthMigrationError('stale_lease');
+        return { state: row.rows[0].state };
+    }
+}
+function postgresCode(error) {
+    return typeof error === 'object' && error !== null && 'code' in error
+        ? String(error.code)
+        : undefined;
+}
+function parseLeaseKey(key) {
+    const [runId, realm, principalId, extra] = key.split('\0');
+    if (runId === undefined ||
+        realm === undefined ||
+        principalId === undefined ||
+        extra !== undefined)
+        throw new PlatformAuthMigrationError('invalid_import');
+    return { runId, realm, principalId };
+}
+//# sourceMappingURL=platform-auth-migration-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-migration-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-migration-postgres.js","sourceRoot":"","sources":["../src/platform-auth-migration-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,8CAA8C,CAAC;AAC9F,OAAO,EAGL,0BAA0B,GAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,eAAe,EACf,aAAa,IAAI,IAAI,EAKrB,qCAAqC,GACtC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAWxE,6GAA6G;AAC7G,MAAM,OAAO,kCAAkC;IACpC,KAAK,CAEZ;IACO,KAAK,CAAwC;IAEtD,YACE,IAEC;QAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,IAAI,qCAAqC,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;IAED,SAAS,CAAC,KAAoC;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,oBAAoB,CAAC,KAAa;QAChC,OAAO,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,wBAAwB,CACtB,KAAa,EACb,OAIC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KASpB;QACC,IACE,KAAK,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAClC,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,WAAW;YAC1C,KAAK,CAAC,KAAK,KAAK,SAAS;YACzB,KAAK,CAAC,aAAa,KAAK,SAAS;YAEjC,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;QACzD,MAAM,UAAU,GACd,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7E,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,MAAM,UAAU,CAAC,KAAK,CAAC,uDAAuD,EAAE;gBAC9E,4BAA4B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;aACjD,CAAC,CAAC;YACH,MAAM,UAAU,CAAC,KAAK,CAAC,uDAAuD,EAAE;gBAC9E,+BAA+B,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;aACzD,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,8BAA8B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAClE,MAAM,UAAU,CAAC,KAAK,CAAC,uDAAuD,EAAE;gBAC9E,2BAA2B,IAAI,CAAC,KAAK,CAAC,EAAE;aACzC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAOpC;;;+EAGuE,EACvE,CAAC,KAAK,CAAC,KAAK,CAAC,CACd,CAAC;YACF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,IACE,GAAG,KAAK,SAAS;gBACjB,GAAG,CAAC,gBAAgB,KAAK,IAAI;gBAC7B,GAAG,CAAC,kBAAkB,KAAK,IAAI;gBAC/B,GAAG,CAAC,wBAAwB,KAAK,IAAI;gBACrC,GAAG,CAAC,gBAAgB,KAAK,IAAI;gBAE7B,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAcnC;;;;;;;;;;qBAUa,EACb,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAC7C,CAAC;YACF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjC,IACE,SAAS,KAAK,SAAS;gBACvB,SAAS,CAAC,eAAe,KAAK,GAAG,CAAC,kBAAkB;gBACpD,SAAS,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW;gBACzC,SAAS,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM,CAAC,KAAK;gBAC7C,SAAS,CAAC,wBAAwB,KAAK,GAAG,CAAC,wBAAwB;gBACnE,SAAS,CAAC,sBAAsB,KAAK,IAAI;gBACzC,GAAG,CAAC,gBAAgB;oBAClB,IAAI,CAAC;wBACH,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;wBAC5C,iBAAiB,EAAE,GAAG,CAAC,kBAAkB;wBACzC,oBAAoB,EAAE,SAAS,CAAC,sBAAsB;wBACtD,sBAAsB,EAAE,GAAG,CAAC,wBAAwB;wBACpD,UAAU,EAAE,GAAG,CAAC,WAAW;qBAC5B,CAAC;gBACJ,SAAS,CAAC,gBAAgB,KAAK,KAAK;gBACpC,SAAS,CAAC,iBAAiB,KAAK,IAAI,CAAC,KAAK,CAAC;gBAC3C,SAAS,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;gBACpC,SAAS,CAAC,qBAAqB,KAAK,eAAe,CAAC,SAAS,CAAC;gBAE9D,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAKrC;gFACwE,EACxE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAClE,CAAC;YACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,KAAK,CAAC,WAAW;gBACvF,MAAM,IAAI,0BAA0B,CAAC,wBAAwB,CAAC,CAAC;YACjE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACnC,wFAAwF;gBACxF,yFAAyF;gBACzF,IACE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBAC1D,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,0BAA0B;wBACzC,IAAI,CAAC,8BAA8B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;oBAE3D,MAAM,IAAI,0BAA0B,CAAC,wBAAwB,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,UAAU,CAAC,KAAK,CACpB;;;+CAGuC,EACvC,CAAC,KAAK,CAAC,WAAW,CAAC,CACpB,CAAC;YACF,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,KAAK,CAKtC,qHAAqH,EACrH,CAAC,KAAK,CAAC,WAAW,CAAC,CACpB,CAAC;YACF,IACE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;gBAC/B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,KAAK,6BAA6B;gBAC3E,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO;gBAE1D,MAAM,IAAI,0BAA0B,CAAC,wBAAwB,CAAC,CAAC;YACjE,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ;gBACvC,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;YACzD,MAAM,UAAU,CAAC,KAAK,CACpB;;+DAEuD,EACvD,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAC9D,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,CAIjC;mFAC2E,EAC3E,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAC3C,CAAC;YACF,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,KAAK,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI;gBACvF,MAAM,IAAI,0BAA0B,CAAC,wBAAwB,CAAC,CAAC;YACjE,MAAM,UAAU,CAAC,KAAK,CACpB;;;kFAG0E,EAC1E,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CACpE,CAAC;YACF,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,KAAK,CAK1C;;;;;;;;qFAQ6E,EAC7E,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAC/C,CAAC;YACF,IACE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,IAAI,CAAC,CAAC,KAAK,CAAC;gBACxD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC;gBAC/C,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,IAAI,CAAC,CAAC,KAAK,CAAC;gBAE3D,MAAM,IAAI,0BAA0B,CAAC,wBAAwB,CAAC,CAAC;YACjE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACjC,OAAO,oBAAoB,CAAC;YAC9B,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CACrC;;;qGAG6F,EAC7F;gBACE,KAAK,CAAC,MAAM,CAAC,QAAQ;gBACrB,KAAK,CAAC,MAAM,CAAC,KAAK;gBAClB,KAAK,CAAC,MAAM,CAAC,OAAO;gBACpB,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,KAAK,IAAI,IAAI;gBACnB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBAClB,IAAI,CACF,KAAK,CAAC,aAAa,KAAK,SAAS;oBAC/B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,8BAA8B,CAAC,KAAK,CAAC,aAAa,CAAC,CACxD;aACF,CACF,CAAC;YACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACjC,OAAO,YAAY,CAAC;YACtB,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,KAAK,CAClC;gFACwE,EACxE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAClE,CAAC;YACF,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,KAAK,KAAK,CAAC,WAAW;gBACnD,MAAM,IAAI,0BAA0B,CAAC,wBAAwB,CAAC,CAAC;YACjE,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,oBAAoB,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1D,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,KAA8B,EAC9B,UAAsE,EAAE;QAExE,MAAM,KAAK,GAAG,8BAA8B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAClE,IACE,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;YAC9B,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,EAAE;YAC7B,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAE/B,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;QAChC,MAAM,UAAU,GACd,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7E,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAChE,MAAM,UAAU,CAAC,KAAK,CACpB,iGAAiG,CAClG,CAAC;YACF,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,KAAK,CAQtC;;;6FAGqF,EACrF,CAAC,KAAK,CAAC,KAAK,CAAC,CACd,CAAC;YACF,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACjC,IACE,GAAG,KAAK,SAAS;gBACjB,GAAG,CAAC,gBAAgB,KAAK,IAAI;gBAC7B,GAAG,CAAC,kBAAkB,KAAK,IAAI;gBAC/B,GAAG,CAAC,gBAAgB,KAAK,IAAI;gBAC7B,GAAG,CAAC,wBAAwB,KAAK,IAAI,CAAC,KAAK,CAAC;gBAE5C,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;YAC/D,MAAM,SAAS,GAAG,MAAM,8BAA8B,CAAC,UAAU,EAAE;gBACjE,cAAc,EAAE,GAAG,CAAC,gBAAgB;gBACpC,iBAAiB,EAAE,GAAG,CAAC,kBAAkB;gBACzC,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,sBAAsB,EAAE,GAAG,CAAC,wBAAwB;gBACpD,eAAe,EAAE,GAAG,CAAC,gBAAgB;gBACrC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,eAAe,EAAE,KAAK;aACvB,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,KAAK,CAKtC;4DACoD,EACpD,CAAC,KAAK,CAAC,WAAW,CAAC,CACpB,CAAC;YACF,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzC,IACE,cAAc,EAAE,MAAM,KAAK,QAAQ;gBACnC,cAAc,CAAC,uBAAuB,KAAK,6BAA6B;gBACxE,cAAc,CAAC,eAAe,KAAK,KAAK,CAAC,WAAW;gBAEpD,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,KAAK,CAIlC;;;;0DAIkD,EAClD,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,YAAY,CAAC,CAC5C,CAAC;YACF,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC;gBACtF,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAKnC;;;;;;;;qFAQ6E,EAC7E,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,CACnD,CAAC;YACF,IACE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,IAAI,CAAC,CAAC,KAAK,CAAC;gBACjD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC;gBACxC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,IAAI,CAAC,CAAC,KAAK,CAAC;gBAEpD,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAarC;;;;;;8DAMsD,EACtD,CAAC,KAAK,CAAC,WAAW,CAAC,CACpB,CAAC;YACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClC,IACE,QAAQ,KAAK,SAAS;gBACtB,CAAC,QAAQ,CAAC,KAAK,KAAK,KAAK;oBACvB,QAAQ,CAAC,gBAAgB,KAAK,KAAK;oBACnC,QAAQ,CAAC,iBAAiB,KAAK,IAAI,CAAC,KAAK,CAAC;oBAC1C,QAAQ,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;oBAC1C,CAAC,QAAQ,CAAC,gBAAgB,KAAK,KAAK,CAAC,KAAK;wBACxC,CAAC,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,QAAQ,CAAC,gBAAgB,KAAK,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBAEtF,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;YAC/D,IACE,QAAQ,KAAK,SAAS;gBACtB,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ;oBAC1B,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC;wBAC5D,OAAO,CAAC,aAAa,KAAK,6BAA6B,CAAC,CAAC;gBAE7D,MAAM,IAAI,0BAA0B,CAAC,aAAa,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IACE,QAAQ,KAAK,SAAS;gBACtB,CAAC,CAAC,QAAQ,CAAC,WAAW,KAAK,IAAI;oBAC7B,CAAC,QAAQ,CAAC,gBAAgB,KAAK,IAAI,IAAI,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,CAAC;oBAClF,CAAC,QAAQ,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,CAAC;gBAEpE,MAAM,IAAI,0BAA0B,CAAC,aAAa,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACnD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,UAAU,CAAC,KAAK,CACpB;;;;kEAIwD,EACxD,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,CACxE,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,UAAU,CAAC,KAAK,CACpB;;;;oCAI0B,EAC1B,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CACtD,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO;gBACL,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,KAAK,KAAK,KAAK,KAAK,CAAC,WAAW,EAAE;gBACrD,UAAU;gBACV,OAAO;aACR,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1D,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,OAAO;gBACjC,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;YAC/D,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,KAA8B,EAC9B,MAIC;QAID,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;YAChE,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;QACzD,IACE,MAAM,CAAC,OAAO,KAAK,SAAS;YAC5B,CAAC,MAAM,CAAC,KAAK,KAAK,oBAAoB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAEvF,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACrC;uEAC+D,EAC/D,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,CAC7B,CAAC;YACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,WAAW;gBACjF,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;YAC/D,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAC3C;wEACgE,EAChE,CAAC,KAAK,EAAE,WAAW,CAAC,CACrB,CAAC;YACF,IACE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;gBACpC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,YAAY;gBAE1D,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAChC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uCA8BiC,EACjC;YACE,KAAK;YACL,KAAK;YACL,WAAW;YACX,KAAK,CAAC,UAAU;YAChB,MAAM,CAAC,KAAK;YACZ,MAAM,CAAC,YAAY,IAAI,IAAI;YAC3B,KAAK,CAAC,OAAO;YACb,IAAI,CAAC,WAAW,CAAC;YACjB,IAAI,CAAC,WAAW,CAAC;YACjB,MAAM,CAAC,OAAO,IAAI,IAAI;SACvB,CACF,CAAC;QACF,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,0BAA0B,CAAC,aAAa,CAAC,CAAC;QACnF,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IACtC,CAAC;CACF;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK;QACnE,CAAC,CAAC,MAAM,CAAE,KAAqC,CAAC,IAAI,CAAC;QACrD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAKhC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3D,IACE,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,SAAS;QACnB,WAAW,KAAK,SAAS;QACzB,KAAK,KAAK,SAAS;QAEnB,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;IACzD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AACvC,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-migration-runs-postgres.d.ts

@@ -0,0 +1,86 @@
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+export type PlatformAuthMigrationRunKind = 'inventory' | 'backfill' | 'import' | 'reconcile';
+export type PlatformAuthMigrationRunInput = {
+    readonly runId: string;
+    readonly releaseSha: string;
+    readonly workosRealm: string;
+    readonly actorFingerprint: string;
+} & ({
+    readonly kind: 'inventory';
+} | {
+    readonly kind: 'backfill' | 'import' | 'reconcile';
+    readonly inventoryRunId: string;
+    readonly inventoryChecksum: string;
+});
+export interface PlatformAuthMigrationRun {
+    readonly runId: string;
+    readonly kind: PlatformAuthMigrationRunKind;
+    readonly state: 'running' | 'completed';
+    readonly lineageChecksum: string;
+    readonly inventoryRunId?: string;
+    readonly inventoryChecksum?: string;
+}
+export interface PlatformAuthFrozenCandidate {
+    readonly source: {
+        readonly provider: 'google';
+        readonly realm: string;
+        readonly subject: string;
+    };
+    readonly principalId: string;
+    readonly verifiedEmail: string;
+    readonly candidateFingerprint: string;
+}
+export interface PlatformAuthFrozenCandidatePage {
+    readonly candidates: readonly PlatformAuthFrozenCandidate[];
+    readonly nextAfterFingerprint?: string;
+}
+export interface FrozenCandidateRow {
+    readonly source_subject: string;
+    readonly source_realm: string | null;
+    readonly principal_id: string | null;
+    readonly normalized_email: string | null;
+    readonly email_fingerprint: string | null;
+    readonly provenance: readonly string[];
+    readonly blocker_codes: readonly string[];
+    readonly source_fingerprint: string;
+    readonly candidate_fingerprint: string | null;
+}
+type Connection = PlatformIdentityQueryable & {
+    release?: () => void;
+};
+type Pool = PlatformIdentityQueryable & {
+    connect?: () => Promise<Connection>;
+};
+export declare class PostgresPlatformAuthMigrationRunStore {
+    #private;
+    constructor(pool: Pool);
+    createRun(input: PlatformAuthMigrationRunInput): Promise<PlatformAuthMigrationRun>;
+    listFrozenCandidates(runId: string): Promise<readonly PlatformAuthFrozenCandidate[]>;
+    listFrozenCandidateBatch(runId: string, options: {
+        readonly limit: number;
+        readonly afterFingerprint?: string;
+        readonly eligibility?: 'all' | 'actionable' | 'operator_reconcile';
+    }): Promise<PlatformAuthFrozenCandidatePage>;
+    completeRun(runId: string): Promise<PlatformAuthMigrationRun>;
+}
+export declare function loadFrozenInventory(pool: PlatformIdentityQueryable, expected: {
+    readonly inventoryRunId: string;
+    readonly inventoryChecksum: string;
+    readonly releaseSha: string;
+    readonly workosRealmFingerprint: string;
+    readonly requireBlockerFree: boolean;
+}): Promise<{
+    readonly googleRealm: string;
+    readonly lineageChecksum: string;
+    readonly candidates: readonly FrozenCandidateRow[];
+}>;
+export declare function candidateDigest(candidate: {
+    readonly principal_id: string | null;
+    readonly email_fingerprint: string | null;
+    readonly provenance: readonly string[];
+    readonly blocker_codes: readonly string[];
+    readonly source_fingerprint: string;
+}): string;
+export declare function migrationHash(value: unknown): string;
+export {};
+//# sourceMappingURL=platform-auth-migration-runs-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-migration-runs-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-migration-runs-postgres.d.ts","sourceRoot":"","sources":["../src/platform-auth-migration-runs-postgres.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,MAAM,MAAM,4BAA4B,GAAG,WAAW,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,CAAC;AAC7F,MAAM,MAAM,6BAA6B,GAAG;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC,GAAG,CACA;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,GAAG,WAAW,CAAC;IACnD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC,CACJ,CAAC;AACF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,WAAW,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AACD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AACD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,UAAU,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAC5D,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/C;AAED,KAAK,UAAU,GAAG,yBAAyB,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE,CAAC;AACvE,KAAK,IAAI,GAAG,yBAAyB,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAA;CAAE,CAAC;AAEhF,qBAAa,qCAAqC;;gBAGpC,IAAI,EAAE,IAAI;IAIhB,SAAS,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAsFlF,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,2BAA2B,EAAE,CAAC;IAQpF,wBAAwB,CAC5B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;QACP,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,GAAG,YAAY,GAAG,oBAAoB,CAAC;KACpE,GACA,OAAO,CAAC,+BAA+B,CAAC;IAiDrC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAwEpE;AAsBD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,yBAAyB,EAC/B,QAAQ,EAAE;IACR,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;CACtC,GACA,OAAO,CAAC;IACT,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACpD,CAAC,CA+GD;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC,GAAG,MAAM,CAST;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD"}