@noodleseed/one 0.63.0 → 0.64.0

package/node_modules/@noodle-borg/service/dist/platform-identity-maintenance.js

@@ -0,0 +1,92 @@
+import { noopLogger } from '@noodle-borg/transport-http';
+export const PLATFORM_IDENTITY_MAINTENANCE_INTERVAL_MS = 30_000;
+/** Single-flight maintenance sweep. Logs are aggregate-only by construction. */
+export class PlatformIdentityMaintenanceWorker {
+    #sync;
+    #events;
+    #logger;
+    #readiness;
+    #batchSize;
+    #running = false;
+    constructor(input) {
+        const batchSize = input.batchSize ?? 25;
+        if (!Number.isInteger(batchSize) || batchSize < 1 || batchSize > 100)
+            throw new Error('identity maintenance batch size must be between 1 and 100');
+        this.#sync = input.sync;
+        this.#events = input.events;
+        this.#readiness = input.readiness;
+        this.#logger = input.logger ?? noopLogger;
+        this.#batchSize = batchSize;
+    }
+    async runOnce() {
+        if (this.#running)
+            return;
+        this.#running = true;
+        let sync = {
+            attempted: 0,
+            delivered: 0,
+            blocked: 0,
+            retryRequired: 0,
+        };
+        let eventsProcessed = 0;
+        const successfulComponents = [];
+        try {
+            if (this.#sync !== undefined) {
+                try {
+                    sync = await this.#sync.processOnce(this.#batchSize);
+                    successfulComponents.push('outbox');
+                }
+                catch {
+                    this.#logger.warn('platform_identity.sync_failed', {
+                        component: 'outbox',
+                        outcome: 'failed',
+                    });
+                }
+            }
+            if (this.#events !== undefined) {
+                try {
+                    eventsProcessed = (await this.#events.processOnce()).processed;
+                    successfulComponents.push('events');
+                }
+                catch {
+                    this.#logger.warn('platform_identity.sync_failed', {
+                        component: 'events',
+                        outcome: 'failed',
+                    });
+                }
+            }
+            if (this.#readiness !== undefined && successfulComponents.length > 0) {
+                try {
+                    await this.#readiness.markMaintenanceSuccess(successfulComponents);
+                }
+                catch {
+                    this.#logger.warn('platform_identity.readiness_failed', {
+                        component: 'heartbeat',
+                        outcome: 'failed',
+                    });
+                }
+            }
+            this.#logger.info('platform_identity.maintenance_completed', {
+                syncAttempted: sync.attempted,
+                syncDelivered: sync.delivered,
+                syncBlocked: sync.blocked,
+                syncRetryRequired: sync.retryRequired,
+                eventsProcessed,
+            });
+        }
+        finally {
+            this.#running = false;
+        }
+    }
+}
+export function startPlatformIdentityMaintenanceWorker(input) {
+    const intervalMs = input.intervalMs ?? PLATFORM_IDENTITY_MAINTENANCE_INTERVAL_MS;
+    if (!Number.isInteger(intervalMs) || intervalMs < 1_000)
+        throw new Error('identity maintenance interval must be at least one second');
+    const worker = new PlatformIdentityMaintenanceWorker(input);
+    void worker.runOnce();
+    const timer = setInterval(() => void worker.runOnce(), intervalMs);
+    timer.unref?.();
+    return timer;
+}
+//# sourceMappingURL=platform-identity-maintenance.js.map

package/node_modules/@noodle-borg/service/dist/platform-identity-maintenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-identity-maintenance.js","sourceRoot":"","sources":["../src/platform-identity-maintenance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAGtE,MAAM,CAAC,MAAM,yCAAyC,GAAG,MAAM,CAAC;AAchE,gFAAgF;AAChF,MAAM,OAAO,iCAAiC;IACnC,KAAK,CAA8C;IACnD,OAAO,CAAgD;IACvD,OAAO,CAAS;IAChB,UAAU,CAAmD;IAC7D,UAAU,CAAS;IAC5B,QAAQ,GAAG,KAAK,CAAC;IAEjB,YAAY,KAMX;QACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,GAAG;YAClE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,IAAI,GAAoC;YAC1C,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,CAAC;YACV,aAAa,EAAE,CAAC;SACjB,CAAC;QACF,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,MAAM,oBAAoB,GAA4B,EAAE,CAAC;QACzD,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACH,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBACrD,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACtC,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,+BAA+B,EAAE;wBACjD,SAAS,EAAE,QAAQ;wBACnB,OAAO,EAAE,QAAQ;qBAClB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,eAAe,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC;oBAC/D,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACtC,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,+BAA+B,EAAE;wBACjD,SAAS,EAAE,QAAQ;wBACnB,OAAO,EAAE,QAAQ;qBAClB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrE,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,CAAC;gBACrE,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE;wBACtD,SAAS,EAAE,WAAW;wBACtB,OAAO,EAAE,QAAQ;qBAClB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,yCAAyC,EAAE;gBAC3D,aAAa,EAAE,IAAI,CAAC,SAAS;gBAC7B,aAAa,EAAE,IAAI,CAAC,SAAS;gBAC7B,WAAW,EAAE,IAAI,CAAC,OAAO;gBACzB,iBAAiB,EAAE,IAAI,CAAC,aAAa;gBACrC,eAAe;aAChB,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CAAC,KAOtD;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,yCAAyC,CAAC;IACjF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,KAAK;QACrD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,IAAI,iCAAiC,CAAC,KAAK,CAAC,CAAC;IAC5D,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;IACnE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,OAAO,KAAK,CAAC;AACf,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-identity-postgres.d.ts

@@ -0,0 +1,23 @@
+import { type PlatformIdentityLink, type PlatformIdentityStore, type ResolvedPlatformIdentity, type UpstreamHumanIdentity } from './platform-identity.js';
+import { type PlatformIdentityQueryable } from './platform-identity-schema-postgres.js';
+export { ensurePlatformIdentitySchema, type PlatformIdentityQueryable, } from './platform-identity-schema-postgres.js';
+/** Durable Postgres implementation. It serializes link/email decisions inside one short transaction. */
+export declare class PostgresPlatformIdentityStore implements PlatformIdentityStore {
+    #private;
+    constructor(pool: PlatformIdentityQueryable & {
+        connect?: () => Promise<PlatformIdentityQueryable & {
+            release?: () => void;
+        }>;
+    }, options?: {
+        readonly now?: () => Date;
+    });
+    ensureSchema(): Promise<void>;
+    resolve(input: UpstreamHumanIdentity): Promise<ResolvedPlatformIdentity>;
+    resolveLinked(input: UpstreamHumanIdentity): Promise<ResolvedPlatformIdentity | undefined>;
+    hasVerifiedEmailEvidence(email: string): Promise<boolean>;
+    suspendPrincipal(principalId: string): Promise<void>;
+    assertActive(principalId: string): Promise<void>;
+    resolveExisting(principalId: string): Promise<ResolvedPlatformIdentity | undefined>;
+    listIdentityLinks(principalId: string): Promise<readonly PlatformIdentityLink[]>;
+}
+//# sourceMappingURL=platform-identity-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-identity-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-identity-postgres.d.ts","sourceRoot":"","sources":["../src/platform-identity-postgres.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAE1B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EACL,4BAA4B,EAC5B,KAAK,yBAAyB,GAC/B,MAAM,wCAAwC,CAAC;AAEhD,wGAAwG;AACxG,qBAAa,6BAA8B,YAAW,qBAAqB;;gBAOvE,IAAI,EAAE,yBAAyB,GAAG;QAChC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,yBAAyB,GAAG;YAAE,OAAO,CAAC,EAAE,MAAM,IAAI,CAAA;SAAE,CAAC,CAAC;KAC/E,EACD,OAAO,GAAE;QAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;KAAO;IAM7C,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAIvB,OAAO,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IA+GxE,aAAa,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAqB1F,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQzD,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqCpD,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAShD,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAanF,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC;CAkDvF"}

package/node_modules/@noodle-borg/service/dist/platform-identity-postgres.js

@@ -0,0 +1,231 @@
+import { randomUUID } from 'node:crypto';
+import { GOOGLE_PLATFORM_IDENTITY_ISSUER, normalizePlatformIdentityEmail, PLATFORM_PRINCIPAL_BILLING_ISSUER, PlatformIdentityError, } from './platform-identity.js';
+import { ensurePlatformIdentitySchema, } from './platform-identity-schema-postgres.js';
+import { enqueueGoogleIdentitySync, enqueueVerifiedEmailChanged, enqueueWorkOSExternalIdReconcile, } from './platform-identity-sync-enqueue.js';
+export { ensurePlatformIdentitySchema, } from './platform-identity-schema-postgres.js';
+/** Durable Postgres implementation. It serializes link/email decisions inside one short transaction. */
+export class PostgresPlatformIdentityStore {
+    #pool;
+    #now;
+    constructor(pool, options = {}) {
+        this.#pool = pool;
+        this.#now = options.now ?? (() => new Date());
+    }
+    ensureSchema() {
+        return ensurePlatformIdentitySchema(this.#pool);
+    }
+    async resolve(input) {
+        if (!input.emailVerified)
+            throw new PlatformIdentityError('identity_email_unverified');
+        const provider = validatedPart('provider', input.provider);
+        const realm = validatedPart('realm', input.realm);
+        const externalId = validatedPart('subject', input.subject);
+        const originalEmail = input.email;
+        const email = normalizePlatformIdentityEmail(originalEmail);
+        const connection = this.#pool.connect === undefined ? this.#pool : await this.#pool.connect();
+        try {
+            await connection.query('BEGIN');
+            await connection.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [
+                `platform-identity:${JSON.stringify([provider, realm, externalId])}`,
+            ]);
+            await connection.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [
+                `platform-email:${email}`,
+            ]);
+            const existing = await connection.query(`SELECT p.principal_id, p.status, p.billing_identity_issuer, p.billing_subject, p.created_at,
+                l.disabled_at
+         FROM platform_identity_links l
+         JOIN platform_principals p ON p.principal_id = l.principal_id
+         WHERE l.provider = $1 AND l.realm = $2 AND l.external_id = $3`, [provider, realm, externalId]);
+            if (existing.rows[0] !== undefined) {
+                if (existing.rows[0].disabled_at !== null) {
+                    throw new PlatformIdentityError('identity_link_disabled');
+                }
+                const principal = principalFromRow(existing.rows[0]);
+                if (principal.status !== 'active')
+                    throw new PlatformIdentityError('principal_suspended');
+                const emailChanged = await this.#recordEmail(connection, principal.id, originalEmail, email, provider, realm);
+                // Google is authoritative while the dual-write bridge is active. A WorkOS callback must update
+                // local evidence without echoing the same change back into WorkOS, where legacy Google evidence can
+                // make that outbox item permanently ambiguous.
+                if (emailChanged && provider === 'google') {
+                    const transitionId = randomUUID();
+                    const createdAt = this.#now().toISOString();
+                    await enqueueGoogleIdentitySync(connection, {
+                        principalId: principal.id,
+                        transitionId,
+                        createdAt,
+                    });
+                    await enqueueVerifiedEmailChanged(connection, {
+                        principalId: principal.id,
+                        transitionId,
+                        createdAt,
+                    });
+                }
+                await connection.query('COMMIT');
+                return { subject: principal.id, billingIdentity: principal.billingIdentity };
+            }
+            if (provider !== 'google') {
+                const collision = await connection.query('SELECT 1 FROM platform_verified_emails WHERE normalized_email = $1 LIMIT 1', [email]);
+                if (collision.rows.length > 0)
+                    throw new PlatformIdentityError('identity_link_required');
+            }
+            const id = provider === 'google' ? externalId : `usr_${randomUUID()}`;
+            const billingIdentity = provider === 'google'
+                ? { identityIssuer: GOOGLE_PLATFORM_IDENTITY_ISSUER, subject: externalId }
+                : { identityIssuer: PLATFORM_PRINCIPAL_BILLING_ISSUER, subject: id };
+            await connection.query(`INSERT INTO platform_principals
+           (principal_id, status, billing_identity_issuer, billing_subject, created_at)
+         VALUES ($1, 'active', $2, $3, $4)
+         ON CONFLICT (principal_id) DO NOTHING`, [id, billingIdentity.identityIssuer, billingIdentity.subject, this.#now().toISOString()]);
+            const inserted = await connection.query(`INSERT INTO platform_identity_links (provider, realm, external_id, principal_id, created_at)
+         VALUES ($1, $2, $3, $4, $5)
+         ON CONFLICT (provider, realm, external_id) DO NOTHING
+         RETURNING principal_id`, [provider, realm, externalId, id, this.#now().toISOString()]);
+            if (inserted.rows.length === 0) {
+                throw new PlatformIdentityError('identity_link_remap_forbidden');
+            }
+            await this.#recordEmail(connection, id, originalEmail, email, provider, realm);
+            if (provider === 'google') {
+                await enqueueGoogleIdentitySync(connection, {
+                    principalId: id,
+                    transitionId: randomUUID(),
+                    createdAt: this.#now().toISOString(),
+                });
+            }
+            await enqueueWorkOSExternalIdReconcile(connection, {
+                principalId: id,
+                provider,
+                createdAt: this.#now().toISOString(),
+            });
+            await connection.query('COMMIT');
+            return { subject: id, billingIdentity };
+        }
+        catch (error) {
+            await connection.query('ROLLBACK').catch(() => undefined);
+            throw error;
+        }
+        finally {
+            connection.release?.();
+        }
+    }
+    async resolveLinked(input) {
+        if (!input.emailVerified)
+            throw new PlatformIdentityError('identity_email_unverified');
+        const provider = validatedPart('provider', input.provider);
+        const realm = validatedPart('realm', input.realm);
+        const externalId = validatedPart('subject', input.subject);
+        const result = await this.#pool.query(`SELECT p.principal_id, p.status, p.billing_identity_issuer, p.billing_subject, p.created_at,
+              l.disabled_at
+       FROM platform_identity_links l
+       JOIN platform_principals p ON p.principal_id = l.principal_id
+       WHERE l.provider = $1 AND l.realm = $2 AND l.external_id = $3`, [provider, realm, externalId]);
+        const row = result.rows[0];
+        if (row === undefined)
+            return undefined;
+        if (row.disabled_at !== null)
+            throw new PlatformIdentityError('identity_link_disabled');
+        const principal = principalFromRow(row);
+        if (principal.status !== 'active')
+            throw new PlatformIdentityError('principal_suspended');
+        return { subject: principal.id, billingIdentity: principal.billingIdentity };
+    }
+    async hasVerifiedEmailEvidence(email) {
+        const result = await this.#pool.query('SELECT 1 FROM platform_verified_emails WHERE normalized_email = $1 LIMIT 1', [normalizePlatformIdentityEmail(email)]);
+        return result.rows.length > 0;
+    }
+    async suspendPrincipal(principalId) {
+        const connection = this.#pool.connect === undefined ? this.#pool : await this.#pool.connect();
+        try {
+            await connection.query('BEGIN');
+            await connection.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [
+                `platform-principal:${principalId}`,
+            ]);
+            const changed = await connection.query(`UPDATE platform_principals
+         SET status = 'suspended', suspended_at = $2
+         WHERE principal_id = $1 AND status = 'active'
+         RETURNING principal_id`, [principalId, this.#now().toISOString()]);
+            if (changed.rows.length > 0) {
+                // OAuth is optional during additive rollout/rollback. `to_regclass` makes a pre-OAuth deployment
+                // safe while still revoking every non-customer family atomically when the table exists.
+                const relation = await connection.query("SELECT to_regclass('oauth_refresh_tokens')::text AS relation");
+                if (relation.rows[0]?.relation !== null) {
+                    await connection.query("DELETE FROM oauth_refresh_tokens WHERE owner_subject = $1 AND identity_kind IS DISTINCT FROM 'customer'", [principalId]);
+                }
+            }
+            await connection.query('COMMIT');
+        }
+        catch (error) {
+            await connection.query('ROLLBACK').catch(() => undefined);
+            throw error;
+        }
+        finally {
+            connection.release?.();
+        }
+    }
+    async assertActive(principalId) {
+        const rows = await this.#pool.query('SELECT status FROM platform_principals WHERE principal_id = $1', [principalId]);
+        if (rows.rows[0]?.status === 'suspended')
+            throw new PlatformIdentityError('principal_suspended');
+    }
+    async resolveExisting(principalId) {
+        const rows = await this.#pool.query(`SELECT principal_id, status, billing_identity_issuer, billing_subject, created_at
+       FROM platform_principals WHERE principal_id = $1`, [principalId]);
+        const row = rows.rows[0];
+        if (row === undefined)
+            return undefined;
+        const principal = principalFromRow(row);
+        if (principal.status === 'suspended')
+            throw new PlatformIdentityError('principal_suspended');
+        return { subject: principal.id, billingIdentity: principal.billingIdentity };
+    }
+    async listIdentityLinks(principalId) {
+        const rows = await this.#pool.query(`SELECT principal_id, provider, realm, external_id, created_at, disabled_at
+       FROM platform_identity_links WHERE principal_id = $1 ORDER BY created_at`, [principalId]);
+        return rows.rows.map((row) => ({
+            principalId: row.principal_id,
+            provider: row.provider,
+            realm: row.realm,
+            subject: row.external_id,
+            createdAt: toIsoTimestamp(row.created_at),
+            ...(row.disabled_at === null ? {} : { disabledAt: toIsoTimestamp(row.disabled_at) }),
+        }));
+    }
+    async #recordEmail(pool, principalId, originalEmail, normalizedEmail, provider, realm) {
+        // Each provider realm has exactly one current verified address. Preserve older evidence for audit and
+        // migration recovery, but never let a provider-originated change leave two addresses authoritative.
+        const current = await pool.query(`SELECT normalized_email FROM platform_verified_emails
+       WHERE principal_id = $1 AND provider = $2 AND realm = $3 AND status = 'active'`, [principalId, provider, realm]);
+        const changed = current.rows.length !== 1 || current.rows[0]?.normalized_email !== normalizedEmail;
+        await pool.query(`UPDATE platform_verified_emails SET status = 'superseded', observed_at = $5
+       WHERE principal_id = $1 AND provider = $2 AND realm = $3
+         AND normalized_email <> $4 AND status = 'active'`, [principalId, provider, realm, normalizedEmail, this.#now().toISOString()]);
+        await pool.query(`INSERT INTO platform_verified_emails
+         (principal_id, original_email, normalized_email, provider, realm, verified_at, observed_at)
+       VALUES ($1, $2, $3, $4, $5, $6, $6)
+       ON CONFLICT (principal_id, normalized_email, provider, realm)
+         DO UPDATE SET status = 'active', verified_at = EXCLUDED.verified_at,
+                       observed_at = EXCLUDED.observed_at`, [principalId, originalEmail, normalizedEmail, provider, realm, this.#now().toISOString()]);
+        return changed;
+    }
+}
+function principalFromRow(row) {
+    return {
+        id: row.principal_id,
+        status: row.status,
+        billingIdentity: {
+            identityIssuer: row.billing_identity_issuer,
+            subject: row.billing_subject,
+        },
+        createdAt: toIsoTimestamp(row.created_at),
+    };
+}
+function toIsoTimestamp(value) {
+    return value instanceof Date ? value.toISOString() : value;
+}
+function validatedPart(name, value) {
+    const normalized = value.trim();
+    if (normalized.length === 0 || normalized.length > 512)
+        throw new Error(`${name} must be non-empty`);
+    return normalized;
+}
+//# sourceMappingURL=platform-identity-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-identity-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-identity-postgres.js","sourceRoot":"","sources":["../src/platform-identity-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,EAC9B,iCAAiC,EACjC,qBAAqB,GAMtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,4BAA4B,GAE7B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EACL,4BAA4B,GAE7B,MAAM,wCAAwC,CAAC;AAEhD,wGAAwG;AACxG,MAAM,OAAO,6BAA6B;IAC/B,KAAK,CAEZ;IACO,IAAI,CAAa;IAE1B,YACE,IAEC,EACD,UAAyC,EAAE;QAE3C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,YAAY;QACV,OAAO,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAA4B;QACxC,IAAI,CAAC,KAAK,CAAC,aAAa;YAAE,MAAM,IAAI,qBAAqB,CAAC,2BAA2B,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC;QAClC,MAAM,KAAK,GAAG,8BAA8B,CAAC,aAAa,CAAC,CAAC;QAC5D,MAAM,UAAU,GACd,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7E,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,MAAM,UAAU,CAAC,KAAK,CAAC,uDAAuD,EAAE;gBAC9E,qBAAqB,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,EAAE;aACrE,CAAC,CAAC;YACH,MAAM,UAAU,CAAC,KAAK,CAAC,uDAAuD,EAAE;gBAC9E,kBAAkB,KAAK,EAAE;aAC1B,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CACrC;;;;uEAI+D,EAC/D,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAC9B,CAAC;YACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACnC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;oBAC1C,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;gBAC5D,CAAC;gBACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrD,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ;oBAAE,MAAM,IAAI,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;gBAC1F,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAC1C,UAAU,EACV,SAAS,CAAC,EAAE,EACZ,aAAa,EACb,KAAK,EACL,QAAQ,EACR,KAAK,CACN,CAAC;gBACF,+FAA+F;gBAC/F,oGAAoG;gBACpG,+CAA+C;gBAC/C,IAAI,YAAY,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBAC1C,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;oBAClC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;oBAC5C,MAAM,yBAAyB,CAAC,UAAU,EAAE;wBAC1C,WAAW,EAAE,SAAS,CAAC,EAAE;wBACzB,YAAY;wBACZ,SAAS;qBACV,CAAC,CAAC;oBACH,MAAM,2BAA2B,CAAC,UAAU,EAAE;wBAC5C,WAAW,EAAE,SAAS,CAAC,EAAE;wBACzB,YAAY;wBACZ,SAAS;qBACV,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACjC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC;YAC/E,CAAC;YACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,KAAK,CACtC,4EAA4E,EAC5E,CAAC,KAAK,CAAC,CACR,CAAC;gBACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;oBAAE,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,EAAE,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,UAAU,EAAE,EAAE,CAAC;YACtE,MAAM,eAAe,GACnB,QAAQ,KAAK,QAAQ;gBACnB,CAAC,CAAC,EAAE,cAAc,EAAE,+BAA+B,EAAE,OAAO,EAAE,UAAU,EAAE;gBAC1E,CAAC,CAAC,EAAE,cAAc,EAAE,iCAAiC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACzE,MAAM,UAAU,CAAC,KAAK,CACpB;;;+CAGuC,EACvC,CAAC,EAAE,EAAE,eAAe,CAAC,cAAc,EAAE,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CACzF,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CACrC;;;gCAGwB,EACxB,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAC7D,CAAC;YACF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,qBAAqB,CAAC,+BAA+B,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC/E,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,yBAAyB,CAAC,UAAU,EAAE;oBAC1C,WAAW,EAAE,EAAE;oBACf,YAAY,EAAE,UAAU,EAAE;oBAC1B,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;iBACrC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,gCAAgC,CAAC,UAAU,EAAE;gBACjD,WAAW,EAAE,EAAE;gBACf,QAAQ;gBACR,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC,CAAC;YACH,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1D,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAA4B;QAC9C,IAAI,CAAC,KAAK,CAAC,aAAa;YAAE,MAAM,IAAI,qBAAqB,CAAC,2BAA2B,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACnC;;;;qEAI+D,EAC/D,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAC9B,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI;YAAE,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;QACxF,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;QAC1F,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAAa;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACnC,4EAA4E,EAC5E,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC,CACxC,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,WAAmB;QACxC,MAAM,UAAU,GACd,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7E,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,MAAM,UAAU,CAAC,KAAK,CAAC,uDAAuD,EAAE;gBAC9E,sBAAsB,WAAW,EAAE;aACpC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CACpC;;;gCAGwB,EACxB,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CACzC,CAAC;YACF,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,iGAAiG;gBACjG,wFAAwF;gBACxF,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CACrC,8DAA8D,CAC/D,CAAC;gBACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;oBACxC,MAAM,UAAU,CAAC,KAAK,CACpB,yGAAyG,EACzG,CAAC,WAAW,CAAC,CACd,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1D,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,WAAmB;QACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACjC,gEAAgE,EAChE,CAAC,WAAW,CAAC,CACd,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,WAAW;YACtC,MAAM,IAAI,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB;QACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACjC;wDACkD,EAClD,CAAC,WAAW,CAAC,CACd,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,SAAS,CAAC,MAAM,KAAK,WAAW;YAAE,MAAM,IAAI,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;QAC7F,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,WAAmB;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACjC;gFAC0E,EAC1E,CAAC,WAAW,CAAC,CACd,CAAC;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC7B,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO,EAAE,GAAG,CAAC,WAAW;YACxB,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC;YACzC,GAAG,CAAC,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;SACrF,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,IAA+B,EAC/B,WAAmB,EACnB,aAAqB,EACrB,eAAuB,EACvB,QAAgB,EAChB,KAAa;QAEb,sGAAsG;QACtG,oGAAoG;QACpG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAC9B;sFACgF,EAChF,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,CAC/B,CAAC;QACF,MAAM,OAAO,GACX,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,KAAK,eAAe,CAAC;QACrF,MAAM,IAAI,CAAC,KAAK,CACd;;0DAEoD,EACpD,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAC3E,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CACd;;;;;0DAKoD,EACpD,CAAC,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAC1F,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAoBD,SAAS,gBAAgB,CAAC,GAAiB;IACzC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,YAAY;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,eAAe,EAAE;YACf,cAAc,EAAE,GAAG,CAAC,uBAAuB;YAC3C,OAAO,EAAE,GAAG,CAAC,eAAe;SAC7B;QACD,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAoB;IAC1C,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,GAAG;QACpD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-identity-schema-postgres.d.ts

@@ -0,0 +1,13 @@
+/** Narrow pool shape so DDL can be tested without a live database. */
+export interface PlatformIdentityQueryable {
+    query<T = Record<string, unknown>>(sql: string, values?: readonly unknown[]): Promise<{
+        readonly rows: readonly T[];
+    }>;
+}
+/**
+ * Additive persistence for the platform-human identity migration. Every relationship uses RESTRICT so a
+ * rollback to the preceding release remains safe, and immutability is enforced by the database rather than
+ * application convention.
+ */
+export declare function ensurePlatformIdentitySchema(pool: PlatformIdentityQueryable): Promise<void>;
+//# sourceMappingURL=platform-identity-schema-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-identity-schema-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-identity-schema-postgres.d.ts","sourceRoot":"","sources":["../src/platform-identity-schema-postgres.ts"],"names":[],"mappings":"AAMA,sEAAsE;AACtE,MAAM,WAAW,yBAAyB;IACxC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAC1B,OAAO,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAA;KAAE,CAAC,CAAC;CAC7C;AAED;;;;GAIG;AACH,wBAAsB,4BAA4B,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAocjG"}