@noodleseed/one 0.63.0 → 0.64.0

package/node_modules/@noodle-borg/service/dist/platform-auth-rollback-guard.js

@@ -0,0 +1,38 @@
+import { PlatformAuthOperationPreviewSchema, PlatformAuthOperatorError, } from './platform-auth-operator.js';
+import { platformAuthPreviewTarget } from './platform-auth-operator-rollout.js';
+/** Prevent an ordinary provider rollback from selecting Google after its human authenticator is removed. */
+export function guardPlatformAuthRollback(operator, options) {
+    return options.googleHumanAuthAvailable ? operator : new RollbackUnavailableOperator(operator);
+}
+class RollbackUnavailableOperator {
+    #operator;
+    constructor(operator) {
+        this.#operator = operator;
+    }
+    inventory(input) {
+        return this.#operator.inventory(input);
+    }
+    status() {
+        return this.#operator.status();
+    }
+    async preview(input) {
+        if (input.operation !== 'rollback')
+            return this.#operator.preview(input);
+        const snapshot = await this.#operator.status();
+        return PlatformAuthOperationPreviewSchema.parse({
+            ...snapshot,
+            operation: input.operation,
+            ready: false,
+            previewChecksum: null,
+            blockers: [{ code: 'rollout_transition_invalid', count: 1 }],
+            target: platformAuthPreviewTarget(input, snapshot.rollout),
+        });
+    }
+    async execute(input) {
+        if (input.operation === 'rollback') {
+            throw new PlatformAuthOperatorError('rollout_transition_invalid');
+        }
+        return this.#operator.execute(input);
+    }
+}
+//# sourceMappingURL=platform-auth-rollback-guard.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-rollback-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-rollback-guard.js","sourceRoot":"","sources":["../src/platform-auth-rollback-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,kCAAkC,EAGlC,yBAAyB,GAG1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAEhF,4GAA4G;AAC5G,MAAM,UAAU,yBAAyB,CACvC,QAA8B,EAC9B,OAAuD;IAEvD,OAAO,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,2BAA2B,CAAC,QAAQ,CAAC,CAAC;AACjG,CAAC;AAED,MAAM,2BAA2B;IACtB,SAAS,CAAuB;IAEzC,YAAY,QAA8B;QACxC,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC5B,CAAC;IAED,SAAS,CAAC,KAGT;QACC,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAiC;QAC7C,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC/C,OAAO,kCAAkC,CAAC,KAAK,CAAC;YAC9C,GAAG,QAAQ;YACX,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,KAAK;YACZ,eAAe,EAAE,IAAI;YACrB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAC5D,MAAM,EAAE,yBAAyB,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAA+B;QAC3C,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;CACF"}

package/node_modules/@noodle-borg/service/dist/platform-auth-rollout-postgres.d.ts

@@ -0,0 +1,61 @@
+import { type BuildInfo } from './build-info.js';
+import { type WorkOSConfigurationIdentity } from './platform-auth-configuration.js';
+import type { PlatformAuthRemoteVerificationStore } from './platform-auth-remote-verification.js';
+import { type CohortInput, type PlatformAuthRolloutSafeResult } from './platform-auth-rollout-support.js';
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+export type { PlatformAuthRolloutSafeResult } from './platform-auth-rollout-support.js';
+type Connection = PlatformIdentityQueryable & {
+    release?: () => void;
+};
+type Pool = PlatformIdentityQueryable & {
+    connect?: () => Promise<Connection>;
+};
+export type PlatformAuthRolloutPreviewInput = CohortInput & {
+    /** Completed inventory run whose frozen candidates this operation controls. */
+    readonly inventoryRunId: string;
+    readonly inventoryChecksum: string;
+    /** Import/reconcile run that owns the WorkOS ledger rows. */
+    readonly importRunId: string;
+    readonly importLineageChecksum: string;
+    /** WorkOS environment/organization realm. Never stored in cleartext by this control plane. */
+    readonly workosRealm: string;
+};
+export type PlatformAuthRolloutMutationInput = PlatformAuthRolloutPreviewInput & {
+    readonly expectedGeneration: number;
+    readonly idempotencyKey: string;
+    readonly previewChecksum: string;
+    readonly actorFingerprint: string;
+    /** Stable caller request fingerprint used only for cross-ledger crash recovery. */
+    readonly replayRequestFingerprint?: string;
+};
+export interface PlatformAuthRolloutReplayInput {
+    readonly idempotencyKey: string;
+    readonly requestFingerprint: string;
+}
+export interface PlatformAuthRolloutLineage {
+    readonly inventoryRunId: string;
+    readonly inventoryChecksum: string;
+    readonly importRunId: string;
+    readonly importLineageChecksum: string;
+}
+/** Provider-neutral Postgres rollout control; provider calls stay outside this digest-only store. */
+export declare class PostgresPlatformAuthRolloutStore {
+    #private;
+    constructor(pool: Pool, options?: {
+        readonly buildInfo?: BuildInfo;
+        readonly now?: () => Date;
+        readonly workos?: WorkOSConfigurationIdentity;
+        readonly remoteVerificationStore?: Pick<PlatformAuthRemoteVerificationStore, 'readiness'>;
+    });
+    status(): Promise<PlatformAuthRolloutSafeResult>;
+    /** Internal durable lineage for emergency rollback after newer inventory generations appear. */
+    boundLineage(): Promise<PlatformAuthRolloutLineage | undefined>;
+    preview(input: PlatformAuthRolloutPreviewInput): Promise<{
+        readonly generation: number;
+        readonly checksum: string;
+    }>;
+    /** Read-only exact replay used to close the crash window between this store and its operator ledger. */
+    replayMutation(input: PlatformAuthRolloutReplayInput): Promise<PlatformAuthRolloutSafeResult | undefined>;
+    mutate(input: PlatformAuthRolloutMutationInput): Promise<PlatformAuthRolloutSafeResult>;
+}
+//# sourceMappingURL=platform-auth-rollout-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-rollout-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-rollout-postgres.d.ts","sourceRoot":"","sources":["../src/platform-auth-rollout-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAoB,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAKL,KAAK,2BAA2B,EACjC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,wCAAwC,CAAC;AAQlG,OAAO,EAEL,KAAK,WAAW,EAOhB,KAAK,6BAA6B,EASnC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,YAAY,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AAExF,KAAK,UAAU,GAAG,yBAAyB,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE,CAAC;AACvE,KAAK,IAAI,GAAG,yBAAyB,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAA;CAAE,CAAC;AAEhF,MAAM,MAAM,+BAA+B,GAAG,WAAW,GAAG;IAC1D,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,8FAA8F;IAC9F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG,+BAA+B,GAAG;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,mFAAmF;IACnF,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CAC5C,CAAC;AAEF,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;CACxC;AAED,qGAAqG;AACrG,qBAAa,gCAAgC;;gBAUzC,IAAI,EAAE,IAAI,EACV,OAAO,GAAE;QACP,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;QAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;QAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,2BAA2B,CAAC;QAC9C,QAAQ,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC,mCAAmC,EAAE,WAAW,CAAC,CAAC;KACtF;IASF,MAAM,IAAI,OAAO,CAAC,6BAA6B,CAAC;IAItD,gGAAgG;IAC1F,YAAY,IAAI,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC;IAmC/D,OAAO,CAAC,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC;QAC7D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,CAAC;IAyEF,wGAAwG;IAClG,cAAc,CAClB,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,6BAA6B,GAAG,SAAS,CAAC;IAkB/C,MAAM,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAAC,6BAA6B,CAAC;CAoP9F"}

package/node_modules/@noodle-borg/service/dist/platform-auth-rollout-postgres.js

@@ -0,0 +1,292 @@
+import { resolveBuildInfo } from './build-info.js';
+import { configurationBoundPreviewRequest, resolveWorkOSRolloutConfigurationFingerprints, } from './platform-auth-configuration.js';
+import { PlatformAuthMigrationError } from './platform-auth-migration.js';
+import { assertPlatformAuthRemoteVerificationReady, loadPlatformAuthRolloutAggregate, loadPlatformAuthRolloutLineage, lockPlatformAuthFinalizationInputs, platformAuthFinalizationCandidatesReady, } from './platform-auth-rollout-readiness-postgres.js';
+import { assertSha, decodeSafeState, effectiveCohorts, hash, lineageMatches, nextState, platformAuthRolloutRequiresReadiness, previewMatches, safeState, sorted, validateFinalize, validateTransition, validLineageId, validOperatorFingerprint, } from './platform-auth-rollout-support.js';
+/** Provider-neutral Postgres rollout control; provider calls stay outside this digest-only store. */
+export class PostgresPlatformAuthRolloutStore {
+    #pool;
+    #gitSha;
+    #now;
+    #workos;
+    #remoteVerificationStore;
+    constructor(pool, options = {}) {
+        this.#pool = pool;
+        this.#gitSha = (options.buildInfo ?? resolveBuildInfo()).gitSha;
+        this.#now = options.now ?? (() => new Date());
+        this.#workos = options.workos;
+        this.#remoteVerificationStore = options.remoteVerificationStore;
+    }
+    async status() {
+        return safeState(await this.#readState(this.#pool, false));
+    }
+    /** Internal durable lineage for emergency rollback after newer inventory generations appear. */
+    async boundLineage() {
+        const result = await this.#pool.query(`SELECT rollout_inventory_run_id, rollout_inventory_checksum,
+              rollout_import_run_id, rollout_import_lineage_checksum
+         FROM platform_auth_rollout_state WHERE singleton = true`);
+        const row = result.rows[0];
+        if (row === undefined)
+            throw new PlatformAuthMigrationError('finalize_precondition_failed');
+        const values = [
+            row.rollout_inventory_run_id,
+            row.rollout_inventory_checksum,
+            row.rollout_import_run_id,
+            row.rollout_import_lineage_checksum,
+        ];
+        if (values.every((value) => value === null))
+            return undefined;
+        if (!validLineageId(row.rollout_inventory_run_id ?? '') ||
+            !/^[0-9a-f]{64}$/.test(row.rollout_inventory_checksum ?? '') ||
+            !validLineageId(row.rollout_import_run_id ?? '') ||
+            !/^[0-9a-f]{64}$/.test(row.rollout_import_lineage_checksum ?? ''))
+            throw new PlatformAuthMigrationError('rollout_transition_invalid');
+        return {
+            inventoryRunId: row.rollout_inventory_run_id,
+            inventoryChecksum: row.rollout_inventory_checksum,
+            importRunId: row.rollout_import_run_id,
+            importLineageChecksum: row.rollout_import_lineage_checksum,
+        };
+    }
+    async preview(input) {
+        this.#assertRunningSha(input.releaseSha);
+        const state = await this.#readState(this.#pool, false);
+        const effective = effectiveCohorts(state, input);
+        validateTransition(state, effective, this.#now());
+        const requiresReady = platformAuthRolloutRequiresReadiness(state, effective);
+        const configuration = this.#configuration(state, effective, input.workosRealm);
+        const lineage = await loadPlatformAuthRolloutLineage(this.#pool, input, requiresReady);
+        const aggregate = await loadPlatformAuthRolloutAggregate(this.#pool, lineage);
+        const candidatesReady = requiresReady
+            ? await platformAuthFinalizationCandidatesReady(this.#pool, lineage)
+            : true;
+        if (requiresReady &&
+            (aggregate.unresolvedImports !== 0 ||
+                aggregate.pendingOutbox !== 0 ||
+                aggregate.candidates === 0 ||
+                aggregate.inventoryBlockers !== 0 ||
+                !candidatesReady))
+            throw new PlatformAuthMigrationError('finalize_precondition_failed');
+        if (requiresReady)
+            await assertPlatformAuthRemoteVerificationReady(this.#remoteVerificationStore, lineage, this.#now());
+        if (input.operation === 'finalize')
+            validateFinalize(state, effective, aggregate, candidatesReady, this.#now());
+        const request = configurationBoundPreviewRequest(state, aggregate, lineage, effective, configuration);
+        const checksum = hash(request);
+        await this.#pool.query(`INSERT INTO platform_auth_rollout_previews
+         (checksum, expected_generation, operation, percentage, cohort_mode,
+          canary_client_set_hash, canary_client_count, recovery_client_set_hash,
+          recovery_client_count, release_sha, inventory_run_hash, inventory_checksum,
+          import_run_hash, import_lineage_checksum, workos_realm_fingerprint,
+          workos_client_fingerprint, rollback_rehearsal_checksum,
+          staging_workos_only_smoke_checksum, aggregate_checksum, expires_at)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19,
+               now() + interval '15 minutes')
+       ON CONFLICT (checksum) DO NOTHING`, [
+            checksum,
+            state.generation,
+            input.operation,
+            input.percentage,
+            input.cohortMode,
+            hash(effective.canaryClientIds),
+            effective.canaryClientIds.length,
+            hash(effective.recoveryClientIds),
+            effective.recoveryClientIds.length,
+            input.releaseSha,
+            lineage.inventoryRunHash,
+            lineage.inventoryChecksum,
+            lineage.importRunHash,
+            lineage.importLineageChecksum,
+            lineage.workosRealmFingerprint,
+            configuration?.client ?? null,
+            effective.operation === 'finalize' ? effective.rollbackRehearsalChecksum : null,
+            effective.operation === 'finalize' ? effective.stagingWorkosOnlySmokeChecksum : null,
+            hash(aggregate),
+        ]);
+        return { generation: state.generation, checksum };
+    }
+    /** Read-only exact replay used to close the crash window between this store and its operator ledger. */
+    async replayMutation(input) {
+        if (!/^[0-9a-f]{64}$/.test(input.requestFingerprint))
+            throw new PlatformAuthMigrationError('rollout_transition_invalid');
+        const replay = await this.#pool.query(`SELECT replay_request_fingerprint, applied_state FROM platform_auth_rollout_evidence_v2
+        WHERE idempotency_key_hash = $1`, [hash(input.idempotencyKey)]);
+        const row = replay.rows[0];
+        if (row === undefined)
+            return undefined;
+        if (row.replay_request_fingerprint !== input.requestFingerprint)
+            throw new PlatformAuthMigrationError('idempotency_conflict');
+        return decodeSafeState(row.applied_state);
+    }
+    async mutate(input) {
+        this.#assertRunningSha(input.releaseSha);
+        if (!validOperatorFingerprint(input.actorFingerprint))
+            throw new PlatformAuthMigrationError('rollout_transition_invalid');
+        const requestFingerprint = hash({ ...input, idempotencyKey: undefined });
+        const replayRequestFingerprint = input.replayRequestFingerprint ?? requestFingerprint;
+        if (!/^[0-9a-f]{64}$/.test(replayRequestFingerprint))
+            throw new PlatformAuthMigrationError('rollout_transition_invalid');
+        const idempotencyHash = hash(input.idempotencyKey);
+        const connection = this.#pool.connect === undefined ? this.#pool : await this.#pool.connect();
+        try {
+            await connection.query('BEGIN');
+            await connection.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [
+                `platform-auth-rollout-idempotency:${idempotencyHash}`,
+            ]);
+            // Exact replay is deliberately before generation validation, so a retry survives later changes.
+            const replay = await connection.query(`SELECT request_fingerprint, applied_state FROM platform_auth_rollout_evidence_v2
+          WHERE idempotency_key_hash = $1 FOR UPDATE`, [idempotencyHash]);
+            if (replay.rows[0] !== undefined) {
+                if (replay.rows[0].request_fingerprint !== requestFingerprint)
+                    throw new PlatformAuthMigrationError('idempotency_conflict');
+                const replayed = decodeSafeState(replay.rows[0].applied_state);
+                await connection.query('COMMIT');
+                return replayed;
+            }
+            const state = await this.#readState(connection, true);
+            if (state.generation !== input.expectedGeneration)
+                throw new PlatformAuthMigrationError('stale_generation');
+            const effective = effectiveCohorts(state, input);
+            const preview = await connection.query(`SELECT expected_generation, operation, percentage, cohort_mode,
+                canary_client_set_hash, canary_client_count,
+                recovery_client_set_hash, recovery_client_count,
+                rollback_rehearsal_checksum, staging_workos_only_smoke_checksum,
+                release_sha, inventory_run_hash, inventory_checksum, import_run_hash,
+                import_lineage_checksum, workos_realm_fingerprint, workos_client_fingerprint,
+                aggregate_checksum
+           FROM platform_auth_rollout_previews
+          WHERE checksum = $1 AND expires_at > now() FOR UPDATE`, [input.previewChecksum]);
+            const frozen = preview.rows[0];
+            if (frozen === undefined ||
+                frozen.cohort_mode !== input.cohortMode ||
+                !previewMatches(frozen, { ...effective, expectedGeneration: input.expectedGeneration }))
+                throw new PlatformAuthMigrationError('preview_mismatch');
+            const requiresReady = platformAuthRolloutRequiresReadiness(state, effective);
+            if (requiresReady)
+                await lockPlatformAuthFinalizationInputs(connection, this.#remoteVerificationStore !== undefined);
+            const configuration = this.#configuration(state, effective, input.workosRealm);
+            const lineage = await loadPlatformAuthRolloutLineage(connection, input, requiresReady);
+            if (!lineageMatches(frozen, lineage) ||
+                frozen.workos_client_fingerprint !== (configuration?.client ?? null))
+                throw new PlatformAuthMigrationError('preview_mismatch');
+            const aggregate = await loadPlatformAuthRolloutAggregate(connection, lineage);
+            if (frozen.aggregate_checksum !== hash(aggregate) ||
+                input.previewChecksum !==
+                    hash(configurationBoundPreviewRequest(state, aggregate, lineage, effective, configuration)))
+                throw new PlatformAuthMigrationError('preview_mismatch');
+            validateTransition(state, effective, this.#now());
+            const candidatesReady = requiresReady
+                ? await platformAuthFinalizationCandidatesReady(connection, lineage)
+                : true;
+            if (requiresReady &&
+                (aggregate.unresolvedImports !== 0 ||
+                    aggregate.pendingOutbox !== 0 ||
+                    aggregate.candidates === 0 ||
+                    aggregate.inventoryBlockers !== 0 ||
+                    !candidatesReady))
+                throw new PlatformAuthMigrationError('finalize_precondition_failed');
+            if (requiresReady)
+                await assertPlatformAuthRemoteVerificationReady(this.#remoteVerificationStore, lineage, this.#now());
+            if (input.operation === 'finalize') {
+                const finalAggregate = await loadPlatformAuthRolloutAggregate(connection, lineage);
+                validateFinalize(state, effective, finalAggregate, candidatesReady, this.#now());
+            }
+            const applied = nextState(state, effective, this.#now());
+            const updated = await connection.query(`UPDATE platform_auth_rollout_state
+            SET generation = $2, workos_percentage = $3, lifecycle = $4, release_sha = $5,
+                workos_canary_client_ids = $6, workos_recovery_client_ids = $7,
+                workos_default_since = $8, workos_stage_since = $9,
+                workos_client_fingerprint = COALESCE($10, workos_client_fingerprint),
+                workos_realm_fingerprint = COALESCE($11, workos_realm_fingerprint),
+                rollout_inventory_run_id = $12, rollout_inventory_checksum = $13,
+                rollout_import_run_id = $14, rollout_import_lineage_checksum = $15,
+                workos_recovery_enabled = $16,
+                finalized_at = CASE WHEN $4 = 'finalized' THEN now() ELSE NULL END, updated_at = now()
+          WHERE singleton = true AND generation = $1 RETURNING generation`, [
+                state.generation,
+                applied.generation,
+                applied.workosPercentage,
+                applied.lifecycle,
+                input.releaseSha,
+                applied.canaryClientIds,
+                applied.recoveryClientIds,
+                applied.workosDefaultSince,
+                applied.workosStageSince,
+                configuration?.client ?? null,
+                configuration?.realm ?? null,
+                input.inventoryRunId,
+                input.inventoryChecksum,
+                input.importRunId,
+                input.importLineageChecksum,
+                applied.workosRecoveryEnabled,
+            ]);
+            if (updated.rows[0] === undefined)
+                throw new PlatformAuthMigrationError('stale_generation');
+            await connection.query(`INSERT INTO platform_auth_rollout_evidence_v2
+           (idempotency_key_hash, request_fingerprint, replay_request_fingerprint,
+            actor_fingerprint, operation, release_sha, preview_checksum, lineage_fingerprint,
+            rollback_rehearsal_checksum, staging_workos_only_smoke_checksum,
+            prior_state, applied_state)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)`, [
+                idempotencyHash,
+                requestFingerprint,
+                replayRequestFingerprint,
+                hash(input.actorFingerprint),
+                input.operation,
+                input.releaseSha,
+                input.previewChecksum,
+                hash(lineage),
+                effective.operation === 'finalize' ? effective.rollbackRehearsalChecksum : null,
+                effective.operation === 'finalize' ? effective.stagingWorkosOnlySmokeChecksum : null,
+                JSON.stringify(safeState(state)),
+                JSON.stringify(safeState(applied)),
+            ]);
+            await connection.query('COMMIT');
+            return safeState(applied);
+        }
+        catch (error) {
+            await connection.query('ROLLBACK').catch(() => undefined);
+            throw error;
+        }
+        finally {
+            connection.release?.();
+        }
+    }
+    #assertRunningSha(releaseSha) {
+        assertSha(releaseSha);
+        if (releaseSha !== this.#gitSha)
+            throw new PlatformAuthMigrationError('release_sha_mismatch');
+    }
+    async #readState(pool, lock) {
+        const result = await pool.query(`SELECT generation, workos_percentage, workos_canary_client_ids,
+              workos_recovery_client_ids, workos_recovery_enabled,
+              workos_default_since, workos_stage_since, lifecycle,
+              workos_client_fingerprint, workos_realm_fingerprint
+         FROM platform_auth_rollout_state WHERE singleton = true${lock ? ' FOR UPDATE' : ''}`);
+        const row = result.rows[0];
+        if (row === undefined)
+            throw new PlatformAuthMigrationError('finalize_precondition_failed');
+        return {
+            generation: Number(row.generation),
+            workosPercentage: row.workos_percentage,
+            canaryClientIds: sorted(row.workos_canary_client_ids),
+            recoveryClientIds: sorted(row.workos_recovery_client_ids),
+            workosRecoveryEnabled: row.workos_recovery_enabled,
+            workosDefaultSince: row.workos_default_since?.toISOString() ?? null,
+            workosStageSince: row.workos_stage_since?.toISOString() ?? null,
+            lifecycle: row.lifecycle,
+            workosClientFingerprint: row.workos_client_fingerprint,
+            workosRealmFingerprint: row.workos_realm_fingerprint,
+        };
+    }
+    #configuration(state, effective, realm) {
+        const resolution = resolveWorkOSRolloutConfigurationFingerprints({
+            ...state,
+            workosRecoveryClientIds: state.recoveryClientIds,
+        }, effective, this.#workos, realm);
+        if (!resolution.valid)
+            throw new PlatformAuthMigrationError('rollout_transition_invalid');
+        return resolution.fingerprints;
+    }
+}
+//# sourceMappingURL=platform-auth-rollout-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-rollout-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-rollout-postgres.js","sourceRoot":"","sources":["../src/platform-auth-rollout-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EACL,gCAAgC,EAChC,6CAA6C,GAI9C,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAE1E,OAAO,EACL,yCAAyC,EACzC,gCAAgC,EAChC,8BAA8B,EAC9B,kCAAkC,EAClC,uCAAuC,GACxC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,SAAS,EAET,eAAe,EACf,gBAAgB,EAChB,IAAI,EACJ,cAAc,EACd,SAAS,EAGT,oCAAoC,EACpC,cAAc,EACd,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,wBAAwB,GACzB,MAAM,oCAAoC,CAAC;AAwC5C,qGAAqG;AACrG,MAAM,OAAO,gCAAgC;IAClC,KAAK,CAAO;IACZ,OAAO,CAAS;IAChB,IAAI,CAAa;IACjB,OAAO,CAA0C;IACjD,wBAAwB,CAEnB;IAEd,YACE,IAAU,EACV,UAKI,EAAE;QAEN,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,MAAM;QACV,OAAO,SAAS,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,gGAAgG;IAChG,KAAK,CAAC,YAAY;QAChB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAMnC;;iEAE2D,CAC5D,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS;YAAE,MAAM,IAAI,0BAA0B,CAAC,8BAA8B,CAAC,CAAC;QAC5F,MAAM,MAAM,GAAG;YACb,GAAG,CAAC,wBAAwB;YAC5B,GAAG,CAAC,0BAA0B;YAC9B,GAAG,CAAC,qBAAqB;YACzB,GAAG,CAAC,+BAA+B;SACpC,CAAC;QACF,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9D,IACE,CAAC,cAAc,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC;YACnD,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC;YAC5D,CAAC,cAAc,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;YAChD,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,+BAA+B,IAAI,EAAE,CAAC;YAEjE,MAAM,IAAI,0BAA0B,CAAC,4BAA4B,CAAC,CAAC;QACrE,OAAO;YACL,cAAc,EAAE,GAAG,CAAC,wBAAkC;YACtD,iBAAiB,EAAE,GAAG,CAAC,0BAAoC;YAC3D,WAAW,EAAE,GAAG,CAAC,qBAA+B;YAChD,qBAAqB,EAAE,GAAG,CAAC,+BAAyC;SACrE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAsC;QAIlD,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACjD,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,aAAa,GAAG,oCAAoC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC7E,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAC/E,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QACvF,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC9E,MAAM,eAAe,GAAG,aAAa;YACnC,CAAC,CAAC,MAAM,uCAAuC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC;YACpE,CAAC,CAAC,IAAI,CAAC;QACT,IACE,aAAa;YACb,CAAC,SAAS,CAAC,iBAAiB,KAAK,CAAC;gBAChC,SAAS,CAAC,aAAa,KAAK,CAAC;gBAC7B,SAAS,CAAC,UAAU,KAAK,CAAC;gBAC1B,SAAS,CAAC,iBAAiB,KAAK,CAAC;gBACjC,CAAC,eAAe,CAAC;YAEnB,MAAM,IAAI,0BAA0B,CAAC,8BAA8B,CAAC,CAAC;QACvE,IAAI,aAAa;YACf,MAAM,yCAAyC,CAC7C,IAAI,CAAC,wBAAwB,EAC7B,OAAO,EACP,IAAI,CAAC,IAAI,EAAE,CACZ,CAAC;QACJ,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU;YAChC,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,gCAAgC,CAC9C,KAAK,EACL,SAAS,EACT,OAAO,EACP,SAAS,EACT,aAAa,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB;;;;;;;;;yCASmC,EACnC;YACE,QAAQ;YACR,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,UAAU;YAChB,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;YAC/B,SAAS,CAAC,eAAe,CAAC,MAAM;YAChC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC;YACjC,SAAS,CAAC,iBAAiB,CAAC,MAAM;YAClC,KAAK,CAAC,UAAU;YAChB,OAAO,CAAC,gBAAgB;YACxB,OAAO,CAAC,iBAAiB;YACzB,OAAO,CAAC,aAAa;YACrB,OAAO,CAAC,qBAAqB;YAC7B,OAAO,CAAC,sBAAsB;YAC9B,aAAa,EAAE,MAAM,IAAI,IAAI;YAC7B,SAAS,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI;YAC/E,SAAS,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC,CAAC,IAAI;YACpF,IAAI,CAAC,SAAS,CAAC;SAChB,CACF,CAAC;QACF,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC;IACpD,CAAC;IAED,wGAAwG;IACxG,KAAK,CAAC,cAAc,CAClB,KAAqC;QAErC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAClD,MAAM,IAAI,0BAA0B,CAAC,4BAA4B,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAInC;wCACkC,EAClC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAC7B,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,IAAI,GAAG,CAAC,0BAA0B,KAAK,KAAK,CAAC,kBAAkB;YAC7D,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;QAC/D,OAAO,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAuC;QAClD,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,gBAAgB,CAAC;YACnD,MAAM,IAAI,0BAA0B,CAAC,4BAA4B,CAAC,CAAC;QACrE,MAAM,kBAAkB,GAAG,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;QACzE,MAAM,wBAAwB,GAAG,KAAK,CAAC,wBAAwB,IAAI,kBAAkB,CAAC;QACtF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,wBAAwB,CAAC;YAClD,MAAM,IAAI,0BAA0B,CAAC,4BAA4B,CAAC,CAAC;QACrE,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,UAAU,GACd,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7E,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,MAAM,UAAU,CAAC,KAAK,CAAC,uDAAuD,EAAE;gBAC9E,qCAAqC,eAAe,EAAE;aACvD,CAAC,CAAC;YACH,gGAAgG;YAChG,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAInC;qDAC6C,EAC7C,CAAC,eAAe,CAAC,CAClB,CAAC;YACF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,KAAK,kBAAkB;oBAC3D,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;gBAC/D,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAC/D,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACjC,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YACtD,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,kBAAkB;gBAC/C,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;YAC3D,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAoBpC;;;;;;;;gEAQwD,EACxD,CAAC,KAAK,CAAC,eAAe,CAAC,CACxB,CAAC;YACF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC/B,IACE,MAAM,KAAK,SAAS;gBACpB,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,UAAU;gBACvC,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,GAAG,SAAS,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC;gBAEvF,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;YAC3D,MAAM,aAAa,GAAG,oCAAoC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC7E,IAAI,aAAa;gBACf,MAAM,kCAAkC,CACtC,UAAU,EACV,IAAI,CAAC,wBAAwB,KAAK,SAAS,CAC5C,CAAC;YACJ,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;YAC/E,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;YACvF,IACE,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC;gBAChC,MAAM,CAAC,yBAAyB,KAAK,CAAC,aAAa,EAAE,MAAM,IAAI,IAAI,CAAC;gBAEpE,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;YAC3D,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC9E,IACE,MAAM,CAAC,kBAAkB,KAAK,IAAI,CAAC,SAAS,CAAC;gBAC7C,KAAK,CAAC,eAAe;oBACnB,IAAI,CACF,gCAAgC,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,CACtF;gBAEH,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;YAC3D,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAClD,MAAM,eAAe,GAAG,aAAa;gBACnC,CAAC,CAAC,MAAM,uCAAuC,CAAC,UAAU,EAAE,OAAO,CAAC;gBACpE,CAAC,CAAC,IAAI,CAAC;YACT,IACE,aAAa;gBACb,CAAC,SAAS,CAAC,iBAAiB,KAAK,CAAC;oBAChC,SAAS,CAAC,aAAa,KAAK,CAAC;oBAC7B,SAAS,CAAC,UAAU,KAAK,CAAC;oBAC1B,SAAS,CAAC,iBAAiB,KAAK,CAAC;oBACjC,CAAC,eAAe,CAAC;gBAEnB,MAAM,IAAI,0BAA0B,CAAC,8BAA8B,CAAC,CAAC;YACvE,IAAI,aAAa;gBACf,MAAM,yCAAyC,CAC7C,IAAI,CAAC,wBAAwB,EAC7B,OAAO,EACP,IAAI,CAAC,IAAI,EAAE,CACZ,CAAC;YACJ,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;gBACnC,MAAM,cAAc,GAAG,MAAM,gCAAgC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACnF,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CACpC;;;;;;;;;;0EAUkE,EAClE;gBACE,KAAK,CAAC,UAAU;gBAChB,OAAO,CAAC,UAAU;gBAClB,OAAO,CAAC,gBAAgB;gBACxB,OAAO,CAAC,SAAS;gBACjB,KAAK,CAAC,UAAU;gBAChB,OAAO,CAAC,eAAe;gBACvB,OAAO,CAAC,iBAAiB;gBACzB,OAAO,CAAC,kBAAkB;gBAC1B,OAAO,CAAC,gBAAgB;gBACxB,aAAa,EAAE,MAAM,IAAI,IAAI;gBAC7B,aAAa,EAAE,KAAK,IAAI,IAAI;gBAC5B,KAAK,CAAC,cAAc;gBACpB,KAAK,CAAC,iBAAiB;gBACvB,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,qBAAqB;gBAC3B,OAAO,CAAC,qBAAqB;aAC9B,CACF,CAAC;YACF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;YAC5F,MAAM,UAAU,CAAC,KAAK,CACpB;;;;;oEAK4D,EAC5D;gBACE,eAAe;gBACf,kBAAkB;gBAClB,wBAAwB;gBACxB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBAC5B,KAAK,CAAC,SAAS;gBACf,KAAK,CAAC,UAAU;gBAChB,KAAK,CAAC,eAAe;gBACrB,IAAI,CAAC,OAAO,CAAC;gBACb,SAAS,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI;gBAC/E,SAAS,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC,CAAC,IAAI;gBACpF,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBAChC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;aACnC,CACF,CAAC;YACF,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1D,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,UAAkB;QAClC,SAAS,CAAC,UAAU,CAAC,CAAC;QACtB,IAAI,UAAU,KAAK,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;IAChG,CAAC;IAED,KAAK,CAAC,UAAU,CACd,IAA+B,EAC/B,IAAa;QAEb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAY7B;;;;kEAI4D,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CACxF,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS;YAAE,MAAM,IAAI,0BAA0B,CAAC,8BAA8B,CAAC,CAAC;QAC5F,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;YAClC,gBAAgB,EAAE,GAAG,CAAC,iBAAiB;YACvC,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC;YACrD,iBAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC;YACzD,qBAAqB,EAAE,GAAG,CAAC,uBAAuB;YAClD,kBAAkB,EAAE,GAAG,CAAC,oBAAoB,EAAE,WAAW,EAAE,IAAI,IAAI;YACnE,gBAAgB,EAAE,GAAG,CAAC,kBAAkB,EAAE,WAAW,EAAE,IAAI,IAAI;YAC/D,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,uBAAuB,EAAE,GAAG,CAAC,yBAAyB;YACtD,sBAAsB,EAAE,GAAG,CAAC,wBAAwB;SACrD,CAAC;IACJ,CAAC;IAED,cAAc,CACZ,KAA+B,EAC/B,SAAyF,EACzF,KAAa;QAEb,MAAM,UAAU,GAAG,6CAA6C,CAC9D;YACE,GAAG,KAAK;YACR,uBAAuB,EAAE,KAAK,CAAC,iBAAiB;SACjD,EACD,SAAS,EACT,IAAI,CAAC,OAAO,EACZ,KAAK,CACN,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,KAAK;YAAE,MAAM,IAAI,0BAA0B,CAAC,4BAA4B,CAAC,CAAC;QAC1F,OAAO,UAAU,CAAC,YAAY,CAAC;IACjC,CAAC;CACF"}

package/node_modules/@noodle-borg/service/dist/platform-auth-rollout-readiness-postgres.d.ts

@@ -0,0 +1,19 @@
+import { type PlatformAuthRemoteVerificationStore } from './platform-auth-remote-verification.js';
+import { type Aggregate, type Lineage } from './platform-auth-rollout-support.js';
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+interface RolloutLineageInput {
+    readonly operation: 'activate' | 'rollback' | 'finalize';
+    readonly inventoryRunId: string;
+    readonly inventoryChecksum: string;
+    readonly importRunId: string;
+    readonly importLineageChecksum: string;
+    readonly workosRealm: string;
+    readonly releaseSha: string;
+}
+export declare function loadPlatformAuthRolloutLineage(pool: PlatformIdentityQueryable, input: RolloutLineageInput, requireCompletedImport: boolean): Promise<Lineage>;
+export declare function loadPlatformAuthRolloutAggregate(pool: PlatformIdentityQueryable, lineage: Lineage): Promise<Aggregate>;
+export declare function lockPlatformAuthFinalizationInputs(connection: PlatformIdentityQueryable, includeRemoteVerification: boolean): Promise<void>;
+export declare function assertPlatformAuthRemoteVerificationReady(store: Pick<PlatformAuthRemoteVerificationStore, 'readiness'> | undefined, lineage: Lineage, now: Date): Promise<void>;
+export declare function platformAuthFinalizationCandidatesReady(connection: PlatformIdentityQueryable, lineage: Lineage): Promise<boolean>;
+export {};
+//# sourceMappingURL=platform-auth-rollout-readiness-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-rollout-readiness-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-rollout-readiness-postgres.d.ts","sourceRoot":"","sources":["../src/platform-auth-rollout-readiness-postgres.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,mCAAmC,EAEzC,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,KAAK,SAAS,EAEd,KAAK,OAAO,EAGb,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;IACzD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,yBAAyB,EAC/B,KAAK,EAAE,mBAAmB,EAC1B,sBAAsB,EAAE,OAAO,GAC9B,OAAO,CAAC,OAAO,CAAC,CAsDlB;AAED,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,yBAAyB,EAC/B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,SAAS,CAAC,CA2BpB;AAED,wBAAsB,kCAAkC,CACtD,UAAU,EAAE,yBAAyB,EACrC,yBAAyB,EAAE,OAAO,GACjC,OAAO,CAAC,IAAI,CAAC,CASf;AAED,wBAAsB,yCAAyC,CAC7D,KAAK,EAAE,IAAI,CAAC,mCAAmC,EAAE,WAAW,CAAC,GAAG,SAAS,EACzE,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,wBAAsB,uCAAuC,CAC3D,UAAU,EAAE,yBAAyB,EACrC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,OAAO,CAAC,CAsClB"}

package/node_modules/@noodle-borg/service/dist/platform-auth-rollout-readiness-postgres.js

@@ -0,0 +1,121 @@
+import { PlatformAuthMigrationError } from './platform-auth-migration.js';
+import { loadFrozenInventory } from './platform-auth-migration-runs-postgres.js';
+import { platformAuthRemoteVerificationFreshAfter, } from './platform-auth-remote-verification.js';
+import { hash, validLineageId, validRealm, } from './platform-auth-rollout-support.js';
+export async function loadPlatformAuthRolloutLineage(pool, input, requireCompletedImport) {
+    if (!validLineageId(input.inventoryRunId) ||
+        !validLineageId(input.importRunId) ||
+        !validRealm(input.workosRealm) ||
+        !/^[0-9a-f]{64}$/.test(input.inventoryChecksum) ||
+        !/^[0-9a-f]{64}$/.test(input.importLineageChecksum))
+        throw new PlatformAuthMigrationError('rollout_transition_invalid');
+    const realmFingerprint = hash(input.workosRealm);
+    const lineage = {
+        inventoryRunId: input.inventoryRunId,
+        inventoryRunHash: hash(input.inventoryRunId),
+        inventoryChecksum: input.inventoryChecksum,
+        importRunId: input.importRunId,
+        importRunHash: hash(input.importRunId),
+        importLineageChecksum: input.importLineageChecksum,
+        workosRealm: input.workosRealm,
+        workosRealmFingerprint: realmFingerprint,
+    };
+    if (input.operation === 'rollback')
+        return lineage;
+    const frozen = await loadFrozenInventory(pool, {
+        inventoryRunId: input.inventoryRunId,
+        inventoryChecksum: input.inventoryChecksum,
+        releaseSha: input.releaseSha,
+        workosRealmFingerprint: realmFingerprint,
+        requireBlockerFree: true,
+    });
+    const imports = await pool.query(`SELECT state, release_sha, inventory_run_id, inventory_checksum,
+            workos_realm_fingerprint, lineage_checksum FROM identity_migration_runs
+      WHERE id = $1 AND kind IN ('import', 'reconcile') AND state IN ('running', 'completed')`, [input.importRunId]);
+    const importRow = imports.rows[0];
+    if (importRow === undefined ||
+        importRow.release_sha !== input.releaseSha ||
+        importRow.inventory_run_id !== input.inventoryRunId ||
+        importRow.inventory_checksum !== input.inventoryChecksum ||
+        importRow.workos_realm_fingerprint !== realmFingerprint ||
+        importRow.lineage_checksum !== input.importLineageChecksum ||
+        frozen.lineageChecksum !== input.importLineageChecksum ||
+        (requireCompletedImport && importRow.state !== 'completed'))
+        throw new PlatformAuthMigrationError('preview_mismatch');
+    return lineage;
+}
+export async function loadPlatformAuthRolloutAggregate(pool, lineage) {
+    // A transaction client processes one query at a time. Keep these reads sequential so
+    // finalization never relies on pg's deprecated concurrent-query queueing behavior.
+    const imports = await pool.query("SELECT count(*)::text AS count FROM workos_import_ledger WHERE migration_run_id = $1 AND realm = $2 AND state <> 'linked'", [lineage.importRunId, lineage.workosRealm]);
+    const outbox = await pool.query(`SELECT count(*)::text AS count
+       FROM platform_identity_sync_outbox outbox
+       JOIN platform_auth_inventory_candidates candidate
+         ON COALESCE(candidate.principal_id, candidate.source_subject) = outbox.principal_id
+      WHERE candidate.migration_run_id = $1 AND outbox.delivered_at IS NULL`, [lineage.inventoryRunId]);
+    const inventory = await pool.query(`SELECT count(*)::text AS candidates,
+            count(*) FILTER (WHERE cardinality(blocker_codes) > 0)::text AS blockers
+         FROM platform_auth_inventory_candidates WHERE migration_run_id = $1`, [lineage.inventoryRunId]);
+    return {
+        unresolvedImports: Number(imports.rows[0]?.count ?? 0),
+        pendingOutbox: Number(outbox.rows[0]?.count ?? 0),
+        candidates: Number(inventory.rows[0]?.candidates ?? 0),
+        inventoryBlockers: Number(inventory.rows[0]?.blockers ?? 0),
+    };
+}
+export async function lockPlatformAuthFinalizationInputs(connection, includeRemoteVerification) {
+    await connection.query('LOCK TABLE platform_auth_inventory_candidates, workos_import_ledger, platform_principals, platform_identity_links, platform_verified_emails, platform_identity_sync_outbox IN SHARE MODE');
+    if (includeRemoteVerification) {
+        await connection.query('LOCK TABLE platform_auth_remote_verification_sweeps, platform_auth_remote_verification_targets, platform_auth_remote_verification_evidence IN SHARE MODE');
+    }
+}
+export async function assertPlatformAuthRemoteVerificationReady(store, lineage, now) {
+    if (store === undefined)
+        throw new PlatformAuthMigrationError('remote_verification_incomplete');
+    const readiness = await store.readiness({
+        inventoryRunId: lineage.inventoryRunId,
+        importRunId: lineage.importRunId,
+        provider: 'workos',
+        realm: lineage.workosRealm,
+        freshAfter: platformAuthRemoteVerificationFreshAfter(now),
+    });
+    if (!readiness.ready)
+        throw new PlatformAuthMigrationError('remote_verification_incomplete');
+}
+export async function platformAuthFinalizationCandidatesReady(connection, lineage) {
+    const result = await connection.query(`SELECT count(*)::text AS count
+       FROM platform_auth_inventory_candidates candidate
+       LEFT JOIN workos_import_ledger ledger
+         ON ledger.principal_id = COALESCE(candidate.principal_id, candidate.source_subject)
+        AND ledger.migration_run_id = $1 AND ledger.realm = $2
+       LEFT JOIN platform_identity_links link
+         ON link.provider = 'workos' AND link.realm = ledger.realm
+        AND link.external_id = ledger.remote_user_id
+        AND link.principal_id = COALESCE(candidate.principal_id, candidate.source_subject)
+       LEFT JOIN platform_principals principal
+         ON principal.principal_id = COALESCE(candidate.principal_id, candidate.source_subject)
+       LEFT JOIN platform_identity_links google_link
+         ON google_link.provider = 'google' AND google_link.realm = candidate.source_realm
+        AND google_link.external_id = candidate.source_subject
+        AND google_link.principal_id = COALESCE(candidate.principal_id, candidate.source_subject)
+      WHERE candidate.migration_run_id = $3 AND (cardinality(candidate.blocker_codes) > 0
+         OR candidate.normalized_email IS NULL
+         OR principal.status IS DISTINCT FROM 'active'
+         OR principal.billing_identity_issuer IS DISTINCT FROM 'https://accounts.google.com'
+         OR principal.billing_subject IS DISTINCT FROM candidate.source_subject
+         OR google_link.principal_id IS NULL OR google_link.disabled_at IS NOT NULL
+         OR (SELECT count(*) FROM platform_verified_emails email
+               WHERE email.principal_id = COALESCE(candidate.principal_id, candidate.source_subject)
+                 AND email.provider = 'google' AND email.realm = candidate.source_realm
+                 AND email.status = 'active') <> 1
+         OR NOT EXISTS (SELECT 1 FROM platform_verified_emails email
+               WHERE email.principal_id = COALESCE(candidate.principal_id, candidate.source_subject)
+                 AND email.provider = 'google' AND email.realm = candidate.source_realm
+                 AND email.status = 'active'
+                 AND email.normalized_email = candidate.normalized_email)
+         OR ledger.state IS DISTINCT FROM 'linked'
+         OR ledger.lease_token IS NOT NULL OR ledger.lease_expires_at IS NOT NULL
+         OR ledger.remote_user_id IS NULL OR link.principal_id IS NULL OR link.disabled_at IS NOT NULL)`, [lineage.importRunId, lineage.workosRealm, lineage.inventoryRunId]);
+    return Number(result.rows[0]?.count ?? 0) === 0;
+}
+//# sourceMappingURL=platform-auth-rollout-readiness-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-rollout-readiness-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-rollout-readiness-postgres.js","sourceRoot":"","sources":["../src/platform-auth-rollout-readiness-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AACjF,OAAO,EAEL,wCAAwC,GACzC,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAEL,IAAI,EAEJ,cAAc,EACd,UAAU,GACX,MAAM,oCAAoC,CAAC;AAa5C,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,IAA+B,EAC/B,KAA0B,EAC1B,sBAA+B;IAE/B,IACE,CAAC,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC;QACrC,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC;QAClC,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;QAC9B,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC/C,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC;QAEnD,MAAM,IAAI,0BAA0B,CAAC,4BAA4B,CAAC,CAAC;IACrE,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,OAAO,GAAY;QACvB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;QAC5C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QACtC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,sBAAsB,EAAE,gBAAgB;KACzC,CAAC;IACF,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE;QAC7C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,sBAAsB,EAAE,gBAAgB;QACxC,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAQ9B;;8FAE0F,EAC1F,CAAC,KAAK,CAAC,WAAW,CAAC,CACpB,CAAC;IACF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClC,IACE,SAAS,KAAK,SAAS;QACvB,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,UAAU;QAC1C,SAAS,CAAC,gBAAgB,KAAK,KAAK,CAAC,cAAc;QACnD,SAAS,CAAC,kBAAkB,KAAK,KAAK,CAAC,iBAAiB;QACxD,SAAS,CAAC,wBAAwB,KAAK,gBAAgB;QACvD,SAAS,CAAC,gBAAgB,KAAK,KAAK,CAAC,qBAAqB;QAC1D,MAAM,CAAC,eAAe,KAAK,KAAK,CAAC,qBAAqB;QACtD,CAAC,sBAAsB,IAAI,SAAS,CAAC,KAAK,KAAK,WAAW,CAAC;QAE3D,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;IAC3D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,IAA+B,EAC/B,OAAgB;IAEhB,qFAAqF;IACrF,mFAAmF;IACnF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAC9B,2HAA2H,EAC3H,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAC3C,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;4EAIwE,EACxE,CAAC,OAAO,CAAC,cAAc,CAAC,CACzB,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAChC;;6EAEyE,EACzE,CAAC,OAAO,CAAC,cAAc,CAAC,CACzB,CAAC;IACF,OAAO;QACL,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;QACtD,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;QACjD,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,CAAC,CAAC;QACtD,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,CAAC,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,UAAqC,EACrC,yBAAkC;IAElC,MAAM,UAAU,CAAC,KAAK,CACpB,0LAA0L,CAC3L,CAAC;IACF,IAAI,yBAAyB,EAAE,CAAC;QAC9B,MAAM,UAAU,CAAC,KAAK,CACpB,0JAA0J,CAC3J,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,KAAyE,EACzE,OAAgB,EAChB,GAAS;IAET,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,0BAA0B,CAAC,gCAAgC,CAAC,CAAC;IAChG,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC;QACtC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,OAAO,CAAC,WAAW;QAC1B,UAAU,EAAE,wCAAwC,CAAC,GAAG,CAAC;KAC1D,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,KAAK;QAAE,MAAM,IAAI,0BAA0B,CAAC,gCAAgC,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,UAAqC,EACrC,OAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CACnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wGAgCoG,EACpG,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC,CACnE,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC"}