@noodleseed/one 0.63.0 → 0.64.0

package/node_modules/@noodle-borg/service/dist/platform-auth-migration-schema.js

@@ -0,0 +1,435 @@
+import { createHash } from 'node:crypto';
+import { ensurePlatformAuthInventorySourceFenceSchema } from './platform-auth-inventory-source-fence-postgres.js';
+/** Additive Task 3 storage kept separate from the canonical identity schema. */
+export async function ensurePlatformAuthMigrationSchema(pool) {
+    await pool.query(`
+    ALTER TABLE platform_auth_rollout_state
+      ADD COLUMN IF NOT EXISTS workos_client_fingerprint text
+        CHECK (workos_client_fingerprint IS NULL OR workos_client_fingerprint ~ '^[0-9a-f]{64}$'),
+      ADD COLUMN IF NOT EXISTS workos_realm_fingerprint text
+        CHECK (workos_realm_fingerprint IS NULL OR workos_realm_fingerprint ~ '^[0-9a-f]{64}$'),
+      ADD COLUMN IF NOT EXISTS rollout_inventory_run_id text,
+      ADD COLUMN IF NOT EXISTS rollout_inventory_checksum text
+        CHECK (rollout_inventory_checksum IS NULL OR rollout_inventory_checksum ~ '^[0-9a-f]{64}$'),
+      ADD COLUMN IF NOT EXISTS rollout_import_run_id text,
+      ADD COLUMN IF NOT EXISTS rollout_import_lineage_checksum text
+        CHECK (rollout_import_lineage_checksum IS NULL OR rollout_import_lineage_checksum ~ '^[0-9a-f]{64}$'),
+      ADD COLUMN IF NOT EXISTS workos_recovery_enabled boolean NOT NULL DEFAULT false
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_auth_inventory_candidates (
+      migration_run_id text NOT NULL REFERENCES identity_migration_runs(id) ON DELETE RESTRICT,
+      source_subject text NOT NULL,
+      source_realm text NOT NULL,
+      principal_id text REFERENCES platform_principals(principal_id) ON DELETE RESTRICT,
+      normalized_email text,
+      email_fingerprint text,
+      provenance text[] NOT NULL,
+      blocker_codes text[] NOT NULL DEFAULT '{}'::text[],
+      source_fingerprint text NOT NULL,
+      candidate_fingerprint text,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      PRIMARY KEY (migration_run_id, source_subject),
+      CHECK (cardinality(provenance) >= 1),
+      CHECK (provenance <@ ARRAY['principal', 'google_link', 'google_billing', 'org_membership', 'refresh_family', 'developer_grant', 'owner_only_deployer', 'consent_grant', 'device_authorization', 'welcome_provisioning']::text[]),
+      CHECK (source_fingerprint ~ '^[0-9a-f]{64}$'),
+      CHECK (email_fingerprint IS NULL OR email_fingerprint ~ '^[0-9a-f]{64}$'),
+      CHECK (blocker_codes <@ ARRAY['missing_verified_email', 'multiple_current_verified_emails', 'shared_verified_email', 'external_id_too_long', 'conflicting_workos_user', 'ambiguous_platform_customer_evidence']::text[])
+    )
+  `);
+    await pool.query(`
+    ALTER TABLE platform_auth_inventory_candidates
+      ADD COLUMN IF NOT EXISTS candidate_fingerprint text,
+      ADD COLUMN IF NOT EXISTS source_realm text
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_auth_inventory_progress (
+      migration_run_id       text PRIMARY KEY REFERENCES identity_migration_runs(id) ON DELETE RESTRICT,
+      phase                  text NOT NULL CHECK (phase IN ('remote', 'local', 'completed')),
+      remote_after           text,
+      remote_page_count      integer NOT NULL DEFAULT 0 CHECK (remote_page_count >= 0),
+      remote_user_count      integer NOT NULL DEFAULT 0 CHECK (remote_user_count >= 0),
+      remote_chain_hash      text NOT NULL CHECK (remote_chain_hash ~ '^[0-9a-f]{64}$'),
+      local_after_subject    text,
+      local_subject_count    integer NOT NULL DEFAULT 0 CHECK (local_subject_count >= 0),
+      candidate_count        integer NOT NULL DEFAULT 0 CHECK (candidate_count >= 0),
+      excluded_count         integer NOT NULL DEFAULT 0 CHECK (excluded_count >= 0),
+      candidate_chain_hash   text NOT NULL CHECK (candidate_chain_hash ~ '^[0-9a-f]{64}$'),
+      excluded_chain_hash    text NOT NULL CHECK (excluded_chain_hash ~ '^[0-9a-f]{64}$'),
+      artifact_counts        jsonb,
+      blocker_counts         jsonb NOT NULL DEFAULT '{}'::jsonb,
+      terminal_error         text CHECK (terminal_error IS NULL OR terminal_error = 'inventory_unavailable'),
+      lease_token_hash       text CHECK (lease_token_hash IS NULL OR lease_token_hash ~ '^[0-9a-f]{64}$'),
+      lease_expires_at       timestamptz,
+      created_at             timestamptz NOT NULL DEFAULT now(),
+      updated_at             timestamptz NOT NULL DEFAULT now(),
+      CHECK ((lease_token_hash IS NULL) = (lease_expires_at IS NULL)),
+      CHECK ((phase = 'remote' AND local_after_subject IS NULL)
+        OR phase IN ('local', 'completed'))
+    )
+  `);
+    await ensurePlatformAuthInventorySourceFenceSchema(pool);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_auth_inventory_remote_pages (
+      migration_run_id         text NOT NULL REFERENCES identity_migration_runs(id) ON DELETE RESTRICT,
+      page_number              integer NOT NULL CHECK (page_number >= 0),
+      input_cursor_fingerprint text NOT NULL CHECK (input_cursor_fingerprint ~ '^[0-9a-f]{64}$'),
+      next_cursor              text,
+      next_cursor_fingerprint  text CHECK (next_cursor_fingerprint IS NULL OR next_cursor_fingerprint ~ '^[0-9a-f]{64}$'),
+      row_count                integer NOT NULL CHECK (row_count BETWEEN 0 AND 100),
+      page_fingerprint         text NOT NULL CHECK (page_fingerprint ~ '^[0-9a-f]{64}$'),
+      created_at               timestamptz NOT NULL DEFAULT now(),
+      PRIMARY KEY (migration_run_id, page_number),
+      UNIQUE (migration_run_id, input_cursor_fingerprint)
+    )
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_auth_inventory_remote_users (
+      migration_run_id  text NOT NULL REFERENCES identity_migration_runs(id) ON DELETE RESTRICT,
+      remote_user_id    text NOT NULL,
+      external_id       text,
+      normalized_email  text NOT NULL,
+      verified          boolean NOT NULL,
+      page_number       integer NOT NULL,
+      ordinal           integer NOT NULL CHECK (ordinal >= 0 AND ordinal < 100),
+      row_fingerprint   text NOT NULL CHECK (row_fingerprint ~ '^[0-9a-f]{64}$'),
+      created_at        timestamptz NOT NULL DEFAULT now(),
+      PRIMARY KEY (migration_run_id, remote_user_id),
+      FOREIGN KEY (migration_run_id, page_number)
+        REFERENCES platform_auth_inventory_remote_pages(migration_run_id, page_number)
+        ON DELETE RESTRICT
+    )
+  `);
+    await pool.query(`
+    CREATE INDEX IF NOT EXISTS platform_auth_inventory_remote_users_email_idx
+      ON platform_auth_inventory_remote_users (migration_run_id, normalized_email)
+  `);
+    await pool.query(`
+    CREATE INDEX IF NOT EXISTS platform_auth_inventory_remote_users_external_idx
+      ON platform_auth_inventory_remote_users (migration_run_id, external_id)
+      WHERE external_id IS NOT NULL
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_auth_inventory_exclusions (
+      migration_run_id    text NOT NULL REFERENCES identity_migration_runs(id) ON DELETE RESTRICT,
+      subject_fingerprint text NOT NULL CHECK (subject_fingerprint ~ '^[0-9a-f]{64}$'),
+      exclusion_kind      text NOT NULL CHECK (exclusion_kind IN ('non_platform_identity', 'suspended_principal', 'suspended_principal_with_authority', 'workload', 'synthetic')),
+      entry_fingerprint   text NOT NULL CHECK (entry_fingerprint ~ '^[0-9a-f]{64}$'),
+      created_at          timestamptz NOT NULL DEFAULT now(),
+      PRIMARY KEY (migration_run_id, subject_fingerprint)
+    )
+  `);
+    await pool.query(`
+    ALTER TABLE platform_auth_inventory_candidates
+      DROP CONSTRAINT IF EXISTS platform_auth_inventory_candidates_provenance_check
+  `);
+    await pool.query(`
+    ALTER TABLE platform_auth_inventory_candidates
+      ADD CONSTRAINT platform_auth_inventory_candidates_provenance_check
+      CHECK (provenance <@ ARRAY['principal', 'google_link', 'google_billing', 'org_membership', 'refresh_family', 'developer_grant', 'owner_only_deployer', 'consent_grant', 'device_authorization', 'welcome_provisioning']::text[]) NOT VALID
+  `);
+    await pool.query(`
+    ALTER TABLE identity_migration_runs
+      DROP CONSTRAINT IF EXISTS identity_migration_runs_inventory_format_check
+  `);
+    await pool.query(`
+    ALTER TABLE identity_migration_runs
+      ADD CONSTRAINT identity_migration_runs_inventory_format_check
+      CHECK (inventory_format IS NULL OR inventory_format IN ('legacy_v0', 'v1', 'v2')) NOT VALID
+  `);
+    await pool.query(`
+    CREATE OR REPLACE FUNCTION platform_auth_inventory_staging_append_only() RETURNS trigger AS $$
+    BEGIN
+      IF TG_OP = 'INSERT' THEN
+        IF NOT EXISTS (SELECT 1 FROM identity_migration_runs
+          WHERE id = NEW.migration_run_id AND kind = 'inventory' AND state = 'running') THEN
+          RAISE EXCEPTION 'completed inventory staging is frozen';
+        END IF;
+        RETURN NEW;
+      END IF;
+      RAISE EXCEPTION 'platform auth inventory staging is append-only';
+    END;
+    $$ LANGUAGE plpgsql
+  `);
+    await pool.query(`
+    CREATE OR REPLACE FUNCTION platform_auth_inventory_progress_guard() RETURNS trigger AS $$
+    BEGIN
+      IF TG_OP = 'DELETE' OR OLD.phase = 'completed' OR OLD.terminal_error IS NOT NULL THEN
+        RAISE EXCEPTION 'terminal inventory progress is immutable';
+      END IF;
+      IF OLD.migration_run_id IS DISTINCT FROM NEW.migration_run_id
+        OR NEW.remote_page_count < OLD.remote_page_count
+        OR NEW.remote_user_count < OLD.remote_user_count
+        OR NEW.local_subject_count < OLD.local_subject_count
+        OR NEW.candidate_count < OLD.candidate_count
+        OR NEW.excluded_count < OLD.excluded_count
+        OR (OLD.local_source_epoch IS NOT NULL
+          AND NEW.local_source_epoch IS DISTINCT FROM OLD.local_source_epoch)
+        OR (OLD.local_snapshot_at IS NOT NULL
+          AND NEW.local_snapshot_at IS DISTINCT FROM OLD.local_snapshot_at)
+        OR (OLD.phase = 'local' AND NEW.phase = 'remote') THEN
+        RAISE EXCEPTION 'inventory progress cannot move backwards';
+      END IF;
+      RETURN NEW;
+    END;
+    $$ LANGUAGE plpgsql
+  `);
+    await pool.query(`
+    DROP TRIGGER IF EXISTS platform_auth_inventory_remote_pages_append_only_trigger
+      ON platform_auth_inventory_remote_pages;
+    CREATE TRIGGER platform_auth_inventory_remote_pages_append_only_trigger
+      BEFORE INSERT OR UPDATE OR DELETE ON platform_auth_inventory_remote_pages
+      FOR EACH ROW EXECUTE FUNCTION platform_auth_inventory_staging_append_only();
+    DROP TRIGGER IF EXISTS platform_auth_inventory_remote_users_append_only_trigger
+      ON platform_auth_inventory_remote_users;
+    CREATE TRIGGER platform_auth_inventory_remote_users_append_only_trigger
+      BEFORE INSERT OR UPDATE OR DELETE ON platform_auth_inventory_remote_users
+      FOR EACH ROW EXECUTE FUNCTION platform_auth_inventory_staging_append_only();
+    DROP TRIGGER IF EXISTS platform_auth_inventory_exclusions_append_only_trigger
+      ON platform_auth_inventory_exclusions;
+    CREATE TRIGGER platform_auth_inventory_exclusions_append_only_trigger
+      BEFORE INSERT OR UPDATE OR DELETE ON platform_auth_inventory_exclusions
+      FOR EACH ROW EXECUTE FUNCTION platform_auth_inventory_staging_append_only();
+    DROP TRIGGER IF EXISTS platform_auth_inventory_progress_guard_trigger
+      ON platform_auth_inventory_progress;
+    CREATE TRIGGER platform_auth_inventory_progress_guard_trigger
+      BEFORE UPDATE OR DELETE ON platform_auth_inventory_progress
+      FOR EACH ROW EXECUTE FUNCTION platform_auth_inventory_progress_guard()
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_auth_rollout_previews (
+      checksum text PRIMARY KEY CHECK (checksum ~ '^[0-9a-f]{64}$'),
+      expected_generation bigint NOT NULL CHECK (expected_generation >= 0),
+      operation text NOT NULL CHECK (operation IN ('activate', 'rollback', 'finalize')),
+      percentage integer NOT NULL CHECK (percentage BETWEEN 0 AND 100),
+      cohort_mode text NOT NULL CHECK (cohort_mode IN ('preserve', 'replace')),
+      canary_client_set_hash text NOT NULL CHECK (canary_client_set_hash ~ '^[0-9a-f]{64}$'),
+      canary_client_count integer NOT NULL CHECK (canary_client_count >= 0),
+      recovery_client_set_hash text NOT NULL CHECK (recovery_client_set_hash ~ '^[0-9a-f]{64}$'),
+      recovery_client_count integer NOT NULL CHECK (recovery_client_count >= 0),
+      release_sha text NOT NULL CHECK (release_sha ~ '^[0-9a-f]{40}$'),
+      inventory_run_hash text,
+      inventory_checksum text,
+      import_run_hash text,
+      import_lineage_checksum text,
+      workos_realm_fingerprint text,
+      workos_client_fingerprint text
+        CHECK (workos_client_fingerprint IS NULL OR workos_client_fingerprint ~ '^[0-9a-f]{64}$'),
+      rollback_rehearsal_checksum text
+        CHECK (rollback_rehearsal_checksum IS NULL OR rollback_rehearsal_checksum ~ '^[0-9a-f]{64}$'),
+      staging_workos_only_smoke_checksum text
+        CHECK (staging_workos_only_smoke_checksum IS NULL OR staging_workos_only_smoke_checksum ~ '^[0-9a-f]{64}$'),
+      aggregate_checksum text NOT NULL CHECK (aggregate_checksum ~ '^[0-9a-f]{64}$'),
+      expires_at timestamptz NOT NULL,
+      created_at timestamptz NOT NULL DEFAULT now()
+    )
+  `);
+    await pool.query(`
+    ALTER TABLE platform_auth_rollout_previews
+      ADD COLUMN IF NOT EXISTS inventory_run_hash text,
+      ADD COLUMN IF NOT EXISTS inventory_checksum text,
+      ADD COLUMN IF NOT EXISTS import_run_hash text,
+      ADD COLUMN IF NOT EXISTS import_lineage_checksum text,
+      ADD COLUMN IF NOT EXISTS cohort_mode text,
+      ADD COLUMN IF NOT EXISTS workos_realm_fingerprint text,
+      ADD COLUMN IF NOT EXISTS workos_client_fingerprint text
+        CHECK (workos_client_fingerprint IS NULL OR workos_client_fingerprint ~ '^[0-9a-f]{64}$'),
+      ADD COLUMN IF NOT EXISTS rollback_rehearsal_checksum text
+        CHECK (rollback_rehearsal_checksum IS NULL OR rollback_rehearsal_checksum ~ '^[0-9a-f]{64}$'),
+      ADD COLUMN IF NOT EXISTS staging_workos_only_smoke_checksum text
+        CHECK (staging_workos_only_smoke_checksum IS NULL OR staging_workos_only_smoke_checksum ~ '^[0-9a-f]{64}$')
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_auth_rollout_evidence_v2 (
+      idempotency_key_hash text PRIMARY KEY CHECK (idempotency_key_hash ~ '^[0-9a-f]{64}$'),
+      request_fingerprint text NOT NULL CHECK (request_fingerprint ~ '^[0-9a-f]{64}$'),
+      replay_request_fingerprint text
+        CHECK (replay_request_fingerprint IS NULL OR replay_request_fingerprint ~ '^[0-9a-f]{64}$'),
+      actor_fingerprint text CHECK (actor_fingerprint IS NULL OR actor_fingerprint ~ '^[0-9a-f]{64}$'),
+      operation text NOT NULL CHECK (operation IN ('activate', 'rollback', 'finalize')),
+      release_sha text NOT NULL CHECK (release_sha ~ '^[0-9a-f]{40}$'),
+      preview_checksum text NOT NULL CHECK (preview_checksum ~ '^[0-9a-f]{64}$'),
+      lineage_fingerprint text,
+      rollback_rehearsal_checksum text
+        CHECK (rollback_rehearsal_checksum IS NULL OR rollback_rehearsal_checksum ~ '^[0-9a-f]{64}$'),
+      staging_workos_only_smoke_checksum text
+        CHECK (staging_workos_only_smoke_checksum IS NULL OR staging_workos_only_smoke_checksum ~ '^[0-9a-f]{64}$'),
+      prior_state jsonb NOT NULL,
+      applied_state jsonb NOT NULL,
+      created_at timestamptz NOT NULL DEFAULT now()
+    )
+  `);
+    await pool.query(`
+    ALTER TABLE platform_auth_rollout_evidence_v2
+      ADD COLUMN IF NOT EXISTS lineage_fingerprint text,
+      ADD COLUMN IF NOT EXISTS replay_request_fingerprint text
+        CHECK (replay_request_fingerprint IS NULL OR replay_request_fingerprint ~ '^[0-9a-f]{64}$'),
+      ADD COLUMN IF NOT EXISTS rollback_rehearsal_checksum text
+        CHECK (rollback_rehearsal_checksum IS NULL OR rollback_rehearsal_checksum ~ '^[0-9a-f]{64}$'),
+      ADD COLUMN IF NOT EXISTS staging_workos_only_smoke_checksum text
+        CHECK (staging_workos_only_smoke_checksum IS NULL OR staging_workos_only_smoke_checksum ~ '^[0-9a-f]{64}$')
+  `);
+}
+/**
+ * Upgrades the rollout clock and frozen inventory shape shipped by preceding releases. Original inventory
+ * checksums remain unchanged; unsupported custom-realm evidence fails closed instead of guessing mutable
+ * identity state.
+ */
+export async function upgradePlatformAuthMigrationSchema(pool) {
+    const connection = pool.connect === undefined ? pool : await pool.connect();
+    try {
+        await connection.query('BEGIN');
+        await connection.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [
+            'platform-auth-inventory-schema:v1',
+        ]);
+        await connection.query('ALTER TABLE platform_auth_rollout_state ADD COLUMN IF NOT EXISTS workos_stage_since timestamptz');
+        await connection.query('UPDATE platform_auth_rollout_state SET workos_stage_since = COALESCE(workos_stage_since, workos_default_since, updated_at) WHERE workos_percentage > 0 AND workos_stage_since IS NULL');
+        await connection.query('LOCK TABLE identity_migration_runs, platform_auth_inventory_candidates IN ACCESS EXCLUSIVE MODE');
+        const triggers = await connection.query(`SELECT trigger.tgname
+         FROM pg_trigger trigger
+        WHERE NOT trigger.tgisinternal
+          AND (
+            (trigger.tgname = 'completed_identity_migration_run_append_only_trigger'
+              AND trigger.tgrelid = to_regclass('identity_migration_runs'))
+            OR
+            (trigger.tgname = 'platform_auth_inventory_candidate_append_only_trigger'
+              AND trigger.tgrelid = to_regclass('platform_auth_inventory_candidates'))
+          )`);
+        const triggerNames = new Set(triggers.rows.map((row) => row.tgname));
+        if (triggerNames.has('completed_identity_migration_run_append_only_trigger'))
+            await connection.query('ALTER TABLE identity_migration_runs DISABLE TRIGGER completed_identity_migration_run_append_only_trigger');
+        if (triggerNames.has('platform_auth_inventory_candidate_append_only_trigger'))
+            await connection.query('ALTER TABLE platform_auth_inventory_candidates DISABLE TRIGGER platform_auth_inventory_candidate_append_only_trigger');
+        const runs = await connection.query(`SELECT id, frozen_checksum, source_fingerprint, workos_realm_fingerprint,
+              google_realm, excluded_fingerprint, inventory_format, safe_result
+         FROM identity_migration_runs
+        WHERE kind = 'inventory' AND state = 'completed' AND inventory_format IS NULL
+        ORDER BY id FOR UPDATE`);
+        for (const run of runs.rows) {
+            const candidates = await connection.query(`SELECT migration_run_id, source_subject, source_realm, principal_id,
+                normalized_email, email_fingerprint, provenance, blocker_codes,
+                source_fingerprint, candidate_fingerprint
+           FROM platform_auth_inventory_candidates
+          WHERE migration_run_id = $1 ORDER BY source_subject FOR UPDATE`, [run.id]);
+            const isLegacy = run.google_realm === null ||
+                run.excluded_fingerprint === null ||
+                candidates.rows.some((candidate) => candidate.source_realm === null || candidate.candidate_fingerprint === null);
+            if (!isLegacy) {
+                await connection.query("UPDATE identity_migration_runs SET inventory_format = 'v1' WHERE id = $1", [run.id]);
+                continue;
+            }
+            await upgradeLegacyInventory(connection, run, candidates.rows);
+        }
+        await connection.query('ALTER TABLE identity_migration_runs DROP CONSTRAINT IF EXISTS identity_migration_runs_inventory_format_check');
+        await connection.query("ALTER TABLE identity_migration_runs ADD CONSTRAINT identity_migration_runs_inventory_format_check CHECK (inventory_format IS NULL OR inventory_format IN ('legacy_v0', 'v1', 'v2')) NOT VALID");
+        await connection.query('ALTER TABLE identity_migration_runs VALIDATE CONSTRAINT identity_migration_runs_inventory_format_check');
+        if (triggerNames.has('platform_auth_inventory_candidate_append_only_trigger'))
+            await connection.query('ALTER TABLE platform_auth_inventory_candidates ENABLE TRIGGER platform_auth_inventory_candidate_append_only_trigger');
+        if (triggerNames.has('completed_identity_migration_run_append_only_trigger'))
+            await connection.query('ALTER TABLE identity_migration_runs ENABLE TRIGGER completed_identity_migration_run_append_only_trigger');
+        await connection.query('COMMIT');
+    }
+    catch (error) {
+        await connection.query('ROLLBACK').catch(() => undefined);
+        throw error;
+    }
+    finally {
+        connection.release?.();
+    }
+}
+async function upgradeLegacyInventory(connection, run, candidates) {
+    const googleRealm = run.google_realm ?? 'accounts.google.com';
+    const blockerCounts = new Map();
+    const checksumEntries = [];
+    for (const candidate of candidates) {
+        const realmFingerprint = schemaHash({
+            subject: candidate.source_subject,
+            realm: googleRealm,
+            provenance: candidate.provenance,
+        });
+        const omittedRealmFingerprint = schemaHash({
+            subject: candidate.source_subject,
+            provenance: candidate.provenance,
+        });
+        if ((candidate.source_realm !== null && candidate.source_realm !== googleRealm) ||
+            (candidate.source_fingerprint !== realmFingerprint &&
+                candidate.source_fingerprint !== omittedRealmFingerprint) ||
+            (candidate.normalized_email === null) !== (candidate.email_fingerprint === null) ||
+            (candidate.normalized_email !== null &&
+                candidate.email_fingerprint !== schemaHash(candidate.normalized_email)))
+            throw new Error('legacy platform-auth inventory lineage cannot be upgraded safely');
+        for (const code of candidate.blocker_codes)
+            blockerCounts.set(code, (blockerCounts.get(code) ?? 0) + 1);
+        const candidateFingerprint = candidateDigest(candidate);
+        await connection.query(`UPDATE platform_auth_inventory_candidates
+          SET source_realm = $3, candidate_fingerprint = $4
+        WHERE migration_run_id = $1 AND source_subject = $2`, [run.id, candidate.source_subject, googleRealm, candidateFingerprint]);
+        checksumEntries.push({
+            sourceFingerprint: candidate.source_fingerprint,
+            emailFingerprint: candidate.email_fingerprint ?? undefined,
+            provenance: candidate.provenance,
+            blockerCodes: candidate.blocker_codes,
+        });
+    }
+    const safe = normalizeLegacySafeResult(run.safe_result, candidates.length, blockerCounts);
+    if (run.frozen_checksum === null ||
+        run.source_fingerprint !== schemaHash(checksumEntries) ||
+        run.workos_realm_fingerprint === null ||
+        run.frozen_checksum !==
+            schemaHash({
+                algorithm: 'inventory-v1',
+                googleRealm,
+                workosRealm: run.workos_realm_fingerprint,
+                safe,
+                candidates: checksumEntries,
+            }))
+        throw new Error('legacy platform-auth inventory lineage cannot be upgraded safely');
+    await connection.query(`UPDATE identity_migration_runs
+        SET google_realm = $2, inventory_format = 'legacy_v0'
+      WHERE id = $1`, [run.id, googleRealm]);
+}
+function candidateDigest(candidate) {
+    return schemaHash({
+        sourceFingerprint: candidate.source_fingerprint,
+        principalFingerprint: candidate.principal_id === null ? undefined : schemaHash(candidate.principal_id),
+        emailFingerprint: candidate.email_fingerprint ?? undefined,
+        provenance: candidate.provenance,
+        blockerCodes: candidate.blocker_codes,
+    });
+}
+function normalizeLegacySafeResult(value, candidateCount, blockerCounts) {
+    if (typeof value !== 'object' || value === null)
+        throw new Error('legacy platform-auth inventory lineage cannot be upgraded safely');
+    const stored = value;
+    if (stored.candidateCount !== candidateCount ||
+        typeof stored.excludedCount !== 'number' ||
+        !Number.isInteger(stored.excludedCount) ||
+        stored.excludedCount < 0 ||
+        typeof stored.blockers !== 'object' ||
+        stored.blockers === null)
+        throw new Error('legacy platform-auth inventory lineage cannot be upgraded safely');
+    const blockers = {};
+    for (const code of LEGACY_BLOCKER_ORDER) {
+        const expected = blockerCounts.get(code) ?? 0;
+        if ((stored.blockers[code] ?? 0) !== expected)
+            throw new Error('legacy platform-auth inventory lineage cannot be upgraded safely');
+        if (expected > 0)
+            blockers[code] = expected;
+    }
+    if (Object.keys(stored.blockers).some((code) => !LEGACY_BLOCKER_SET.has(code)))
+        throw new Error('legacy platform-auth inventory lineage cannot be upgraded safely');
+    return { candidateCount, excludedCount: stored.excludedCount, blockers };
+}
+const LEGACY_BLOCKER_ORDER = [
+    'ambiguous_platform_customer_evidence',
+    'missing_verified_email',
+    'multiple_current_verified_emails',
+    'external_id_too_long',
+    'shared_verified_email',
+    'conflicting_workos_user',
+];
+const LEGACY_BLOCKER_SET = new Set(LEGACY_BLOCKER_ORDER);
+function schemaHash(value) {
+    return createHash('sha256').update(JSON.stringify(value)).digest('hex');
+}
+//# sourceMappingURL=platform-auth-migration-schema.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-migration-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-migration-schema.js","sourceRoot":"","sources":["../src/platform-auth-migration-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,4CAA4C,EAAE,MAAM,oDAAoD,CAAC;AAgClH,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,IAA+B;IAE/B,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;GAahB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;GAoBhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;GAIhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBhB,CAAC,CAAC;IACH,MAAM,4CAA4C,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;GAahB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;GAgBhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;GAGhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;GAIhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;GAShB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;GAGhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;GAIhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;GAGhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;GAIhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;GAahB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;GAsBhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;GAqBhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;GAchB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;GAmBhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;GAShB,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,IAAgB;IACvE,MAAM,UAAU,GAAqB,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IAC9F,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,UAAU,CAAC,KAAK,CAAC,uDAAuD,EAAE;YAC9E,mCAAmC;SACpC,CAAC,CAAC;QACH,MAAM,UAAU,CAAC,KAAK,CACpB,iGAAiG,CAClG,CAAC;QACF,MAAM,UAAU,CAAC,KAAK,CACpB,uLAAuL,CACxL,CAAC;QACF,MAAM,UAAU,CAAC,KAAK,CACpB,iGAAiG,CAClG,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CACrC;;;;;;;;;YASM,CACP,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,IAAI,YAAY,CAAC,GAAG,CAAC,sDAAsD,CAAC;YAC1E,MAAM,UAAU,CAAC,KAAK,CACpB,0GAA0G,CAC3G,CAAC;QACJ,IAAI,YAAY,CAAC,GAAG,CAAC,uDAAuD,CAAC;YAC3E,MAAM,UAAU,CAAC,KAAK,CACpB,sHAAsH,CACvH,CAAC;QAEJ,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,CACjC;;;;+BAIyB,CAC1B,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,KAAK,CACvC;;;;yEAIiE,EACjE,CAAC,GAAG,CAAC,EAAE,CAAC,CACT,CAAC;YACF,MAAM,QAAQ,GACZ,GAAG,CAAC,YAAY,KAAK,IAAI;gBACzB,GAAG,CAAC,oBAAoB,KAAK,IAAI;gBACjC,UAAU,CAAC,IAAI,CAAC,IAAI,CAClB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,YAAY,KAAK,IAAI,IAAI,SAAS,CAAC,qBAAqB,KAAK,IAAI,CAC9E,CAAC;YACJ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,UAAU,CAAC,KAAK,CACpB,0EAA0E,EAC1E,CAAC,GAAG,CAAC,EAAE,CAAC,CACT,CAAC;gBACF,SAAS;YACX,CAAC;YACD,MAAM,sBAAsB,CAAC,UAAU,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,UAAU,CAAC,KAAK,CACpB,8GAA8G,CAC/G,CAAC;QACF,MAAM,UAAU,CAAC,KAAK,CACpB,+LAA+L,CAChM,CAAC;QACF,MAAM,UAAU,CAAC,KAAK,CACpB,wGAAwG,CACzG,CAAC;QAEF,IAAI,YAAY,CAAC,GAAG,CAAC,uDAAuD,CAAC;YAC3E,MAAM,UAAU,CAAC,KAAK,CACpB,qHAAqH,CACtH,CAAC;QACJ,IAAI,YAAY,CAAC,GAAG,CAAC,sDAAsD,CAAC;YAC1E,MAAM,UAAU,CAAC,KAAK,CACpB,yGAAyG,CAC1G,CAAC;QACJ,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,UAA4B,EAC5B,GAA0B,EAC1B,UAAyC;IAEzC,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,IAAI,qBAAqB,CAAC;IAC9D,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,MAAM,eAAe,GAAc,EAAE,CAAC;IACtC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,gBAAgB,GAAG,UAAU,CAAC;YAClC,OAAO,EAAE,SAAS,CAAC,cAAc;YACjC,KAAK,EAAE,WAAW;YAClB,UAAU,EAAE,SAAS,CAAC,UAAU;SACjC,CAAC,CAAC;QACH,MAAM,uBAAuB,GAAG,UAAU,CAAC;YACzC,OAAO,EAAE,SAAS,CAAC,cAAc;YACjC,UAAU,EAAE,SAAS,CAAC,UAAU;SACjC,CAAC,CAAC;QACH,IACE,CAAC,SAAS,CAAC,YAAY,KAAK,IAAI,IAAI,SAAS,CAAC,YAAY,KAAK,WAAW,CAAC;YAC3E,CAAC,SAAS,CAAC,kBAAkB,KAAK,gBAAgB;gBAChD,SAAS,CAAC,kBAAkB,KAAK,uBAAuB,CAAC;YAC3D,CAAC,SAAS,CAAC,gBAAgB,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,iBAAiB,KAAK,IAAI,CAAC;YAChF,CAAC,SAAS,CAAC,gBAAgB,KAAK,IAAI;gBAClC,SAAS,CAAC,iBAAiB,KAAK,UAAU,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAEzE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,aAAa;YACxC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9D,MAAM,oBAAoB,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,UAAU,CAAC,KAAK,CACpB;;4DAEsD,EACtD,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,cAAc,EAAE,WAAW,EAAE,oBAAoB,CAAC,CACtE,CAAC;QACF,eAAe,CAAC,IAAI,CAAC;YACnB,iBAAiB,EAAE,SAAS,CAAC,kBAAkB;YAC/C,gBAAgB,EAAE,SAAS,CAAC,iBAAiB,IAAI,SAAS;YAC1D,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,YAAY,EAAE,SAAS,CAAC,aAAa;SACtC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,yBAAyB,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC1F,IACE,GAAG,CAAC,eAAe,KAAK,IAAI;QAC5B,GAAG,CAAC,kBAAkB,KAAK,UAAU,CAAC,eAAe,CAAC;QACtD,GAAG,CAAC,wBAAwB,KAAK,IAAI;QACrC,GAAG,CAAC,eAAe;YACjB,UAAU,CAAC;gBACT,SAAS,EAAE,cAAc;gBACzB,WAAW;gBACX,WAAW,EAAE,GAAG,CAAC,wBAAwB;gBACzC,IAAI;gBACJ,UAAU,EAAE,eAAe;aAC5B,CAAC;QAEJ,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,MAAM,UAAU,CAAC,KAAK,CACpB;;oBAEgB,EAChB,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,CAAC,CACtB,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,SAA6B;IACpD,OAAO,UAAU,CAAC;QAChB,iBAAiB,EAAE,SAAS,CAAC,kBAAkB;QAC/C,oBAAoB,EAClB,SAAS,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC;QAClF,gBAAgB,EAAE,SAAS,CAAC,iBAAiB,IAAI,SAAS;QAC1D,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,YAAY,EAAE,SAAS,CAAC,aAAa;KACtC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAc,EACd,cAAsB,EACtB,aAA0C;IAE1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAC7C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,KAId,CAAC;IACF,IACE,MAAM,CAAC,cAAc,KAAK,cAAc;QACxC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;QACxC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC;QACvC,MAAM,CAAC,aAAa,GAAG,CAAC;QACxB,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACnC,MAAM,CAAC,QAAQ,KAAK,IAAI;QAExB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAE,MAAM,CAAC,QAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,QAAQ;YACxE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,IAAI,QAAQ,GAAG,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,oBAAoB,GAAG;IAC3B,sCAAsC;IACtC,wBAAwB;IACxB,kCAAkC;IAClC,sBAAsB;IACtB,uBAAuB;IACvB,yBAAyB;CACjB,CAAC;AACX,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS,oBAAoB,CAAC,CAAC;AAEjE,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-migration.d.ts

@@ -0,0 +1,202 @@
+export type PlatformAuthBlockerCode = 'missing_verified_email' | 'multiple_current_verified_emails' | 'shared_verified_email' | 'external_id_too_long' | 'conflicting_workos_user' | 'ambiguous_platform_customer_evidence';
+export interface PlatformAuthInventory {
+    readonly candidateCount: number;
+    readonly excludedCount: number;
+    readonly blockers: Readonly<Partial<Record<PlatformAuthBlockerCode, number>>>;
+    readonly checksum: string;
+}
+/** Only authoritative current roots are accepted; historical/audit evidence is intentionally not a root. */
+export interface PlatformAuthInventoryInput {
+    readonly principals: readonly {
+        readonly principalId: string;
+        readonly verifiedEmails: readonly string[];
+    }[];
+    readonly orgMemberships: readonly string[];
+    readonly googleBillingOwners: readonly string[];
+    readonly activeRefreshFamilies: readonly string[];
+    readonly developerGrants: readonly string[];
+    readonly ownerOnlyDeployers: readonly {
+        readonly subject: string;
+        readonly kind: 'human' | 'github_run' | 'workload' | 'synthetic';
+    }[];
+    readonly excludedActors: readonly {
+        readonly subject: string;
+        readonly kind: 'customer' | 'delegated' | 'assistant' | 'github_run' | 'workload' | 'synthetic' | 'invitation' | 'allowlist_only' | 'audit_only';
+    }[];
+    readonly workosUsers: readonly {
+        readonly externalId: string | undefined;
+        readonly normalizedEmail: string;
+        readonly verified: boolean;
+    }[];
+}
+/** Computes aggregate-only inventory. Its return value deliberately cannot be used to enumerate identities. */
+export declare class PlatformAuthInventoryService {
+    inspect(input: PlatformAuthInventoryInput): Promise<PlatformAuthInventory>;
+}
+export interface PlatformAuthDirectoryUser {
+    readonly id: string;
+    readonly externalId: string | undefined;
+    readonly normalizedEmail: string;
+    readonly verified: boolean;
+}
+/** Provider-neutral directory boundary. Implementations must bound email results to two. */
+export interface PlatformAuthDirectory {
+    findUserByExternalId(externalId: string): Promise<PlatformAuthDirectoryUser | undefined>;
+    listUsersByNormalizedEmail(normalizedEmail: string): Promise<readonly PlatformAuthDirectoryUser[]>;
+    createVerifiedUser(input: {
+        readonly externalId: string;
+        readonly normalizedEmail: string;
+    }): Promise<PlatformAuthDirectoryUser>;
+    /** Complete bounded snapshot used only by the controlled migration inventory preflight. */
+    snapshotUsers?(): Promise<readonly PlatformAuthDirectoryUser[]>;
+    /** One provider page for the durable inventory preflight; callers persist the opaque cursor. */
+    listInventoryPage?(input: {
+        readonly after?: string;
+        readonly limit: number;
+    }): Promise<{
+        readonly users: readonly PlatformAuthDirectoryUser[];
+        readonly nextAfter?: string;
+    }>;
+}
+export type PlatformAuthDirectoryFailureKind = 'conflict' | 'rate_limited' | 'transient' | 'permanent' | 'unauthorized';
+export interface PlatformAuthDirectoryFailure {
+    readonly kind: PlatformAuthDirectoryFailureKind;
+    /** Provider-supplied retry time. The migration ledger preserves it exactly when valid. */
+    readonly retryAt?: string;
+}
+export declare class PlatformAuthMigrationError extends Error {
+    readonly code: 'source_remap_forbidden' | 'reconciliation_drift' | 'stale_lease' | 'invalid_import' | 'idempotency_conflict' | 'stale_generation' | 'release_sha_mismatch' | 'preview_mismatch' | 'remote_verification_incomplete' | 'rollout_transition_invalid' | 'finalize_precondition_failed' | 'inventory_unavailable';
+    constructor(code: 'source_remap_forbidden' | 'reconciliation_drift' | 'stale_lease' | 'invalid_import' | 'idempotency_conflict' | 'stale_generation' | 'release_sha_mismatch' | 'preview_mismatch' | 'remote_verification_incomplete' | 'rollout_transition_invalid' | 'finalize_precondition_failed' | 'inventory_unavailable');
+}
+interface ImportEntry {
+    runId: string;
+    realm: string;
+    principalId: string;
+    email: string;
+    state: 'pending' | 'reconcile_required' | 'linked' | 'blocked' | 'failed';
+    leaseToken?: string;
+    leaseExpiresAt?: number;
+    attempt: number;
+    remoteUserId?: string;
+    retryAt?: number;
+}
+export interface PlatformAuthImportLease {
+    readonly key: string;
+    readonly leaseToken: string;
+    readonly attempt: number;
+}
+export interface PlatformAuthMigrationStore {
+    recordBackfill(input: {
+        readonly source: {
+            readonly provider: string;
+            readonly realm: string;
+            readonly subject: string;
+        };
+        readonly principalId: string;
+        readonly verifiedEmail?: string;
+        readonly runId?: string;
+    }): Promise<'backfilled' | 'already_backfilled'>;
+    claimImport(input: PlatformAuthImportInput, options?: {
+        readonly forceExpired?: boolean;
+        readonly terminalRetry?: 'explicit_operator_reconcile';
+    }): Promise<PlatformAuthImportLease>;
+    finishImport(lease: PlatformAuthImportLease, result: {
+        readonly state: 'pending' | 'reconcile_required' | 'linked' | 'blocked' | 'failed';
+        readonly remoteUserId?: string;
+        readonly retryAt?: string;
+    }): Promise<{
+        readonly state: 'pending' | 'reconcile_required' | 'linked' | 'blocked' | 'failed';
+    }>;
+}
+export interface PlatformAuthImportInput {
+    readonly runId: string;
+    readonly realm: string;
+    readonly principalId: string;
+    readonly verifiedEmail: string;
+}
+/** In-memory contract store; the Postgres implementation uses the same lease fencing fields. */
+export declare class InMemoryPlatformAuthMigrationStore implements PlatformAuthMigrationStore {
+    #private;
+    recordBackfill(input: {
+        readonly source: {
+            readonly provider: string;
+            readonly realm: string;
+            readonly subject: string;
+        };
+        readonly principalId: string;
+        readonly verifiedEmail?: string;
+        readonly runId?: string;
+    }): Promise<'backfilled' | 'already_backfilled'>;
+    claimImport(input: PlatformAuthImportInput, options?: {
+        readonly forceExpired?: boolean;
+        readonly terminalRetry?: 'explicit_operator_reconcile';
+    }): Promise<PlatformAuthImportLease>;
+    finishImport(lease: PlatformAuthImportLease, result: {
+        readonly state: ImportEntry['state'];
+        readonly remoteUserId?: string;
+        readonly retryAt?: string;
+    }): Promise<{
+        readonly state: ImportEntry['state'];
+    }>;
+    getRollout(): PlatformAuthRolloutState;
+    setRollout(state: PlatformAuthRolloutState): void;
+    replayRollout(keyHash: string, request: string): PlatformAuthRolloutState | undefined;
+    recordRollout(keyHash: string, request: string, result: PlatformAuthRolloutState): void;
+}
+export declare class PlatformAuthImportService {
+    #private;
+    constructor(store: PlatformAuthMigrationStore, directory: PlatformAuthDirectory);
+    backfill(input: {
+        readonly runId: string;
+        readonly source: {
+            readonly provider: string;
+            readonly realm: string;
+            readonly subject: string;
+        };
+        readonly principalId: string;
+        readonly verifiedEmail: string;
+    }): Promise<{
+        readonly state: 'backfilled' | 'already_backfilled';
+    }>;
+    importOne(input: PlatformAuthImportInput): Promise<{
+        readonly state: ImportEntry['state'];
+    }>;
+    reconcileOne(input: PlatformAuthImportInput, options?: {
+        readonly terminalRetry?: 'explicit_operator_reconcile';
+    }): Promise<{
+        readonly state: ImportEntry['state'];
+    }>;
+}
+export interface PlatformAuthRolloutState {
+    readonly generation: number;
+    readonly workosPercentage: number;
+    readonly canaryClientIds: readonly string[];
+    readonly recoveryClientIds?: readonly string[];
+    readonly lifecycle: 'google' | 'workos' | 'finalized';
+}
+type RolloutOperation = 'activate' | 'rollback' | 'finalize';
+export declare class PlatformAuthRolloutService {
+    #private;
+    constructor(store: InMemoryPlatformAuthMigrationStore, buildInfo: {
+        readonly gitSha: string;
+    });
+    preview(input: {
+        readonly operation: RolloutOperation;
+        readonly percentage: number;
+        readonly canaryClientIds: readonly string[];
+    }): Promise<{
+        readonly generation: number;
+        readonly checksum: string;
+    }>;
+    mutate(input: {
+        readonly operation: RolloutOperation;
+        readonly percentage: number;
+        readonly canaryClientIds?: readonly string[];
+        readonly expectedGeneration: number;
+        readonly releaseSha: string;
+        readonly idempotencyKey: string;
+        readonly previewChecksum: string;
+    }): Promise<PlatformAuthRolloutState>;
+}
+export {};
+//# sourceMappingURL=platform-auth-migration.d.ts.map