@noodleseed/one 0.63.0 → 0.64.0

package/node_modules/@noodle-borg/service/dist/platform-auth-migration-runs-postgres.js

@@ -0,0 +1,474 @@
+import { createHash } from 'node:crypto';
+import { inventoryChain, inventoryChainSeed } from './platform-auth-inventory-paging.js';
+import { PlatformAuthMigrationError } from './platform-auth-migration.js';
+export class PostgresPlatformAuthMigrationRunStore {
+    #pool;
+    constructor(pool) {
+        this.#pool = pool;
+    }
+    async createRun(input) {
+        validateRunInput(input);
+        const requestFingerprint = migrationHash(input);
+        const connection = this.#pool.connect === undefined ? this.#pool : await this.#pool.connect();
+        try {
+            await connection.query('BEGIN');
+            await connection.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [
+                `platform-auth-run:${migrationHash(input.runId)}`,
+            ]);
+            const existing = await connection.query(`SELECT kind, state, release_sha, request_fingerprint, lineage_checksum,
+                workos_realm_fingerprint, inventory_run_id, inventory_checksum
+           FROM identity_migration_runs WHERE id = $1 FOR UPDATE`, [input.runId]);
+            const prior = existing.rows[0];
+            if (prior !== undefined) {
+                if (prior.request_fingerprint !== requestFingerprint ||
+                    prior.lineage_checksum === null ||
+                    (prior.state !== 'running' && prior.state !== 'completed'))
+                    throw new PlatformAuthMigrationError('idempotency_conflict');
+                await connection.query('COMMIT');
+                return runResult(input.runId, prior, prior.lineage_checksum);
+            }
+            const realmFingerprint = migrationHash(input.workosRealm);
+            let lineageChecksum = migrationHash({
+                kind: input.kind,
+                releaseSha: input.releaseSha,
+                workosRealmFingerprint: realmFingerprint,
+            });
+            let inventoryRunId = null;
+            let inventoryChecksum = null;
+            let googleRealm = null;
+            if (input.kind !== 'inventory') {
+                const frozen = await loadFrozenInventory(connection, {
+                    inventoryRunId: input.inventoryRunId,
+                    inventoryChecksum: input.inventoryChecksum,
+                    releaseSha: input.releaseSha,
+                    workosRealmFingerprint: realmFingerprint,
+                    requireBlockerFree: true,
+                });
+                inventoryRunId = input.inventoryRunId;
+                inventoryChecksum = input.inventoryChecksum;
+                googleRealm = frozen.googleRealm;
+                lineageChecksum = frozen.lineageChecksum;
+            }
+            await connection.query(`INSERT INTO identity_migration_runs
+           (id, kind, state, release_sha, idempotency_key_hash, request_fingerprint,
+            actor_fingerprint, workos_realm_fingerprint, google_realm,
+            inventory_run_id, inventory_checksum, lineage_checksum, started_at)
+         VALUES ($1, $2, 'running', $3, $4, $5, $6, $7, $8, $9, $10, $11, now())`, [
+                input.runId,
+                input.kind,
+                input.releaseSha,
+                migrationHash(input.runId),
+                requestFingerprint,
+                migrationHash(input.actorFingerprint),
+                realmFingerprint,
+                googleRealm,
+                inventoryRunId,
+                inventoryChecksum,
+                lineageChecksum,
+            ]);
+            await connection.query('COMMIT');
+            return {
+                runId: input.runId,
+                kind: input.kind,
+                state: 'running',
+                lineageChecksum,
+                ...(inventoryRunId === null ? {} : { inventoryRunId }),
+                ...(inventoryChecksum === null ? {} : { inventoryChecksum }),
+            };
+        }
+        catch (error) {
+            await connection.query('ROLLBACK').catch(() => undefined);
+            throw error;
+        }
+        finally {
+            connection.release?.();
+        }
+    }
+    async listFrozenCandidates(runId) {
+        const run = await this.#boundRun(this.#pool, runId);
+        const frozen = await loadFrozenInventory(this.#pool, expectedInventory(run, true));
+        if (frozen.lineageChecksum !== run.lineage_checksum)
+            throw new PlatformAuthMigrationError('reconciliation_drift');
+        return frozen.candidates.map(toCandidate);
+    }
+    async listFrozenCandidateBatch(runId, options) {
+        if (!Number.isInteger(options.limit) ||
+            options.limit < 1 ||
+            options.limit > 100 ||
+            (options.eligibility !== undefined &&
+                options.eligibility !== 'all' &&
+                options.eligibility !== 'actionable' &&
+                options.eligibility !== 'operator_reconcile') ||
+            (options.afterFingerprint !== undefined && !/^[0-9a-f]{64}$/.test(options.afterFingerprint)))
+            throw new PlatformAuthMigrationError('invalid_import');
+        const run = await this.#boundRun(this.#pool, runId);
+        const inventoryFormat = await assertBoundInventory(this.#pool, run);
+        const rows = await this.#pool.query(`SELECT candidate.source_subject, candidate.source_realm, candidate.principal_id,
+              candidate.normalized_email, candidate.email_fingerprint, candidate.provenance,
+              candidate.blocker_codes, candidate.source_fingerprint, candidate.candidate_fingerprint
+         FROM platform_auth_inventory_candidates candidate
+         LEFT JOIN workos_import_ledger ledger
+           ON ledger.principal_id = COALESCE(candidate.principal_id, candidate.source_subject)
+        WHERE candidate.migration_run_id = $1
+          AND ($2::text IS NULL OR candidate.candidate_fingerprint > $2)
+          AND ($3 = 'all' OR ledger.principal_id IS NULL OR
+            (ledger.state IN ('pending', 'reconcile_required')
+              AND (ledger.retry_at IS NULL OR ledger.retry_at <= now())
+              AND (ledger.lease_expires_at IS NULL OR ledger.lease_expires_at <= now())) OR
+            ($3 = 'operator_reconcile' AND ledger.state IN ('blocked', 'failed')
+              AND (ledger.lease_expires_at IS NULL OR ledger.lease_expires_at <= now())))
+        ORDER BY candidate.candidate_fingerprint LIMIT $4`, [
+            run.inventory_run_id,
+            options.afterFingerprint ?? null,
+            options.eligibility ?? 'all',
+            options.limit,
+        ]);
+        for (const row of rows.rows)
+            assertFrozenCandidate(row, run.google_realm, true, inventoryFormat);
+        const candidates = rows.rows.map(toCandidate);
+        const cursor = rows.rows.at(-1)?.candidate_fingerprint ?? undefined;
+        return {
+            candidates,
+            ...(rows.rows.length === options.limit && cursor !== undefined
+                ? { nextAfterFingerprint: cursor }
+                : {}),
+        };
+    }
+    async completeRun(runId) {
+        if (!validBounded(runId))
+            throw new PlatformAuthMigrationError('invalid_import');
+        const connection = this.#pool.connect === undefined ? this.#pool : await this.#pool.connect();
+        try {
+            await connection.query('BEGIN');
+            const run = await this.#boundRun(connection, runId, true);
+            if (run.state === 'completed') {
+                await connection.query('COMMIT');
+                return runResult(runId, run, run.lineage_checksum);
+            }
+            const frozen = await loadFrozenInventory(connection, expectedInventory(run, true));
+            if (frozen.lineageChecksum !== run.lineage_checksum)
+                throw new PlatformAuthMigrationError('reconciliation_drift');
+            await connection.query('LOCK TABLE platform_principals, platform_identity_links, platform_verified_emails, identity_backfill_ledger, workos_import_ledger IN SHARE MODE');
+            const ready = run.kind === 'backfill'
+                ? await backfillReady(connection, run.inventory_run_id, run.google_realm)
+                : await importReady(connection, run.inventory_run_id, run.lineage_checksum, run.workos_realm_fingerprint);
+            if (!ready)
+                throw new PlatformAuthMigrationError('reconciliation_drift');
+            const completed = await connection.query(`UPDATE identity_migration_runs
+            SET state = 'completed', completed_at = now(),
+                safe_result = jsonb_build_object('candidateCount', $2::int, 'completedCount', $2::int)
+          WHERE id = $1 AND state = 'running' RETURNING id`, [runId, frozen.candidates.length]);
+            if (completed.rows[0] === undefined)
+                throw new PlatformAuthMigrationError('reconciliation_drift');
+            await connection.query('COMMIT');
+            return runResult(runId, { ...run, state: 'completed' }, run.lineage_checksum);
+        }
+        catch (error) {
+            await connection.query('ROLLBACK').catch(() => undefined);
+            throw error;
+        }
+        finally {
+            connection.release?.();
+        }
+    }
+    async #boundRun(pool, runId, lock = false) {
+        if (!validBounded(runId))
+            throw new PlatformAuthMigrationError('invalid_import');
+        const result = await pool.query(`SELECT kind, state, release_sha, request_fingerprint, lineage_checksum,
+              workos_realm_fingerprint, google_realm, inventory_run_id, inventory_checksum
+         FROM identity_migration_runs
+        WHERE id = $1 AND kind IN ('backfill', 'import', 'reconcile')
+          AND state IN ('running', 'completed')${lock ? ' FOR UPDATE' : ''}`, [runId]);
+        const run = result.rows[0];
+        if (run === undefined ||
+            run.lineage_checksum === null ||
+            run.workos_realm_fingerprint === null ||
+            run.google_realm === null ||
+            run.inventory_run_id === null ||
+            run.inventory_checksum === null)
+            throw new PlatformAuthMigrationError('invalid_import');
+        return run;
+    }
+}
+export async function loadFrozenInventory(pool, expected) {
+    const inventory = await pool.query(`SELECT release_sha, frozen_checksum, source_fingerprint, excluded_fingerprint,
+            workos_realm_fingerprint, google_realm, inventory_format, safe_result
+       FROM identity_migration_runs
+      WHERE id = $1 AND kind = 'inventory' AND state = 'completed'`, [expected.inventoryRunId]);
+    const run = inventory.rows[0];
+    if (run === undefined ||
+        run.release_sha !== expected.releaseSha ||
+        run.frozen_checksum !== expected.inventoryChecksum ||
+        run.workos_realm_fingerprint !== expected.workosRealmFingerprint ||
+        run.google_realm === null ||
+        run.source_fingerprint === null ||
+        (run.inventory_format !== 'v2' &&
+            run.inventory_format !== 'v1' &&
+            run.inventory_format !== 'legacy_v0') ||
+        (run.inventory_format !== 'legacy_v0' && run.excluded_fingerprint === null))
+        throw new PlatformAuthMigrationError('reconciliation_drift');
+    const frozenChecksum = run.frozen_checksum;
+    const sourceFingerprint = run.source_fingerprint;
+    const workosRealmFingerprint = run.workos_realm_fingerprint;
+    const candidates = await pool.query(`SELECT source_subject, source_realm, principal_id, normalized_email,
+            email_fingerprint, provenance, blocker_codes, source_fingerprint,
+            candidate_fingerprint
+       FROM platform_auth_inventory_candidates
+      WHERE migration_run_id = $1 ORDER BY source_subject COLLATE "C"`, [expected.inventoryRunId]);
+    const blockerCounts = {};
+    const checksumEntries = [];
+    let candidateChain = inventoryChainSeed('candidate');
+    for (const candidate of candidates.rows) {
+        for (const code of candidate.blocker_codes)
+            blockerCounts[code] = (blockerCounts[code] ?? 0) + 1;
+        assertFrozenCandidate(candidate, run.google_realm, expected.requireBlockerFree, run.inventory_format);
+        const checksumEntry = {
+            sourceFingerprint: candidate.source_fingerprint,
+            emailFingerprint: candidate.email_fingerprint ?? undefined,
+            provenance: candidate.provenance,
+            blockerCodes: candidate.blocker_codes,
+        };
+        const storedEntry = run.inventory_format === 'legacy_v0'
+            ? checksumEntry
+            : { ...checksumEntry, candidateFingerprint: candidate.candidate_fingerprint };
+        checksumEntries.push(storedEntry);
+        if (run.inventory_format === 'v2')
+            candidateChain = inventoryChain(candidateChain, storedEntry);
+    }
+    const safe = normalizeSafeResult(run.safe_result, candidates.rows.length, blockerCounts);
+    if (sourceFingerprint !==
+        (run.inventory_format === 'v2' ? candidateChain : migrationHash(checksumEntries)) ||
+        frozenChecksum !==
+            migrationHash(run.inventory_format === 'legacy_v0'
+                ? {
+                    algorithm: 'inventory-v1',
+                    googleRealm: run.google_realm,
+                    workosRealm: workosRealmFingerprint,
+                    safe,
+                    candidates: checksumEntries,
+                }
+                : run.inventory_format === 'v1'
+                    ? {
+                        algorithm: 'inventory-v1',
+                        googleRealm: run.google_realm,
+                        workosRealm: workosRealmFingerprint,
+                        safe,
+                        excludedFingerprint: run.excluded_fingerprint,
+                        candidates: checksumEntries,
+                    }
+                    : {
+                        algorithm: 'inventory-v2',
+                        googleRealm: run.google_realm,
+                        workosRealm: workosRealmFingerprint,
+                        safe,
+                        excludedFingerprint: run.excluded_fingerprint,
+                        candidateChain,
+                    }))
+        throw new PlatformAuthMigrationError('reconciliation_drift');
+    return {
+        googleRealm: run.google_realm,
+        lineageChecksum: lineageChecksum(expected.inventoryRunId, {
+            frozen_checksum: frozenChecksum,
+            source_fingerprint: sourceFingerprint,
+            workos_realm_fingerprint: workosRealmFingerprint,
+            release_sha: run.release_sha,
+        }),
+        candidates: candidates.rows,
+    };
+}
+export function candidateDigest(candidate) {
+    return migrationHash({
+        sourceFingerprint: candidate.source_fingerprint,
+        principalFingerprint: candidate.principal_id === null ? undefined : migrationHash(candidate.principal_id),
+        emailFingerprint: candidate.email_fingerprint ?? undefined,
+        provenance: candidate.provenance,
+        blockerCodes: candidate.blocker_codes,
+    });
+}
+export function migrationHash(value) {
+    return createHash('sha256').update(JSON.stringify(value)).digest('hex');
+}
+function assertFrozenCandidate(candidate, googleRealm, requireBlockerFree, inventoryFormat) {
+    const expectedFingerprint = migrationHash({
+        subject: candidate.source_subject,
+        realm: candidate.source_realm,
+        provenance: candidate.provenance,
+    });
+    const legacyOmittedRealmFingerprint = migrationHash({
+        subject: candidate.source_subject,
+        provenance: candidate.provenance,
+    });
+    if (candidate.source_realm === null ||
+        candidate.source_realm !== googleRealm ||
+        (candidate.source_fingerprint !== expectedFingerprint &&
+            (inventoryFormat !== 'legacy_v0' ||
+                candidate.source_fingerprint !== legacyOmittedRealmFingerprint)) ||
+        candidate.candidate_fingerprint !== candidateDigest(candidate) ||
+        (candidate.normalized_email === null) !== (candidate.email_fingerprint === null) ||
+        (candidate.normalized_email !== null &&
+            candidate.email_fingerprint !== migrationHash(candidate.normalized_email)) ||
+        (requireBlockerFree &&
+            (candidate.blocker_codes.length !== 0 || candidate.normalized_email === null)))
+        throw new PlatformAuthMigrationError('reconciliation_drift');
+}
+async function assertBoundInventory(pool, run) {
+    const inventory = await pool.query(`SELECT release_sha, frozen_checksum, source_fingerprint,
+            workos_realm_fingerprint, google_realm, inventory_format
+       FROM identity_migration_runs
+      WHERE id = $1 AND kind = 'inventory' AND state = 'completed'`, [run.inventory_run_id]);
+    const parent = inventory.rows[0];
+    if (parent === undefined ||
+        parent.release_sha !== run.release_sha ||
+        parent.frozen_checksum !== run.inventory_checksum ||
+        parent.workos_realm_fingerprint !== run.workos_realm_fingerprint ||
+        parent.google_realm !== run.google_realm ||
+        parent.source_fingerprint === null ||
+        (parent.inventory_format !== 'legacy_v0' &&
+            parent.inventory_format !== 'v1' &&
+            parent.inventory_format !== 'v2') ||
+        lineageChecksum(run.inventory_run_id, {
+            frozen_checksum: parent.frozen_checksum ?? '',
+            source_fingerprint: parent.source_fingerprint ?? '',
+            workos_realm_fingerprint: parent.workos_realm_fingerprint ?? '',
+            release_sha: parent.release_sha,
+        }) !== run.lineage_checksum)
+        throw new PlatformAuthMigrationError('reconciliation_drift');
+    return parent.inventory_format;
+}
+function expectedInventory(run, requireBlockerFree) {
+    return {
+        inventoryRunId: run.inventory_run_id,
+        inventoryChecksum: run.inventory_checksum,
+        releaseSha: run.release_sha,
+        workosRealmFingerprint: run.workos_realm_fingerprint,
+        requireBlockerFree,
+    };
+}
+function lineageChecksum(inventoryRunId, row) {
+    return migrationHash({
+        inventoryRunHash: migrationHash(inventoryRunId),
+        inventoryChecksum: row.frozen_checksum,
+        candidateSetChecksum: row.source_fingerprint,
+        workosRealmFingerprint: row.workos_realm_fingerprint,
+        releaseSha: row.release_sha,
+    });
+}
+function toCandidate(candidate) {
+    if (candidate.source_realm === null ||
+        candidate.normalized_email === null ||
+        candidate.candidate_fingerprint === null)
+        throw new PlatformAuthMigrationError('reconciliation_drift');
+    return {
+        source: {
+            provider: 'google',
+            realm: candidate.source_realm,
+            subject: candidate.source_subject,
+        },
+        principalId: candidate.principal_id ?? candidate.source_subject,
+        verifiedEmail: candidate.normalized_email,
+        candidateFingerprint: candidate.candidate_fingerprint,
+    };
+}
+async function backfillReady(pool, inventoryRunId, googleRealm) {
+    const result = await pool.query(`SELECT count(*)::text AS count
+       FROM platform_auth_inventory_candidates candidate
+       LEFT JOIN platform_principals principal
+         ON principal.principal_id = COALESCE(candidate.principal_id, candidate.source_subject)
+       LEFT JOIN platform_identity_links link
+         ON link.provider = 'google' AND link.realm = $2
+        AND link.external_id = candidate.source_subject
+        AND link.principal_id = COALESCE(candidate.principal_id, candidate.source_subject)
+      WHERE candidate.migration_run_id = $1 AND
+        (cardinality(candidate.blocker_codes) > 0 OR candidate.normalized_email IS NULL
+         OR principal.status IS DISTINCT FROM 'active'
+         OR principal.billing_identity_issuer IS DISTINCT FROM 'https://accounts.google.com'
+         OR principal.billing_subject IS DISTINCT FROM candidate.source_subject
+         OR link.principal_id IS NULL OR link.disabled_at IS NOT NULL
+         OR (SELECT count(*) FROM platform_verified_emails email
+               WHERE email.principal_id = COALESCE(candidate.principal_id, candidate.source_subject)
+                 AND email.provider = 'google' AND email.realm = $2
+                 AND email.status = 'active') <> 1
+         OR NOT EXISTS (SELECT 1 FROM platform_verified_emails email
+               WHERE email.principal_id = COALESCE(candidate.principal_id, candidate.source_subject)
+                 AND email.provider = 'google' AND email.realm = $2
+                 AND email.status = 'active'
+                 AND email.normalized_email = candidate.normalized_email))`, [inventoryRunId, googleRealm]);
+    return Number(result.rows[0]?.count ?? 0) === 0;
+}
+async function importReady(pool, inventoryRunId, lineage, workosRealmFingerprint) {
+    const result = await pool.query(`SELECT count(*)::text AS count
+       FROM platform_auth_inventory_candidates candidate
+       LEFT JOIN workos_import_ledger ledger
+         ON ledger.principal_id = COALESCE(candidate.principal_id, candidate.source_subject)
+       LEFT JOIN identity_migration_runs owner ON owner.id = ledger.migration_run_id
+       LEFT JOIN platform_identity_links link
+         ON link.provider = 'workos' AND link.realm = ledger.realm
+        AND link.external_id = ledger.remote_user_id
+        AND link.principal_id = COALESCE(candidate.principal_id, candidate.source_subject)
+      WHERE candidate.migration_run_id = $1 AND
+        (cardinality(candidate.blocker_codes) > 0 OR candidate.normalized_email IS NULL
+         OR ledger.state IS DISTINCT FROM 'linked' OR ledger.remote_user_id IS NULL
+         OR ledger.lease_token IS NOT NULL OR ledger.lease_expires_at IS NOT NULL
+         OR owner.lineage_checksum IS DISTINCT FROM $2
+         OR owner.workos_realm_fingerprint IS DISTINCT FROM $3
+         OR link.principal_id IS NULL OR link.disabled_at IS NOT NULL)`, [inventoryRunId, lineage, workosRealmFingerprint]);
+    return Number(result.rows[0]?.count ?? 0) === 0;
+}
+function runResult(runId, row, lineageChecksumValue) {
+    if (row.state !== 'running' && row.state !== 'completed')
+        throw new PlatformAuthMigrationError('idempotency_conflict');
+    return {
+        runId,
+        kind: row.kind,
+        state: row.state,
+        lineageChecksum: lineageChecksumValue,
+        ...(row.inventory_run_id === null ? {} : { inventoryRunId: row.inventory_run_id }),
+        ...(row.inventory_checksum === null ? {} : { inventoryChecksum: row.inventory_checksum }),
+    };
+}
+function validateRunInput(input) {
+    if (!validBounded(input.runId) ||
+        !validBounded(input.workosRealm) ||
+        !validBounded(input.actorFingerprint) ||
+        !/^[0-9a-f]{40}$/.test(input.releaseSha) ||
+        ('inventoryRunId' in input && !validBounded(input.inventoryRunId)) ||
+        ('inventoryChecksum' in input && !/^[0-9a-f]{64}$/.test(input.inventoryChecksum)))
+        throw new PlatformAuthMigrationError('invalid_import');
+}
+function normalizeSafeResult(value, candidateCount, blockerCounts) {
+    if (typeof value !== 'object' || value === null)
+        throw new PlatformAuthMigrationError('reconciliation_drift');
+    const safe = value;
+    if (safe.candidateCount !== candidateCount ||
+        typeof safe.excludedCount !== 'number' ||
+        !Number.isInteger(safe.excludedCount) ||
+        safe.excludedCount < 0 ||
+        typeof safe.blockers !== 'object' ||
+        safe.blockers === null)
+        throw new PlatformAuthMigrationError('reconciliation_drift');
+    const blockers = {};
+    for (const code of BLOCKER_ORDER) {
+        const expected = blockerCounts[code] ?? 0;
+        const stored = safe.blockers[code] ?? 0;
+        if (stored !== expected)
+            throw new PlatformAuthMigrationError('reconciliation_drift');
+        if (expected > 0)
+            blockers[code] = expected;
+    }
+    if (Object.keys(safe.blockers).some((code) => !BLOCKER_CODE_SET.has(code)))
+        throw new PlatformAuthMigrationError('reconciliation_drift');
+    return { candidateCount, excludedCount: safe.excludedCount, blockers };
+}
+const BLOCKER_ORDER = [
+    'ambiguous_platform_customer_evidence',
+    'missing_verified_email',
+    'multiple_current_verified_emails',
+    'external_id_too_long',
+    'shared_verified_email',
+    'conflicting_workos_user',
+];
+const BLOCKER_CODE_SET = new Set(BLOCKER_ORDER);
+function validBounded(value) {
+    return value.trim() === value && value.length > 0 && value.length <= 256;
+}
+//# sourceMappingURL=platform-auth-migration-runs-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-migration-runs-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-migration-runs-postgres.js","sourceRoot":"","sources":["../src/platform-auth-migration-runs-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzF,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAuD1E,MAAM,OAAO,qCAAqC;IACvC,KAAK,CAAO;IAErB,YAAY,IAAU;QACpB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAoC;QAClD,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,kBAAkB,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,UAAU,GACd,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7E,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,MAAM,UAAU,CAAC,KAAK,CAAC,uDAAuD,EAAE;gBAC9E,qBAAqB,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;aAClD,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CACrC;;iEAEyD,EACzD,CAAC,KAAK,CAAC,KAAK,CAAC,CACd,CAAC;YACF,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,IACE,KAAK,CAAC,mBAAmB,KAAK,kBAAkB;oBAChD,KAAK,CAAC,gBAAgB,KAAK,IAAI;oBAC/B,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC;oBAE1D,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;gBAC/D,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACjC,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,gBAAgB,GAAG,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAC1D,IAAI,eAAe,GAAG,aAAa,CAAC;gBAClC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,sBAAsB,EAAE,gBAAgB;aACzC,CAAC,CAAC;YACH,IAAI,cAAc,GAAkB,IAAI,CAAC;YACzC,IAAI,iBAAiB,GAAkB,IAAI,CAAC;YAC5C,IAAI,WAAW,GAAkB,IAAI,CAAC;YACtC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE;oBACnD,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;oBAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,sBAAsB,EAAE,gBAAgB;oBACxC,kBAAkB,EAAE,IAAI;iBACzB,CAAC,CAAC;gBACH,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;gBACtC,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAC;gBAC5C,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;gBACjC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;YAC3C,CAAC;YACD,MAAM,UAAU,CAAC,KAAK,CACpB;;;;iFAIyE,EACzE;gBACE,KAAK,CAAC,KAAK;gBACX,KAAK,CAAC,IAAI;gBACV,KAAK,CAAC,UAAU;gBAChB,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC;gBAC1B,kBAAkB;gBAClB,aAAa,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBACrC,gBAAgB;gBAChB,WAAW;gBACX,cAAc;gBACd,iBAAiB;gBACjB,eAAe;aAChB,CACF,CAAC;YACF,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO;gBACL,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,SAAS;gBAChB,eAAe;gBACf,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;gBACtD,GAAG,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC;aAC7D,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1D,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,KAAa;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACnF,IAAI,MAAM,CAAC,eAAe,KAAK,GAAG,CAAC,gBAAgB;YACjD,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;QAC/D,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC5B,KAAa,EACb,OAIC;QAED,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;YAChC,OAAO,CAAC,KAAK,GAAG,CAAC;YACjB,OAAO,CAAC,KAAK,GAAG,GAAG;YACnB,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;gBAChC,OAAO,CAAC,WAAW,KAAK,KAAK;gBAC7B,OAAO,CAAC,WAAW,KAAK,YAAY;gBACpC,OAAO,CAAC,WAAW,KAAK,oBAAoB,CAAC;YAC/C,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAE5F,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACjC;;;;;;;;;;;;;;0DAcoD,EACpD;YACE,GAAG,CAAC,gBAAgB;YACpB,OAAO,CAAC,gBAAgB,IAAI,IAAI;YAChC,OAAO,CAAC,WAAW,IAAI,KAAK;YAC5B,OAAO,CAAC,KAAK;SACd,CACF,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI;YACzB,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,qBAAqB,IAAI,SAAS,CAAC;QACpE,OAAO;YACL,UAAU;YACV,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,IAAI,MAAM,KAAK,SAAS;gBAC5D,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,EAAE;gBAClC,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;QACjF,MAAM,UAAU,GACd,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7E,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC1D,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC9B,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACjC,OAAO,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACnF,IAAI,MAAM,CAAC,eAAe,KAAK,GAAG,CAAC,gBAAgB;gBACjD,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;YAC/D,MAAM,UAAU,CAAC,KAAK,CACpB,iJAAiJ,CAClJ,CAAC;YACF,MAAM,KAAK,GACT,GAAG,CAAC,IAAI,KAAK,UAAU;gBACrB,CAAC,CAAC,MAAM,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC,YAAY,CAAC;gBACzE,CAAC,CAAC,MAAM,WAAW,CACf,UAAU,EACV,GAAG,CAAC,gBAAgB,EACpB,GAAG,CAAC,gBAAgB,EACpB,GAAG,CAAC,wBAAwB,CAC7B,CAAC;YACR,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;YACzE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,KAAK,CACtC;;;2DAGmD,EACnD,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAClC,CAAC;YACF,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;gBACjC,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;YAC/D,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,SAAS,CAAC,KAAK,EAAE,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1D,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CACb,IAA+B,EAC/B,KAAa,EACb,IAAI,GAAG,KAAK;QAEZ,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;QACjF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;iDAI2C,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,EACtE,CAAC,KAAK,CAAC,CACR,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IACE,GAAG,KAAK,SAAS;YACjB,GAAG,CAAC,gBAAgB,KAAK,IAAI;YAC7B,GAAG,CAAC,wBAAwB,KAAK,IAAI;YACrC,GAAG,CAAC,YAAY,KAAK,IAAI;YACzB,GAAG,CAAC,gBAAgB,KAAK,IAAI;YAC7B,GAAG,CAAC,kBAAkB,KAAK,IAAI;YAE/B,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;QACzD,OAAO,GAAkB,CAAC;IAC5B,CAAC;CACF;AAsBD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA+B,EAC/B,QAMC;IAMD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAUhC;;;mEAG+D,EAC/D,CAAC,QAAQ,CAAC,cAAc,CAAC,CAC1B,CAAC;IACF,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IACE,GAAG,KAAK,SAAS;QACjB,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,UAAU;QACvC,GAAG,CAAC,eAAe,KAAK,QAAQ,CAAC,iBAAiB;QAClD,GAAG,CAAC,wBAAwB,KAAK,QAAQ,CAAC,sBAAsB;QAChE,GAAG,CAAC,YAAY,KAAK,IAAI;QACzB,GAAG,CAAC,kBAAkB,KAAK,IAAI;QAC/B,CAAC,GAAG,CAAC,gBAAgB,KAAK,IAAI;YAC5B,GAAG,CAAC,gBAAgB,KAAK,IAAI;YAC7B,GAAG,CAAC,gBAAgB,KAAK,WAAW,CAAC;QACvC,CAAC,GAAG,CAAC,gBAAgB,KAAK,WAAW,IAAI,GAAG,CAAC,oBAAoB,KAAK,IAAI,CAAC;QAE3E,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,GAAG,CAAC,eAAe,CAAC;IAC3C,MAAM,iBAAiB,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACjD,MAAM,sBAAsB,GAAG,GAAG,CAAC,wBAAwB,CAAC;IAC5D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CACjC;;;;sEAIkE,EAClE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAC1B,CAAC;IACF,MAAM,aAAa,GAA2B,EAAE,CAAC;IACjD,MAAM,eAAe,GAAc,EAAE,CAAC;IACtC,IAAI,cAAc,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACrD,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;QACxC,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,aAAa;YACxC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACvD,qBAAqB,CACnB,SAAS,EACT,GAAG,CAAC,YAAY,EAChB,QAAQ,CAAC,kBAAkB,EAC3B,GAAG,CAAC,gBAAgB,CACrB,CAAC;QACF,MAAM,aAAa,GAAG;YACpB,iBAAiB,EAAE,SAAS,CAAC,kBAAkB;YAC/C,gBAAgB,EAAE,SAAS,CAAC,iBAAiB,IAAI,SAAS;YAC1D,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,YAAY,EAAE,SAAS,CAAC,aAAa;SACtC,CAAC;QACF,MAAM,WAAW,GACf,GAAG,CAAC,gBAAgB,KAAK,WAAW;YAClC,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,oBAAoB,EAAE,SAAS,CAAC,qBAAqB,EAAE,CAAC;QAClF,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClC,IAAI,GAAG,CAAC,gBAAgB,KAAK,IAAI;YAAE,cAAc,GAAG,cAAc,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACzF,IACE,iBAAiB;QACf,CAAC,GAAG,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;QACnF,cAAc;YACZ,aAAa,CACX,GAAG,CAAC,gBAAgB,KAAK,WAAW;gBAClC,CAAC,CAAC;oBACE,SAAS,EAAE,cAAc;oBACzB,WAAW,EAAE,GAAG,CAAC,YAAY;oBAC7B,WAAW,EAAE,sBAAsB;oBACnC,IAAI;oBACJ,UAAU,EAAE,eAAe;iBAC5B;gBACH,CAAC,CAAC,GAAG,CAAC,gBAAgB,KAAK,IAAI;oBAC7B,CAAC,CAAC;wBACE,SAAS,EAAE,cAAc;wBACzB,WAAW,EAAE,GAAG,CAAC,YAAY;wBAC7B,WAAW,EAAE,sBAAsB;wBACnC,IAAI;wBACJ,mBAAmB,EAAE,GAAG,CAAC,oBAAoB;wBAC7C,UAAU,EAAE,eAAe;qBAC5B;oBACH,CAAC,CAAC;wBACE,SAAS,EAAE,cAAc;wBACzB,WAAW,EAAE,GAAG,CAAC,YAAY;wBAC7B,WAAW,EAAE,sBAAsB;wBACnC,IAAI;wBACJ,mBAAmB,EAAE,GAAG,CAAC,oBAAoB;wBAC7C,cAAc;qBACf,CACR;QAEH,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;IAC/D,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,eAAe,EAAE,eAAe,CAAC,QAAQ,CAAC,cAAc,EAAE;YACxD,eAAe,EAAE,cAAc;YAC/B,kBAAkB,EAAE,iBAAiB;YACrC,wBAAwB,EAAE,sBAAsB;YAChD,WAAW,EAAE,GAAG,CAAC,WAAW;SAC7B,CAAC;QACF,UAAU,EAAE,UAAU,CAAC,IAAI;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAM/B;IACC,OAAO,aAAa,CAAC;QACnB,iBAAiB,EAAE,SAAS,CAAC,kBAAkB;QAC/C,oBAAoB,EAClB,SAAS,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,YAAY,CAAC;QACrF,gBAAgB,EAAE,SAAS,CAAC,iBAAiB,IAAI,SAAS;QAC1D,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,YAAY,EAAE,SAAS,CAAC,aAAa;KACtC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,qBAAqB,CAC5B,SAA6B,EAC7B,WAAmB,EACnB,kBAA2B,EAC3B,eAA0C;IAE1C,MAAM,mBAAmB,GAAG,aAAa,CAAC;QACxC,OAAO,EAAE,SAAS,CAAC,cAAc;QACjC,KAAK,EAAE,SAAS,CAAC,YAAY;QAC7B,UAAU,EAAE,SAAS,CAAC,UAAU;KACjC,CAAC,CAAC;IACH,MAAM,6BAA6B,GAAG,aAAa,CAAC;QAClD,OAAO,EAAE,SAAS,CAAC,cAAc;QACjC,UAAU,EAAE,SAAS,CAAC,UAAU;KACjC,CAAC,CAAC;IACH,IACE,SAAS,CAAC,YAAY,KAAK,IAAI;QAC/B,SAAS,CAAC,YAAY,KAAK,WAAW;QACtC,CAAC,SAAS,CAAC,kBAAkB,KAAK,mBAAmB;YACnD,CAAC,eAAe,KAAK,WAAW;gBAC9B,SAAS,CAAC,kBAAkB,KAAK,6BAA6B,CAAC,CAAC;QACpE,SAAS,CAAC,qBAAqB,KAAK,eAAe,CAAC,SAAS,CAAC;QAC9D,CAAC,SAAS,CAAC,gBAAgB,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,iBAAiB,KAAK,IAAI,CAAC;QAChF,CAAC,SAAS,CAAC,gBAAgB,KAAK,IAAI;YAClC,SAAS,CAAC,iBAAiB,KAAK,aAAa,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC5E,CAAC,kBAAkB;YACjB,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC;QAEhF,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,IAA+B,EAC/B,GAAgB;IAEhB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAQhC;;;mEAG+D,EAC/D,CAAC,GAAG,CAAC,gBAAgB,CAAC,CACvB,CAAC;IACF,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjC,IACE,MAAM,KAAK,SAAS;QACpB,MAAM,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW;QACtC,MAAM,CAAC,eAAe,KAAK,GAAG,CAAC,kBAAkB;QACjD,MAAM,CAAC,wBAAwB,KAAK,GAAG,CAAC,wBAAwB;QAChE,MAAM,CAAC,YAAY,KAAK,GAAG,CAAC,YAAY;QACxC,MAAM,CAAC,kBAAkB,KAAK,IAAI;QAClC,CAAC,MAAM,CAAC,gBAAgB,KAAK,WAAW;YACtC,MAAM,CAAC,gBAAgB,KAAK,IAAI;YAChC,MAAM,CAAC,gBAAgB,KAAK,IAAI,CAAC;QACnC,eAAe,CAAC,GAAG,CAAC,gBAAgB,EAAE;YACpC,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,EAAE;YAC7C,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,EAAE;YACnD,wBAAwB,EAAE,MAAM,CAAC,wBAAwB,IAAI,EAAE;YAC/D,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,KAAK,GAAG,CAAC,gBAAgB;QAE3B,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,gBAAgB,CAAC;AACjC,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAgB,EAAE,kBAA2B;IACtE,OAAO;QACL,cAAc,EAAE,GAAG,CAAC,gBAAgB;QACpC,iBAAiB,EAAE,GAAG,CAAC,kBAAkB;QACzC,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,sBAAsB,EAAE,GAAG,CAAC,wBAAwB;QACpD,kBAAkB;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,cAAsB,EACtB,GAKC;IAED,OAAO,aAAa,CAAC;QACnB,gBAAgB,EAAE,aAAa,CAAC,cAAc,CAAC;QAC/C,iBAAiB,EAAE,GAAG,CAAC,eAAe;QACtC,oBAAoB,EAAE,GAAG,CAAC,kBAAkB;QAC5C,sBAAsB,EAAE,GAAG,CAAC,wBAAwB;QACpD,UAAU,EAAE,GAAG,CAAC,WAAW;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,SAA6B;IAChD,IACE,SAAS,CAAC,YAAY,KAAK,IAAI;QAC/B,SAAS,CAAC,gBAAgB,KAAK,IAAI;QACnC,SAAS,CAAC,qBAAqB,KAAK,IAAI;QAExC,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;IAC/D,OAAO;QACL,MAAM,EAAE;YACN,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,SAAS,CAAC,YAAY;YAC7B,OAAO,EAAE,SAAS,CAAC,cAAc;SAClC;QACD,WAAW,EAAE,SAAS,CAAC,YAAY,IAAI,SAAS,CAAC,cAAc;QAC/D,aAAa,EAAE,SAAS,CAAC,gBAAgB;QACzC,oBAAoB,EAAE,SAAS,CAAC,qBAAqB;KACtD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAA+B,EAC/B,cAAsB,EACtB,WAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;;;;;;;;;;;;;;;;;;;2EAsBuE,EACvE,CAAC,cAAc,EAAE,WAAW,CAAC,CAC9B,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,IAA+B,EAC/B,cAAsB,EACtB,OAAe,EACf,sBAA8B;IAE9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;;;;;;;;;;;;uEAemE,EACnE,CAAC,cAAc,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAClD,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,SAAS,CAChB,KAAa,EACb,GAAW,EACX,oBAA4B;IAE5B,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW;QACtD,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;IAC/D,OAAO;QACL,KAAK;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,eAAe,EAAE,oBAAoB;QACrC,GAAG,CAAC,GAAG,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAClF,GAAG,CAAC,GAAG,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,kBAAkB,EAAE,CAAC;KAC1F,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAoC;IAC5D,IACE,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC;QAC1B,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC;QAChC,CAAC,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACrC,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QACxC,CAAC,gBAAgB,IAAI,KAAK,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAClE,CAAC,mBAAmB,IAAI,KAAK,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAEjF,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAc,EACd,cAAsB,EACtB,aAA+C;IAE/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAC7C,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,KAIZ,CAAC;IACF,IACE,IAAI,CAAC,cAAc,KAAK,cAAc;QACtC,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;QACtC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,CAAC;QACtB,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QACjC,IAAI,CAAC,QAAQ,KAAK,IAAI;QAEtB,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAI,IAAI,CAAC,QAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;QACtF,IAAI,QAAQ,GAAG,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClF,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;IAC/D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,aAAa,GAAG;IACpB,sCAAsC;IACtC,wBAAwB;IACxB,kCAAkC;IAClC,sBAAsB;IACtB,uBAAuB;IACvB,yBAAyB;CACjB,CAAC;AACX,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAS,aAAa,CAAC,CAAC;AAExD,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC;AAC3E,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-migration-schema.d.ts

@@ -0,0 +1,17 @@
+import type { PlatformIdentityQueryable } from './platform-identity-schema-postgres.js';
+type SchemaConnection = PlatformIdentityQueryable & {
+    release?: () => void;
+};
+type SchemaPool = PlatformIdentityQueryable & {
+    connect?: () => Promise<SchemaConnection>;
+};
+/** Additive Task 3 storage kept separate from the canonical identity schema. */
+export declare function ensurePlatformAuthMigrationSchema(pool: PlatformIdentityQueryable): Promise<void>;
+/**
+ * Upgrades the rollout clock and frozen inventory shape shipped by preceding releases. Original inventory
+ * checksums remain unchanged; unsupported custom-realm evidence fails closed instead of guessing mutable
+ * identity state.
+ */
+export declare function upgradePlatformAuthMigrationSchema(pool: SchemaPool): Promise<void>;
+export {};
+//# sourceMappingURL=platform-auth-migration-schema.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-migration-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-migration-schema.d.ts","sourceRoot":"","sources":["../src/platform-auth-migration-schema.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AAExF,KAAK,gBAAgB,GAAG,yBAAyB,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE,CAAC;AAC7E,KAAK,UAAU,GAAG,yBAAyB,GAAG;IAC5C,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC3C,CAAC;AA0BF,gFAAgF;AAChF,wBAAsB,iCAAiC,CACrD,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,IAAI,CAAC,CA4Qf;AAED;;;;GAIG;AACH,wBAAsB,kCAAkC,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAgGxF"}