@noodleseed/one 0.63.0 → 0.64.0

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-rollout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-operator-rollout.js","sourceRoot":"","sources":["../src/platform-auth-operator-rollout.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,wBAAwB,IAAI,IAAI,EAAE,MAAM,4CAA4C,CAAC;AAU9F,MAAM,CAAC,MAAM,4CAA4C,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAEtF,MAAM,UAAU,2BAA2B,CACzC,KAAiC,EACjC,QAAsC,EACtC,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,IAAI,KAAK,CAAC,SAAS,KAAK,gBAAgB;QAAE,OAAO,EAAE,CAAC;IACpD,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU;QAChC,OAAO,QAAQ,CAAC,OAAO,CAAC,SAAS,KAAK,WAAW;YAC/C,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACpD,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,QAAQ,GAAuD;QACnE,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ;KAC/B,CAAC;IACF,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,KAAK,aAAa,IAAI,QAAQ,CAAC,SAAS,CAAC,cAAc,KAAK,CAAC;QACvF,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,SAAS,KAAK,cAAc,EAAE,CAAC;QACvC,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,aAAa;YACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9D,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,aAAa;QACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,SAAS,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC;IACrD,MAAM,UAAU,GACd,QAAQ,CAAC,MAAM,CAAC,OAAO;QACvB,QAAQ,CAAC,MAAM,CAAC,iBAAiB;QACjC,QAAQ,CAAC,MAAM,CAAC,OAAO;QACvB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IACzB,IAAI,UAAU,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACrF,IAAI,QAAQ,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC;QAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACvF,IAAI,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC;QAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,IAAI,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,KAAK,gBAAgB;QAC7D,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iCAAiC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;SAClE,IAAI,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS;QAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACrE,IAAI,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,KAAK,gBAAgB;QAC7D,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iCAAiC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;SAClE,IAAI,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS;QAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACrE,IACE,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACxF,QAAQ,CAAC,OAAO,CAAC,SAAS,KAAK,WAAW;QAE1C,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACnC,MAAM,YAAY,GAChB,QAAQ,CAAC,OAAO,CAAC,kBAAkB,KAAK,IAAI;YAC1C,CAAC,CAAC,MAAM,CAAC,GAAG;YACZ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACtD,IACE,QAAQ,CAAC,OAAO,CAAC,gBAAgB,KAAK,GAAG;YACzC,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC9B,YAAY,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,4CAA4C;YAE3E,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAiC,EACjC,OAAgD;IAEhD,IAAI,KAAK,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;QACzC,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,aAAa,EAAE,CAAC;YAChB,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC;SAC1B,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GACV,KAAK,CAAC,SAAS,KAAK,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAC9D,CAAC,CAAC;YACE,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YACxD,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,MAAM;YACvD,qBAAqB,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAC5D,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,MAAM;SAC5D;QACH,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU;YAC5B,KAAK,CAAC,SAAS,KAAK,UAAU;YAC9B,KAAK,CAAC,SAAS,KAAK,UAAU;YAChC,CAAC,CAAC;gBACE,UAAU,EAAE,UAAmB;gBAC/B,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;gBAChD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;gBAC5C,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;gBACpD,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;aACjD;YACH,CAAC,CAAC;gBACE,UAAU,EAAE,IAAI;gBAChB,mBAAmB,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC7B,iBAAiB,EAAE,CAAC;gBACpB,qBAAqB,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC/B,mBAAmB,EAAE,CAAC;aACvB,CAAC;IACV,OAAO;QACL,UAAU,EACR,KAAK,CAAC,SAAS,KAAK,UAAU;YAC5B,CAAC,CAAC,KAAK,CAAC,UAAU;YAClB,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU;gBAC9B,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU;oBAC9B,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,IAAI;QACd,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;QACnE,GAAG,MAAM;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAQK;IAEL,OAAO,KAAK,CAAC,SAAS,KAAK,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QACrE,CAAC,CAAC;YACE,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;SAC3C;QACH,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,KAQK;IAEL,OAAO,KAAK,CAAC,SAAS,KAAK,UAAU;QACnC,CAAC,CAAC,KAAK,CAAC,UAAU;QAClB,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU;YAC9B,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,GAAG,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAQK;IAQL,OAAO,KAAK,CAAC,SAAS,KAAK,UAAU;QACnC,CAAC,CAAC;YACE,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;YAC1D,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;SACrE;QACH,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,KAGC;IAED,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC,UAAU,KAAK,SAAS;YACnC,CAAC,CAAC;gBACE,aAAa,EAAE,CAAC;gBAChB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,eAAe,EAAE,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC;gBAC3C,iBAAiB,EAAE,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC;aAChD;YACH,CAAC,CAAC;gBACE,aAAa,EAAE,CAAC;gBAChB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC;IACR,CAAC;IACD,OAAO,KAAK,CAAC,SAAS,KAAK,UAAU;QACnC,CAAC,CAAC;YACE,aAAa,EAAE,CAAC;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;YAC1D,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;SACrE;QACH,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,MAAM,CAAC,MAAyB;IACvC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACrC,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-schema.d.ts

@@ -0,0 +1,4 @@
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+/** Additive persistence for the aggregate-only migration operator surface. */
+export declare function ensurePlatformAuthOperatorSchema(pool: PlatformIdentityQueryable): Promise<void>;
+//# sourceMappingURL=platform-auth-operator-schema.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-operator-schema.d.ts","sourceRoot":"","sources":["../src/platform-auth-operator-schema.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,8EAA8E;AAC9E,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,IAAI,CAAC,CA8Jf"}

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-schema.js

@@ -0,0 +1,162 @@
+import { ensurePlatformAuthRemoteVerificationSchema } from './platform-auth-remote-verification-schema.js';
+/** Additive persistence for the aggregate-only migration operator surface. */
+export async function ensurePlatformAuthOperatorSchema(pool) {
+    await ensurePlatformAuthRemoteVerificationSchema(pool);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_auth_operator_campaigns (
+      import_run_id              text PRIMARY KEY REFERENCES identity_migration_runs(id) ON DELETE RESTRICT,
+      backfill_run_id            text NOT NULL UNIQUE REFERENCES identity_migration_runs(id) ON DELETE RESTRICT,
+      inventory_run_id           text NOT NULL REFERENCES identity_migration_runs(id) ON DELETE RESTRICT,
+      inventory_checksum         text NOT NULL CHECK (inventory_checksum ~ '^[0-9a-f]{64}$'),
+      import_lineage_checksum    text NOT NULL CHECK (import_lineage_checksum ~ '^[0-9a-f]{64}$'),
+      workos_realm_fingerprint   text NOT NULL CHECK (workos_realm_fingerprint ~ '^[0-9a-f]{64}$'),
+      release_sha                text NOT NULL CHECK (release_sha ~ '^[0-9a-f]{40}$'),
+      state                      text NOT NULL DEFAULT 'running' CHECK (state IN ('running', 'completed', 'failed')),
+      created_at                 timestamptz NOT NULL DEFAULT now(),
+      completed_at               timestamptz,
+      CONSTRAINT platform_auth_operator_campaign_lineage_unique
+        UNIQUE (inventory_run_id, workos_realm_fingerprint)
+    )
+  `);
+    await pool.query(`
+    CREATE INDEX IF NOT EXISTS platform_auth_operator_campaigns_latest_idx
+      ON platform_auth_operator_campaigns (created_at DESC)
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_auth_operator_previews (
+      checksum              text PRIMARY KEY CHECK (checksum ~ '^[0-9a-f]{64}$'),
+      operation             text NOT NULL CHECK (operation IN ('start_import', 'reconcile', 'recover_outbox')),
+      expected_generation   bigint NOT NULL CHECK (expected_generation >= 0),
+      release_sha           text NOT NULL CHECK (release_sha ~ '^[0-9a-f]{40}$'),
+      target_fingerprint    text NOT NULL CHECK (target_fingerprint ~ '^[0-9a-f]{64}$'),
+      snapshot_fingerprint  text NOT NULL CHECK (snapshot_fingerprint ~ '^[0-9a-f]{64}$'),
+      expires_at            timestamptz NOT NULL,
+      created_at            timestamptz NOT NULL DEFAULT now()
+    )
+  `);
+    await pool.query(`
+    ALTER TABLE platform_auth_operator_previews
+      DROP CONSTRAINT IF EXISTS platform_auth_operator_previews_operation_check;
+    ALTER TABLE platform_auth_operator_previews
+      ADD CONSTRAINT platform_auth_operator_previews_operation_check
+        CHECK (operation IN ('start_import', 'reconcile', 'recover_outbox'))
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_auth_operator_operations (
+      idempotency_key_hash  text PRIMARY KEY CHECK (idempotency_key_hash ~ '^[0-9a-f]{64}$'),
+      request_fingerprint   text NOT NULL CHECK (request_fingerprint ~ '^[0-9a-f]{64}$'),
+      actor_fingerprint     text NOT NULL CHECK (actor_fingerprint ~ '^[0-9a-f]{64}$'),
+      reason_fingerprint    text CHECK (reason_fingerprint IS NULL OR reason_fingerprint ~ '^[0-9a-f]{64}$'),
+      operation             text NOT NULL CHECK (operation IN ('start_import', 'reconcile', 'recover_outbox', 'activate', 'rollback', 'finalize')),
+      preview_checksum      text NOT NULL CHECK (preview_checksum ~ '^[0-9a-f]{64}$'),
+      state                 text NOT NULL,
+      lease_token_hash      text CHECK (lease_token_hash IS NULL OR lease_token_hash ~ '^[0-9a-f]{64}$'),
+      lease_expires_at      timestamptz,
+      safe_result           jsonb,
+      created_at            timestamptz NOT NULL DEFAULT now(),
+      updated_at            timestamptz NOT NULL DEFAULT now(),
+      CONSTRAINT platform_auth_operator_operations_state_check
+        CHECK (state IN ('running', 'applied', 'completed')),
+      CONSTRAINT platform_auth_operator_operations_lifecycle_check
+        CHECK ((state = 'running' AND lease_token_hash IS NOT NULL AND lease_expires_at IS NOT NULL AND safe_result IS NULL)
+          OR (state = 'applied' AND lease_token_hash IS NOT NULL AND lease_expires_at IS NOT NULL AND safe_result IS NOT NULL)
+          OR (state = 'completed' AND lease_token_hash IS NULL AND lease_expires_at IS NULL AND safe_result IS NOT NULL))
+    )
+  `);
+    await pool.query(`
+    ALTER TABLE platform_auth_operator_operations
+      ADD COLUMN IF NOT EXISTS reason_fingerprint text
+        CHECK (reason_fingerprint IS NULL OR reason_fingerprint ~ '^[0-9a-f]{64}$')
+  `);
+    await pool.query(`
+    ALTER TABLE platform_auth_operator_operations
+      DROP CONSTRAINT IF EXISTS platform_auth_operator_operations_operation_check,
+      DROP CONSTRAINT IF EXISTS platform_auth_operator_operations_state_check,
+      DROP CONSTRAINT IF EXISTS platform_auth_operator_operations_lifecycle_check,
+      DROP CONSTRAINT IF EXISTS platform_auth_operator_operations_check;
+    ALTER TABLE platform_auth_operator_operations
+      ADD CONSTRAINT platform_auth_operator_operations_operation_check
+        CHECK (operation IN ('start_import', 'reconcile', 'recover_outbox', 'activate', 'rollback', 'finalize')),
+      ADD CONSTRAINT platform_auth_operator_operations_state_check
+        CHECK (state IN ('running', 'applied', 'completed')),
+      ADD CONSTRAINT platform_auth_operator_operations_lifecycle_check
+        CHECK ((state = 'running' AND lease_token_hash IS NOT NULL AND lease_expires_at IS NOT NULL AND safe_result IS NULL)
+          OR (state = 'applied' AND lease_token_hash IS NOT NULL AND lease_expires_at IS NOT NULL AND safe_result IS NOT NULL)
+          OR (state = 'completed' AND lease_token_hash IS NULL AND lease_expires_at IS NULL AND safe_result IS NOT NULL))
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_auth_operator_sync_health (
+      component        text PRIMARY KEY CHECK (component IN ('outbox', 'events')),
+      last_success_at  timestamptz NOT NULL,
+      updated_at       timestamptz NOT NULL DEFAULT now()
+    )
+  `);
+    await pool.query(`
+    CREATE OR REPLACE FUNCTION platform_auth_operator_operation_guard() RETURNS trigger AS $$
+    BEGIN
+      IF TG_OP = 'DELETE' OR OLD.state = 'completed' THEN
+        RAISE EXCEPTION 'platform auth operator operations are append-only';
+      END IF;
+      IF OLD.idempotency_key_hash IS DISTINCT FROM NEW.idempotency_key_hash
+        OR OLD.request_fingerprint IS DISTINCT FROM NEW.request_fingerprint
+        OR OLD.actor_fingerprint IS DISTINCT FROM NEW.actor_fingerprint
+        OR OLD.reason_fingerprint IS DISTINCT FROM NEW.reason_fingerprint
+        OR OLD.operation IS DISTINCT FROM NEW.operation
+        OR OLD.preview_checksum IS DISTINCT FROM NEW.preview_checksum THEN
+        RAISE EXCEPTION 'platform auth operator operation evidence is immutable';
+      END IF;
+      IF OLD.state = 'applied' AND (
+        NEW.state <> 'completed'
+        OR OLD.safe_result IS DISTINCT FROM NEW.safe_result
+      ) THEN
+        RAISE EXCEPTION 'platform auth operator applied result is immutable';
+      END IF;
+      RETURN NEW;
+    END;
+    $$ LANGUAGE plpgsql
+  `);
+    await pool.query(`
+    CREATE OR REPLACE FUNCTION platform_auth_operator_campaign_guard() RETURNS trigger AS $$
+    BEGIN
+      IF TG_OP = 'DELETE' OR OLD.state <> 'running' THEN
+        RAISE EXCEPTION 'platform auth operator campaigns are append-only';
+      END IF;
+      IF OLD.import_run_id IS DISTINCT FROM NEW.import_run_id
+        OR OLD.backfill_run_id IS DISTINCT FROM NEW.backfill_run_id
+        OR OLD.inventory_run_id IS DISTINCT FROM NEW.inventory_run_id
+        OR OLD.inventory_checksum IS DISTINCT FROM NEW.inventory_checksum
+        OR OLD.import_lineage_checksum IS DISTINCT FROM NEW.import_lineage_checksum
+        OR OLD.workos_realm_fingerprint IS DISTINCT FROM NEW.workos_realm_fingerprint
+        OR OLD.release_sha IS DISTINCT FROM NEW.release_sha THEN
+        RAISE EXCEPTION 'platform auth operator campaign lineage is immutable';
+      END IF;
+      RETURN NEW;
+    END;
+    $$ LANGUAGE plpgsql
+  `);
+    await pool.query(`
+    CREATE OR REPLACE FUNCTION platform_auth_operator_preview_guard() RETURNS trigger AS $$
+    BEGIN
+      RAISE EXCEPTION 'platform auth operator previews are append-only';
+    END;
+    $$ LANGUAGE plpgsql
+  `);
+    await pool.query(`
+    DROP TRIGGER IF EXISTS platform_auth_operator_operation_guard_trigger
+      ON platform_auth_operator_operations;
+    CREATE TRIGGER platform_auth_operator_operation_guard_trigger
+      BEFORE UPDATE OR DELETE ON platform_auth_operator_operations
+      FOR EACH ROW EXECUTE FUNCTION platform_auth_operator_operation_guard();
+    DROP TRIGGER IF EXISTS platform_auth_operator_campaign_guard_trigger
+      ON platform_auth_operator_campaigns;
+    CREATE TRIGGER platform_auth_operator_campaign_guard_trigger
+      BEFORE UPDATE OR DELETE ON platform_auth_operator_campaigns
+      FOR EACH ROW EXECUTE FUNCTION platform_auth_operator_campaign_guard();
+    DROP TRIGGER IF EXISTS platform_auth_operator_preview_guard_trigger
+      ON platform_auth_operator_previews;
+    CREATE TRIGGER platform_auth_operator_preview_guard_trigger
+      BEFORE UPDATE OR DELETE ON platform_auth_operator_previews
+      FOR EACH ROW EXECUTE FUNCTION platform_auth_operator_preview_guard()
+  `);
+}
+//# sourceMappingURL=platform-auth-operator-schema.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-operator-schema.js","sourceRoot":"","sources":["../src/platform-auth-operator-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0CAA0C,EAAE,MAAM,+CAA+C,CAAC;AAG3G,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,IAA+B;IAE/B,MAAM,0CAA0C,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;GAehB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;GAGhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;GAWhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;GAMhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;GAqBhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;GAIhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;GAehB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;GAMhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;GAuBhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;GAkBhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;GAMhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;GAgBhB,CAAC,CAAC;AACL,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-state-postgres.d.ts

@@ -0,0 +1,92 @@
+import { type PlatformAuthOperatorSnapshot } from './platform-auth-operator.js';
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+export { PLATFORM_AUTH_SYNCHRONIZATION_FRESHNESS_SECONDS } from './platform-auth-operator-state-support.js';
+export type PlatformAuthOperatorPool = PlatformIdentityQueryable & {
+    connect?: () => Promise<PlatformIdentityQueryable & {
+        release?: () => void;
+    }>;
+};
+export interface OperatorInventoryLineage {
+    readonly runId: string;
+    readonly checksum: string;
+    readonly candidateCount: number;
+    readonly excludedCount: number;
+    readonly blockers: PlatformAuthOperatorSnapshot['inventory']['blockers'];
+}
+export interface OperatorCampaignLineage {
+    readonly importRunId: string;
+    readonly backfillRunId: string;
+    readonly inventoryRunId: string;
+    readonly inventoryChecksum: string;
+    readonly importLineageChecksum: string;
+    readonly state: 'running' | 'completed' | 'failed';
+}
+export declare class PostgresPlatformAuthOperatorState {
+    #private;
+    constructor(pool: PlatformAuthOperatorPool);
+    currentInventoryRun(input: {
+        readonly releaseSha: string;
+        readonly workosRealmFingerprint: string;
+    }): Promise<{
+        readonly runId: string;
+        readonly state: 'running' | 'completed';
+        readonly terminal: boolean;
+    } | undefined>;
+    withInventoryLock<T>(input: {
+        readonly releaseSha: string;
+        readonly workosRealmFingerprint: string;
+    }, task: () => Promise<T>): Promise<T>;
+    withStartImportLock<T>(input: {
+        readonly releaseSha: string;
+        readonly workosRealmFingerprint: string;
+        readonly inventoryRunId: string;
+        readonly backfillRunId: string;
+        readonly importRunId: string;
+    }, task: () => Promise<T>): Promise<T>;
+    latestInventory(input: {
+        readonly releaseSha: string;
+        readonly workosRealmFingerprint: string;
+    }): Promise<OperatorInventoryLineage | undefined>;
+    inventoryStatus(input: {
+        readonly releaseSha: string;
+        readonly workosRealmFingerprint: string;
+    }): Promise<PlatformAuthOperatorSnapshot['inventory'] | undefined>;
+    latestCampaign(input: {
+        readonly releaseSha: string;
+        readonly workosRealmFingerprint: string;
+    }): Promise<OperatorCampaignLineage | undefined>;
+    insertCampaign(input: {
+        readonly importRunId: string;
+        readonly backfillRunId: string;
+        readonly inventoryRunId: string;
+        readonly inventoryChecksum: string;
+        readonly importLineageChecksum: string;
+        readonly workosRealmFingerprint: string;
+        readonly releaseSha: string;
+    }): Promise<void>;
+    importAggregate(inventory: OperatorInventoryLineage | undefined, campaign: OperatorCampaignLineage | undefined): Promise<PlatformAuthOperatorSnapshot['import']>;
+    synchronization(input: {
+        readonly outboxConfigured: boolean;
+        readonly eventsConfigured: boolean;
+    }): Promise<PlatformAuthOperatorSnapshot['synchronization']>;
+    markSynchronizationSuccess(components: readonly ('outbox' | 'events')[]): Promise<void>;
+    savePreview(input: {
+        readonly checksum: string;
+        readonly operation: 'start_import' | 'reconcile' | 'recover_outbox';
+        readonly expectedGeneration: number;
+        readonly releaseSha: string;
+        readonly targetFingerprint: string;
+        readonly snapshotFingerprint: string;
+    }): Promise<void>;
+    assertPreview(input: {
+        readonly checksum: string;
+        readonly operation: 'start_import' | 'reconcile' | 'recover_outbox';
+        readonly expectedGeneration: number;
+        readonly releaseSha: string;
+        readonly targetFingerprint: string;
+        readonly snapshotFingerprint: string;
+    }): Promise<void>;
+    markCampaignComplete(campaign: OperatorCampaignLineage): Promise<void>;
+}
+export declare function platformAuthOperatorHash(value: unknown): string;
+//# sourceMappingURL=platform-auth-operator-state-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-state-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-operator-state-postgres.d.ts","sourceRoot":"","sources":["../src/platform-auth-operator-state-postgres.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,6BAA6B,CAAC;AAQrC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,OAAO,EAAE,+CAA+C,EAAE,MAAM,2CAA2C,CAAC;AAE5G,MAAM,MAAM,wBAAwB,GAAG,yBAAyB,GAAG;IACjE,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,yBAAyB,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC,CAAC;CAC/E,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;CACpD;AAED,qBAAa,iCAAiC;;gBAGhC,IAAI,EAAE,wBAAwB;IAIpC,mBAAmB,CAAC,KAAK,EAAE;QAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;KACzC,GAAG,OAAO,CACP;QACE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,WAAW,CAAC;QACxC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,GACD,SAAS,CACZ;IAqBK,iBAAiB,CAAC,CAAC,EACvB,KAAK,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;KAAE,EAC/E,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACrB,OAAO,CAAC,CAAC,CAAC;IAOP,mBAAmB,CAAC,CAAC,EACzB,KAAK,EAAE;QACL,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;QACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,EACD,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACrB,OAAO,CAAC,CAAC,CAAC;IAyBP,eAAe,CAAC,KAAK,EAAE;QAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;KACzC,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAqB3C,eAAe,CAAC,KAAK,EAAE;QAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;KACzC,GAAG,OAAO,CAAC,4BAA4B,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC;IAyD5D,cAAc,CAAC,KAAK,EAAE;QAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;KACzC,GAAG,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC;IA4B1C,cAAc,CAAC,KAAK,EAAE;QAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;QACvC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;QACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC;IAgCX,eAAe,CACnB,SAAS,EAAE,wBAAwB,GAAG,SAAS,EAC/C,QAAQ,EAAE,uBAAuB,GAAG,SAAS,GAC5C,OAAO,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAoD5C,eAAe,CAAC,KAAK,EAAE;QAC3B,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;QACnC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;KACpC,GAAG,OAAO,CAAC,4BAA4B,CAAC,iBAAiB,CAAC,CAAC;IAsCtD,0BAA0B,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAYvF,WAAW,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,SAAS,EAAE,cAAc,GAAG,WAAW,GAAG,gBAAgB,CAAC;QACpE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;KACtC,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBX,aAAa,CAAC,KAAK,EAAE;QACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,SAAS,EAAE,cAAc,GAAG,WAAW,GAAG,gBAAgB,CAAC;QACpE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;KACtC,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBX,oBAAoB,CAAC,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;CA4B7E;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE/D"}

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-state-postgres.js

@@ -0,0 +1,271 @@
+import { createHash } from 'node:crypto';
+import { PlatformAuthOperatorError, } from './platform-auth-operator.js';
+import { emptyPlatformAuthImport, parsePlatformAuthInventoryBlockers, parsePlatformAuthInventoryResult, platformAuthSynchronizationAgeFresh, platformAuthTimestamp, } from './platform-auth-operator-state-support.js';
+export { PLATFORM_AUTH_SYNCHRONIZATION_FRESHNESS_SECONDS } from './platform-auth-operator-state-support.js';
+export class PostgresPlatformAuthOperatorState {
+    #pool;
+    constructor(pool) {
+        this.#pool = pool;
+    }
+    async currentInventoryRun(input) {
+        const result = await this.#pool.query(`SELECT run.id, run.state, progress.terminal_error
+         FROM identity_migration_runs run
+         LEFT JOIN platform_auth_inventory_progress progress
+           ON progress.migration_run_id = run.id
+        WHERE run.kind = 'inventory' AND run.state IN ('running', 'completed')
+          AND run.release_sha = $1 AND run.workos_realm_fingerprint = $2
+        ORDER BY ${INVENTORY_GENERATION_ORDER} LIMIT 1`, [input.releaseSha, input.workosRealmFingerprint]);
+        const row = result.rows[0];
+        return row === undefined
+            ? undefined
+            : { runId: row.id, state: row.state, terminal: row.terminal_error !== null };
+    }
+    async withInventoryLock(input, task) {
+        return this.#withLock(`platform-auth-inventory-generation:${input.releaseSha}:${input.workosRealmFingerprint}`, task);
+    }
+    async withStartImportLock(input, task) {
+        return this.#withLock(`platform-auth-start-import:${input.releaseSha}:${input.workosRealmFingerprint}:${input.inventoryRunId}`, async (connection) => {
+            const existing = await connection.query(`SELECT backfill_run_id, import_run_id FROM platform_auth_operator_campaigns
+            WHERE release_sha = $1 AND workos_realm_fingerprint = $2
+              AND inventory_run_id = $3 LIMIT 1`, [input.releaseSha, input.workosRealmFingerprint, input.inventoryRunId]);
+            const campaign = existing.rows[0];
+            if (campaign !== undefined &&
+                (campaign.backfill_run_id !== input.backfillRunId ||
+                    campaign.import_run_id !== input.importRunId))
+                throw new PlatformAuthOperatorError('import_already_started');
+            return task();
+        });
+    }
+    async latestInventory(input) {
+        const result = await this.#pool.query(`SELECT run.id, run.state, run.frozen_checksum, run.safe_result
+         FROM identity_migration_runs run
+        WHERE run.kind = 'inventory' AND run.state IN ('running', 'completed')
+          AND run.release_sha = $1 AND run.workos_realm_fingerprint = $2
+        ORDER BY ${INVENTORY_GENERATION_ORDER} LIMIT 1`, [input.releaseSha, input.workosRealmFingerprint]);
+        const row = result.rows[0];
+        if (row === undefined || row.state !== 'completed' || row.frozen_checksum === null)
+            return undefined;
+        const safe = parsePlatformAuthInventoryResult(row.safe_result);
+        return { runId: row.id, checksum: row.frozen_checksum, ...safe };
+    }
+    async inventoryStatus(input) {
+        const result = await this.#pool.query(`SELECT run.state, run.frozen_checksum, run.safe_result, progress.phase,
+              progress.remote_page_count, progress.remote_user_count,
+              progress.local_subject_count, progress.candidate_count,
+              progress.excluded_count, progress.blocker_counts, progress.terminal_error
+         FROM identity_migration_runs run
+         LEFT JOIN platform_auth_inventory_progress progress
+           ON progress.migration_run_id = run.id
+        WHERE run.kind = 'inventory' AND run.state IN ('running', 'completed')
+          AND run.release_sha = $1 AND run.workos_realm_fingerprint = $2
+        ORDER BY ${INVENTORY_GENERATION_ORDER} LIMIT 1`, [input.releaseSha, input.workosRealmFingerprint]);
+        const row = result.rows[0];
+        if (row === undefined)
+            return undefined;
+        if (row.state === 'completed') {
+            if (row.frozen_checksum === null)
+                throw new PlatformAuthOperatorError('inventory_unavailable');
+            const safe = parsePlatformAuthInventoryResult(row.safe_result);
+            return {
+                state: safe.blockers.length === 0 ? 'ready' : 'blocked',
+                phase: 'completed',
+                remotePages: row.remote_page_count ?? 0,
+                remoteUsers: row.remote_user_count ?? 0,
+                localSubjects: row.local_subject_count ?? safe.candidateCount + safe.excludedCount,
+                candidateCount: safe.candidateCount,
+                excludedCount: safe.excludedCount,
+                checksum: row.frozen_checksum,
+                blockers: safe.blockers,
+            };
+        }
+        return {
+            state: row.terminal_error === null ? 'running' : 'unavailable',
+            phase: row.phase,
+            remotePages: row.remote_page_count ?? 0,
+            remoteUsers: row.remote_user_count ?? 0,
+            localSubjects: row.local_subject_count ?? 0,
+            candidateCount: row.candidate_count ?? 0,
+            excludedCount: row.excluded_count ?? 0,
+            checksum: null,
+            blockers: parsePlatformAuthInventoryBlockers(row.blocker_counts ?? {}),
+        };
+    }
+    async latestCampaign(input) {
+        const result = await this.#pool.query(`SELECT import_run_id, backfill_run_id, inventory_run_id, inventory_checksum,
+              import_lineage_checksum, state
+         FROM platform_auth_operator_campaigns
+        WHERE release_sha = $1 AND workos_realm_fingerprint = $2
+        ORDER BY created_at DESC LIMIT 1`, [input.releaseSha, input.workosRealmFingerprint]);
+        const row = result.rows[0];
+        if (row === undefined)
+            return undefined;
+        return {
+            importRunId: row.import_run_id,
+            backfillRunId: row.backfill_run_id,
+            inventoryRunId: row.inventory_run_id,
+            inventoryChecksum: row.inventory_checksum,
+            importLineageChecksum: row.import_lineage_checksum,
+            state: row.state,
+        };
+    }
+    async insertCampaign(input) {
+        const inserted = await this.#pool.query(`INSERT INTO platform_auth_operator_campaigns
+         (import_run_id, backfill_run_id, inventory_run_id, inventory_checksum,
+          import_lineage_checksum, workos_realm_fingerprint, release_sha)
+       VALUES ($1, $2, $3, $4, $5, $6, $7)
+       ON CONFLICT DO NOTHING RETURNING import_run_id`, [
+            input.importRunId,
+            input.backfillRunId,
+            input.inventoryRunId,
+            input.inventoryChecksum,
+            input.importLineageChecksum,
+            input.workosRealmFingerprint,
+            input.releaseSha,
+        ]);
+        if (inserted.rows[0] !== undefined)
+            return;
+        const existing = await this.latestCampaign({
+            releaseSha: input.releaseSha,
+            workosRealmFingerprint: input.workosRealmFingerprint,
+        });
+        if (existing?.importRunId !== input.importRunId ||
+            existing.backfillRunId !== input.backfillRunId ||
+            existing.inventoryRunId !== input.inventoryRunId ||
+            existing.inventoryChecksum !== input.inventoryChecksum ||
+            existing.importLineageChecksum !== input.importLineageChecksum)
+            throw new PlatformAuthOperatorError('import_already_started');
+    }
+    async importAggregate(inventory, campaign) {
+        if (inventory === undefined || campaign === undefined)
+            return emptyPlatformAuthImport();
+        const result = await this.#pool.query(`SELECT
+         (SELECT count(*)::text FROM platform_auth_inventory_candidates
+           WHERE migration_run_id = $1) AS total,
+         count(*)::text AS ledger_total,
+         count(*) FILTER (WHERE state = 'pending')::text AS pending,
+         count(*) FILTER (WHERE state = 'reconcile_required')::text AS reconcile_required,
+         count(*) FILTER (WHERE state = 'linked')::text AS linked,
+         count(*) FILTER (WHERE state = 'blocked')::text AS blocked,
+         count(*) FILTER (WHERE state = 'failed')::text AS failed,
+         count(*) FILTER (WHERE lease_expires_at > now())::text AS active_leases,
+         min(retry_at) FILTER (WHERE state = 'reconcile_required') AS next_retry_at
+       FROM workos_import_ledger WHERE migration_run_id = $2`, [inventory.runId, campaign.importRunId]);
+        const row = result.rows[0];
+        if (row === undefined)
+            return emptyPlatformAuthImport();
+        const total = Number(row.total);
+        const pending = total - Number(row.ledger_total) + Number(row.pending);
+        const linked = Number(row.linked);
+        const failed = Number(row.failed);
+        const state = campaign.state === 'failed' || failed > 0
+            ? 'failed'
+            : total > 0 && linked === total
+                ? 'completed'
+                : 'running';
+        return {
+            state,
+            total,
+            pending,
+            reconcileRequired: Number(row.reconcile_required),
+            linked,
+            blocked: Number(row.blocked),
+            failed,
+            activeLeases: Number(row.active_leases),
+            nextRetryAt: platformAuthTimestamp(row.next_retry_at),
+        };
+    }
+    async synchronization(input) {
+        const [outbox, health] = await Promise.all([
+            this.#pool.query('SELECT count(*)::text AS pending FROM platform_identity_sync_outbox WHERE delivered_at IS NULL'),
+            this.#pool.query(`SELECT component,
+                greatest(0, extract(epoch FROM now() - last_success_at)::bigint)::text AS age_seconds
+           FROM platform_auth_operator_sync_health`),
+        ]);
+        const ages = new Map(health.rows.map((row) => [row.component, Number(row.age_seconds)]));
+        const outboxAge = ages.get('outbox');
+        const eventsAge = ages.get('events');
+        return {
+            outbox: {
+                status: !input.outboxConfigured
+                    ? 'not_configured'
+                    : !platformAuthSynchronizationAgeFresh(outboxAge)
+                        ? 'pending'
+                        : 'ready',
+                pending: Number(outbox.rows[0]?.pending ?? 0),
+                lastSuccessAgeSeconds: outboxAge ?? null,
+            },
+            events: {
+                status: !input.eventsConfigured
+                    ? 'not_configured'
+                    : !platformAuthSynchronizationAgeFresh(eventsAge)
+                        ? 'pending'
+                        : 'ready',
+                lastSuccessAgeSeconds: eventsAge ?? null,
+            },
+        };
+    }
+    async markSynchronizationSuccess(components) {
+        for (const component of components) {
+            await this.#pool.query(`INSERT INTO platform_auth_operator_sync_health (component, last_success_at, updated_at)
+         VALUES ($1, now(), now())
+         ON CONFLICT (component) DO UPDATE
+           SET last_success_at = excluded.last_success_at, updated_at = excluded.updated_at`, [component]);
+        }
+    }
+    async savePreview(input) {
+        await this.#pool.query(`INSERT INTO platform_auth_operator_previews
+         (checksum, operation, expected_generation, release_sha, target_fingerprint,
+          snapshot_fingerprint, expires_at)
+       VALUES ($1, $2, $3, $4, $5, $6, now() + interval '15 minutes')
+       ON CONFLICT (checksum) DO NOTHING`, [
+            input.checksum,
+            input.operation,
+            input.expectedGeneration,
+            input.releaseSha,
+            input.targetFingerprint,
+            input.snapshotFingerprint,
+        ]);
+    }
+    async assertPreview(input) {
+        const result = await this.#pool.query(`SELECT true AS ok FROM platform_auth_operator_previews
+        WHERE checksum = $1 AND operation = $2 AND expected_generation = $3
+          AND release_sha = $4 AND target_fingerprint = $5 AND snapshot_fingerprint = $6
+          AND expires_at > now()`, [
+            input.checksum,
+            input.operation,
+            input.expectedGeneration,
+            input.releaseSha,
+            input.targetFingerprint,
+            input.snapshotFingerprint,
+        ]);
+        if (result.rows[0] === undefined)
+            throw new PlatformAuthOperatorError('preview_mismatch');
+    }
+    async markCampaignComplete(campaign) {
+        await this.#pool.query(`UPDATE platform_auth_operator_campaigns
+          SET state = 'completed', completed_at = now()
+        WHERE import_run_id = $1 AND state = 'running'`, [campaign.importRunId]);
+    }
+    async #withLock(key, task) {
+        const connection = this.#pool.connect === undefined ? this.#pool : await this.#pool.connect();
+        try {
+            await connection.query('BEGIN');
+            await connection.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [key]);
+            const result = await task(connection);
+            await connection.query('COMMIT');
+            return result;
+        }
+        catch (error) {
+            await connection.query('ROLLBACK').catch(() => undefined);
+            throw error;
+        }
+        finally {
+            connection.release?.();
+        }
+    }
+}
+export function platformAuthOperatorHash(value) {
+    return createHash('sha256').update(JSON.stringify(value)).digest('hex');
+}
+const INVENTORY_GENERATION_ORDER = "COALESCE((substring(run.id FROM '-generation-([0-9]+)$'))::numeric, 0) DESC, run.created_at DESC";
+//# sourceMappingURL=platform-auth-operator-state-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-state-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-operator-state-postgres.js","sourceRoot":"","sources":["../src/platform-auth-operator-state-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,yBAAyB,GAE1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,uBAAuB,EACvB,kCAAkC,EAClC,gCAAgC,EAChC,mCAAmC,EACnC,qBAAqB,GACtB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,EAAE,+CAA+C,EAAE,MAAM,2CAA2C,CAAC;AAuB5G,MAAM,OAAO,iCAAiC;IACnC,KAAK,CAA2B;IAEzC,YAAY,IAA8B;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAGzB;QAQC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAKnC;;;;;;mBAMa,0BAA0B,UAAU,EACjD,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,sBAAsB,CAAC,CACjD,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,OAAO,GAAG,KAAK,SAAS;YACtB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,KAA+E,EAC/E,IAAsB;QAEtB,OAAO,IAAI,CAAC,SAAS,CACnB,sCAAsC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,sBAAsB,EAAE,EACxF,IAAI,CACL,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,KAMC,EACD,IAAsB;QAEtB,OAAO,IAAI,CAAC,SAAS,CACnB,8BAA8B,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,sBAAsB,IAAI,KAAK,CAAC,cAAc,EAAE,EACxG,KAAK,EAAE,UAAU,EAAE,EAAE;YACnB,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAIrC;;gDAEsC,EACtC,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,cAAc,CAAC,CACvE,CAAC;YACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClC,IACE,QAAQ,KAAK,SAAS;gBACtB,CAAC,QAAQ,CAAC,eAAe,KAAK,KAAK,CAAC,aAAa;oBAC/C,QAAQ,CAAC,aAAa,KAAK,KAAK,CAAC,WAAW,CAAC;gBAE/C,MAAM,IAAI,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;YAChE,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAGrB;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAMnC;;;;mBAIa,0BAA0B,UAAU,EACjD,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,sBAAsB,CAAC,CACjD,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,IAAI,GAAG,CAAC,eAAe,KAAK,IAAI;YAChF,OAAO,SAAS,CAAC;QACnB,MAAM,IAAI,GAAG,gCAAgC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/D,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,eAAe,EAAE,GAAG,IAAI,EAAE,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAGrB;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAanC;;;;;;;;;mBASa,0BAA0B,UAAU,EACjD,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,sBAAsB,CAAC,CACjD,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAC9B,IAAI,GAAG,CAAC,eAAe,KAAK,IAAI;gBAC9B,MAAM,IAAI,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;YAC/D,MAAM,IAAI,GAAG,gCAAgC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC/D,OAAO;gBACL,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACvD,KAAK,EAAE,WAAW;gBAClB,WAAW,EAAE,GAAG,CAAC,iBAAiB,IAAI,CAAC;gBACvC,WAAW,EAAE,GAAG,CAAC,iBAAiB,IAAI,CAAC;gBACvC,aAAa,EAAE,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,aAAa;gBAClF,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,QAAQ,EAAE,GAAG,CAAC,eAAe;gBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa;YAC9D,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,WAAW,EAAE,GAAG,CAAC,iBAAiB,IAAI,CAAC;YACvC,WAAW,EAAE,GAAG,CAAC,iBAAiB,IAAI,CAAC;YACvC,aAAa,EAAE,GAAG,CAAC,mBAAmB,IAAI,CAAC;YAC3C,cAAc,EAAE,GAAG,CAAC,eAAe,IAAI,CAAC;YACxC,aAAa,EAAE,GAAG,CAAC,cAAc,IAAI,CAAC;YACtC,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,kCAAkC,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;SACvE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAGpB;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAQnC;;;;yCAImC,EACnC,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,sBAAsB,CAAC,CACjD,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO;YACL,WAAW,EAAE,GAAG,CAAC,aAAa;YAC9B,aAAa,EAAE,GAAG,CAAC,eAAe;YAClC,cAAc,EAAE,GAAG,CAAC,gBAAgB;YACpC,iBAAiB,EAAE,GAAG,CAAC,kBAAkB;YACzC,qBAAqB,EAAE,GAAG,CAAC,uBAAuB;YAClD,KAAK,EAAE,GAAG,CAAC,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAQpB;QACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACrC;;;;sDAIgD,EAChD;YACE,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,aAAa;YACnB,KAAK,CAAC,cAAc;YACpB,KAAK,CAAC,iBAAiB;YACvB,KAAK,CAAC,qBAAqB;YAC3B,KAAK,CAAC,sBAAsB;YAC5B,KAAK,CAAC,UAAU;SACjB,CACF,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO;QAC3C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;YACzC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;SACrD,CAAC,CAAC;QACH,IACE,QAAQ,EAAE,WAAW,KAAK,KAAK,CAAC,WAAW;YAC3C,QAAQ,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;YAC9C,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAChD,QAAQ,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;YACtD,QAAQ,CAAC,qBAAqB,KAAK,KAAK,CAAC,qBAAqB;YAE9D,MAAM,IAAI,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,SAA+C,EAC/C,QAA6C;QAE7C,IAAI,SAAS,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,uBAAuB,EAAE,CAAC;QACxF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAWnC;;;;;;;;;;;6DAWuD,EACvD,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,CACxC,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,uBAAuB,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,KAAK,GACT,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,GAAG,CAAC;YACvC,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,MAAM,KAAK,KAAK;gBAC7B,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,SAAS,CAAC;QAClB,OAAO;YACL,KAAK;YACL,KAAK;YACL,OAAO;YACP,iBAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC;YACjD,MAAM;YACN,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;YAC5B,MAAM;YACN,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC;YACvC,WAAW,EAAE,qBAAqB,CAAC,GAAG,CAAC,aAAa,CAAC;SACtD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAGrB;QACC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACzC,IAAI,CAAC,KAAK,CAAC,KAAK,CACd,gGAAgG,CACjG;YACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAId;;mDAE2C,CAC5C;SACF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,OAAO;YACL,MAAM,EAAE;gBACN,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB;oBAC7B,CAAC,CAAC,gBAAgB;oBAClB,CAAC,CAAC,CAAC,mCAAmC,CAAC,SAAS,CAAC;wBAC/C,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,OAAO;gBACb,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC;gBAC7C,qBAAqB,EAAE,SAAS,IAAI,IAAI;aACzC;YACD,MAAM,EAAE;gBACN,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB;oBAC7B,CAAC,CAAC,gBAAgB;oBAClB,CAAC,CAAC,CAAC,mCAAmC,CAAC,SAAS,CAAC;wBAC/C,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,OAAO;gBACb,qBAAqB,EAAE,SAAS,IAAI,IAAI;aACzC;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,0BAA0B,CAAC,UAA4C;QAC3E,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB;;;4FAGoF,EACpF,CAAC,SAAS,CAAC,CACZ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAOjB;QACC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB;;;;yCAImC,EACnC;YACE,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,kBAAkB;YACxB,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,iBAAiB;YACvB,KAAK,CAAC,mBAAmB;SAC1B,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAOnB;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACnC;;;iCAG2B,EAC3B;YACE,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,kBAAkB;YACxB,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,iBAAiB;YACvB,KAAK,CAAC,mBAAmB;SAC1B,CACF,CAAC;QACF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,yBAAyB,CAAC,kBAAkB,CAAC,CAAC;IAC5F,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,QAAiC;QAC1D,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB;;uDAEiD,EACjD,CAAC,QAAQ,CAAC,WAAW,CAAC,CACvB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CACb,GAAW,EACX,IAA2D;QAE3D,MAAM,UAAU,GACd,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7E,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,MAAM,UAAU,CAAC,KAAK,CAAC,uDAAuD,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;YACtC,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1D,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,0BAA0B,GAC9B,kGAAkG,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-state-support.d.ts

@@ -0,0 +1,13 @@
+import { type PlatformAuthOperatorSnapshot } from './platform-auth-operator.js';
+/** Reconciliation runs on a 30-second maintenance cadence; four missed runs fail readiness closed. */
+export declare const PLATFORM_AUTH_SYNCHRONIZATION_FRESHNESS_SECONDS = 120;
+export declare function parsePlatformAuthInventoryResult(value: unknown): {
+    readonly candidateCount: number;
+    readonly excludedCount: number;
+    readonly blockers: PlatformAuthOperatorSnapshot['inventory']['blockers'];
+};
+export declare function parsePlatformAuthInventoryBlockers(value: unknown): PlatformAuthOperatorSnapshot['inventory']['blockers'];
+export declare function emptyPlatformAuthImport(): PlatformAuthOperatorSnapshot['import'];
+export declare function platformAuthTimestamp(value: string | Date | null): string | null;
+export declare function platformAuthSynchronizationAgeFresh(value: number | undefined): value is number;
+//# sourceMappingURL=platform-auth-operator-state-support.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-operator-state-support.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-operator-state-support.d.ts","sourceRoot":"","sources":["../src/platform-auth-operator-state-support.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,6BAA6B,CAAC;AAErC,sGAAsG;AACtG,eAAO,MAAM,+CAA+C,MAAM,CAAC;AAEnE,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,OAAO,GAAG;IAChE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,CAAC;CAC1E,CAoBA;AAED,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,OAAO,GACb,4BAA4B,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,CAWvD;AAED,wBAAgB,uBAAuB,IAAI,4BAA4B,CAAC,QAAQ,CAAC,CAYhF;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAGhF;AAED,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM,CAO9F"}