@noodleseed/one 0.63.0 → 0.64.0

package/node_modules/@noodle-borg/service/dist/platform-identity-schema-postgres.js

@@ -0,0 +1,399 @@
+import { ensurePlatformAuthMigrationSchema, upgradePlatformAuthMigrationSchema, } from './platform-auth-migration-schema.js';
+import { ensurePlatformIdentitySyncOutboxSchema } from './platform-identity-sync-postgres.js';
+/**
+ * Additive persistence for the platform-human identity migration. Every relationship uses RESTRICT so a
+ * rollback to the preceding release remains safe, and immutability is enforced by the database rather than
+ * application convention.
+ */
+export async function ensurePlatformIdentitySchema(pool) {
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_principals (
+      principal_id             text PRIMARY KEY,
+      status                   text NOT NULL CHECK (status IN ('active', 'suspended')),
+      billing_identity_issuer  text NOT NULL,
+      billing_subject          text NOT NULL,
+      created_at               timestamptz NOT NULL DEFAULT now(),
+      suspended_at             timestamptz,
+      UNIQUE (billing_identity_issuer, billing_subject)
+    )
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_identity_links (
+      provider      text NOT NULL,
+      realm         text NOT NULL,
+      external_id   text NOT NULL,
+      principal_id  text NOT NULL REFERENCES platform_principals(principal_id) ON DELETE RESTRICT,
+      created_at    timestamptz NOT NULL DEFAULT now(),
+      disabled_at   timestamptz,
+      PRIMARY KEY (provider, realm, external_id),
+      UNIQUE (principal_id, provider, realm)
+    )
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_verified_emails (
+      principal_id      text NOT NULL REFERENCES platform_principals(principal_id) ON DELETE RESTRICT,
+      original_email    text NOT NULL,
+      normalized_email  text NOT NULL,
+      provider          text NOT NULL,
+      realm             text NOT NULL,
+      status            text NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'superseded')),
+      verified_at       timestamptz NOT NULL DEFAULT now(),
+      observed_at       timestamptz NOT NULL DEFAULT now(),
+      PRIMARY KEY (principal_id, normalized_email, provider, realm)
+    )
+  `);
+    await pool.query(`
+    CREATE INDEX IF NOT EXISTS platform_verified_emails_lookup_idx
+      ON platform_verified_emails (normalized_email)
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS identity_migration_runs (
+      id                 text PRIMARY KEY,
+      kind               text NOT NULL DEFAULT 'backfill' CHECK (kind IN ('inventory', 'backfill', 'import', 'reconcile')),
+      state              text NOT NULL CHECK (state IN ('planned', 'running', 'completed', 'failed')),
+      release_sha        text NOT NULL,
+      frozen_checksum    text,
+      source_fingerprint text,
+      excluded_fingerprint text,
+      idempotency_key_hash text,
+      request_fingerprint text,
+      safe_result        jsonb,
+      actor_fingerprint  text,
+      workos_realm_fingerprint text,
+      google_realm        text,
+      inventory_format    text CHECK (inventory_format IS NULL OR inventory_format IN ('legacy_v0', 'v1', 'v2')),
+      inventory_run_id   text REFERENCES identity_migration_runs(id) ON DELETE RESTRICT,
+      inventory_checksum text,
+      lineage_checksum   text,
+      started_at         timestamptz,
+      completed_at       timestamptz,
+      created_at         timestamptz NOT NULL DEFAULT now()
+    )
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS identity_backfill_ledger (
+      source_provider    text NOT NULL,
+      source_realm       text NOT NULL,
+      source_subject     text NOT NULL,
+      principal_id       text NOT NULL REFERENCES platform_principals(principal_id) ON DELETE RESTRICT,
+      migration_run_id   text REFERENCES identity_migration_runs(id) ON DELETE RESTRICT,
+      source_fingerprint text,
+      verified_email_fingerprint text,
+      state              text NOT NULL DEFAULT 'completed' CHECK (state IN ('pending', 'completed', 'blocked', 'failed')),
+      completed_at       timestamptz NOT NULL DEFAULT now(),
+      PRIMARY KEY (source_provider, source_realm, source_subject)
+    )
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS workos_import_ledger (
+      principal_id       text PRIMARY KEY REFERENCES platform_principals(principal_id) ON DELETE RESTRICT,
+      migration_run_id   text REFERENCES identity_migration_runs(id) ON DELETE RESTRICT,
+      realm              text NOT NULL DEFAULT 'default',
+      normalized_email   text NOT NULL,
+      email_fingerprint  text,
+      external_id        text NOT NULL CHECK (char_length(external_id) <= 64),
+      state              text NOT NULL CHECK (state IN ('pending', 'reconcile_required', 'linked', 'blocked', 'failed')),
+      lease_token        text,
+      lease_expires_at   timestamptz,
+      attempt_count      integer NOT NULL DEFAULT 0 CHECK (attempt_count >= 0),
+      retry_at           timestamptz,
+      outcome_code       text,
+      remote_user_id     text,
+      linked_at          timestamptz,
+      created_at         timestamptz NOT NULL DEFAULT now(),
+      updated_at         timestamptz NOT NULL DEFAULT now(),
+      CONSTRAINT workos_import_ledger_external_id_unique UNIQUE (external_id)
+    )
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_identity_sync_outbox (
+      idempotency_key    text PRIMARY KEY,
+      principal_id       text NOT NULL REFERENCES platform_principals(principal_id) ON DELETE RESTRICT,
+      event_type         text NOT NULL CHECK (event_type IN ('google_identity_upsert', 'verified_email_changed')),
+      created_at         timestamptz NOT NULL DEFAULT now(),
+      delivered_at       timestamptz,
+      attempt_count      integer NOT NULL DEFAULT 0 CHECK (attempt_count >= 0)
+    )
+  `);
+    await ensurePlatformIdentitySyncOutboxSchema(pool);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS workos_import_attempt_evidence (
+      id                 bigserial PRIMARY KEY,
+      principal_id       text NOT NULL REFERENCES platform_principals(principal_id) ON DELETE RESTRICT,
+      migration_run_id   text REFERENCES identity_migration_runs(id) ON DELETE RESTRICT,
+      attempt            integer NOT NULL CHECK (attempt >= 0),
+      outcome_code       text NOT NULL,
+      external_id_fingerprint text NOT NULL,
+      email_fingerprint  text NOT NULL,
+      principal_fingerprint text,
+      retry_at           timestamptz,
+      created_at         timestamptz NOT NULL DEFAULT now()
+    )
+  `);
+    await pool.query(`
+    CREATE INDEX IF NOT EXISTS platform_identity_sync_outbox_pending_idx
+      ON platform_identity_sync_outbox (created_at)
+      WHERE delivered_at IS NULL
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_identity_event_cursors (
+      provider           text NOT NULL,
+      stream             text NOT NULL,
+      cursor             text NOT NULL,
+      updated_at         timestamptz NOT NULL DEFAULT now(),
+      PRIMARY KEY (provider, stream)
+    )
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_auth_rollout_state (
+      singleton          boolean PRIMARY KEY DEFAULT true CHECK (singleton),
+      generation         bigint NOT NULL DEFAULT 0 CHECK (generation >= 0),
+      workos_percentage  integer NOT NULL DEFAULT 0 CHECK (workos_percentage BETWEEN 0 AND 100),
+      lifecycle          text NOT NULL DEFAULT 'google' CHECK (lifecycle IN ('google', 'workos', 'finalized')),
+      finalized_at       timestamptz,
+      release_sha        text,
+      workos_default_since timestamptz,
+      workos_stage_since timestamptz,
+      workos_recovery_client_ids text[] NOT NULL DEFAULT '{}'::text[],
+      updated_at         timestamptz NOT NULL DEFAULT now()
+    )
+  `);
+    await pool.query("ALTER TABLE platform_auth_rollout_state ADD COLUMN IF NOT EXISTS workos_canary_client_ids text[] NOT NULL DEFAULT '{}'::text[]");
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_identity_event_receipts (
+      provider           text NOT NULL,
+      event_id           text NOT NULL,
+      occurred_at        timestamptz NOT NULL,
+      received_at        timestamptz NOT NULL DEFAULT now(),
+      PRIMARY KEY (provider, event_id)
+    )
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_identity_upstream_versions (
+      provider           text NOT NULL,
+      realm              text NOT NULL,
+      external_id        text NOT NULL,
+      upstream_updated_at timestamptz NOT NULL,
+      PRIMARY KEY (provider, realm, external_id)
+    )
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS platform_auth_rollout_operations (
+      idempotency_key    text PRIMARY KEY,
+      expected_generation bigint NOT NULL CHECK (expected_generation >= 0),
+      applied_generation bigint NOT NULL CHECK (applied_generation >= 0),
+      operation          text NOT NULL CHECK (operation IN ('activate', 'rollback', 'finalize')),
+      release_sha        text NOT NULL,
+      preview_checksum   text NOT NULL,
+      actor_subject      text NOT NULL,
+      created_at         timestamptz NOT NULL DEFAULT now(),
+      idempotency_key_hash text,
+      request_fingerprint text,
+      actor_fingerprint  text,
+      prior_state        jsonb,
+      applied_state      jsonb
+    )
+  `);
+    await ensurePlatformAuthMigrationSchema(pool);
+    // Upgrade preceding Task 1 releases before dependent indexes/rows. No new code writes raw keys or actors.
+    await pool.query("ALTER TABLE identity_migration_runs ADD COLUMN IF NOT EXISTS kind text NOT NULL DEFAULT 'backfill'");
+    await pool.query('ALTER TABLE identity_migration_runs ADD COLUMN IF NOT EXISTS frozen_checksum text, ADD COLUMN IF NOT EXISTS source_fingerprint text, ADD COLUMN IF NOT EXISTS excluded_fingerprint text, ADD COLUMN IF NOT EXISTS idempotency_key_hash text, ADD COLUMN IF NOT EXISTS request_fingerprint text, ADD COLUMN IF NOT EXISTS safe_result jsonb, ADD COLUMN IF NOT EXISTS actor_fingerprint text, ADD COLUMN IF NOT EXISTS workos_realm_fingerprint text, ADD COLUMN IF NOT EXISTS google_realm text, ADD COLUMN IF NOT EXISTS inventory_format text, ADD COLUMN IF NOT EXISTS inventory_run_id text REFERENCES identity_migration_runs(id) ON DELETE RESTRICT, ADD COLUMN IF NOT EXISTS inventory_checksum text, ADD COLUMN IF NOT EXISTS lineage_checksum text');
+    await pool.query("ALTER TABLE identity_backfill_ledger ADD COLUMN IF NOT EXISTS source_fingerprint text, ADD COLUMN IF NOT EXISTS verified_email_fingerprint text, ADD COLUMN IF NOT EXISTS state text NOT NULL DEFAULT 'completed'");
+    await pool.query("ALTER TABLE workos_import_ledger ADD COLUMN IF NOT EXISTS migration_run_id text REFERENCES identity_migration_runs(id) ON DELETE RESTRICT, ADD COLUMN IF NOT EXISTS realm text NOT NULL DEFAULT 'default', ADD COLUMN IF NOT EXISTS email_fingerprint text, ADD COLUMN IF NOT EXISTS lease_token text, ADD COLUMN IF NOT EXISTS attempt_count integer NOT NULL DEFAULT 0, ADD COLUMN IF NOT EXISTS retry_at timestamptz, ADD COLUMN IF NOT EXISTS outcome_code text, ADD COLUMN IF NOT EXISTS linked_at timestamptz");
+    await pool.query('ALTER TABLE workos_import_ledger DROP CONSTRAINT IF EXISTS workos_import_ledger_state_check');
+    await pool.query('ALTER TABLE workos_import_attempt_evidence ALTER COLUMN principal_id DROP NOT NULL, ADD COLUMN IF NOT EXISTS principal_fingerprint text');
+    await pool.query("UPDATE workos_import_ledger SET state = 'linked' WHERE state = 'created'");
+    await pool.query("ALTER TABLE workos_import_ledger ADD CONSTRAINT workos_import_ledger_state_check CHECK (state IN ('pending', 'reconcile_required', 'linked', 'blocked', 'failed')) NOT VALID");
+    await pool.query('ALTER TABLE workos_import_ledger DROP CONSTRAINT IF EXISTS workos_import_ledger_external_id_check');
+    await pool.query('ALTER TABLE workos_import_ledger ADD CONSTRAINT workos_import_ledger_external_id_check CHECK (char_length(external_id) <= 64) NOT VALID');
+    await pool.query("ALTER TABLE platform_auth_rollout_state ADD COLUMN IF NOT EXISTS lifecycle text NOT NULL DEFAULT 'google', ADD COLUMN IF NOT EXISTS finalized_at timestamptz, ADD COLUMN IF NOT EXISTS release_sha text, ADD COLUMN IF NOT EXISTS workos_default_since timestamptz, ADD COLUMN IF NOT EXISTS workos_recovery_client_ids text[] NOT NULL DEFAULT '{}'::text[]");
+    await upgradePlatformAuthMigrationSchema(pool);
+    await pool.query('ALTER TABLE platform_auth_rollout_operations ADD COLUMN IF NOT EXISTS idempotency_key_hash text, ADD COLUMN IF NOT EXISTS request_fingerprint text, ADD COLUMN IF NOT EXISTS actor_fingerprint text, ADD COLUMN IF NOT EXISTS prior_state jsonb, ADD COLUMN IF NOT EXISTS applied_state jsonb');
+    await pool.query(`
+    CREATE UNIQUE INDEX IF NOT EXISTS workos_import_ledger_realm_email_reservation_v2
+      ON workos_import_ledger (realm, normalized_email)
+      WHERE state IN ('pending', 'reconcile_required', 'linked')
+  `);
+    await pool.query(`
+    DO $workos_import_index_upgrade$
+    BEGIN
+      IF to_regclass('workos_import_ledger_active_email_unique') IS NOT NULL
+         AND to_regclass('workos_import_ledger_realm_email_reservation_v2') IS NOT NULL THEN
+        DROP INDEX workos_import_ledger_active_email_unique;
+      END IF;
+    END
+    $workos_import_index_upgrade$
+  `);
+    await pool.query(`
+    CREATE UNIQUE INDEX IF NOT EXISTS workos_import_ledger_remote_user_unique
+      ON workos_import_ledger (realm, remote_user_id) WHERE remote_user_id IS NOT NULL
+  `);
+    await pool.query("INSERT INTO platform_auth_rollout_state (singleton, generation, workos_percentage, lifecycle) VALUES (true, 0, 0, 'google') ON CONFLICT (singleton) DO NOTHING");
+    await pool.query('ALTER TABLE workos_import_ledger VALIDATE CONSTRAINT workos_import_ledger_state_check');
+    await pool.query('ALTER TABLE workos_import_ledger VALIDATE CONSTRAINT workos_import_ledger_external_id_check');
+    await pool.query('CREATE UNIQUE INDEX IF NOT EXISTS platform_auth_rollout_operations_idempotency_hash_unique ON platform_auth_rollout_operations (idempotency_key_hash) WHERE idempotency_key_hash IS NOT NULL');
+    await pool.query('ALTER TABLE identity_migration_runs DROP CONSTRAINT IF EXISTS identity_migration_runs_kind_check');
+    await pool.query("ALTER TABLE identity_migration_runs ADD CONSTRAINT identity_migration_runs_kind_check CHECK (kind IN ('inventory', 'backfill', 'import', 'reconcile')) NOT VALID");
+    await pool.query('ALTER TABLE identity_migration_runs DROP CONSTRAINT IF EXISTS identity_migration_runs_state_check');
+    await pool.query("ALTER TABLE identity_migration_runs ADD CONSTRAINT identity_migration_runs_state_check CHECK (state IN ('planned', 'running', 'completed', 'failed')) NOT VALID");
+    await pool.query('ALTER TABLE workos_import_ledger DROP CONSTRAINT IF EXISTS workos_import_ledger_outcome_code_check');
+    await pool.query("ALTER TABLE workos_import_ledger ADD CONSTRAINT workos_import_ledger_outcome_code_check CHECK (outcome_code IS NULL OR outcome_code IN ('pending', 'reconcile_required', 'linked', 'blocked', 'failed')) NOT VALID");
+    await pool.query('ALTER TABLE workos_import_attempt_evidence DROP CONSTRAINT IF EXISTS workos_import_attempt_evidence_outcome_code_check');
+    await pool.query("ALTER TABLE workos_import_attempt_evidence ADD CONSTRAINT workos_import_attempt_evidence_outcome_code_check CHECK (outcome_code IN ('pending', 'reconcile_required', 'linked', 'blocked', 'failed')) NOT VALID");
+    await pool.query('ALTER TABLE platform_auth_rollout_state DROP CONSTRAINT IF EXISTS platform_auth_rollout_state_lifecycle_check');
+    await pool.query("ALTER TABLE platform_auth_rollout_state ADD CONSTRAINT platform_auth_rollout_state_lifecycle_check CHECK (lifecycle IN ('google', 'workos', 'finalized')) NOT VALID");
+    await pool.query('ALTER TABLE identity_migration_runs VALIDATE CONSTRAINT identity_migration_runs_kind_check');
+    await pool.query('ALTER TABLE identity_migration_runs VALIDATE CONSTRAINT identity_migration_runs_state_check');
+    await pool.query('ALTER TABLE workos_import_ledger VALIDATE CONSTRAINT workos_import_ledger_outcome_code_check');
+    await pool.query('ALTER TABLE workos_import_attempt_evidence VALIDATE CONSTRAINT workos_import_attempt_evidence_outcome_code_check');
+    await pool.query('ALTER TABLE platform_auth_rollout_state VALIDATE CONSTRAINT platform_auth_rollout_state_lifecycle_check');
+    await pool.query(`
+    CREATE OR REPLACE FUNCTION platform_identity_link_immutable() RETURNS trigger AS $$
+    BEGIN
+      IF OLD.provider IS DISTINCT FROM NEW.provider
+        OR OLD.realm IS DISTINCT FROM NEW.realm
+        OR OLD.external_id IS DISTINCT FROM NEW.external_id
+        OR OLD.principal_id IS DISTINCT FROM NEW.principal_id THEN
+        RAISE EXCEPTION 'identity link remapping is forbidden';
+      END IF;
+      IF OLD.disabled_at IS NOT NULL AND NEW IS DISTINCT FROM OLD THEN
+        RAISE EXCEPTION 'disabled identity links are immutable';
+      END IF;
+      RETURN NEW;
+    END;
+    $$ LANGUAGE plpgsql
+  `);
+    await pool.query(`
+    CREATE OR REPLACE FUNCTION platform_identity_link_no_delete() RETURNS trigger AS $$
+    BEGIN
+      RAISE EXCEPTION 'identity links cannot be deleted';
+    END;
+    $$ LANGUAGE plpgsql
+  `);
+    await pool.query(`
+    CREATE OR REPLACE FUNCTION platform_principal_billing_immutable() RETURNS trigger AS $$
+    BEGIN
+      IF OLD.billing_identity_issuer IS DISTINCT FROM NEW.billing_identity_issuer
+        OR OLD.billing_subject IS DISTINCT FROM NEW.billing_subject THEN
+        RAISE EXCEPTION 'platform principal billing identity is immutable';
+      END IF;
+      RETURN NEW;
+    END;
+    $$ LANGUAGE plpgsql
+  `);
+    await pool.query(`
+    CREATE OR REPLACE FUNCTION platform_rollout_operation_append_only() RETURNS trigger AS $$
+    BEGIN
+      RAISE EXCEPTION 'platform rollout operations are append-only';
+    END;
+    $$ LANGUAGE plpgsql
+  `);
+    await pool.query(`
+    CREATE OR REPLACE FUNCTION platform_rollout_evidence_v2_append_only() RETURNS trigger AS $$
+    BEGIN
+      RAISE EXCEPTION 'platform rollout evidence is append-only';
+    END;
+    $$ LANGUAGE plpgsql
+  `);
+    await pool.query(`
+    CREATE OR REPLACE FUNCTION completed_identity_migration_run_append_only() RETURNS trigger AS $$
+    BEGIN
+      IF OLD.state = 'completed' THEN
+        RAISE EXCEPTION 'completed identity migration runs are append-only';
+      END IF;
+      IF TG_OP = 'DELETE' THEN RETURN OLD; END IF;
+      IF OLD.id IS DISTINCT FROM NEW.id OR OLD.kind IS DISTINCT FROM NEW.kind
+        OR OLD.release_sha IS DISTINCT FROM NEW.release_sha
+        OR (OLD.source_fingerprint IS NOT NULL AND OLD.source_fingerprint IS DISTINCT FROM NEW.source_fingerprint)
+        OR (OLD.excluded_fingerprint IS NOT NULL AND OLD.excluded_fingerprint IS DISTINCT FROM NEW.excluded_fingerprint)
+        OR OLD.request_fingerprint IS DISTINCT FROM NEW.request_fingerprint
+        OR (OLD.workos_realm_fingerprint IS NOT NULL AND OLD.workos_realm_fingerprint IS DISTINCT FROM NEW.workos_realm_fingerprint)
+        OR (OLD.google_realm IS NOT NULL AND OLD.google_realm IS DISTINCT FROM NEW.google_realm)
+        OR (OLD.inventory_format IS NOT NULL AND OLD.inventory_format IS DISTINCT FROM NEW.inventory_format)
+        OR OLD.inventory_run_id IS DISTINCT FROM NEW.inventory_run_id
+        OR OLD.inventory_checksum IS DISTINCT FROM NEW.inventory_checksum
+        OR OLD.lineage_checksum IS DISTINCT FROM NEW.lineage_checksum THEN
+        RAISE EXCEPTION 'identity migration run lineage is immutable';
+      END IF;
+      RETURN NEW;
+    END;
+    $$ LANGUAGE plpgsql
+  `);
+    await pool.query(`
+    CREATE OR REPLACE FUNCTION platform_auth_inventory_candidate_append_only() RETURNS trigger AS $$
+    BEGIN
+      IF TG_OP = 'INSERT' THEN
+        IF NOT EXISTS (SELECT 1 FROM identity_migration_runs
+          WHERE id = NEW.migration_run_id AND kind = 'inventory' AND state = 'running') THEN
+          RAISE EXCEPTION 'completed inventory candidates are frozen';
+        END IF;
+        RETURN NEW;
+      END IF;
+      RAISE EXCEPTION 'platform auth inventory candidates are append-only';
+    END;
+    $$ LANGUAGE plpgsql
+  `);
+    await pool.query(`
+    CREATE OR REPLACE FUNCTION workos_import_attempt_evidence_append_only() RETURNS trigger AS $$
+    BEGIN
+      RAISE EXCEPTION 'WorkOS import attempt evidence is append-only';
+    END;
+    $$ LANGUAGE plpgsql
+  `);
+    await pool.query(`
+    DO $platform_identity_triggers$
+    BEGIN
+      IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgname = 'platform_identity_link_immutable_trigger'
+        AND tgrelid = 'platform_identity_links'::regclass AND NOT tgisinternal) THEN
+        CREATE TRIGGER platform_identity_link_immutable_trigger BEFORE UPDATE ON platform_identity_links
+          FOR EACH ROW EXECUTE FUNCTION platform_identity_link_immutable();
+      END IF;
+      IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgname = 'platform_identity_link_no_delete_trigger'
+        AND tgrelid = 'platform_identity_links'::regclass AND NOT tgisinternal) THEN
+        CREATE TRIGGER platform_identity_link_no_delete_trigger BEFORE DELETE ON platform_identity_links
+          FOR EACH ROW EXECUTE FUNCTION platform_identity_link_no_delete();
+      END IF;
+      IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgname = 'platform_principal_billing_immutable_trigger'
+        AND tgrelid = 'platform_principals'::regclass AND NOT tgisinternal) THEN
+        CREATE TRIGGER platform_principal_billing_immutable_trigger BEFORE UPDATE ON platform_principals
+          FOR EACH ROW EXECUTE FUNCTION platform_principal_billing_immutable();
+      END IF;
+      IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgname = 'platform_rollout_operation_append_only_update_trigger'
+        AND tgrelid = 'platform_auth_rollout_operations'::regclass AND NOT tgisinternal) THEN
+        CREATE TRIGGER platform_rollout_operation_append_only_update_trigger BEFORE UPDATE ON platform_auth_rollout_operations
+          FOR EACH ROW EXECUTE FUNCTION platform_rollout_operation_append_only();
+      END IF;
+      IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgname = 'platform_rollout_operation_append_only_delete_trigger'
+        AND tgrelid = 'platform_auth_rollout_operations'::regclass AND NOT tgisinternal) THEN
+        CREATE TRIGGER platform_rollout_operation_append_only_delete_trigger BEFORE DELETE ON platform_auth_rollout_operations
+          FOR EACH ROW EXECUTE FUNCTION platform_rollout_operation_append_only();
+      END IF;
+      IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgname = 'platform_rollout_evidence_v2_append_only_update_trigger'
+        AND tgrelid = 'platform_auth_rollout_evidence_v2'::regclass AND NOT tgisinternal) THEN
+        CREATE TRIGGER platform_rollout_evidence_v2_append_only_update_trigger BEFORE UPDATE ON platform_auth_rollout_evidence_v2
+          FOR EACH ROW EXECUTE FUNCTION platform_rollout_evidence_v2_append_only();
+      END IF;
+      IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgname = 'platform_rollout_evidence_v2_append_only_delete_trigger'
+        AND tgrelid = 'platform_auth_rollout_evidence_v2'::regclass AND NOT tgisinternal) THEN
+        CREATE TRIGGER platform_rollout_evidence_v2_append_only_delete_trigger BEFORE DELETE ON platform_auth_rollout_evidence_v2
+          FOR EACH ROW EXECUTE FUNCTION platform_rollout_evidence_v2_append_only();
+      END IF;
+      IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgname = 'completed_identity_migration_run_append_only_trigger'
+        AND tgrelid = 'identity_migration_runs'::regclass AND NOT tgisinternal) THEN
+        CREATE TRIGGER completed_identity_migration_run_append_only_trigger BEFORE UPDATE OR DELETE ON identity_migration_runs
+          FOR EACH ROW EXECUTE FUNCTION completed_identity_migration_run_append_only();
+      END IF;
+      DROP TRIGGER IF EXISTS platform_auth_inventory_candidate_append_only_trigger ON platform_auth_inventory_candidates;
+      CREATE TRIGGER platform_auth_inventory_candidate_append_only_trigger BEFORE INSERT OR UPDATE OR DELETE ON platform_auth_inventory_candidates
+        FOR EACH ROW EXECUTE FUNCTION platform_auth_inventory_candidate_append_only();
+      IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgname = 'workos_import_attempt_evidence_append_only_trigger'
+        AND tgrelid = 'workos_import_attempt_evidence'::regclass AND NOT tgisinternal) THEN
+        CREATE TRIGGER workos_import_attempt_evidence_append_only_trigger BEFORE UPDATE OR DELETE ON workos_import_attempt_evidence
+          FOR EACH ROW EXECUTE FUNCTION workos_import_attempt_evidence_append_only();
+      END IF;
+    EXCEPTION WHEN duplicate_object THEN NULL;
+    END
+    $platform_identity_triggers$
+  `);
+}
+//# sourceMappingURL=platform-identity-schema-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-identity-schema-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-identity-schema-postgres.js","sourceRoot":"","sources":["../src/platform-identity-schema-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iCAAiC,EACjC,kCAAkC,GACnC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,sCAAsC,EAAE,MAAM,sCAAsC,CAAC;AAU9F;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,IAA+B;IAChF,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;GAUhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;GAWhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;GAYhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;GAGhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;GAuBhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;GAahB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;GAoBhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;GAShB,CAAC,CAAC;IACH,MAAM,sCAAsC,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;GAahB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;GAIhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;GAQhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;GAahB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CACd,gIAAgI,CACjI,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;GAQhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;GAQhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;GAgBhB,CAAC,CAAC;IACH,MAAM,iCAAiC,CAAC,IAAI,CAAC,CAAC;IAC9C,0GAA0G;IAC1G,MAAM,IAAI,CAAC,KAAK,CACd,oGAAoG,CACrG,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,6tBAA6tB,CAC9tB,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,mNAAmN,CACpN,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,qfAAqf,CACtf,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,6FAA6F,CAC9F,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,yIAAyI,CAC1I,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC7F,MAAM,IAAI,CAAC,KAAK,CACd,8KAA8K,CAC/K,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,mGAAmG,CACpG,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,yIAAyI,CAC1I,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,8VAA8V,CAC/V,CAAC;IACF,MAAM,kCAAkC,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,IAAI,CAAC,KAAK,CACd,+RAA+R,CAChS,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC;;;;GAIhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;GAShB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;GAGhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CACd,gKAAgK,CACjK,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,uFAAuF,CACxF,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,6FAA6F,CAC9F,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,8LAA8L,CAC/L,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,kGAAkG,CACnG,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,kKAAkK,CACnK,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,mGAAmG,CACpG,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,iKAAiK,CAClK,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,oGAAoG,CACrG,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,oNAAoN,CACrN,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,wHAAwH,CACzH,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,gNAAgN,CACjN,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,+GAA+G,CAChH,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,qKAAqK,CACtK,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,4FAA4F,CAC7F,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,6FAA6F,CAC9F,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,8FAA8F,CAC/F,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,kHAAkH,CACnH,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,yGAAyG,CAC1G,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;GAehB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;GAMhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;GAUhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;GAMhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;GAMhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;GAuBhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;GAahB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;GAMhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDhB,CAAC,CAAC;AACL,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-identity-sync-enqueue.d.ts

@@ -0,0 +1,18 @@
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+/** Transaction-scoped enqueue helpers; callers commit identity/link/email evidence and its event together. */
+export declare function enqueueGoogleIdentitySync(pool: PlatformIdentityQueryable, input: {
+    readonly principalId: string;
+    readonly transitionId: string;
+    readonly createdAt: string;
+}): Promise<void>;
+export declare function enqueueVerifiedEmailChanged(pool: PlatformIdentityQueryable, input: {
+    readonly principalId: string;
+    readonly transitionId: string;
+    readonly createdAt: string;
+}): Promise<void>;
+export declare function enqueueWorkOSExternalIdReconcile(pool: PlatformIdentityQueryable, input: {
+    readonly principalId: string;
+    readonly provider: string;
+    readonly createdAt: string;
+}): Promise<void>;
+//# sourceMappingURL=platform-identity-sync-enqueue.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-identity-sync-enqueue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-identity-sync-enqueue.d.ts","sourceRoot":"","sources":["../src/platform-identity-sync-enqueue.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,8GAA8G;AAC9G,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,yBAAyB,EAC/B,KAAK,EAAE;IACL,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,GACA,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,yBAAyB,EAC/B,KAAK,EAAE;IACL,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,GACA,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,yBAAyB,EAC/B,KAAK,EAAE;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7F,OAAO,CAAC,IAAI,CAAC,CAQf"}

package/node_modules/@noodle-borg/service/dist/platform-identity-sync-enqueue.js

@@ -0,0 +1,25 @@
+/** Transaction-scoped enqueue helpers; callers commit identity/link/email evidence and its event together. */
+export async function enqueueGoogleIdentitySync(pool, input) {
+    await pool.query(`INSERT INTO platform_identity_sync_outbox (idempotency_key, principal_id, event_type, created_at)
+     VALUES ($1, $2, 'google_identity_upsert', $3) ON CONFLICT (idempotency_key) DO NOTHING`, [
+        `google_identity_upsert:${input.principalId}:${input.transitionId}`,
+        input.principalId,
+        input.createdAt,
+    ]);
+}
+export async function enqueueVerifiedEmailChanged(pool, input) {
+    await pool.query(`INSERT INTO platform_identity_sync_outbox (idempotency_key, principal_id, event_type, created_at)
+     VALUES ($1, $2, 'verified_email_changed', $3) ON CONFLICT (idempotency_key) DO NOTHING`, [
+        `verified_email_changed:${input.principalId}:${input.transitionId}`,
+        input.principalId,
+        input.createdAt,
+    ]);
+}
+export async function enqueueWorkOSExternalIdReconcile(pool, input) {
+    if (input.provider !== 'workos')
+        return;
+    await pool.query(`INSERT INTO platform_identity_sync_outbox (idempotency_key, principal_id, event_type, created_at)
+     VALUES ($1, $2, 'workos_external_id_reconcile', $3)
+     ON CONFLICT (idempotency_key) DO NOTHING`, [`workos_external_id_reconcile:${input.principalId}`, input.principalId, input.createdAt]);
+}
+//# sourceMappingURL=platform-identity-sync-enqueue.js.map

package/node_modules/@noodle-borg/service/dist/platform-identity-sync-enqueue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-identity-sync-enqueue.js","sourceRoot":"","sources":["../src/platform-identity-sync-enqueue.ts"],"names":[],"mappings":"AAEA,8GAA8G;AAC9G,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAA+B,EAC/B,KAIC;IAED,MAAM,IAAI,CAAC,KAAK,CACd;4FACwF,EACxF;QACE,0BAA0B,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,YAAY,EAAE;QACnE,KAAK,CAAC,WAAW;QACjB,KAAK,CAAC,SAAS;KAChB,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAA+B,EAC/B,KAIC;IAED,MAAM,IAAI,CAAC,KAAK,CACd;4FACwF,EACxF;QACE,0BAA0B,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,YAAY,EAAE;QACnE,KAAK,CAAC,WAAW;QACjB,KAAK,CAAC,SAAS;KAChB,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,IAA+B,EAC/B,KAA8F;IAE9F,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO;IACxC,MAAM,IAAI,CAAC,KAAK,CACd;;8CAE0C,EAC1C,CAAC,gCAAgC,KAAK,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAC1F,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-identity-sync-evidence-postgres.d.ts

@@ -0,0 +1,15 @@
+import type { PoolClient } from 'pg';
+import type { PlatformIdentitySyncEventType } from './platform-identity-sync.js';
+export interface PlatformIdentitySyncEvidence {
+    readonly status: 'active' | 'suspended';
+    readonly googleEmails: readonly string[];
+    readonly workosEmails: readonly string[];
+    readonly sharedGoogleEmailPrincipalCount: number;
+    readonly sharedWorkosEmailPrincipalCount: number;
+    readonly googleLinkCount: number;
+    readonly workosUserIds: readonly string[];
+}
+export declare function loadPlatformIdentitySyncEvidence(client: PoolClient, principalId: string, googleRealm: string, workosRealm: string, lock?: boolean): Promise<PlatformIdentitySyncEvidence>;
+export declare function platformIdentitySyncEmail(eventType: PlatformIdentitySyncEventType, evidence: PlatformIdentitySyncEvidence): string | undefined;
+export declare function isValidPlatformIdentitySyncEvidence(eventType: PlatformIdentitySyncEventType, evidence: PlatformIdentitySyncEvidence): boolean;
+//# sourceMappingURL=platform-identity-sync-evidence-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-identity-sync-evidence-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-identity-sync-evidence-postgres.d.ts","sourceRoot":"","sources":["../src/platform-identity-sync-evidence-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AACrC,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAEjF,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,WAAW,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,+BAA+B,EAAE,MAAM,CAAC;IACjD,QAAQ,CAAC,+BAA+B,EAAE,MAAM,CAAC;IACjD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,wBAAsB,gCAAgC,CACpD,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,IAAI,UAAO,GACV,OAAO,CAAC,4BAA4B,CAAC,CAiEvC;AAED,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,6BAA6B,EACxC,QAAQ,EAAE,4BAA4B,GACrC,MAAM,GAAG,SAAS,CAIpB;AAED,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,6BAA6B,EACxC,QAAQ,EAAE,4BAA4B,GACrC,OAAO,CAeT"}

package/node_modules/@noodle-borg/service/dist/platform-identity-sync-evidence-postgres.js

@@ -0,0 +1,74 @@
+export async function loadPlatformIdentitySyncEvidence(client, principalId, googleRealm, workosRealm, lock = true) {
+    const result = await client.query(`SELECT p.status,
+            ARRAY(SELECT DISTINCT e.normalized_email
+                    FROM platform_verified_emails e
+                   WHERE e.principal_id = p.principal_id AND e.status = 'active'
+                     AND e.provider = 'google' AND e.realm = $2
+                   ORDER BY e.normalized_email) AS google_emails,
+            ARRAY(SELECT DISTINCT e.normalized_email
+                    FROM platform_verified_emails e
+                   WHERE e.principal_id = p.principal_id AND e.status = 'active'
+                     AND e.provider = 'workos' AND e.realm = $3
+                   ORDER BY e.normalized_email) AS workos_emails,
+            (SELECT count(DISTINCT peer.principal_id)::text
+               FROM platform_verified_emails own
+               JOIN platform_verified_emails peer
+                 ON peer.normalized_email = own.normalized_email AND peer.status = 'active'
+              WHERE own.principal_id = p.principal_id AND own.status = 'active'
+                AND own.provider = 'google' AND own.realm = $2
+                AND peer.principal_id <> p.principal_id) AS shared_google_email_principal_count,
+            (SELECT count(DISTINCT peer.principal_id)::text
+               FROM platform_verified_emails own
+               JOIN platform_verified_emails peer
+                 ON peer.normalized_email = own.normalized_email AND peer.status = 'active'
+              WHERE own.principal_id = p.principal_id AND own.status = 'active'
+                AND own.provider = 'workos' AND own.realm = $3
+                AND peer.principal_id <> p.principal_id) AS shared_workos_email_principal_count,
+            (SELECT count(*)::text FROM platform_identity_links l
+              WHERE l.principal_id = p.principal_id AND l.provider = 'google'
+                AND l.realm = $2 AND l.disabled_at IS NULL) AS google_link_count,
+            ARRAY(SELECT l.external_id FROM platform_identity_links l
+                    WHERE l.principal_id = p.principal_id AND l.provider = 'workos'
+                      AND l.realm = $3 AND l.disabled_at IS NULL
+                    ORDER BY l.external_id) AS workos_user_ids
+       FROM platform_principals p WHERE p.principal_id = $1 ${lock ? 'FOR UPDATE' : ''}`, [principalId, googleRealm, workosRealm]);
+    const row = result.rows[0];
+    return row === undefined
+        ? {
+            status: 'suspended',
+            googleEmails: [],
+            workosEmails: [],
+            sharedGoogleEmailPrincipalCount: 0,
+            sharedWorkosEmailPrincipalCount: 0,
+            googleLinkCount: 0,
+            workosUserIds: [],
+        }
+        : {
+            status: row.status,
+            googleEmails: row.google_emails,
+            workosEmails: row.workos_emails,
+            sharedGoogleEmailPrincipalCount: Number(row.shared_google_email_principal_count),
+            sharedWorkosEmailPrincipalCount: Number(row.shared_workos_email_principal_count),
+            googleLinkCount: Number(row.google_link_count),
+            workosUserIds: row.workos_user_ids,
+        };
+}
+export function platformIdentitySyncEmail(eventType, evidence) {
+    const emails = eventType === 'workos_external_id_reconcile' ? evidence.workosEmails : evidence.googleEmails;
+    return emails.length === 1 ? emails[0] : undefined;
+}
+export function isValidPlatformIdentitySyncEvidence(eventType, evidence) {
+    const email = platformIdentitySyncEmail(eventType, evidence);
+    const sharedEmailPrincipalCount = eventType === 'workos_external_id_reconcile'
+        ? evidence.sharedWorkosEmailPrincipalCount
+        : evidence.sharedGoogleEmailPrincipalCount;
+    if (evidence.status !== 'active' ||
+        email === undefined ||
+        sharedEmailPrincipalCount !== 0 ||
+        evidence.workosUserIds.length > 1)
+        return false;
+    if (eventType === 'workos_external_id_reconcile')
+        return evidence.workosUserIds.length === 1;
+    return evidence.googleLinkCount === 1;
+}
+//# sourceMappingURL=platform-identity-sync-evidence-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-identity-sync-evidence-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-identity-sync-evidence-postgres.js","sourceRoot":"","sources":["../src/platform-identity-sync-evidence-postgres.ts"],"names":[],"mappings":"AAaA,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,MAAkB,EAClB,WAAmB,EACnB,WAAmB,EACnB,WAAmB,EACnB,IAAI,GAAG,IAAI;IAEX,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAS/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8DAgC0D,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,EACpF,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CACxC,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,OAAO,GAAG,KAAK,SAAS;QACtB,CAAC,CAAC;YACE,MAAM,EAAE,WAAW;YACnB,YAAY,EAAE,EAAE;YAChB,YAAY,EAAE,EAAE;YAChB,+BAA+B,EAAE,CAAC;YAClC,+BAA+B,EAAE,CAAC;YAClC,eAAe,EAAE,CAAC;YAClB,aAAa,EAAE,EAAE;SAClB;QACH,CAAC,CAAC;YACE,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,YAAY,EAAE,GAAG,CAAC,aAAa;YAC/B,YAAY,EAAE,GAAG,CAAC,aAAa;YAC/B,+BAA+B,EAAE,MAAM,CAAC,GAAG,CAAC,mCAAmC,CAAC;YAChF,+BAA+B,EAAE,MAAM,CAAC,GAAG,CAAC,mCAAmC,CAAC;YAChF,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAC9C,aAAa,EAAE,GAAG,CAAC,eAAe;SACnC,CAAC;AACR,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,SAAwC,EACxC,QAAsC;IAEtC,MAAM,MAAM,GACV,SAAS,KAAK,8BAA8B,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC/F,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,SAAwC,EACxC,QAAsC;IAEtC,MAAM,KAAK,GAAG,yBAAyB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC7D,MAAM,yBAAyB,GAC7B,SAAS,KAAK,8BAA8B;QAC1C,CAAC,CAAC,QAAQ,CAAC,+BAA+B;QAC1C,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;IAC/C,IACE,QAAQ,CAAC,MAAM,KAAK,QAAQ;QAC5B,KAAK,KAAK,SAAS;QACnB,yBAAyB,KAAK,CAAC;QAC/B,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;QAEjC,OAAO,KAAK,CAAC;IACf,IAAI,SAAS,KAAK,8BAA8B;QAAE,OAAO,QAAQ,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;IAC7F,OAAO,QAAQ,CAAC,eAAe,KAAK,CAAC,CAAC;AACxC,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-identity-sync-postgres.d.ts

@@ -0,0 +1,19 @@
+import type { Pool } from 'pg';
+import type { PlatformIdentityQueryable } from './platform-identity-schema-postgres.js';
+import type { PlatformIdentitySyncLease, PlatformIdentitySyncStore } from './platform-identity-sync.js';
+/** Additive upgrade kept separate so the already-large canonical identity schema stays reviewable. */
+export declare function ensurePlatformIdentitySyncOutboxSchema(pool: PlatformIdentityQueryable): Promise<void>;
+/** Durable, lease-fenced outbox adapter. Remote calls occur only after the claim transaction commits. */
+export declare class PostgresPlatformIdentitySyncStore implements PlatformIdentitySyncStore {
+    #private;
+    constructor(pool: Pool, input: {
+        readonly workosRealm: string;
+        readonly googleRealm?: string;
+    });
+    claimBatch(input: {
+        readonly limit: number;
+        readonly leaseSeconds: number;
+    }): Promise<readonly PlatformIdentitySyncLease[]>;
+    finish(lease: PlatformIdentitySyncLease, result: Parameters<PlatformIdentitySyncStore['finish']>[1]): Promise<void>;
+}
+//# sourceMappingURL=platform-identity-sync-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-identity-sync-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-identity-sync-postgres.d.ts","sourceRoot":"","sources":["../src/platform-identity-sync-postgres.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAC;AAC3C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AACxF,OAAO,KAAK,EAEV,yBAAyB,EAEzB,yBAAyB,EAC1B,MAAM,6BAA6B,CAAC;AAYrC,sGAAsG;AACtG,wBAAsB,sCAAsC,CAC1D,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAsEf;AAED,yGAAyG;AACzG,qBAAa,iCAAkC,YAAW,yBAAyB;;gBAKrE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;IAMxF,UAAU,CAAC,KAAK,EAAE;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;KAC/B,GAAG,OAAO,CAAC,SAAS,yBAAyB,EAAE,CAAC;IAsE3C,MAAM,CACV,KAAK,EAAE,yBAAyB,EAChC,MAAM,EAAE,UAAU,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GACzD,OAAO,CAAC,IAAI,CAAC;CAuEjB"}