@noodleseed/one 0.63.0 → 0.64.0

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-effects.js

@@ -0,0 +1,92 @@
+import { PlatformAuthOperationResultSchema } from './platform-auth-operator.js';
+import { platformAuthFinalizationEvidence, platformAuthRolloutCohort, platformAuthRolloutPercentage, } from './platform-auth-operator-rollout.js';
+import { platformAuthOperatorHash as hash } from './platform-auth-operator-state-postgres.js';
+import { mapPlatformAuthRecoveryError, platformAuthPreviewSnapshotFingerprint, platformAuthRecoveryEvidence, } from './platform-auth-operator-support.js';
+export async function recoverPlatformAuthOutbox(input) {
+    const { request, store } = input;
+    const plan = await store.previewTerminalRecovery({ limit: request.batchSize });
+    const target = {
+        batchSize: request.batchSize,
+        terminalCount: plan.terminal,
+        terminalSetHash: plan.checksum,
+    };
+    await input.state.assertPreview({
+        checksum: request.previewChecksum,
+        operation: request.operation,
+        expectedGeneration: request.expectedGeneration,
+        releaseSha: request.releaseSha,
+        targetFingerprint: hash(target),
+        snapshotFingerprint: platformAuthPreviewSnapshotFingerprint(input.snapshot),
+    });
+    let recovered;
+    try {
+        recovered = await store.recoverTerminal({
+            ...platformAuthRecoveryEvidence(request, input.requestFingerprint),
+            expectedChecksum: plan.checksum,
+        });
+    }
+    catch (error) {
+        throw mapPlatformAuthRecoveryError(error);
+    }
+    return platformAuthRecoveryResult(request, recovered, input.status);
+}
+export async function platformAuthRecoveryResult(input, recovery, status) {
+    return PlatformAuthOperationResultSchema.parse({
+        ...(await status()),
+        operation: input.operation,
+        replayed: recovery.replayed,
+        batch: {
+            attempted: recovery.attempted,
+            recovered: recovery.recovered,
+            rejected: recovery.rejected,
+        },
+    });
+}
+export async function executePlatformAuthRollout(input) {
+    const rollout = await input.rolloutStore.mutate(await platformAuthRolloutMutation({
+        ...input,
+        operation: input.request.operation,
+    }));
+    return platformAuthRolloutResult(input.request, rollout, false, input.status);
+}
+export async function platformAuthRolloutMutation(input) {
+    const lineage = await resolvePlatformAuthRolloutLineage(input.operation, input.rolloutStore, input.currentLineage);
+    const { request } = input;
+    return {
+        ...platformAuthFinalizationEvidence(request),
+        percentage: platformAuthRolloutPercentage(request),
+        ...lineage,
+        workosRealm: input.workosRealm,
+        releaseSha: input.releaseSha,
+        expectedGeneration: request.expectedGeneration,
+        idempotencyKey: request.idempotencyKey,
+        previewChecksum: request.previewChecksum,
+        actorFingerprint: request.actorFingerprint,
+        replayRequestFingerprint: input.requestFingerprint,
+        ...platformAuthRolloutCohort(request),
+    };
+}
+export async function platformAuthRolloutResult(input, rollout, replayed, status) {
+    return PlatformAuthOperationResultSchema.parse({
+        ...(await status()),
+        rollout,
+        operation: input.operation,
+        replayed,
+        batch: null,
+    });
+}
+export async function resolvePlatformAuthRolloutLineage(operation, rolloutStore, currentLineage) {
+    if (operation === 'rollback') {
+        const bound = await rolloutStore.boundLineage();
+        if (bound !== undefined)
+            return bound;
+    }
+    const lineage = await currentLineage();
+    return {
+        inventoryRunId: lineage.inventory.runId,
+        inventoryChecksum: lineage.inventory.checksum,
+        importRunId: lineage.campaign.importRunId,
+        importLineageChecksum: lineage.campaign.importLineageChecksum,
+    };
+}
+//# sourceMappingURL=platform-auth-operator-effects.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-effects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-operator-effects.js","sourceRoot":"","sources":["../src/platform-auth-operator-effects.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAKhF,OAAO,EACL,gCAAgC,EAChC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,wBAAwB,IAAI,IAAI,EAAE,MAAM,4CAA4C,CAAC;AAC9F,OAAO,EACL,4BAA4B,EAC5B,sCAAsC,EACtC,4BAA4B,GAC7B,MAAM,qCAAqC,CAAC;AAgB7C,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAO/C;IACC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,uBAAuB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,IAAI,CAAC,QAAQ;QAC5B,eAAe,EAAE,IAAI,CAAC,QAAQ;KAC/B,CAAC;IACF,MAAM,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC;QAC9B,QAAQ,EAAE,OAAO,CAAC,eAAe;QACjC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC;QAC/B,mBAAmB,EAAE,sCAAsC,CAAC,KAAK,CAAC,QAAQ,CAAC;KAC5E,CAAC,CAAC;IACH,IAAI,SAA6C,CAAC;IAClD,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC;YACtC,GAAG,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC,kBAAkB,CAAC;YAClE,gBAAgB,EAAE,IAAI,CAAC,QAAQ;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,0BAA0B,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAkF,EAClF,QAA4C,EAC5C,MAAmD;IAEnD,OAAO,iCAAiC,CAAC,KAAK,CAAC;QAC7C,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC;QACnB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK,EAAE;YACL,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAQhD;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAC7C,MAAM,2BAA2B,CAAC;QAChC,GAAG,KAAK;QACR,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;KACnC,CAAC,CACH,CAAC;IACF,OAAO,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAQjD;IACC,MAAM,OAAO,GAAG,MAAM,iCAAiC,CACrD,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,OAAO;QACL,GAAG,gCAAgC,CAAC,OAAO,CAAC;QAC5C,UAAU,EAAE,6BAA6B,CAAC,OAAO,CAAC;QAClD,GAAG,OAAO;QACV,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,wBAAwB,EAAE,KAAK,CAAC,kBAAkB;QAClD,GAAG,yBAAyB,CAAC,OAAO,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAmB,EACnB,OAAsC,EACtC,QAAiB,EACjB,MAAmD;IAEnD,OAAO,iCAAiC,CAAC,KAAK,CAAC;QAC7C,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC;QACnB,OAAO;QACP,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ;QACR,KAAK,EAAE,IAAI;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,SAA+C,EAC/C,YAA0C,EAC1C,cAAiE;IAEjE,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,YAAY,EAAE,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;IACvC,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK;QACvC,iBAAiB,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ;QAC7C,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW;QACzC,qBAAqB,EAAE,OAAO,CAAC,QAAQ,CAAC,qBAAqB;KAC9D,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-operation-postgres.d.ts

@@ -0,0 +1,31 @@
+import { type PlatformAuthOperationResult } from './platform-auth-operator.js';
+import type { PlatformAuthOperatorPool } from './platform-auth-operator-state-postgres.js';
+/** Durable idempotency ledger with an applied stage that closes the post-side-effect crash window. */
+export declare class PostgresPlatformAuthOperatorOperationStore {
+    #private;
+    constructor(pool: PlatformAuthOperatorPool);
+    claim(input: {
+        readonly idempotencyKey: string;
+        readonly requestFingerprint: string;
+        readonly actorFingerprint: string;
+        readonly reasonFingerprint: string;
+        readonly operation: PlatformAuthOperationResult['operation'];
+        readonly previewChecksum: string;
+    }): Promise<{
+        readonly kind: 'replay';
+        readonly result: PlatformAuthOperationResult;
+    } | {
+        readonly kind: 'claimed';
+        readonly leaseToken: string;
+    }>;
+    recordApplied(input: {
+        readonly idempotencyKey: string;
+        readonly leaseToken: string;
+        readonly result: PlatformAuthOperationResult;
+    }): Promise<void>;
+    complete(input: {
+        readonly idempotencyKey: string;
+        readonly leaseToken: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=platform-auth-operator-operation-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-operation-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-operator-operation-postgres.d.ts","sourceRoot":"","sources":["../src/platform-auth-operator-operation-postgres.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,2BAA2B,EAGjC,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAG3F,sGAAsG;AACtG,qBAAa,0CAA0C;;gBAGzC,IAAI,EAAE,wBAAwB;IAIpC,KAAK,CAAC,KAAK,EAAE;QACjB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,SAAS,EAAE,2BAA2B,CAAC,WAAW,CAAC,CAAC;QAC7D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;KAClC,GAAG,OAAO,CACP;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;KAAE,GACzE;QAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAC5D;IA2EK,aAAa,CAAC,KAAK,EAAE;QACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;KAC9C,GAAG,OAAO,CAAC,IAAI,CAAC;IAWX,QAAQ,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC;CAWlB"}

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-operation-postgres.js

@@ -0,0 +1,94 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { PlatformAuthOperationResultSchema, PlatformAuthOperatorError, } from './platform-auth-operator.js';
+/** Durable idempotency ledger with an applied stage that closes the post-side-effect crash window. */
+export class PostgresPlatformAuthOperatorOperationStore {
+    #pool;
+    constructor(pool) {
+        this.#pool = pool;
+    }
+    async claim(input) {
+        const idempotencyHash = hash(input.idempotencyKey);
+        const leaseToken = randomUUID();
+        const leaseTokenHash = hash(leaseToken);
+        const connection = this.#pool.connect === undefined ? this.#pool : await this.#pool.connect();
+        try {
+            await connection.query('BEGIN');
+            await connection.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [
+                `platform-auth-operator:${idempotencyHash}`,
+            ]);
+            const prior = await connection.query(`SELECT request_fingerprint, state, lease_expires_at, safe_result
+           FROM platform_auth_operator_operations WHERE idempotency_key_hash = $1 FOR UPDATE`, [idempotencyHash]);
+            const row = prior.rows[0];
+            if (row !== undefined && row.request_fingerprint !== input.requestFingerprint)
+                throw new PlatformAuthOperatorError('idempotency_conflict');
+            if (row?.state === 'completed' || row?.state === 'applied') {
+                const result = PlatformAuthOperationResultSchema.parse(row.safe_result);
+                if (row.state === 'applied') {
+                    await connection.query(`UPDATE platform_auth_operator_operations
+                SET state = 'completed', lease_token_hash = NULL, lease_expires_at = NULL,
+                    updated_at = now()
+              WHERE idempotency_key_hash = $1 AND state = 'applied'`, [idempotencyHash]);
+                }
+                await connection.query('COMMIT');
+                return { kind: 'replay', result: { ...result, replayed: true } };
+            }
+            if (row !== undefined && isFuture(row.lease_expires_at))
+                throw new PlatformAuthOperatorError('stale_lease');
+            if (row === undefined) {
+                await connection.query(`INSERT INTO platform_auth_operator_operations
+             (idempotency_key_hash, request_fingerprint, actor_fingerprint, reason_fingerprint,
+              operation, preview_checksum, state, lease_token_hash, lease_expires_at)
+           VALUES ($1, $2, $3, $4, $5, $6, 'running', $7, now() + interval '15 minutes')`, [
+                    idempotencyHash,
+                    input.requestFingerprint,
+                    input.actorFingerprint,
+                    input.reasonFingerprint,
+                    input.operation,
+                    input.previewChecksum,
+                    leaseTokenHash,
+                ]);
+            }
+            else {
+                await connection.query(`UPDATE platform_auth_operator_operations
+              SET lease_token_hash = $2, lease_expires_at = now() + interval '15 minutes',
+                  updated_at = now()
+            WHERE idempotency_key_hash = $1`, [idempotencyHash, leaseTokenHash]);
+            }
+            await connection.query('COMMIT');
+            return { kind: 'claimed', leaseToken };
+        }
+        catch (error) {
+            await connection.query('ROLLBACK').catch(() => undefined);
+            throw error;
+        }
+        finally {
+            connection.release?.();
+        }
+    }
+    async recordApplied(input) {
+        const updated = await this.#pool.query(`UPDATE platform_auth_operator_operations
+          SET state = 'applied', safe_result = $3, updated_at = now()
+        WHERE idempotency_key_hash = $1 AND state = 'running' AND lease_token_hash = $2
+          AND lease_expires_at > now() RETURNING idempotency_key_hash`, [hash(input.idempotencyKey), hash(input.leaseToken), JSON.stringify(input.result)]);
+        if (updated.rows[0] === undefined)
+            throw new PlatformAuthOperatorError('stale_lease');
+    }
+    async complete(input) {
+        const updated = await this.#pool.query(`UPDATE platform_auth_operator_operations
+          SET state = 'completed', lease_token_hash = NULL, lease_expires_at = NULL,
+              updated_at = now()
+        WHERE idempotency_key_hash = $1 AND state = 'applied' AND lease_token_hash = $2
+        RETURNING idempotency_key_hash`, [hash(input.idempotencyKey), hash(input.leaseToken)]);
+        if (updated.rows[0] === undefined)
+            throw new PlatformAuthOperatorError('stale_lease');
+    }
+}
+function hash(value) {
+    return createHash('sha256').update(JSON.stringify(value)).digest('hex');
+}
+function isFuture(value) {
+    if (value === null)
+        return false;
+    return new Date(value).getTime() > Date.now();
+}
+//# sourceMappingURL=platform-auth-operator-operation-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-operation-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-operator-operation-postgres.js","sourceRoot":"","sources":["../src/platform-auth-operator-operation-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAEL,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,6BAA6B,CAAC;AAIrC,sGAAsG;AACtG,MAAM,OAAO,0CAA0C;IAC5C,KAAK,CAA2B;IAEzC,YAAY,IAA8B;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAOX;QAIC,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;QAChC,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,UAAU,GACd,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7E,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,MAAM,UAAU,CAAC,KAAK,CAAC,uDAAuD,EAAE;gBAC9E,0BAA0B,eAAe,EAAE;aAC5C,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,KAAK,CAMlC;6FACqF,EACrF,CAAC,eAAe,CAAC,CAClB,CAAC;YACF,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,mBAAmB,KAAK,KAAK,CAAC,kBAAkB;gBAC3E,MAAM,IAAI,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;YAC9D,IAAI,GAAG,EAAE,KAAK,KAAK,WAAW,IAAI,GAAG,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC3D,MAAM,MAAM,GAAG,iCAAiC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACxE,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBAC5B,MAAM,UAAU,CAAC,KAAK,CACpB;;;oEAGwD,EACxD,CAAC,eAAe,CAAC,CAClB,CAAC;gBACJ,CAAC;gBACD,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACjC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;YACnE,CAAC;YACD,IAAI,GAAG,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBACrD,MAAM,IAAI,yBAAyB,CAAC,aAAa,CAAC,CAAC;YACrD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,UAAU,CAAC,KAAK,CACpB;;;yFAG+E,EAC/E;oBACE,eAAe;oBACf,KAAK,CAAC,kBAAkB;oBACxB,KAAK,CAAC,gBAAgB;oBACtB,KAAK,CAAC,iBAAiB;oBACvB,KAAK,CAAC,SAAS;oBACf,KAAK,CAAC,eAAe;oBACrB,cAAc;iBACf,CACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,UAAU,CAAC,KAAK,CACpB;;;4CAGkC,EAClC,CAAC,eAAe,EAAE,cAAc,CAAC,CAClC,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1D,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAInB;QACC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpC;;;sEAGgE,EAChE,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CACnF,CAAC;QACF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,yBAAyB,CAAC,aAAa,CAAC,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAGd;QACC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpC;;;;uCAIiC,EACjC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CACrD,CAAC;QACF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,yBAAyB,CAAC,aAAa,CAAC,CAAC;IACxF,CAAC;CACF;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,QAAQ,CAAC,KAA2B;IAC3C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAChD,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-ports.d.ts

@@ -0,0 +1,102 @@
+import type { PlatformAuthInventoryAdvance } from './platform-auth-inventory-paging.js';
+import type { PlatformAuthInventory } from './platform-auth-migration.js';
+import type { PlatformAuthFrozenCandidate, PlatformAuthMigrationRun, PlatformAuthMigrationRunInput } from './platform-auth-migration-postgres.js';
+import type { PlatformAuthEventsProcessor, PlatformAuthOutboxProcessor } from './platform-auth-operator.js';
+import type { PlatformAuthOperatorRolloutTarget } from './platform-auth-operator-rollout.js';
+import type { OperatorCampaignLineage, OperatorInventoryLineage, PlatformAuthOperatorPool } from './platform-auth-operator-state-postgres.js';
+import type { PlatformAuthRemoteVerificationStore } from './platform-auth-remote-verification.js';
+import type { PlatformAuthRolloutLineage, PlatformAuthRolloutReplayInput, PlatformAuthRolloutSafeResult } from './platform-auth-rollout-postgres.js';
+import type { PlatformAuthRolloutOperationInput } from './platform-auth-rollout-support.js';
+import type { PlatformIdentitySyncRecoveryStore } from './platform-identity-sync.js';
+export interface PlatformAuthInventoryStorePort {
+    inspect(runId: string): Promise<PlatformAuthInventory>;
+    advance?(runId: string): Promise<PlatformAuthInventoryAdvance>;
+}
+export interface PlatformAuthMigrationStorePort {
+    createRun(input: PlatformAuthMigrationRunInput): Promise<PlatformAuthMigrationRun>;
+    listFrozenCandidateBatch(runId: string, options: {
+        readonly limit: number;
+        readonly eligibility: 'operator_reconcile';
+    }): Promise<{
+        readonly candidates: readonly PlatformAuthFrozenCandidate[];
+    }>;
+    completeRun(runId: string): Promise<PlatformAuthMigrationRun>;
+}
+export interface PlatformAuthImportServicePort {
+    backfill(input: {
+        readonly runId: string;
+        readonly source: PlatformAuthFrozenCandidate['source'];
+        readonly principalId: string;
+        readonly verifiedEmail: string;
+    }): Promise<{
+        readonly state: 'backfilled' | 'already_backfilled';
+    }>;
+    reconcileOne(input: {
+        readonly runId: string;
+        readonly realm: string;
+        readonly principalId: string;
+        readonly verifiedEmail: string;
+    }, options: {
+        readonly terminalRetry: 'explicit_operator_reconcile';
+    }): Promise<{
+        readonly state: 'pending' | 'reconcile_required' | 'linked' | 'blocked' | 'failed';
+    }>;
+}
+export interface PlatformAuthRolloutStorePort {
+    status(): Promise<PlatformAuthRolloutSafeResult>;
+    boundLineage(): Promise<PlatformAuthRolloutLineage | undefined>;
+    preview(input: PlatformAuthRolloutOperationInput & {
+        readonly percentage: number;
+        readonly inventoryRunId: string;
+        readonly inventoryChecksum: string;
+        readonly importRunId: string;
+        readonly importLineageChecksum: string;
+        readonly workosRealm: string;
+        readonly releaseSha: string;
+    } & PlatformAuthOperatorRolloutTarget): Promise<{
+        readonly generation: number;
+        readonly checksum: string;
+    }>;
+    mutate(input: PlatformAuthRolloutOperationInput & {
+        readonly percentage: number;
+        readonly inventoryRunId: string;
+        readonly inventoryChecksum: string;
+        readonly importRunId: string;
+        readonly importLineageChecksum: string;
+        readonly workosRealm: string;
+        readonly releaseSha: string;
+        readonly expectedGeneration: number;
+        readonly idempotencyKey: string;
+        readonly previewChecksum: string;
+        readonly actorFingerprint: string;
+    } & PlatformAuthOperatorRolloutTarget): Promise<PlatformAuthRolloutSafeResult>;
+    replayMutation(input: PlatformAuthRolloutReplayInput): Promise<PlatformAuthRolloutSafeResult | undefined>;
+}
+export interface PlatformAuthRemoteVerificationWorkerPort {
+    verify(input: {
+        readonly inventoryRunId: string;
+        readonly importRunId: string;
+        readonly realm: string;
+        readonly freshAfter: Date;
+        readonly limit: number;
+    }): Promise<unknown>;
+}
+export interface PlatformAuthOperatorCurrentLineage {
+    readonly inventory: OperatorInventoryLineage;
+    readonly campaign: OperatorCampaignLineage;
+}
+export interface PostgresPlatformAuthOperatorOptions {
+    readonly pool: PlatformAuthOperatorPool;
+    readonly inventoryStore: PlatformAuthInventoryStorePort;
+    readonly migrationStore: PlatformAuthMigrationStorePort;
+    readonly importService: PlatformAuthImportServicePort;
+    readonly rolloutStore: PlatformAuthRolloutStorePort;
+    readonly releaseSha: string;
+    readonly workosRealm: string;
+    readonly outboxProcessor?: PlatformAuthOutboxProcessor;
+    readonly outboxRecoveryStore?: PlatformIdentitySyncRecoveryStore;
+    readonly eventsProcessor?: PlatformAuthEventsProcessor;
+    readonly remoteVerificationWorker?: PlatformAuthRemoteVerificationWorkerPort;
+    readonly remoteVerificationStore?: Pick<PlatformAuthRemoteVerificationStore, 'readiness'>;
+}
+//# sourceMappingURL=platform-auth-operator-ports.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-operator-ports.d.ts","sourceRoot":"","sources":["../src/platform-auth-operator-ports.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AACxF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,KAAK,EACV,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,EAC9B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EACV,2BAA2B,EAC3B,2BAA2B,EAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAC7F,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,wCAAwC,CAAC;AAClG,OAAO,KAAK,EACV,0BAA0B,EAC1B,8BAA8B,EAC9B,6BAA6B,EAC9B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAErF,MAAM,WAAW,8BAA8B;IAC7C,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACvD,OAAO,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,8BAA8B;IAC7C,SAAS,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACnF,wBAAwB,CACtB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAA;KAAE,GAC9E,OAAO,CAAC;QAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,2BAA2B,EAAE,CAAA;KAAE,CAAC,CAAC;IAC5E,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;KAChC,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,oBAAoB,CAAA;KAAE,CAAC,CAAC;IACrE,YAAY,CACV,KAAK,EAAE;QACL,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;KAChC,EACD,OAAO,EAAE;QAAE,QAAQ,CAAC,aAAa,EAAE,6BAA6B,CAAA;KAAE,GACjE,OAAO,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,oBAAoB,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;KACpF,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,IAAI,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACjD,YAAY,IAAI,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAAC;IAChE,OAAO,CACL,KAAK,EAAE,iCAAiC,GAAG;QACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;QACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC7B,GAAG,iCAAiC,GACpC,OAAO,CAAC;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,MAAM,CACJ,KAAK,EAAE,iCAAiC,GAAG;QACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;QACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;KACnC,GAAG,iCAAiC,GACpC,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC1C,cAAc,CACZ,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,6BAA6B,GAAG,SAAS,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,wCAAwC;IACvD,MAAM,CAAC,KAAK,EAAE;QACZ,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;QAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;CAC5C;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,8BAA8B,CAAC;IACxD,QAAQ,CAAC,cAAc,EAAE,8BAA8B,CAAC;IACxD,QAAQ,CAAC,aAAa,EAAE,6BAA6B,CAAC;IACtD,QAAQ,CAAC,YAAY,EAAE,4BAA4B,CAAC;IACpD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,CAAC,EAAE,2BAA2B,CAAC;IACvD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,iCAAiC,CAAC;IACjE,QAAQ,CAAC,eAAe,CAAC,EAAE,2BAA2B,CAAC;IACvD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wCAAwC,CAAC;IAC7E,QAAQ,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC,mCAAmC,EAAE,WAAW,CAAC,CAAC;CAC3F"}

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=platform-auth-operator-ports.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-operator-ports.js","sourceRoot":"","sources":["../src/platform-auth-operator-ports.ts"],"names":[],"mappings":""}

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-postgres.d.ts

@@ -0,0 +1,17 @@
+import { type PlatformAuthExecuteInput, type PlatformAuthMaintenanceReporter, type PlatformAuthOperationPreview, type PlatformAuthOperationResult, type PlatformAuthOperator, type PlatformAuthOperatorSnapshot, type PlatformAuthPreviewRequest, type PlatformAuthSynchronizationComponent } from './platform-auth-operator.js';
+import type { PostgresPlatformAuthOperatorOptions } from './platform-auth-operator-ports.js';
+export type { PostgresPlatformAuthOperatorOptions } from './platform-auth-operator-ports.js';
+/** Durable aggregate-only orchestration. Upstream identity calls happen only in bounded explicit batches. */
+export declare class PostgresPlatformAuthOperator implements PlatformAuthOperator, PlatformAuthMaintenanceReporter {
+    #private;
+    constructor(options: PostgresPlatformAuthOperatorOptions);
+    inventory(input: {
+        readonly actorFingerprint: string;
+        readonly generation?: number;
+    }): Promise<PlatformAuthOperatorSnapshot>;
+    status(): Promise<PlatformAuthOperatorSnapshot>;
+    markMaintenanceSuccess(components: readonly PlatformAuthSynchronizationComponent[]): Promise<void>;
+    preview(input: PlatformAuthPreviewRequest): Promise<PlatformAuthOperationPreview>;
+    execute(input: PlatformAuthExecuteInput): Promise<PlatformAuthOperationResult>;
+}
+//# sourceMappingURL=platform-auth-operator-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-operator-postgres.d.ts","sourceRoot":"","sources":["../src/platform-auth-operator-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,wBAAwB,EAC7B,KAAK,+BAA+B,EACpC,KAAK,4BAA4B,EAEjC,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EAEzB,KAAK,4BAA4B,EAGjC,KAAK,0BAA0B,EAC/B,KAAK,oCAAoC,EAC1C,MAAM,6BAA6B,CAAC;AAarC,OAAO,KAAK,EAMV,mCAAmC,EACpC,MAAM,mCAAmC,CAAC;AA4B3C,YAAY,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AAE7F,6GAA6G;AAC7G,qBAAa,4BACX,YAAW,oBAAoB,EAAE,+BAA+B;;gBAiBpD,OAAO,EAAE,mCAAmC;IAmBlD,SAAS,CAAC,KAAK,EAAE;QACrB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;KAC9B,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAqCnC,MAAM,IAAI,OAAO,CAAC,4BAA4B,CAAC;IA+C/C,sBAAsB,CAC1B,UAAU,EAAE,SAAS,oCAAoC,EAAE,GAC1D,OAAO,CAAC,IAAI,CAAC;IAYV,OAAO,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,4BAA4B,CAAC;IA6EjF,OAAO,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,2BAA2B,CAAC;CAyKrF"}