@noodleseed/one 0.63.0 → 0.64.0

package/node_modules/@noodle-borg/service/dist/platform-auth-rollout-support.d.ts

@@ -0,0 +1,119 @@
+import { type PlatformAuthRolloutState } from './platform-auth-migration.js';
+export type Operation = 'activate' | 'rollback' | 'finalize';
+export interface Aggregate {
+    readonly unresolvedImports: number;
+    readonly pendingOutbox: number;
+    readonly candidates: number;
+    readonly inventoryBlockers: number;
+}
+export interface Lineage {
+    readonly inventoryRunId: string;
+    readonly inventoryRunHash: string;
+    readonly inventoryChecksum: string;
+    readonly importRunId: string;
+    readonly importRunHash: string;
+    readonly importLineageChecksum: string;
+    readonly workosRealm: string;
+    readonly workosRealmFingerprint: string;
+}
+export interface DurableState extends PlatformAuthRolloutState {
+    readonly recoveryClientIds: readonly string[];
+    readonly workosRecoveryEnabled: boolean;
+    readonly workosDefaultSince: string | null;
+    readonly workosStageSince: string | null;
+}
+export interface PlatformAuthRolloutSafeResult {
+    readonly generation: number;
+    readonly workosPercentage: number;
+    readonly lifecycle: 'google' | 'workos' | 'finalized';
+    readonly canaryClientSetHash: string;
+    readonly canaryClientCount: number;
+    readonly recoveryClientSetHash: string;
+    readonly recoveryClientCount: number;
+    readonly workosDefaultSince: string | null;
+}
+export type PlatformAuthRolloutOperationInput = {
+    readonly operation: 'finalize';
+    readonly rollbackRehearsalChecksum: string;
+    readonly stagingWorkosOnlySmokeChecksum: string;
+} | {
+    readonly operation: 'activate' | 'rollback';
+    readonly rollbackRehearsalChecksum?: never;
+    readonly stagingWorkosOnlySmokeChecksum?: never;
+};
+type RolloutTarget = {
+    readonly percentage: number;
+    readonly releaseSha: string;
+} & ({
+    readonly cohortMode: 'preserve';
+    readonly canaryClientIds?: never;
+    readonly recoveryClientIds?: never;
+} | {
+    readonly cohortMode: 'replace';
+    readonly canaryClientIds: readonly string[];
+    readonly recoveryClientIds: readonly string[];
+});
+export type CohortInput = PlatformAuthRolloutOperationInput & RolloutTarget;
+export type EffectiveCohortInput = PlatformAuthRolloutOperationInput & {
+    readonly percentage: number;
+    readonly releaseSha: string;
+    readonly cohortMode: 'preserve' | 'replace';
+    readonly canaryClientIds: readonly string[];
+    readonly recoveryClientIds: readonly string[];
+};
+export declare function effectiveCohorts(state: DurableState, input: CohortInput): EffectiveCohortInput;
+/** Any newly selected route that can reach WorkOS needs a reconciled remote identity set. */
+export declare function platformAuthRolloutRequiresReadiness(state: DurableState, input: EffectiveCohortInput): boolean;
+export declare function previewRequest(state: DurableState, aggregate: Aggregate, lineage: Lineage, input: EffectiveCohortInput): {
+    rollbackRehearsalChecksum: string | null;
+    stagingWorkosOnlySmokeChecksum: string | null;
+    state: DurableState;
+    aggregate: Aggregate;
+    lineage: {
+        inventoryRunHash: string;
+        inventoryChecksum: string;
+        importRunHash: string;
+        importLineageChecksum: string;
+        workosRealmFingerprint: string;
+    };
+    operation: "activate" | "rollback" | "finalize";
+    percentage: number;
+    cohortMode: "replace" | "preserve";
+    canaryClientIds: readonly string[];
+    recoveryClientIds: readonly string[];
+    releaseSha: string;
+};
+export declare function previewMatches(preview: {
+    readonly expected_generation: string;
+    readonly operation: Operation;
+    readonly percentage: number;
+    readonly canary_client_set_hash: string;
+    readonly canary_client_count: number;
+    readonly recovery_client_set_hash: string;
+    readonly recovery_client_count: number;
+    readonly rollback_rehearsal_checksum: string | null;
+    readonly staging_workos_only_smoke_checksum: string | null;
+    readonly release_sha: string;
+}, input: EffectiveCohortInput & {
+    readonly expectedGeneration: number;
+}): boolean;
+export declare function lineageMatches(preview: {
+    readonly inventory_run_hash: string | null;
+    readonly import_run_hash: string | null;
+    readonly inventory_checksum?: string | null;
+    readonly import_lineage_checksum?: string | null;
+    readonly workos_realm_fingerprint: string | null;
+}, lineage: Lineage): boolean;
+export declare function validateTransition(state: DurableState, input: EffectiveCohortInput, now: Date): void;
+export declare function validateFinalize(state: DurableState, input: EffectiveCohortInput, aggregate: Aggregate, candidatesReady: boolean, now: Date): void;
+export declare function nextState(state: DurableState, input: EffectiveCohortInput, now: Date): DurableState;
+export declare function safeState(state: DurableState): PlatformAuthRolloutSafeResult;
+export declare function decodeSafeState(value: unknown): PlatformAuthRolloutSafeResult;
+export declare function assertSha(releaseSha: string): void;
+export declare function hash(value: unknown): string;
+export declare function sorted(values: readonly string[] | undefined): readonly string[];
+export declare function validLineageId(value: string): boolean;
+export declare function validRealm(value: string): boolean;
+export declare function validOperatorFingerprint(value: string): boolean;
+export {};
+//# sourceMappingURL=platform-auth-rollout-support.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-rollout-support.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-rollout-support.d.ts","sourceRoot":"","sources":["../src/platform-auth-rollout-support.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;AAC7D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AACD,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;CACzC;AACD,MAAM,WAAW,YAAa,SAAQ,wBAAwB;IAC5D,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C;AACD,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;IACtD,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5C;AAED,MAAM,MAAM,iCAAiC,GACzC;IACE,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,8BAA8B,EAAE,MAAM,CAAC;CACjD,GACD;IACE,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,UAAU,CAAC;IAC5C,QAAQ,CAAC,yBAAyB,CAAC,EAAE,KAAK,CAAC;IAC3C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,KAAK,CAAC;CACjD,CAAC;AAEN,KAAK,aAAa,GAAG;IACnB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GAAG,CACA;IACE,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC;IACjC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC;CACpC,GACD;IACE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C,CACJ,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,iCAAiC,GAAG,aAAa,CAAC;AAC5E,MAAM,MAAM,oBAAoB,GAAG,iCAAiC,GAAG;IACrE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,GAAG,oBAAoB,CAQ9F;AAED,6FAA6F;AAC7F,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAIT;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,YAAY,EACnB,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,oBAAoB;+BAoNS,MAAM,GAAG,IAAI;oCACR,MAAM,GAAG,IAAI;;;;;;;;;;;;;;;;EAjMvD;AACD,wBAAgB,cAAc,CAC5B,OAAO,EAAE;IACP,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAC;IACpD,QAAQ,CAAC,kCAAkC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,EACD,KAAK,EAAE,oBAAoB,GAAG;IAAE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,GACpE,OAAO,CAcT;AACD,wBAAgB,cAAc,CAC5B,OAAO,EAAE;IACP,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjD,QAAQ,CAAC,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClD,EACD,OAAO,EAAE,OAAO,GACf,OAAO,CAQT;AACD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,oBAAoB,EAC3B,GAAG,EAAE,IAAI,GACR,IAAI,CA6CN;AACD,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,oBAAoB,EAC3B,SAAS,EAAE,SAAS,EACpB,eAAe,EAAE,OAAO,EACxB,GAAG,EAAE,IAAI,GACR,IAAI,CAaN;AACD,wBAAgB,SAAS,CACvB,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,oBAAoB,EAC3B,GAAG,EAAE,IAAI,GACR,YAAY,CA6Bd;AACD,wBAAgB,SAAS,CAAC,KAAK,EAAE,YAAY,GAAG,6BAA6B,CAW5E;AACD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,6BAA6B,CAkB7E;AACD,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAGlD;AACD,wBAAgB,IAAI,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE3C;AAoBD,wBAAgB,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,SAAS,MAAM,EAAE,CAE/E;AACD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAErD;AACD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEjD;AACD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE/D"}

package/node_modules/@noodle-borg/service/dist/platform-auth-rollout-support.js

@@ -0,0 +1,194 @@
+import { createHash } from 'node:crypto';
+import { PlatformAuthMigrationError, } from './platform-auth-migration.js';
+export function effectiveCohorts(state, input) {
+    return {
+        ...input,
+        canaryClientIds: input.cohortMode === 'preserve' ? state.canaryClientIds : sorted(input.canaryClientIds),
+        recoveryClientIds: input.cohortMode === 'preserve' ? state.recoveryClientIds : sorted(input.recoveryClientIds),
+    };
+}
+/** Any newly selected route that can reach WorkOS needs a reconciled remote identity set. */
+export function platformAuthRolloutRequiresReadiness(state, input) {
+    if (input.percentage > 0)
+        return true;
+    if (input.recoveryClientIds.length === 0)
+        return false;
+    return input.operation !== 'rollback' || state.workosPercentage === 0;
+}
+export function previewRequest(state, aggregate, lineage, input) {
+    return {
+        state,
+        aggregate,
+        lineage: {
+            inventoryRunHash: lineage.inventoryRunHash,
+            inventoryChecksum: lineage.inventoryChecksum,
+            importRunHash: lineage.importRunHash,
+            importLineageChecksum: lineage.importLineageChecksum,
+            workosRealmFingerprint: lineage.workosRealmFingerprint,
+        },
+        operation: input.operation,
+        percentage: input.percentage,
+        cohortMode: input.cohortMode,
+        canaryClientIds: input.canaryClientIds,
+        recoveryClientIds: input.recoveryClientIds,
+        releaseSha: input.releaseSha,
+        ...rolloutFinalizationEvidence(input),
+    };
+}
+export function previewMatches(preview, input) {
+    const evidence = rolloutFinalizationEvidence(input);
+    return (Number(preview.expected_generation) === input.expectedGeneration &&
+        preview.operation === input.operation &&
+        preview.percentage === input.percentage &&
+        preview.canary_client_set_hash === hash(input.canaryClientIds) &&
+        preview.canary_client_count === input.canaryClientIds.length &&
+        preview.recovery_client_set_hash === hash(input.recoveryClientIds) &&
+        preview.recovery_client_count === input.recoveryClientIds.length &&
+        preview.rollback_rehearsal_checksum === evidence.rollbackRehearsalChecksum &&
+        preview.staging_workos_only_smoke_checksum === evidence.stagingWorkosOnlySmokeChecksum &&
+        preview.release_sha === input.releaseSha);
+}
+export function lineageMatches(preview, lineage) {
+    return (preview.inventory_run_hash === lineage.inventoryRunHash &&
+        preview.import_run_hash === lineage.importRunHash &&
+        preview.inventory_checksum === lineage.inventoryChecksum &&
+        preview.import_lineage_checksum === lineage.importLineageChecksum &&
+        preview.workos_realm_fingerprint === lineage.workosRealmFingerprint);
+}
+export function validateTransition(state, input, now) {
+    const raw = input;
+    if ((input.operation === 'finalize' &&
+        (!validChecksum(input.rollbackRehearsalChecksum) ||
+            !validChecksum(input.stagingWorkosOnlySmokeChecksum))) ||
+        (input.operation !== 'finalize' &&
+            (raw.rollbackRehearsalChecksum !== undefined ||
+                raw.stagingWorkosOnlySmokeChecksum !== undefined)))
+        throw new PlatformAuthMigrationError('rollout_transition_invalid');
+    const canaries = input.canaryClientIds;
+    const recovery = input.recoveryClientIds;
+    if (state.lifecycle === 'finalized' ||
+        canaries.some((id) => !validClientId(id)) ||
+        recovery.some((id) => !validClientId(id)))
+        throw new PlatformAuthMigrationError('rollout_transition_invalid');
+    if (!Number.isInteger(input.percentage) ||
+        input.percentage < 0 ||
+        input.percentage > 100 ||
+        (input.operation === 'activate' && input.percentage < state.workosPercentage) ||
+        (input.operation === 'rollback' && input.percentage !== 0))
+        throw new PlatformAuthMigrationError('rollout_transition_invalid');
+    if (input.operation !== 'activate' || input.percentage === state.workosPercentage)
+        return;
+    const nextPercentage = new Map([
+        [0, 1],
+        [1, 10],
+        [10, 50],
+        [50, 100],
+    ]).get(state.workosPercentage);
+    const stageSince = state.workosStageSince === null ? Number.NaN : Date.parse(state.workosStageSince);
+    if (input.percentage !== nextPercentage ||
+        (state.workosPercentage > 0 &&
+            (!Number.isFinite(stageSince) || stageSince > now.getTime() - 24 * 60 * 60 * 1_000)))
+        throw new PlatformAuthMigrationError('rollout_transition_invalid');
+}
+export function validateFinalize(state, input, aggregate, candidatesReady, now) {
+    if (state.workosPercentage !== 100 ||
+        input.percentage !== 100 ||
+        aggregate.unresolvedImports !== 0 ||
+        aggregate.pendingOutbox !== 0 ||
+        aggregate.candidates === 0 ||
+        aggregate.inventoryBlockers !== 0 ||
+        state.workosDefaultSince === null ||
+        Date.parse(state.workosDefaultSince) > now.getTime() - 14 * 24 * 60 * 60 * 1_000 ||
+        !candidatesReady)
+        throw new PlatformAuthMigrationError('finalize_precondition_failed');
+}
+export function nextState(state, input, now) {
+    const canaryClientIds = input.operation === 'rollback' ? state.canaryClientIds : input.canaryClientIds;
+    const recoveryClientIds = input.operation === 'rollback' ? state.recoveryClientIds : input.recoveryClientIds;
+    return {
+        generation: state.generation + 1,
+        workosPercentage: input.percentage,
+        canaryClientIds,
+        recoveryClientIds,
+        workosStageSince: input.operation === 'rollback'
+            ? null
+            : input.operation === 'activate' && input.percentage > state.workosPercentage
+                ? now.toISOString()
+                : state.workosStageSince,
+        workosDefaultSince: input.operation === 'rollback' || input.percentage < 100
+            ? null
+            : (state.workosDefaultSince ?? now.toISOString()),
+        workosRecoveryEnabled: input.operation === 'finalize' || input.percentage === 100
+            ? false
+            : input.operation === 'rollback' && state.workosPercentage > 0
+                ? true
+                : state.workosRecoveryEnabled,
+        lifecycle: input.operation === 'finalize' ? 'finalized' : input.percentage === 0 ? 'google' : 'workos',
+    };
+}
+export function safeState(state) {
+    return {
+        generation: state.generation,
+        workosPercentage: state.workosPercentage,
+        lifecycle: state.lifecycle,
+        canaryClientSetHash: hash(state.canaryClientIds),
+        canaryClientCount: state.canaryClientIds.length,
+        recoveryClientSetHash: hash(state.recoveryClientIds),
+        recoveryClientCount: state.recoveryClientIds.length,
+        workosDefaultSince: state.workosDefaultSince,
+    };
+}
+export function decodeSafeState(value) {
+    if (typeof value !== 'object' || value === null)
+        throw new PlatformAuthMigrationError('idempotency_conflict');
+    const result = value;
+    if (typeof result.generation !== 'number' ||
+        typeof result.workosPercentage !== 'number' ||
+        (result.lifecycle !== 'google' &&
+            result.lifecycle !== 'workos' &&
+            result.lifecycle !== 'finalized') ||
+        typeof result.canaryClientSetHash !== 'string' ||
+        typeof result.canaryClientCount !== 'number' ||
+        typeof result.recoveryClientSetHash !== 'string' ||
+        typeof result.recoveryClientCount !== 'number' ||
+        (result.workosDefaultSince !== null && typeof result.workosDefaultSince !== 'string'))
+        throw new PlatformAuthMigrationError('idempotency_conflict');
+    return result;
+}
+export function assertSha(releaseSha) {
+    if (!/^[0-9a-f]{40}$/.test(releaseSha))
+        throw new PlatformAuthMigrationError('release_sha_mismatch');
+}
+export function hash(value) {
+    return createHash('sha256').update(JSON.stringify(value)).digest('hex');
+}
+function rolloutFinalizationEvidence(input) {
+    return input.operation === 'finalize'
+        ? {
+            rollbackRehearsalChecksum: input.rollbackRehearsalChecksum,
+            stagingWorkosOnlySmokeChecksum: input.stagingWorkosOnlySmokeChecksum,
+        }
+        : {
+            rollbackRehearsalChecksum: null,
+            stagingWorkosOnlySmokeChecksum: null,
+        };
+}
+function validChecksum(value) {
+    return /^[0-9a-f]{64}$/.test(value);
+}
+export function sorted(values) {
+    return [...new Set(values ?? [])].sort();
+}
+export function validLineageId(value) {
+    return value.trim() === value && value.length > 0 && value.length <= 256;
+}
+export function validRealm(value) {
+    return value.trim() === value && value.length > 0 && value.length <= 256;
+}
+export function validOperatorFingerprint(value) {
+    return value.length > 0 && value.length <= 256 && value.trim() === value;
+}
+function validClientId(value) {
+    return value.length > 0 && value.length <= 256 && value.trim() === value;
+}
+//# sourceMappingURL=platform-auth-rollout-support.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-rollout-support.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-rollout-support.js","sourceRoot":"","sources":["../src/platform-auth-rollout-support.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,0BAA0B,GAE3B,MAAM,8BAA8B,CAAC;AAyEtC,MAAM,UAAU,gBAAgB,CAAC,KAAmB,EAAE,KAAkB;IACtE,OAAO;QACL,GAAG,KAAK;QACR,eAAe,EACb,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;QACzF,iBAAiB,EACf,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC;KAC9F,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,oCAAoC,CAClD,KAAmB,EACnB,KAA2B;IAE3B,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,KAAK,CAAC,SAAS,KAAK,UAAU,IAAI,KAAK,CAAC,gBAAgB,KAAK,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAmB,EACnB,SAAoB,EACpB,OAAgB,EAChB,KAA2B;IAE3B,OAAO;QACL,KAAK;QACL,SAAS;QACT,OAAO,EAAE;YACP,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;YACpD,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;SACvD;QACD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,GAAG,2BAA2B,CAAC,KAAK,CAAC;KACtC,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,cAAc,CAC5B,OAWC,EACD,KAAqE;IAErE,MAAM,QAAQ,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACpD,OAAO,CACL,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,KAAK,CAAC,kBAAkB;QAChE,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QACrC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QACvC,OAAO,CAAC,sBAAsB,KAAK,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;QAC9D,OAAO,CAAC,mBAAmB,KAAK,KAAK,CAAC,eAAe,CAAC,MAAM;QAC5D,OAAO,CAAC,wBAAwB,KAAK,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAClE,OAAO,CAAC,qBAAqB,KAAK,KAAK,CAAC,iBAAiB,CAAC,MAAM;QAChE,OAAO,CAAC,2BAA2B,KAAK,QAAQ,CAAC,yBAAyB;QAC1E,OAAO,CAAC,kCAAkC,KAAK,QAAQ,CAAC,8BAA8B;QACtF,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,UAAU,CACzC,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,cAAc,CAC5B,OAMC,EACD,OAAgB;IAEhB,OAAO,CACL,OAAO,CAAC,kBAAkB,KAAK,OAAO,CAAC,gBAAgB;QACvD,OAAO,CAAC,eAAe,KAAK,OAAO,CAAC,aAAa;QACjD,OAAO,CAAC,kBAAkB,KAAK,OAAO,CAAC,iBAAiB;QACxD,OAAO,CAAC,uBAAuB,KAAK,OAAO,CAAC,qBAAqB;QACjE,OAAO,CAAC,wBAAwB,KAAK,OAAO,CAAC,sBAAsB,CACpE,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,kBAAkB,CAChC,KAAmB,EACnB,KAA2B,EAC3B,GAAS;IAET,MAAM,GAAG,GAAG,KAGX,CAAC;IACF,IACE,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU;QAC7B,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,yBAAyB,CAAC;YAC9C,CAAC,aAAa,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;QAC1D,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU;YAC7B,CAAC,GAAG,CAAC,yBAAyB,KAAK,SAAS;gBAC1C,GAAG,CAAC,8BAA8B,KAAK,SAAS,CAAC,CAAC;QAEtD,MAAM,IAAI,0BAA0B,CAAC,4BAA4B,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,CAAC;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,CAAC;IACzC,IACE,KAAK,CAAC,SAAS,KAAK,WAAW;QAC/B,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAEzC,MAAM,IAAI,0BAA0B,CAAC,4BAA4B,CAAC,CAAC;IACrE,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC;QACnC,KAAK,CAAC,UAAU,GAAG,CAAC;QACpB,KAAK,CAAC,UAAU,GAAG,GAAG;QACtB,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,gBAAgB,CAAC;QAC7E,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC;QAE1D,MAAM,IAAI,0BAA0B,CAAC,4BAA4B,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,gBAAgB;QAAE,OAAO;IAC1F,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;QAC7B,CAAC,CAAC,EAAE,CAAC,CAAC;QACN,CAAC,CAAC,EAAE,EAAE,CAAC;QACP,CAAC,EAAE,EAAE,EAAE,CAAC;QACR,CAAC,EAAE,EAAE,GAAG,CAAC;KACV,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/B,MAAM,UAAU,GACd,KAAK,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACpF,IACE,KAAK,CAAC,UAAU,KAAK,cAAc;QACnC,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC;YACzB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;QAEtF,MAAM,IAAI,0BAA0B,CAAC,4BAA4B,CAAC,CAAC;AACvE,CAAC;AACD,MAAM,UAAU,gBAAgB,CAC9B,KAAmB,EACnB,KAA2B,EAC3B,SAAoB,EACpB,eAAwB,EACxB,GAAS;IAET,IACE,KAAK,CAAC,gBAAgB,KAAK,GAAG;QAC9B,KAAK,CAAC,UAAU,KAAK,GAAG;QACxB,SAAS,CAAC,iBAAiB,KAAK,CAAC;QACjC,SAAS,CAAC,aAAa,KAAK,CAAC;QAC7B,SAAS,CAAC,UAAU,KAAK,CAAC;QAC1B,SAAS,CAAC,iBAAiB,KAAK,CAAC;QACjC,KAAK,CAAC,kBAAkB,KAAK,IAAI;QACjC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK;QAChF,CAAC,eAAe;QAEhB,MAAM,IAAI,0BAA0B,CAAC,8BAA8B,CAAC,CAAC;AACzE,CAAC;AACD,MAAM,UAAU,SAAS,CACvB,KAAmB,EACnB,KAA2B,EAC3B,GAAS;IAET,MAAM,eAAe,GACnB,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IACjF,MAAM,iBAAiB,GACrB,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;IACrF,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,CAAC;QAChC,gBAAgB,EAAE,KAAK,CAAC,UAAU;QAClC,eAAe;QACf,iBAAiB;QACjB,gBAAgB,EACd,KAAK,CAAC,SAAS,KAAK,UAAU;YAC5B,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,gBAAgB;gBAC3E,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE;gBACnB,CAAC,CAAC,KAAK,CAAC,gBAAgB;QAC9B,kBAAkB,EAChB,KAAK,CAAC,SAAS,KAAK,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG;YACtD,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACrD,qBAAqB,EACnB,KAAK,CAAC,SAAS,KAAK,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG;YACxD,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC;gBAC5D,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,KAAK,CAAC,qBAAqB;QACnC,SAAS,EACP,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;KAC9F,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,SAAS,CAAC,KAAmB;IAC3C,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;QAChD,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC,MAAM;QAC/C,qBAAqB,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;QACpD,mBAAmB,EAAE,KAAK,CAAC,iBAAiB,CAAC,MAAM;QACnD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAC7C,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,KAA+C,CAAC;IAC/D,IACE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QACrC,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ;QAC3C,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ;YAC5B,MAAM,CAAC,SAAS,KAAK,QAAQ;YAC7B,MAAM,CAAC,SAAS,KAAK,WAAW,CAAC;QACnC,OAAO,MAAM,CAAC,mBAAmB,KAAK,QAAQ;QAC9C,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ;QAC5C,OAAO,MAAM,CAAC,qBAAqB,KAAK,QAAQ;QAChD,OAAO,MAAM,CAAC,mBAAmB,KAAK,QAAQ;QAC9C,CAAC,MAAM,CAAC,kBAAkB,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,CAAC;QAErF,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;IAC/D,OAAO,MAAuC,CAAC;AACjD,CAAC;AACD,MAAM,UAAU,SAAS,CAAC,UAAkB;IAC1C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC;QACpC,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;AACjE,CAAC;AACD,MAAM,UAAU,IAAI,CAAC,KAAc;IACjC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,2BAA2B,CAAC,KAA2B;IAI9D,OAAO,KAAK,CAAC,SAAS,KAAK,UAAU;QACnC,CAAC,CAAC;YACE,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;YAC1D,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;SACrE;QACH,CAAC,CAAC;YACE,yBAAyB,EAAE,IAAI;YAC/B,8BAA8B,EAAE,IAAI;SACrC,CAAC;AACR,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AACD,MAAM,UAAU,MAAM,CAAC,MAAqC;IAC1D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC;AAC3E,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC;AAC3E,CAAC;AACD,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC;AAC3E,CAAC;AACD,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC;AAC3E,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-runtime.d.ts

@@ -0,0 +1,36 @@
+import type { Pool } from 'pg';
+import { WorkOSEventProcessor, type WorkOSEventsClient } from './oauth/workos-events.js';
+import { type PlatformAuthDirectory } from './platform-auth-migration.js';
+import { PostgresPlatformAuthOperator } from './platform-auth-operator-postgres.js';
+import { type PlatformIdentitySyncDirectory, PlatformIdentitySyncProcessor } from './platform-identity-sync.js';
+export interface PostgresPlatformAuthRuntime {
+    readonly operator: PostgresPlatformAuthOperator;
+    readonly outboxProcessor: PlatformIdentitySyncProcessor;
+    readonly eventsProcessor: WorkOSEventProcessor;
+}
+/** Leave the migration runtime dormant until the complete WorkOS configuration is present. */
+export declare function createConfiguredPostgresPlatformAuthRuntime(input: {
+    readonly pool: Pool;
+    readonly releaseSha: string;
+    readonly workos: {
+        readonly apiKey?: string;
+        readonly clientId?: string;
+        readonly realm?: string;
+    } | undefined;
+    readonly workloadSubjects: readonly string[] | undefined;
+}): Promise<PostgresPlatformAuthRuntime | undefined>;
+/** Builds the durable migration/control runtime once the ordinary Postgres schemas already exist. */
+export declare function createPostgresPlatformAuthRuntime(input: {
+    readonly pool: Pool;
+    readonly releaseSha: string;
+    readonly workos: {
+        readonly apiKey: string;
+        readonly clientId: string;
+        readonly realm: string;
+    };
+    readonly workloadSubjects?: readonly string[];
+    readonly syntheticSubjects?: readonly string[];
+    readonly directory?: PlatformAuthDirectory & PlatformIdentitySyncDirectory;
+    readonly eventsClient?: WorkOSEventsClient;
+}): Promise<PostgresPlatformAuthRuntime>;
+//# sourceMappingURL=platform-auth-runtime.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-runtime.d.ts","sourceRoot":"","sources":["../src/platform-auth-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,EAEL,oBAAoB,EACpB,KAAK,kBAAkB,EAExB,MAAM,0BAA0B,CAAC;AAMlC,OAAO,EACL,KAAK,qBAAqB,EAE3B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAKpF,OAAO,EACL,KAAK,6BAA6B,EAClC,6BAA6B,EAC9B,MAAM,6BAA6B,CAAC;AAKrC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;IAChD,QAAQ,CAAC,eAAe,EAAE,6BAA6B,CAAC;IACxD,QAAQ,CAAC,eAAe,EAAE,oBAAoB,CAAC;CAChD;AAED,8FAA8F;AAC9F,wBAAgB,2CAA2C,CAAC,KAAK,EAAE;IACjE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EACX;QACE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,GACD,SAAS,CAAC;IACd,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAC1D,GAAG,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAWnD;AAED,qGAAqG;AACrG,wBAAsB,iCAAiC,CAAC,KAAK,EAAE;IAC7D,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAChG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,GAAG,6BAA6B,CAAC;IAC3E,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;CAC5C,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAiEvC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-runtime.js

@@ -0,0 +1,93 @@
+import { PostgresWorkOSIdentityEventStore, WorkOSEventProcessor, WorkOSEventsSdkClient, } from './oauth/workos-events.js';
+import { PLATFORM_AUTH_INVENTORY_SOURCES, PostgresPlatformAuthInventoryStore, } from './platform-auth-inventory-postgres.js';
+import { PlatformAuthImportService, } from './platform-auth-migration.js';
+import { PostgresPlatformAuthMigrationStore } from './platform-auth-migration-postgres.js';
+import { PostgresPlatformAuthOperator } from './platform-auth-operator-postgres.js';
+import { ensurePlatformAuthOperatorSchema } from './platform-auth-operator-schema.js';
+import { WorkOSLinkedCandidateVerificationWorker } from './platform-auth-remote-verification.js';
+import { PostgresPlatformAuthRemoteVerificationStore } from './platform-auth-remote-verification-postgres.js';
+import { PostgresPlatformAuthRolloutStore } from './platform-auth-rollout-postgres.js';
+import { PlatformIdentitySyncProcessor, } from './platform-identity-sync.js';
+import { PostgresPlatformIdentitySyncStore } from './platform-identity-sync-postgres.js';
+import { PostgresPlatformIdentitySyncRecoveryStore } from './platform-identity-sync-recovery-postgres.js';
+import { WorkOSDirectoryAdapter } from './workos-directory.js';
+/** Leave the migration runtime dormant until the complete WorkOS configuration is present. */
+export function createConfiguredPostgresPlatformAuthRuntime(input) {
+    const { workos } = input;
+    if (workos?.apiKey === undefined || workos.clientId === undefined || workos.realm === undefined) {
+        return Promise.resolve(undefined);
+    }
+    return createPostgresPlatformAuthRuntime({
+        pool: input.pool,
+        releaseSha: input.releaseSha,
+        workos: { apiKey: workos.apiKey, clientId: workos.clientId, realm: workos.realm },
+        workloadSubjects: input.workloadSubjects ?? [],
+    });
+}
+/** Builds the durable migration/control runtime once the ordinary Postgres schemas already exist. */
+export async function createPostgresPlatformAuthRuntime(input) {
+    if (!/^[0-9a-f]{40}$/.test(input.releaseSha)) {
+        throw new Error('WorkOS platform-auth runtime requires an exact release SHA');
+    }
+    await ensurePlatformAuthOperatorSchema(input.pool);
+    const directory = input.directory ??
+        WorkOSDirectoryAdapter.fromApiKey(input.workos.apiKey, input.workos.clientId);
+    const outboxProcessor = new PlatformIdentitySyncProcessor({
+        store: new PostgresPlatformIdentitySyncStore(input.pool, { workosRealm: input.workos.realm }),
+        directory,
+    });
+    const eventsProcessor = new WorkOSEventProcessor({
+        client: input.eventsClient ?? new WorkOSEventsSdkClient(input.workos.apiKey),
+        store: new PostgresWorkOSIdentityEventStore(input.pool),
+        realm: input.workos.realm,
+    });
+    const migrationStore = new PostgresPlatformAuthMigrationStore(input.pool);
+    const remoteVerificationStore = new PostgresPlatformAuthRemoteVerificationStore(input.pool);
+    const remoteVerificationWorker = new WorkOSLinkedCandidateVerificationWorker(remoteVerificationStore, directory);
+    const operator = new PostgresPlatformAuthOperator({
+        pool: input.pool,
+        inventoryStore: new PostgresPlatformAuthInventoryStore(input.pool, {
+            workosRealm: input.workos.realm,
+            workosPageSource: {
+                listPage: async (page) => {
+                    if (directory.listInventoryPage === undefined) {
+                        throw new Error('WorkOS directory does not support paged inventory snapshots');
+                    }
+                    return directory.listInventoryPage(page);
+                },
+            },
+            sourceAvailability: configuredInventorySources(),
+            excludedSubjects: [
+                ...(input.workloadSubjects ?? []).map((subject) => ({
+                    subject,
+                    kind: 'workload',
+                })),
+                ...(input.syntheticSubjects ?? []).map((subject) => ({
+                    subject,
+                    kind: 'synthetic',
+                })),
+            ],
+        }),
+        migrationStore,
+        importService: new PlatformAuthImportService(migrationStore, directory),
+        rolloutStore: new PostgresPlatformAuthRolloutStore(input.pool, {
+            buildInfo: { version: 'runtime', gitSha: input.releaseSha, buildTime: 'runtime' },
+            workos: { clientId: input.workos.clientId, realm: input.workos.realm },
+            remoteVerificationStore,
+        }),
+        releaseSha: input.releaseSha,
+        workosRealm: input.workos.realm,
+        outboxProcessor,
+        outboxRecoveryStore: new PostgresPlatformIdentitySyncRecoveryStore(input.pool, {
+            workosRealm: input.workos.realm,
+        }),
+        eventsProcessor,
+        remoteVerificationWorker,
+        remoteVerificationStore,
+    });
+    return { operator, outboxProcessor, eventsProcessor };
+}
+function configuredInventorySources() {
+    return Object.fromEntries(PLATFORM_AUTH_INVENTORY_SOURCES.map((source) => [source, 'configured']));
+}
+//# sourceMappingURL=platform-auth-runtime.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-runtime.js","sourceRoot":"","sources":["../src/platform-auth-runtime.ts"],"names":[],"mappings":"AACA,OAAO,EACL,gCAAgC,EAChC,oBAAoB,EAEpB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,+BAA+B,EAE/B,kCAAkC,GACnC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAEL,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kCAAkC,EAAE,MAAM,uCAAuC,CAAC;AAC3F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,2CAA2C,EAAE,MAAM,iDAAiD,CAAC;AAC9G,OAAO,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,EAEL,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AACzF,OAAO,EAAE,yCAAyC,EAAE,MAAM,+CAA+C,CAAC;AAC1G,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAQ/D,8FAA8F;AAC9F,MAAM,UAAU,2CAA2C,CAAC,KAW3D;IACC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzB,IAAI,MAAM,EAAE,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChG,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,iCAAiC,CAAC;QACvC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE;QACjF,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,EAAE;KAC/C,CAAC,CAAC;AACL,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAQvD;IACC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,gCAAgC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,SAAS,GACb,KAAK,CAAC,SAAS;QACf,sBAAsB,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChF,MAAM,eAAe,GAAG,IAAI,6BAA6B,CAAC;QACxD,KAAK,EAAE,IAAI,iCAAiC,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7F,SAAS;KACV,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,IAAI,oBAAoB,CAAC;QAC/C,MAAM,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;QAC5E,KAAK,EAAE,IAAI,gCAAgC,CAAC,KAAK,CAAC,IAAI,CAAC;QACvD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;KAC1B,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,IAAI,kCAAkC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1E,MAAM,uBAAuB,GAAG,IAAI,2CAA2C,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5F,MAAM,wBAAwB,GAAG,IAAI,uCAAuC,CAC1E,uBAAuB,EACvB,SAAS,CACV,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,4BAA4B,CAAC;QAChD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,cAAc,EAAE,IAAI,kCAAkC,CAAC,KAAK,CAAC,IAAI,EAAE;YACjE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;YAC/B,gBAAgB,EAAE;gBAChB,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;oBACvB,IAAI,SAAS,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;wBAC9C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;oBACjF,CAAC;oBACD,OAAO,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBAC3C,CAAC;aACF;YACD,kBAAkB,EAAE,0BAA0B,EAAE;YAChD,gBAAgB,EAAE;gBAChB,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBAClD,OAAO;oBACP,IAAI,EAAE,UAAmB;iBAC1B,CAAC,CAAC;gBACH,GAAG,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBACnD,OAAO;oBACP,IAAI,EAAE,WAAoB;iBAC3B,CAAC,CAAC;aACJ;SACF,CAAC;QACF,cAAc;QACd,aAAa,EAAE,IAAI,yBAAyB,CAAC,cAAc,EAAE,SAAS,CAAC;QACvE,YAAY,EAAE,IAAI,gCAAgC,CAAC,KAAK,CAAC,IAAI,EAAE;YAC7D,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE;YACjF,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE;YACtE,uBAAuB;SACxB,CAAC;QACF,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;QAC/B,eAAe;QACf,mBAAmB,EAAE,IAAI,yCAAyC,CAAC,KAAK,CAAC,IAAI,EAAE;YAC7E,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;SAChC,CAAC;QACF,eAAe;QACf,wBAAwB;QACxB,uBAAuB;KACxB,CAAC,CAAC;IACH,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,0BAA0B;IACjC,OAAO,MAAM,CAAC,WAAW,CACvB,+BAA+B,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,YAAY,CAAU,CAAC,CAC1C,CAAC;AAC3C,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-service-bootstrap.d.ts

@@ -0,0 +1,32 @@
+import type { Pool } from 'pg';
+import { type DurableUpstreamHumanRollout, type UpstreamHumanRolloutStore } from './oauth/upstream-rollout-store.js';
+import type { PlatformAuthOperator } from './platform-auth-operator.js';
+import { type PostgresPlatformAuthRuntime } from './platform-auth-runtime.js';
+export interface PlatformAuthServiceBootstrap {
+    readonly operator?: PlatformAuthOperator;
+    readonly runtime?: PostgresPlatformAuthRuntime;
+    readonly rolloutStore?: UpstreamHumanRolloutStore;
+    readonly assertContinuity?: () => Promise<void>;
+}
+/** A WorkOS-only process may start only when every new authorization deterministically selects WorkOS. */
+export declare function assertWorkOSOnlyContinuity(input: {
+    readonly googleHumanAuthAvailable: boolean;
+    readonly workosHumanAuthAvailable: boolean;
+    readonly durablePlatformIdentityAvailable: boolean;
+    readonly rollout?: DurableUpstreamHumanRollout;
+}): void;
+/** Resolve the durable WorkOS migration runtime before any HTTP listener can be created. */
+export declare function resolvePlatformAuthServiceBootstrap(input: {
+    readonly pool?: Pool;
+    readonly releaseSha: string;
+    readonly workos: {
+        readonly apiKey?: string;
+        readonly clientId?: string;
+        readonly realm?: string;
+    } | undefined;
+    readonly workloadSubjects: readonly string[] | undefined;
+    readonly googleHumanAuthAvailable: boolean;
+    readonly durablePlatformIdentityAvailable: boolean;
+    readonly configuredOperator?: PlatformAuthOperator;
+}): Promise<PlatformAuthServiceBootstrap>;
+//# sourceMappingURL=platform-auth-service-bootstrap.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-service-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-service-bootstrap.d.ts","sourceRoot":"","sources":["../src/platform-auth-service-bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,EACL,KAAK,2BAA2B,EAEhC,KAAK,yBAAyB,EAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAExE,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,4BAA4B,CAAC;AAEpC,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,2BAA2B,CAAC;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,yBAAyB,CAAC;IAClD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED,0GAA0G;AAC1G,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,gCAAgC,EAAE,OAAO,CAAC;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,2BAA2B,CAAC;CAChD,GAAG,IAAI,CAQP;AAED,4FAA4F;AAC5F,wBAAsB,mCAAmC,CAAC,KAAK,EAAE;IAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EACX;QACE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,GACD,SAAS,CAAC;IACd,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,gCAAgC,EAAE,OAAO,CAAC;IACnD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;CACpD,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAuDxC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-service-bootstrap.js

@@ -0,0 +1,68 @@
+import { PostgresUpstreamHumanRolloutStore, } from './oauth/upstream-rollout-store.js';
+import { guardPlatformAuthRollback } from './platform-auth-rollback-guard.js';
+import { createConfiguredPostgresPlatformAuthRuntime, } from './platform-auth-runtime.js';
+/** A WorkOS-only process may start only when every new authorization deterministically selects WorkOS. */
+export function assertWorkOSOnlyContinuity(input) {
+    if (input.googleHumanAuthAvailable || !input.workosHumanAuthAvailable)
+        return;
+    if (!input.durablePlatformIdentityAvailable) {
+        throw new Error('WorkOS-only OAuth requires durable Postgres identity and rollout state');
+    }
+    if (input.rollout?.workosPercentage !== 100 || input.rollout.lifecycle !== 'finalized') {
+        throw new Error('WorkOS-only OAuth requires a durable finalized 100% WorkOS rollout state');
+    }
+}
+/** Resolve the durable WorkOS migration runtime before any HTTP listener can be created. */
+export async function resolvePlatformAuthServiceBootstrap(input) {
+    const workosComplete = input.workos?.apiKey !== undefined &&
+        input.workos.clientId !== undefined &&
+        input.workos.realm !== undefined;
+    if (workosComplete &&
+        !input.googleHumanAuthAvailable &&
+        (input.pool === undefined || !input.durablePlatformIdentityAvailable)) {
+        throw new Error('WorkOS-only OAuth requires durable Postgres identity and rollout state');
+    }
+    if (input.pool === undefined) {
+        return input.configuredOperator === undefined
+            ? {}
+            : {
+                operator: guardPlatformAuthRollback(input.configuredOperator, {
+                    googleHumanAuthAvailable: input.googleHumanAuthAvailable,
+                }),
+            };
+    }
+    const runtime = await createConfiguredPostgresPlatformAuthRuntime({
+        pool: input.pool,
+        releaseSha: input.releaseSha,
+        workos: input.workos,
+        workloadSubjects: input.workloadSubjects,
+    });
+    const rolloutStore = new PostgresUpstreamHumanRolloutStore(input.pool, {
+        ...(workosComplete
+            ? { workos: { clientId: input.workos.clientId, realm: input.workos.realm } }
+            : {}),
+    });
+    const assertContinuity = async () => {
+        const rollout = await rolloutStore.get();
+        assertWorkOSOnlyContinuity({
+            googleHumanAuthAvailable: input.googleHumanAuthAvailable,
+            workosHumanAuthAvailable: workosComplete,
+            durablePlatformIdentityAvailable: input.durablePlatformIdentityAvailable,
+            rollout,
+        });
+    };
+    await assertContinuity();
+    const resolvedOperator = input.configuredOperator ?? runtime?.operator;
+    const operator = resolvedOperator === undefined
+        ? undefined
+        : guardPlatformAuthRollback(resolvedOperator, {
+            googleHumanAuthAvailable: input.googleHumanAuthAvailable,
+        });
+    return {
+        rolloutStore,
+        assertContinuity,
+        ...(operator === undefined ? {} : { operator }),
+        ...(runtime === undefined ? {} : { runtime }),
+    };
+}
+//# sourceMappingURL=platform-auth-service-bootstrap.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-service-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-service-bootstrap.js","sourceRoot":"","sources":["../src/platform-auth-service-bootstrap.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,iCAAiC,GAElC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EACL,2CAA2C,GAE5C,MAAM,4BAA4B,CAAC;AASpC,0GAA0G;AAC1G,MAAM,UAAU,0BAA0B,CAAC,KAK1C;IACC,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,KAAK,CAAC,wBAAwB;QAAE,OAAO;IAC9E,IAAI,CAAC,KAAK,CAAC,gCAAgC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,EAAE,gBAAgB,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAczD;IACC,MAAM,cAAc,GAClB,KAAK,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS;QAClC,KAAK,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS;QACnC,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC;IACnC,IACE,cAAc;QACd,CAAC,KAAK,CAAC,wBAAwB;QAC/B,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,gCAAgC,CAAC,EACrE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC,kBAAkB,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,QAAQ,EAAE,yBAAyB,CAAC,KAAK,CAAC,kBAAkB,EAAE;oBAC5D,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;iBACzD,CAAC;aACH,CAAC;IACR,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,2CAA2C,CAAC;QAChE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,iCAAiC,CAAC,KAAK,CAAC,IAAI,EAAE;QACrE,GAAG,CAAC,cAAc;YAChB,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE;YAC5E,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,KAAK,IAAI,EAAE;QAClC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC;QACzC,0BAA0B,CAAC;YACzB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,wBAAwB,EAAE,cAAc;YACxC,gCAAgC,EAAE,KAAK,CAAC,gCAAgC;YACxE,OAAO;SACR,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,gBAAgB,EAAE,CAAC;IACzB,MAAM,gBAAgB,GAAG,KAAK,CAAC,kBAAkB,IAAI,OAAO,EAAE,QAAQ,CAAC;IACvE,MAAM,QAAQ,GACZ,gBAAgB,KAAK,SAAS;QAC5B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,yBAAyB,CAAC,gBAAgB,EAAE;YAC1C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;SACzD,CAAC,CAAC;IACT,OAAO;QACL,YAAY;QACZ,gBAAgB;QAChB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-identity-maintenance.d.ts

@@ -0,0 +1,36 @@
+import { type Logger } from '@noodle-borg/transport-http';
+import type { PlatformIdentitySyncBatchResult } from './platform-identity-sync.js';
+export declare const PLATFORM_IDENTITY_MAINTENANCE_INTERVAL_MS = 30000;
+export interface PlatformIdentityMaintenanceSync {
+    processOnce(limit?: number): Promise<PlatformIdentitySyncBatchResult>;
+}
+export interface PlatformIdentityMaintenanceEvents {
+    processOnce(): Promise<{
+        readonly processed: number;
+        readonly cursor?: string;
+    }>;
+}
+export interface PlatformIdentityMaintenanceReadiness {
+    markMaintenanceSuccess(components: readonly ('outbox' | 'events')[]): Promise<void>;
+}
+/** Single-flight maintenance sweep. Logs are aggregate-only by construction. */
+export declare class PlatformIdentityMaintenanceWorker {
+    #private;
+    constructor(input: {
+        readonly sync?: PlatformIdentityMaintenanceSync;
+        readonly events?: PlatformIdentityMaintenanceEvents;
+        readonly readiness?: PlatformIdentityMaintenanceReadiness;
+        readonly logger?: Logger;
+        readonly batchSize?: number;
+    });
+    runOnce(): Promise<void>;
+}
+export declare function startPlatformIdentityMaintenanceWorker(input: {
+    readonly sync?: PlatformIdentityMaintenanceSync;
+    readonly events?: PlatformIdentityMaintenanceEvents;
+    readonly readiness?: PlatformIdentityMaintenanceReadiness;
+    readonly logger?: Logger;
+    readonly batchSize?: number;
+    readonly intervalMs?: number;
+}): NodeJS.Timeout;
+//# sourceMappingURL=platform-identity-maintenance.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-identity-maintenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-identity-maintenance.d.ts","sourceRoot":"","sources":["../src/platform-identity-maintenance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAc,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAEnF,eAAO,MAAM,yCAAyC,QAAS,CAAC;AAEhE,MAAM,WAAW,+BAA+B;IAC9C,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,iCAAiC;IAChD,WAAW,IAAI,OAAO,CAAC;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClF;AAED,MAAM,WAAW,oCAAoC;IACnD,sBAAsB,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrF;AAED,gFAAgF;AAChF,qBAAa,iCAAiC;;gBAQhC,KAAK,EAAE;QACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,+BAA+B,CAAC;QAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,iCAAiC,CAAC;QACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,oCAAoC,CAAC;QAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B;IAWK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAuD/B;AAED,wBAAgB,sCAAsC,CAAC,KAAK,EAAE;IAC5D,QAAQ,CAAC,IAAI,CAAC,EAAE,+BAA+B,CAAC;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,iCAAiC,CAAC;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,oCAAoC,CAAC;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,GAAG,MAAM,CAAC,OAAO,CASjB"}