@noodleseed/one 0.63.0 → 0.64.0

package/node_modules/@noodle-borg/service/dist/platform-auth-remote-verification-postgres.js

@@ -0,0 +1,274 @@
+import { randomUUID } from 'node:crypto';
+import { PlatformAuthMigrationError } from './platform-auth-migration.js';
+import { assertRemoteVerificationRunBinding as assertRunBinding, remoteVerificationCandidateCount as candidateCount, remoteVerificationEvidenceParameters as evidenceParameters, remoteVerificationFingerprint as fingerprint, remoteVerificationProgress as progressFor, REMOTE_VERIFICATION_SWEEP_SELECT as SWEEP_SELECT, REMOTE_VERIFICATION_TARGET_SELECT as TARGET_SELECT, remoteVerificationTarget as targetFromRow, validateRemoteVerificationEvidence as validateEvidence, validateRemoteVerificationScope as validateScope, validRemoteVerificationSweepId as validSweepId, } from './platform-auth-remote-verification-postgres-support.js';
+const MAX_BATCH_SIZE = 100;
+const BATCH_LEASE_SECONDS = 15 * 60;
+export class PostgresPlatformAuthRemoteVerificationStore {
+    #pool;
+    constructor(pool) {
+        this.#pool = pool;
+    }
+    async beginOrResumeSweep(scope, freshAfter) {
+        validateScope(scope, freshAfter);
+        const connection = await this.#connection();
+        try {
+            await connection.query('BEGIN');
+            await connection.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [
+                `platform-auth-remote-verification:${fingerprint(scope)}`,
+            ]);
+            await assertRunBinding(connection, scope);
+            const latest = await connection.query(`${SWEEP_SELECT} WHERE inventory_run_id = $1 AND import_run_id = $2
+          AND provider = $3 AND realm_fingerprint = $4 ORDER BY id DESC LIMIT 1 FOR UPDATE`, [scope.inventoryRunId, scope.importRunId, scope.provider, fingerprint(scope.realm)]);
+            const current = latest.rows[0];
+            if (current !== undefined) {
+                const completedFresh = current.completed_at !== null && current.completed_at.getTime() >= freshAfter.getTime();
+                const mismatchRetryPending = current.state === 'completed' &&
+                    current.verified_count < current.candidate_count &&
+                    current.retry_at !== null &&
+                    current.retry_at.getTime() > Date.now();
+                if (current.state === 'running' ||
+                    (current.verified_count === current.candidate_count && completedFresh) ||
+                    mismatchRetryPending) {
+                    const progress = await progressFor(connection, current);
+                    await connection.query('COMMIT');
+                    return progress;
+                }
+            }
+            const count = await candidateCount(connection, scope.inventoryRunId);
+            const inserted = await connection.query(`INSERT INTO platform_auth_remote_verification_sweeps
+           (inventory_run_id, import_run_id, provider, realm, realm_fingerprint, candidate_count)
+         VALUES ($1, $2, $3, $4, $5, $6)
+         RETURNING id::text, state, started_at, completed_at, retry_at,
+                   candidate_count, verified_count`, [
+                scope.inventoryRunId,
+                scope.importRunId,
+                scope.provider,
+                scope.realm,
+                fingerprint(scope.realm),
+                count,
+            ]);
+            const row = inserted.rows[0];
+            if (row === undefined)
+                throw new PlatformAuthMigrationError('reconciliation_drift');
+            await connection.query('COMMIT');
+            return {
+                sweepId: row.id,
+                state: row.state,
+                startedAt: row.started_at,
+                candidateCount: row.candidate_count,
+                checkedCount: 0,
+                verifiedCount: 0,
+                allVerified: false,
+                hasMore: true,
+            };
+        }
+        catch (error) {
+            await connection.query('ROLLBACK').catch(() => undefined);
+            throw error;
+        }
+        finally {
+            connection.release?.();
+        }
+    }
+    async claimBatch(sweepId, limit) {
+        if (!validSweepId(sweepId) || !Number.isInteger(limit) || limit < 1 || limit > MAX_BATCH_SIZE)
+            throw new PlatformAuthMigrationError('invalid_import');
+        const connection = await this.#connection();
+        try {
+            await connection.query('BEGIN');
+            const sweeps = await connection.query(`SELECT id::text, state, started_at, completed_at, retry_at,
+                candidate_count, verified_count,
+                provider, realm, inventory_run_id, import_run_id
+           FROM platform_auth_remote_verification_sweeps sweep
+          WHERE id = $1 AND state = 'running' AND NOT EXISTS (
+            SELECT 1 FROM platform_auth_remote_verification_sweeps newer
+             WHERE newer.inventory_run_id = sweep.inventory_run_id
+               AND newer.import_run_id = sweep.import_run_id AND newer.provider = sweep.provider
+               AND newer.realm_fingerprint = sweep.realm_fingerprint AND newer.id > sweep.id)
+          FOR UPDATE`, [sweepId]);
+            const sweep = sweeps.rows[0];
+            if (sweep?.provider === undefined ||
+                sweep.realm === undefined ||
+                sweep.inventory_run_id === undefined ||
+                sweep.import_run_id === undefined)
+                throw new PlatformAuthMigrationError('stale_lease');
+            const rows = await connection.query(`${TARGET_SELECT}
+           LEFT JOIN platform_auth_remote_verification_targets claimed
+             ON claimed.sweep_id = $4 AND claimed.candidate_fingerprint = candidate.candidate_fingerprint
+           LEFT JOIN platform_auth_remote_verification_evidence evidence
+             ON evidence.sweep_id = $4 AND evidence.candidate_fingerprint = candidate.candidate_fingerprint
+          WHERE candidate.migration_run_id = $1 AND evidence.sweep_id IS NULL
+            AND (claimed.sweep_id IS NULL OR (
+              (claimed.lease_token IS NULL OR claimed.lease_expires_at <= now())
+              AND (claimed.retry_at IS NULL OR claimed.retry_at <= now())))
+          ORDER BY candidate.candidate_fingerprint
+          LIMIT $5 FOR UPDATE OF candidate SKIP LOCKED`, [sweep.inventory_run_id, sweep.import_run_id, sweep.realm, sweepId, limit]);
+            const leases = [];
+            for (const row of rows.rows) {
+                const target = targetFromRow(row);
+                const leaseToken = randomUUID();
+                const claimed = await connection.query(`INSERT INTO platform_auth_remote_verification_targets
+             (sweep_id, candidate_fingerprint, lease_token, lease_expires_at, attempt_count)
+           VALUES ($1, $2, $3, now() + make_interval(secs => $4), 1)
+           ON CONFLICT (sweep_id, candidate_fingerprint) DO UPDATE
+             SET lease_token = EXCLUDED.lease_token, lease_expires_at = EXCLUDED.lease_expires_at,
+                 retry_at = NULL,
+                 attempt_count = platform_auth_remote_verification_targets.attempt_count + 1
+           WHERE (platform_auth_remote_verification_targets.lease_token IS NULL
+                  OR platform_auth_remote_verification_targets.lease_expires_at <= now())
+             AND (platform_auth_remote_verification_targets.retry_at IS NULL
+                  OR platform_auth_remote_verification_targets.retry_at <= now())
+           RETURNING attempt_count`, [sweepId, target.candidateFingerprint, leaseToken, BATCH_LEASE_SECONDS]);
+                const attempt = claimed.rows[0]?.attempt_count;
+                if (attempt !== undefined)
+                    leases.push({ sweepId, leaseToken, attempt, target });
+            }
+            await connection.query('COMMIT');
+            return leases;
+        }
+        catch (error) {
+            await connection.query('ROLLBACK').catch(() => undefined);
+            throw error;
+        }
+        finally {
+            connection.release?.();
+        }
+    }
+    async recordEvidence(input) {
+        validateEvidence(input);
+        const inserted = await this.#pool.query(`WITH released AS (
+         UPDATE platform_auth_remote_verification_targets
+            SET lease_token = NULL, lease_expires_at = NULL, retry_at = NULL
+          WHERE sweep_id = $1 AND candidate_fingerprint = $2 AND lease_token = $3
+            AND attempt_count = $4 AND lease_expires_at > now()
+          RETURNING sweep_id, candidate_fingerprint
+       ) INSERT INTO platform_auth_remote_verification_evidence
+          (sweep_id, candidate_fingerprint, outcome_code, principal_id, external_id,
+           normalized_email, remote_user_id, local_binding_ready, principal_fingerprint,
+           external_id_fingerprint, email_fingerprint, expected_remote_user_fingerprint,
+           observed_remote_user_fingerprint, observed_external_id_fingerprint,
+           observed_email_fingerprint, observed_email_verified)
+       SELECT sweep_id, candidate_fingerprint, $5, $6, $7, $8, $9, $10,
+              $11, $12, $13, $14, $15, $16, $17, $18 FROM released
+       RETURNING candidate_fingerprint`, evidenceParameters(input));
+        if (inserted.rows[0] === undefined)
+            throw new PlatformAuthMigrationError('stale_lease');
+    }
+    async deferVerification(input) {
+        if (!Number.isFinite(input.retryAt.getTime()))
+            throw new PlatformAuthMigrationError('invalid_import');
+        const updated = await this.#pool.query(`UPDATE platform_auth_remote_verification_targets
+          SET lease_token = NULL, lease_expires_at = NULL, retry_at = $5
+        WHERE sweep_id = $1 AND candidate_fingerprint = $2 AND lease_token = $3
+          AND attempt_count = $4 AND lease_expires_at > now()
+        RETURNING candidate_fingerprint`, [
+            input.lease.sweepId,
+            input.lease.target.candidateFingerprint,
+            input.lease.leaseToken,
+            input.lease.attempt,
+            input.retryAt,
+        ]);
+        if (updated.rows[0] === undefined)
+            throw new PlatformAuthMigrationError('stale_lease');
+    }
+    async progress(sweepId) {
+        if (!validSweepId(sweepId))
+            throw new PlatformAuthMigrationError('invalid_import');
+        const connection = await this.#connection();
+        try {
+            await connection.query('BEGIN');
+            const result = await connection.query(`${SWEEP_SELECT} WHERE id = $1 FOR UPDATE`, [
+                sweepId,
+            ]);
+            const sweep = result.rows[0];
+            if (sweep === undefined)
+                throw new PlatformAuthMigrationError('invalid_import');
+            const progress = await progressFor(connection, sweep);
+            await connection.query('COMMIT');
+            return progress;
+        }
+        catch (error) {
+            await connection.query('ROLLBACK').catch(() => undefined);
+            throw error;
+        }
+        finally {
+            connection.release?.();
+        }
+    }
+    async readiness(scope) {
+        validateScope(scope, scope.freshAfter);
+        await assertRunBinding(this.#pool, scope);
+        const latest = await this.#pool.query(`${SWEEP_SELECT} WHERE inventory_run_id = $1 AND import_run_id = $2
+        AND provider = $3 AND realm_fingerprint = $4 ORDER BY id DESC LIMIT 1`, [scope.inventoryRunId, scope.importRunId, scope.provider, fingerprint(scope.realm)]);
+        const sweep = latest.rows[0];
+        if (sweep === undefined)
+            return {
+                state: 'not_started',
+                checkedCount: 0,
+                candidateCount: await candidateCount(this.#pool, scope.inventoryRunId),
+                verifiedCount: 0,
+                ready: false,
+            };
+        const aggregate = await this.#pool.query(`SELECT count(*)::int AS candidates,
+              count(*) FILTER (WHERE evidence.outcome_code = 'verified'
+                AND evidence.principal_id = COALESCE(candidate.principal_id, candidate.source_subject)
+                AND evidence.external_id = ledger.external_id
+                AND evidence.normalized_email = candidate.normalized_email
+                AND evidence.remote_user_id = ledger.remote_user_id AND evidence.local_binding_ready
+                AND evidence.observed_email_verified
+                AND cardinality(candidate.blocker_codes) = 0 AND candidate.normalized_email IS NOT NULL
+                AND ledger.state = 'linked' AND ledger.external_id = COALESCE(candidate.principal_id, candidate.source_subject)
+                AND ledger.remote_user_id IS NOT NULL AND ledger.lease_token IS NULL
+                AND ledger.lease_expires_at IS NULL AND link.principal_id IS NOT NULL
+                AND link.disabled_at IS NULL)::int AS exact,
+              (SELECT count(*)::int FROM platform_auth_remote_verification_evidence all_evidence
+                WHERE all_evidence.sweep_id = $4) AS evidence,
+              (SELECT count(*) FILTER (WHERE all_evidence.outcome_code = 'verified')::int
+                 FROM platform_auth_remote_verification_evidence all_evidence
+                WHERE all_evidence.sweep_id = $4) AS verified,
+              (SELECT min(COALESCE(target.retry_at, target.lease_expires_at))
+                 FROM platform_auth_remote_verification_targets target
+                 LEFT JOIN platform_auth_remote_verification_evidence target_evidence
+                   ON target_evidence.sweep_id = target.sweep_id
+                  AND target_evidence.candidate_fingerprint = target.candidate_fingerprint
+                WHERE target.sweep_id = $4 AND target_evidence.sweep_id IS NULL) AS retry_at
+         FROM platform_auth_inventory_candidates candidate
+         LEFT JOIN workos_import_ledger ledger
+           ON ledger.principal_id = COALESCE(candidate.principal_id, candidate.source_subject)
+          AND ledger.migration_run_id = $2 AND ledger.realm = $3
+         LEFT JOIN platform_identity_links link
+           ON link.provider = $5 AND link.realm = $3 AND link.external_id = ledger.remote_user_id
+          AND link.principal_id = COALESCE(candidate.principal_id, candidate.source_subject)
+         LEFT JOIN platform_auth_remote_verification_evidence evidence
+           ON evidence.sweep_id = $4 AND evidence.candidate_fingerprint = candidate.candidate_fingerprint
+        WHERE candidate.migration_run_id = $1`, [scope.inventoryRunId, scope.importRunId, scope.realm, sweep.id, scope.provider]);
+        const row = aggregate.rows[0] ?? {
+            candidates: 0,
+            verified: 0,
+            exact: 0,
+            evidence: 0,
+            retry_at: null,
+        };
+        const ready = sweep.state === 'completed' &&
+            sweep.completed_at !== null &&
+            sweep.completed_at.getTime() >= scope.freshAfter.getTime() &&
+            row.candidates === sweep.candidate_count &&
+            row.evidence === sweep.candidate_count &&
+            row.exact === sweep.candidate_count &&
+            sweep.verified_count === sweep.candidate_count;
+        const retryAt = sweep.retry_at ?? row.retry_at ?? undefined;
+        return {
+            sweepId: sweep.id,
+            state: ready ? 'ready' : sweep.state === 'running' ? 'running' : 'blocked',
+            checkedCount: row.evidence,
+            candidateCount: row.candidates,
+            verifiedCount: row.verified,
+            ready,
+            ...(retryAt === undefined ? {} : { retryAt }),
+        };
+    }
+    async #connection() {
+        return this.#pool.connect === undefined ? this.#pool : this.#pool.connect();
+    }
+}
+//# sourceMappingURL=platform-auth-remote-verification-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-remote-verification-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-remote-verification-postgres.js","sourceRoot":"","sources":["../src/platform-auth-remote-verification-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAS1E,OAAO,EACL,kCAAkC,IAAI,gBAAgB,EACtD,gCAAgC,IAAI,cAAc,EAClD,oCAAoC,IAAI,kBAAkB,EAC1D,6BAA6B,IAAI,WAAW,EAC5C,0BAA0B,IAAI,WAAW,EACzC,gCAAgC,IAAI,YAAY,EAEhD,iCAAiC,IAAI,aAAa,EAElD,wBAAwB,IAAI,aAAa,EACzC,kCAAkC,IAAI,gBAAgB,EACtD,+BAA+B,IAAI,aAAa,EAChD,8BAA8B,IAAI,YAAY,GAC/C,MAAM,yDAAyD,CAAC;AAGjE,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,CAAC;AAIpC,MAAM,OAAO,2CAA2C;IAG7C,KAAK,CAAO;IAErB,YAAY,IAAU;QACpB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,KAA0C,EAC1C,UAAgB;QAEhB,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,MAAM,UAAU,CAAC,KAAK,CAAC,uDAAuD,EAAE;gBAC9E,qCAAqC,WAAW,CAAC,KAAK,CAAC,EAAE;aAC1D,CAAC,CAAC;YACH,MAAM,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CACnC,GAAG,YAAY;2FACoE,EACnF,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CACpF,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,cAAc,GAClB,OAAO,CAAC,YAAY,KAAK,IAAI,IAAI,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC1F,MAAM,oBAAoB,GACxB,OAAO,CAAC,KAAK,KAAK,WAAW;oBAC7B,OAAO,CAAC,cAAc,GAAG,OAAO,CAAC,eAAe;oBAChD,OAAO,CAAC,QAAQ,KAAK,IAAI;oBACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC1C,IACE,OAAO,CAAC,KAAK,KAAK,SAAS;oBAC3B,CAAC,OAAO,CAAC,cAAc,KAAK,OAAO,CAAC,eAAe,IAAI,cAAc,CAAC;oBACtE,oBAAoB,EACpB,CAAC;oBACD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;oBACxD,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;oBACjC,OAAO,QAAQ,CAAC;gBAClB,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;YACrE,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CACrC;;;;mDAI2C,EAC3C;gBACE,KAAK,CAAC,cAAc;gBACpB,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,QAAQ;gBACd,KAAK,CAAC,KAAK;gBACX,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC;gBACxB,KAAK;aACN,CACF,CAAC;YACF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,GAAG,KAAK,SAAS;gBAAE,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;YACpF,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,GAAG,CAAC,EAAE;gBACf,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,cAAc,EAAE,GAAG,CAAC,eAAe;gBACnC,YAAY,EAAE,CAAC;gBACf,aAAa,EAAE,CAAC;gBAChB,WAAW,EAAE,KAAK;gBAClB,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1D,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CACd,OAAe,EACf,KAAa;QAEb,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,cAAc;YAC3F,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CACnC;;;;;;;;;qBASa,EACb,CAAC,OAAO,CAAC,CACV,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC7B,IACE,KAAK,EAAE,QAAQ,KAAK,SAAS;gBAC7B,KAAK,CAAC,KAAK,KAAK,SAAS;gBACzB,KAAK,CAAC,gBAAgB,KAAK,SAAS;gBACpC,KAAK,CAAC,aAAa,KAAK,SAAS;gBAEjC,MAAM,IAAI,0BAA0B,CAAC,aAAa,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,CACjC,GAAG,aAAa;;;;;;;;;;uDAU+B,EAC/C,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAC3E,CAAC;YACF,MAAM,MAAM,GAA0C,EAAE,CAAC;YACzD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;gBAClC,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CACpC;;;;;;;;;;;mCAWyB,EACzB,CAAC,OAAO,EAAE,MAAM,CAAC,oBAAoB,EAAE,UAAU,EAAE,mBAAmB,CAAC,CACxE,CAAC;gBACF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC;gBAC/C,IAAI,OAAO,KAAK,SAAS;oBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1D,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KASpB;QACC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACrC;;;;;;;;;;;;;;uCAciC,EACjC,kBAAkB,CAAC,KAAK,CAAC,CAC1B,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,0BAA0B,CAAC,aAAa,CAAC,CAAC;IAC1F,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAGvB;QACC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC3C,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpC;;;;wCAIkC,EAClC;YACE,KAAK,CAAC,KAAK,CAAC,OAAO;YACnB,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACvC,KAAK,CAAC,KAAK,CAAC,UAAU;YACtB,KAAK,CAAC,KAAK,CAAC,OAAO;YACnB,KAAK,CAAC,OAAO;SACd,CACF,CAAC;QACF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,0BAA0B,CAAC,aAAa,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;QACnF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAW,GAAG,YAAY,2BAA2B,EAAE;gBAC1F,OAAO;aACR,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;YAChF,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YACtD,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1D,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CACb,KAA0E;QAE1E,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACnC,GAAG,YAAY;8EACyD,EACxE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CACpF,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,KAAK,KAAK,SAAS;YACrB,OAAO;gBACL,KAAK,EAAE,aAAa;gBACpB,YAAY,EAAE,CAAC;gBACf,cAAc,EAAE,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC;gBACtE,aAAa,EAAE,CAAC;gBAChB,KAAK,EAAE,KAAK;aACb,CAAC;QACJ,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAOtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CAgCwC,EACxC,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CACjF,CAAC;QACF,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;YAC/B,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,CAAC;YACX,KAAK,EAAE,CAAC;YACR,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,MAAM,KAAK,GACT,KAAK,CAAC,KAAK,KAAK,WAAW;YAC3B,KAAK,CAAC,YAAY,KAAK,IAAI;YAC3B,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE;YAC1D,GAAG,CAAC,UAAU,KAAK,KAAK,CAAC,eAAe;YACxC,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,eAAe;YACtC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,eAAe;YACnC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,eAAe,CAAC;QACjD,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,SAAS,CAAC;QAC5D,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YAC1E,YAAY,EAAE,GAAG,CAAC,QAAQ;YAC1B,cAAc,EAAE,GAAG,CAAC,UAAU;YAC9B,aAAa,EAAE,GAAG,CAAC,QAAQ;YAC3B,KAAK;YACL,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAC9E,CAAC;CACF"}

package/node_modules/@noodle-borg/service/dist/platform-auth-remote-verification-schema.d.ts

@@ -0,0 +1,3 @@
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+export declare function ensurePlatformAuthRemoteVerificationSchema(pool: PlatformIdentityQueryable): Promise<void>;
+//# sourceMappingURL=platform-auth-remote-verification-schema.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-remote-verification-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-remote-verification-schema.d.ts","sourceRoot":"","sources":["../src/platform-auth-remote-verification-schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,wBAAsB,0CAA0C,CAC9D,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,IAAI,CAAC,CA4Hf"}

package/node_modules/@noodle-borg/service/dist/platform-auth-remote-verification-schema.js

@@ -0,0 +1,120 @@
+export async function ensurePlatformAuthRemoteVerificationSchema(pool) {
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_auth_remote_verification_sweeps (
+      id bigserial PRIMARY KEY,
+      inventory_run_id text NOT NULL REFERENCES identity_migration_runs(id) ON DELETE RESTRICT,
+      import_run_id text NOT NULL REFERENCES identity_migration_runs(id) ON DELETE RESTRICT,
+      provider text NOT NULL,
+      realm text NOT NULL,
+      realm_fingerprint text NOT NULL CHECK (realm_fingerprint ~ '^[0-9a-f]{64}$'),
+      state text NOT NULL DEFAULT 'running' CHECK (state IN ('running', 'completed')),
+      candidate_count integer NOT NULL CHECK (candidate_count >= 0),
+      verified_count integer NOT NULL DEFAULT 0
+        CHECK (verified_count >= 0 AND verified_count <= candidate_count),
+      started_at timestamptz NOT NULL DEFAULT now(),
+      completed_at timestamptz,
+      retry_at timestamptz,
+      CHECK ((state = 'running' AND completed_at IS NULL) OR
+             (state = 'completed' AND completed_at IS NOT NULL))
+    )
+  `);
+    await pool.query(`
+    CREATE INDEX IF NOT EXISTS platform_auth_remote_verification_sweeps_scope_idx
+      ON platform_auth_remote_verification_sweeps
+        (inventory_run_id, import_run_id, provider, realm_fingerprint, id DESC)
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_auth_remote_verification_targets (
+      sweep_id bigint NOT NULL REFERENCES platform_auth_remote_verification_sweeps(id) ON DELETE RESTRICT,
+      candidate_fingerprint text NOT NULL CHECK (candidate_fingerprint ~ '^[0-9a-f]{64}$'),
+      lease_token text,
+      lease_expires_at timestamptz,
+      retry_at timestamptz,
+      attempt_count integer NOT NULL DEFAULT 0 CHECK (attempt_count >= 0),
+      PRIMARY KEY (sweep_id, candidate_fingerprint)
+    )
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_auth_remote_verification_evidence (
+      sweep_id bigint NOT NULL,
+      candidate_fingerprint text NOT NULL,
+      outcome_code text NOT NULL CHECK (outcome_code IN (
+        'verified', 'local_binding_invalid', 'not_found', 'remote_id_mismatch',
+        'external_id_mismatch', 'email_unverified', 'email_mismatch'
+      )),
+      principal_id text NOT NULL,
+      external_id text NOT NULL,
+      normalized_email text NOT NULL,
+      remote_user_id text,
+      local_binding_ready boolean NOT NULL,
+      principal_fingerprint text NOT NULL CHECK (principal_fingerprint ~ '^[0-9a-f]{64}$'),
+      external_id_fingerprint text NOT NULL CHECK (external_id_fingerprint ~ '^[0-9a-f]{64}$'),
+      email_fingerprint text NOT NULL CHECK (email_fingerprint ~ '^[0-9a-f]{64}$'),
+      expected_remote_user_fingerprint text
+        CHECK (expected_remote_user_fingerprint IS NULL OR expected_remote_user_fingerprint ~ '^[0-9a-f]{64}$'),
+      observed_remote_user_fingerprint text
+        CHECK (observed_remote_user_fingerprint IS NULL OR observed_remote_user_fingerprint ~ '^[0-9a-f]{64}$'),
+      observed_external_id_fingerprint text
+        CHECK (observed_external_id_fingerprint IS NULL OR observed_external_id_fingerprint ~ '^[0-9a-f]{64}$'),
+      observed_email_fingerprint text
+        CHECK (observed_email_fingerprint IS NULL OR observed_email_fingerprint ~ '^[0-9a-f]{64}$'),
+      observed_email_verified boolean,
+      checked_at timestamptz NOT NULL DEFAULT now(),
+      PRIMARY KEY (sweep_id, candidate_fingerprint),
+      FOREIGN KEY (sweep_id, candidate_fingerprint)
+        REFERENCES platform_auth_remote_verification_targets(sweep_id, candidate_fingerprint)
+        ON DELETE RESTRICT
+    )
+  `);
+    await pool.query(`
+    CREATE OR REPLACE FUNCTION reject_platform_auth_remote_verification_evidence_mutation()
+    RETURNS trigger LANGUAGE plpgsql AS $$
+    BEGIN
+      RAISE EXCEPTION 'platform auth remote verification evidence is append-only';
+    END;
+    $$
+  `);
+    await pool.query(`
+    CREATE OR REPLACE FUNCTION enforce_platform_auth_remote_verification_target_lease()
+    RETURNS trigger LANGUAGE plpgsql AS $$
+    BEGIN
+      IF TG_OP = 'DELETE' OR OLD.sweep_id IS DISTINCT FROM NEW.sweep_id
+        OR OLD.candidate_fingerprint IS DISTINCT FROM NEW.candidate_fingerprint THEN
+        RAISE EXCEPTION 'platform auth remote verification target is immutable';
+      END IF;
+      RETURN NEW;
+    END;
+    $$
+  `);
+    await pool.query(`
+    CREATE OR REPLACE FUNCTION enforce_platform_auth_remote_verification_sweep_transition()
+    RETURNS trigger LANGUAGE plpgsql AS $$
+    BEGIN
+      IF TG_OP = 'DELETE' OR OLD.state = 'completed'
+        OR OLD.inventory_run_id IS DISTINCT FROM NEW.inventory_run_id
+        OR OLD.import_run_id IS DISTINCT FROM NEW.import_run_id
+        OR OLD.provider IS DISTINCT FROM NEW.provider OR OLD.realm IS DISTINCT FROM NEW.realm
+        OR OLD.realm_fingerprint IS DISTINCT FROM NEW.realm_fingerprint
+        OR OLD.candidate_count IS DISTINCT FROM NEW.candidate_count
+        OR OLD.started_at IS DISTINCT FROM NEW.started_at
+        OR NEW.state <> 'completed' OR NEW.completed_at IS NULL THEN
+        RAISE EXCEPTION 'platform auth remote verification sweep is immutable';
+      END IF;
+      RETURN NEW;
+    END;
+    $$
+  `);
+    await pool.query('DROP TRIGGER IF EXISTS platform_auth_remote_verification_target_lease ON platform_auth_remote_verification_targets');
+    await pool.query(`CREATE TRIGGER platform_auth_remote_verification_target_lease
+    BEFORE UPDATE OR DELETE ON platform_auth_remote_verification_targets
+    FOR EACH ROW EXECUTE FUNCTION enforce_platform_auth_remote_verification_target_lease()`);
+    await pool.query('DROP TRIGGER IF EXISTS platform_auth_remote_verification_evidence_append_only ON platform_auth_remote_verification_evidence');
+    await pool.query(`CREATE TRIGGER platform_auth_remote_verification_evidence_append_only
+    BEFORE UPDATE OR DELETE ON platform_auth_remote_verification_evidence
+    FOR EACH ROW EXECUTE FUNCTION reject_platform_auth_remote_verification_evidence_mutation()`);
+    await pool.query('DROP TRIGGER IF EXISTS platform_auth_remote_verification_sweep_transition ON platform_auth_remote_verification_sweeps');
+    await pool.query(`CREATE TRIGGER platform_auth_remote_verification_sweep_transition
+    BEFORE UPDATE OR DELETE ON platform_auth_remote_verification_sweeps
+    FOR EACH ROW EXECUTE FUNCTION enforce_platform_auth_remote_verification_sweep_transition()`);
+}
+//# sourceMappingURL=platform-auth-remote-verification-schema.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-remote-verification-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-remote-verification-schema.js","sourceRoot":"","sources":["../src/platform-auth-remote-verification-schema.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,KAAK,UAAU,0CAA0C,CAC9D,IAA+B;IAE/B,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;GAkBhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;GAIhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;GAUhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;GAOhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;GAWhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;GAiBhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CACd,oHAAoH,CACrH,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC;;2FAEwE,CAAC,CAAC;IAC3F,MAAM,IAAI,CAAC,KAAK,CACd,6HAA6H,CAC9H,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC;;+FAE4E,CAAC,CAAC;IAC/F,MAAM,IAAI,CAAC,KAAK,CACd,uHAAuH,CACxH,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC;;+FAE4E,CAAC,CAAC;AACjG,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-remote-verification.d.ts

@@ -0,0 +1,79 @@
+import type { PlatformAuthDirectory } from './platform-auth-migration.js';
+export declare const PLATFORM_AUTH_REMOTE_VERIFICATION_FRESHNESS_MS: number;
+export declare function platformAuthRemoteVerificationFreshAfter(now?: Date): Date;
+export type PlatformAuthRemoteVerificationOutcome = 'verified' | 'local_binding_invalid' | 'not_found' | 'remote_id_mismatch' | 'external_id_mismatch' | 'email_unverified' | 'email_mismatch';
+export interface PlatformAuthRemoteVerificationScope {
+    readonly inventoryRunId: string;
+    readonly importRunId: string;
+    readonly provider: string;
+    readonly realm: string;
+}
+export interface PlatformAuthRemoteVerificationTarget {
+    readonly candidateFingerprint: string;
+    readonly principalId: string;
+    readonly externalId: string;
+    readonly verifiedEmail: string;
+    readonly remoteUserId?: string;
+    readonly localBindingReady: boolean;
+}
+export interface PlatformAuthRemoteVerificationLease {
+    readonly sweepId: string;
+    readonly leaseToken: string;
+    readonly attempt: number;
+    readonly target: PlatformAuthRemoteVerificationTarget;
+}
+export interface PlatformAuthRemoteVerificationSweepProgress {
+    readonly sweepId: string;
+    readonly state: 'running' | 'completed';
+    readonly startedAt: Date;
+    readonly candidateCount: number;
+    readonly checkedCount: number;
+    readonly verifiedCount: number;
+    readonly allVerified: boolean;
+    readonly hasMore: boolean;
+    readonly retryAt?: Date;
+}
+export interface PlatformAuthRemoteVerificationBatchResult extends PlatformAuthRemoteVerificationSweepProgress {
+    readonly processedCount: number;
+}
+export interface PlatformAuthRemoteVerificationReadiness {
+    readonly sweepId?: string;
+    readonly state: 'not_started' | 'running' | 'ready' | 'blocked';
+    readonly checkedCount: number;
+    readonly candidateCount: number;
+    readonly verifiedCount: number;
+    readonly ready: boolean;
+    readonly retryAt?: Date;
+}
+export interface PlatformAuthRemoteVerificationStore {
+    beginOrResumeSweep(scope: PlatformAuthRemoteVerificationScope, freshAfter: Date): Promise<PlatformAuthRemoteVerificationSweepProgress>;
+    claimBatch(sweepId: string, limit: number): Promise<readonly PlatformAuthRemoteVerificationLease[]>;
+    recordEvidence(input: {
+        readonly lease: PlatformAuthRemoteVerificationLease;
+        readonly outcome: PlatformAuthRemoteVerificationOutcome;
+        readonly observed?: {
+            readonly remoteUserId: string;
+            readonly externalId?: string;
+            readonly normalizedEmail: string;
+            readonly emailVerified: boolean;
+        };
+    }): Promise<void>;
+    deferVerification(input: {
+        readonly lease: PlatformAuthRemoteVerificationLease;
+        readonly retryAt: Date;
+    }): Promise<void>;
+    progress(sweepId: string): Promise<PlatformAuthRemoteVerificationSweepProgress>;
+    readiness(scope: PlatformAuthRemoteVerificationScope & {
+        readonly freshAfter: Date;
+    }): Promise<PlatformAuthRemoteVerificationReadiness>;
+}
+/** Advances one resumable WorkOS verification sweep by at most the requested bounded batch. */
+export declare class WorkOSLinkedCandidateVerificationWorker {
+    #private;
+    constructor(store: PlatformAuthRemoteVerificationStore, directory: PlatformAuthDirectory, now?: () => Date);
+    verify(input: Omit<PlatformAuthRemoteVerificationScope, 'provider'> & {
+        readonly freshAfter: Date;
+        readonly limit: number;
+    }): Promise<PlatformAuthRemoteVerificationBatchResult>;
+}
+//# sourceMappingURL=platform-auth-remote-verification.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-remote-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-remote-verification.d.ts","sourceRoot":"","sources":["../src/platform-auth-remote-verification.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAG1E,eAAO,MAAM,8CAA8C,QAAkB,CAAC;AAI9E,wBAAgB,wCAAwC,CAAC,GAAG,OAAa,GAAG,IAAI,CAE/E;AAED,MAAM,MAAM,qCAAqC,GAC7C,UAAU,GACV,uBAAuB,GACvB,WAAW,GACX,oBAAoB,GACpB,sBAAsB,GACtB,kBAAkB,GAClB,gBAAgB,CAAC;AAErB,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACrC;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,oCAAoC,CAAC;CACvD;AAED,MAAM,WAAW,2CAA2C;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,WAAW,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,yCACf,SAAQ,2CAA2C;IACnD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,mCAAmC;IAClD,kBAAkB,CAChB,KAAK,EAAE,mCAAmC,EAC1C,UAAU,EAAE,IAAI,GACf,OAAO,CAAC,2CAA2C,CAAC,CAAC;IACxD,UAAU,CACR,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,SAAS,mCAAmC,EAAE,CAAC,CAAC;IAC3D,cAAc,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,KAAK,EAAE,mCAAmC,CAAC;QACpD,QAAQ,CAAC,OAAO,EAAE,qCAAqC,CAAC;QACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE;YAClB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;YAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;YAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;YACjC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;SACjC,CAAC;KACH,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,iBAAiB,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,mCAAmC,CAAC;QACpD,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;KACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,2CAA2C,CAAC,CAAC;IAChF,SAAS,CACP,KAAK,EAAE,mCAAmC,GAAG;QAAE,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;KAAE,GACzE,OAAO,CAAC,uCAAuC,CAAC,CAAC;CACrD;AAED,+FAA+F;AAC/F,qBAAa,uCAAuC;;gBAMhD,KAAK,EAAE,mCAAmC,EAC1C,SAAS,EAAE,qBAAqB,EAChC,GAAG,GAAE,MAAM,IAAuB;IAO9B,MAAM,CACV,KAAK,EAAE,IAAI,CAAC,mCAAmC,EAAE,UAAU,CAAC,GAAG;QAC7D,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;QAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,GACA,OAAO,CAAC,yCAAyC,CAAC;CAyCtD"}

package/node_modules/@noodle-borg/service/dist/platform-auth-remote-verification.js

@@ -0,0 +1,88 @@
+import { normalizePlatformIdentityEmail } from './platform-identity.js';
+export const PLATFORM_AUTH_REMOTE_VERIFICATION_FRESHNESS_MS = 60 * 60 * 1_000;
+const REMOTE_VERIFICATION_RETRY_BASE_MS = 5_000;
+const REMOTE_VERIFICATION_RETRY_MAX_MS = 5 * 60 * 1_000;
+export function platformAuthRemoteVerificationFreshAfter(now = new Date()) {
+    return new Date(now.getTime() - PLATFORM_AUTH_REMOTE_VERIFICATION_FRESHNESS_MS);
+}
+/** Advances one resumable WorkOS verification sweep by at most the requested bounded batch. */
+export class WorkOSLinkedCandidateVerificationWorker {
+    #store;
+    #directory;
+    #now;
+    constructor(store, directory, now = () => new Date()) {
+        this.#store = store;
+        this.#directory = directory;
+        this.#now = now;
+    }
+    async verify(input) {
+        const scope = { ...input, provider: 'workos' };
+        const sweep = await this.#store.beginOrResumeSweep(scope, input.freshAfter);
+        if (sweep.state === 'completed')
+            return { ...sweep, processedCount: 0 };
+        const leases = await this.#store.claimBatch(sweep.sweepId, input.limit);
+        for (const lease of leases)
+            await this.#verifyOne(lease);
+        return { ...(await this.#store.progress(sweep.sweepId)), processedCount: leases.length };
+    }
+    async #verifyOne(lease) {
+        const { target } = lease;
+        if (!target.localBindingReady || target.remoteUserId === undefined) {
+            await this.#store.recordEvidence({ lease, outcome: 'local_binding_invalid' });
+            return;
+        }
+        let remote;
+        try {
+            remote = await this.#directory.findUserByExternalId(target.externalId);
+        }
+        catch (error) {
+            await this.#store.deferVerification({
+                lease,
+                retryAt: retryAtFor(error, lease.attempt, this.#now()),
+            });
+            return;
+        }
+        const outcome = verificationOutcome(target, remote);
+        await this.#store.recordEvidence({
+            lease,
+            outcome,
+            ...(remote === undefined
+                ? {}
+                : {
+                    observed: {
+                        remoteUserId: remote.id,
+                        ...(remote.externalId === undefined ? {} : { externalId: remote.externalId }),
+                        normalizedEmail: remote.normalizedEmail,
+                        emailVerified: remote.verified,
+                    },
+                }),
+        });
+    }
+}
+function verificationOutcome(target, remote) {
+    if (remote === undefined)
+        return 'not_found';
+    if (remote.id !== target.remoteUserId)
+        return 'remote_id_mismatch';
+    if (remote.externalId !== target.externalId)
+        return 'external_id_mismatch';
+    if (!remote.verified)
+        return 'email_unverified';
+    if (normalizePlatformIdentityEmail(remote.normalizedEmail) !== target.verifiedEmail)
+        return 'email_mismatch';
+    return 'verified';
+}
+function retryAtFor(error, attempt, now) {
+    if (typeof error === 'object' && error !== null && 'retryAt' in error) {
+        const retryAt = error.retryAt;
+        if (typeof retryAt === 'string') {
+            const parsed = Date.parse(retryAt);
+            if (Number.isFinite(parsed) && parsed > now.getTime())
+                return new Date(parsed);
+        }
+    }
+    const exponent = Math.min(Math.max(attempt - 1, 0), 8);
+    const delay = Math.min(REMOTE_VERIFICATION_RETRY_BASE_MS * 2 ** exponent, REMOTE_VERIFICATION_RETRY_MAX_MS);
+    return new Date(now.getTime() + delay);
+}
+//# sourceMappingURL=platform-auth-remote-verification.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-remote-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-remote-verification.js","sourceRoot":"","sources":["../src/platform-auth-remote-verification.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAExE,MAAM,CAAC,MAAM,8CAA8C,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAC9E,MAAM,iCAAiC,GAAG,KAAK,CAAC;AAChD,MAAM,gCAAgC,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;AAExD,MAAM,UAAU,wCAAwC,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE;IACvE,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,8CAA8C,CAAC,CAAC;AAClF,CAAC;AA0FD,+FAA+F;AAC/F,MAAM,OAAO,uCAAuC;IACzC,MAAM,CAAsC;IAC5C,UAAU,CAAwB;IAClC,IAAI,CAAa;IAE1B,YACE,KAA0C,EAC1C,SAAgC,EAChC,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QAElC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAGC;QAED,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC5E,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACxE,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC3F,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAA0C;QACzD,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACnE,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,IAAI,MAA0E,CAAC;QAC/E,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBAClC,KAAK;gBACL,OAAO,EAAE,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;aACvD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;YAC/B,KAAK;YACL,OAAO;YACP,GAAG,CAAC,MAAM,KAAK,SAAS;gBACtB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE,QAAQ,EAAE;wBACR,YAAY,EAAE,MAAM,CAAC,EAAE;wBACvB,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;wBAC7E,eAAe,EAAE,MAAM,CAAC,eAAe;wBACvC,aAAa,EAAE,MAAM,CAAC,QAAQ;qBAC/B;iBACF,CAAC;SACP,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,mBAAmB,CAC1B,MAA4C,EAC5C,MAOa;IAEb,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAC7C,IAAI,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,YAAY;QAAE,OAAO,oBAAoB,CAAC;IACnE,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;QAAE,OAAO,sBAAsB,CAAC;IAC3E,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,OAAO,kBAAkB,CAAC;IAChD,IAAI,8BAA8B,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,MAAM,CAAC,aAAa;QACjF,OAAO,gBAAgB,CAAC;IAC1B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,OAAe,EAAE,GAAS;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACtE,MAAM,OAAO,GAAI,KAAwC,CAAC,OAAO,CAAC;QAClE,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE;gBAAE,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,iCAAiC,GAAG,CAAC,IAAI,QAAQ,EACjD,gCAAgC,CACjC,CAAC;IACF,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC;AACzC,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-rollback-guard.d.ts

@@ -0,0 +1,6 @@
+import { type PlatformAuthOperator } from './platform-auth-operator.js';
+/** Prevent an ordinary provider rollback from selecting Google after its human authenticator is removed. */
+export declare function guardPlatformAuthRollback(operator: PlatformAuthOperator, options: {
+    readonly googleHumanAuthAvailable: boolean;
+}): PlatformAuthOperator;
+//# sourceMappingURL=platform-auth-rollback-guard.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-rollback-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-rollback-guard.d.ts","sourceRoot":"","sources":["../src/platform-auth-rollback-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,oBAAoB,EAI1B,MAAM,6BAA6B,CAAC;AAGrC,4GAA4G;AAC5G,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,EAAE;IAAE,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAA;CAAE,GACtD,oBAAoB,CAEtB"}