@noodleseed/one 0.63.0 → 0.64.0

package/node_modules/@noodle-borg/service/dist/platform-identity-sync.d.ts

@@ -0,0 +1,98 @@
+import type { PlatformAuthDirectory, PlatformAuthDirectoryUser } from './platform-auth-migration.js';
+export type PlatformIdentitySyncEventType = 'google_identity_upsert' | 'verified_email_changed' | 'workos_external_id_reconcile';
+/** A lease contains only the current, transactionally revalidated evidence needed for one remote mutation. */
+export interface PlatformIdentitySyncLease {
+    readonly idempotencyKey: string;
+    readonly principalId: string;
+    readonly eventType: PlatformIdentitySyncEventType;
+    readonly normalizedEmail: string;
+    /** Immutable local WorkOS link, when one already exists. */
+    readonly workosUserId: string | undefined;
+    readonly leaseToken: string;
+    readonly attempt: number;
+}
+export type PlatformIdentitySyncOutcomeCode = 'delivered' | 'remote_identity_conflict' | 'provider_conflict' | 'provider_rate_limited' | 'provider_transient' | 'provider_permanent' | 'provider_unauthorized';
+export declare class PlatformIdentitySyncError extends Error {
+    readonly code: 'stale_lease' | 'identity_sync_drift' | 'identity_sync_recovery_drift' | 'identity_sync_recovery_conflict';
+    constructor(code: 'stale_lease' | 'identity_sync_drift' | 'identity_sync_recovery_drift' | 'identity_sync_recovery_conflict');
+}
+export interface PlatformIdentitySyncStore {
+    claimBatch(input: {
+        readonly limit: number;
+        readonly leaseSeconds: number;
+    }): Promise<readonly PlatformIdentitySyncLease[]>;
+    finish(lease: PlatformIdentitySyncLease, result: {
+        readonly state: 'delivered';
+        readonly outcomeCode: 'delivered';
+        readonly remoteUserId: string;
+    } | {
+        readonly state: 'retry';
+        readonly outcomeCode: Exclude<PlatformIdentitySyncOutcomeCode, 'delivered' | 'remote_identity_conflict' | 'provider_permanent' | 'provider_unauthorized'>;
+        readonly retryAt: string;
+    } | {
+        readonly state: 'blocked';
+        readonly outcomeCode: 'remote_identity_conflict' | 'provider_permanent' | 'provider_unauthorized';
+    }): Promise<void>;
+}
+export interface PlatformIdentitySyncRecoveryPreview {
+    readonly terminal: number;
+    readonly checksum: string;
+}
+export interface PlatformIdentitySyncRecoveryResult {
+    readonly attempted: number;
+    readonly recovered: number;
+    readonly rejected: number;
+    readonly replayed: boolean;
+}
+/** Explicit operator-only port. Ordinary workers and enqueue paths never receive this authority. */
+export interface PlatformIdentitySyncRecoveryStore {
+    previewTerminalRecovery(input: {
+        readonly limit: number;
+    }): Promise<PlatformIdentitySyncRecoveryPreview>;
+    /** Returns only previously committed aggregate evidence; it never mutates outbox state. */
+    replayTerminalRecovery(input: {
+        readonly limit: number;
+        readonly operationFingerprint: string;
+        readonly requestFingerprint: string;
+        readonly actorFingerprint: string;
+        readonly reasonFingerprint: string;
+    }): Promise<PlatformIdentitySyncRecoveryResult | undefined>;
+    recoverTerminal(input: {
+        readonly limit: number;
+        readonly expectedChecksum: string;
+        readonly operationFingerprint: string;
+        readonly requestFingerprint: string;
+        readonly actorFingerprint: string;
+        readonly reasonFingerprint: string;
+    }): Promise<PlatformIdentitySyncRecoveryResult>;
+}
+/** Migration directory plus the one narrowly-scoped update used by dual-write and external-ID repair. */
+export interface PlatformIdentitySyncDirectory extends PlatformAuthDirectory {
+    updateVerifiedUser(input: {
+        readonly userId: string;
+        readonly externalId: string;
+        readonly normalizedEmail: string;
+    }): Promise<PlatformAuthDirectoryUser>;
+}
+export interface PlatformIdentitySyncBatchResult {
+    readonly attempted: number;
+    readonly delivered: number;
+    readonly blocked: number;
+    readonly retryRequired: number;
+}
+/**
+ * Bounded explicit worker. It never polls continuously, logs evidence, or authorizes by email. Email is used
+ * only to prove that creating a remote import will not collide; an existing local WorkOS link is always keyed
+ * by the immutable WorkOS user ID.
+ */
+export declare class PlatformIdentitySyncProcessor {
+    #private;
+    constructor(input: {
+        readonly store: PlatformIdentitySyncStore;
+        readonly directory: PlatformIdentitySyncDirectory;
+        readonly now?: () => Date;
+        readonly leaseSeconds?: number;
+    });
+    processOnce(limit?: number): Promise<PlatformIdentitySyncBatchResult>;
+}
+//# sourceMappingURL=platform-identity-sync.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-identity-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-identity-sync.d.ts","sourceRoot":"","sources":["../src/platform-identity-sync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,qBAAqB,EAGrB,yBAAyB,EAC1B,MAAM,8BAA8B,CAAC;AAGtC,MAAM,MAAM,6BAA6B,GACrC,wBAAwB,GACxB,wBAAwB,GACxB,8BAA8B,CAAC;AAEnC,8GAA8G;AAC9G,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;IAClD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,+BAA+B,GACvC,WAAW,GACX,0BAA0B,GAC1B,mBAAmB,GACnB,uBAAuB,GACvB,oBAAoB,GACpB,oBAAoB,GACpB,uBAAuB,CAAC;AAE5B,qBAAa,yBAA0B,SAAQ,KAAK;IAEhD,QAAQ,CAAC,IAAI,EACT,aAAa,GACb,qBAAqB,GACrB,8BAA8B,GAC9B,iCAAiC;gBAJ5B,IAAI,EACT,aAAa,GACb,qBAAqB,GACrB,8BAA8B,GAC9B,iCAAiC;CAKxC;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,CAAC,KAAK,EAAE;QAChB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;KAC/B,GAAG,OAAO,CAAC,SAAS,yBAAyB,EAAE,CAAC,CAAC;IAClD,MAAM,CACJ,KAAK,EAAE,yBAAyB,EAChC,MAAM,EACF;QACE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;QAC5B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;QAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;KAC/B,GACD;QACE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAC3B,+BAA+B,EAC7B,WAAW,GACX,0BAA0B,GAC1B,oBAAoB,GACpB,uBAAuB,CAC1B,CAAC;QACF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,GACD;QACE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;QAC1B,QAAQ,CAAC,WAAW,EAChB,0BAA0B,GAC1B,oBAAoB,GACpB,uBAAuB,CAAC;KAC7B,GACJ,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,oGAAoG;AACpG,MAAM,WAAW,iCAAiC;IAChD,uBAAuB,CAAC,KAAK,EAAE;QAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAAC;IACjD,2FAA2F;IAC3F,sBAAsB,CAAC,KAAK,EAAE;QAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;QACtC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;KACpC,GAAG,OAAO,CAAC,kCAAkC,GAAG,SAAS,CAAC,CAAC;IAC5D,eAAe,CAAC,KAAK,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;QACtC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;KACpC,GAAG,OAAO,CAAC,kCAAkC,CAAC,CAAC;CACjD;AAED,yGAAyG;AACzG,MAAM,WAAW,6BAA8B,SAAQ,qBAAqB;IAC1E,kBAAkB,CAAC,KAAK,EAAE;QACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;KAClC,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;GAIG;AACH,qBAAa,6BAA6B;;gBAM5B,KAAK,EAAE;QACjB,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;QAC1C,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;QAClD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;QAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;KAChC;IAOK,WAAW,CAAC,KAAK,SAAK,GAAG,OAAO,CAAC,+BAA+B,CAAC;CAqHxE"}

package/node_modules/@noodle-borg/service/dist/platform-identity-sync.js

@@ -0,0 +1,179 @@
+import { normalizePlatformIdentityEmail } from './platform-identity.js';
+export class PlatformIdentitySyncError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = 'PlatformIdentitySyncError';
+    }
+}
+/**
+ * Bounded explicit worker. It never polls continuously, logs evidence, or authorizes by email. Email is used
+ * only to prove that creating a remote import will not collide; an existing local WorkOS link is always keyed
+ * by the immutable WorkOS user ID.
+ */
+export class PlatformIdentitySyncProcessor {
+    #store;
+    #directory;
+    #now;
+    #leaseSeconds;
+    constructor(input) {
+        this.#store = input.store;
+        this.#directory = input.directory;
+        this.#now = input.now ?? (() => new Date());
+        this.#leaseSeconds = input.leaseSeconds ?? 60;
+    }
+    async processOnce(limit = 25) {
+        if (!Number.isInteger(limit) || limit < 1 || limit > 100)
+            throw new Error('identity sync batch size must be between 1 and 100');
+        const leases = await this.#store.claimBatch({ limit, leaseSeconds: this.#leaseSeconds });
+        const result = { attempted: leases.length, delivered: 0, blocked: 0, retryRequired: 0 };
+        for (const lease of leases) {
+            const state = await this.#processLease(lease);
+            if (state === 'delivered')
+                result.delivered += 1;
+            else if (state === 'blocked')
+                result.blocked += 1;
+            else
+                result.retryRequired += 1;
+        }
+        return result;
+    }
+    async #processLease(lease) {
+        try {
+            const remote = lease.workosUserId === undefined
+                ? await this.#upsertImportedIdentity(lease)
+                : await this.#reconcileLinkedIdentity(lease, lease.workosUserId);
+            if (!matches(remote, lease))
+                return await this.#block(lease, 'remote_identity_conflict');
+            await this.#store.finish(lease, {
+                state: 'delivered',
+                outcomeCode: 'delivered',
+                remoteUserId: remote.id,
+            });
+            return 'delivered';
+        }
+        catch (error) {
+            const failure = directoryFailure(error);
+            if (failure === undefined)
+                throw error;
+            const { kind } = failure;
+            if (kind === 'permanent' || kind === 'unauthorized') {
+                await this.#store.finish(lease, {
+                    state: 'blocked',
+                    outcomeCode: kind === 'permanent' ? 'provider_permanent' : 'provider_unauthorized',
+                });
+                return 'blocked';
+            }
+            const outcomeCode = kind === 'conflict'
+                ? 'provider_conflict'
+                : kind === 'rate_limited'
+                    ? 'provider_rate_limited'
+                    : 'provider_transient';
+            await this.#store.finish(lease, {
+                state: 'retry',
+                outcomeCode,
+                retryAt: retryAt(this.#now(), lease.attempt, failure.retryAt),
+            });
+            return 'retry';
+        }
+    }
+    async #upsertImportedIdentity(lease) {
+        const byExternalId = await this.#directory.findUserByExternalId(lease.principalId);
+        if (byExternalId !== undefined) {
+            return matches(byExternalId, lease)
+                ? byExternalId
+                : this.#directory.updateVerifiedUser({
+                    userId: byExternalId.id,
+                    externalId: lease.principalId,
+                    normalizedEmail: lease.normalizedEmail,
+                });
+        }
+        const byEmail = await this.#directory.listUsersByNormalizedEmail(lease.normalizedEmail);
+        if (byEmail.length !== 0) {
+            // Email is collision evidence only. It never supplies a remote ID to an unlinked principal.
+            return conflictUser();
+        }
+        return this.#directory.createVerifiedUser({
+            externalId: lease.principalId,
+            normalizedEmail: lease.normalizedEmail,
+        });
+    }
+    async #reconcileLinkedIdentity(lease, workosUserId) {
+        const byExternalId = await this.#directory.findUserByExternalId(lease.principalId);
+        if (byExternalId !== undefined) {
+            if (byExternalId.id !== workosUserId)
+                return conflictUser();
+            return matches(byExternalId, lease)
+                ? byExternalId
+                : this.#directory.updateVerifiedUser({
+                    userId: workosUserId,
+                    externalId: lease.principalId,
+                    normalizedEmail: lease.normalizedEmail,
+                });
+        }
+        const byEmail = await this.#directory.listUsersByNormalizedEmail(lease.normalizedEmail);
+        if (byEmail.some((candidate) => candidate.id !== workosUserId))
+            return conflictUser();
+        const linkedUser = byEmail.find((candidate) => candidate.id === workosUserId);
+        if (linkedUser?.externalId !== undefined && linkedUser.externalId !== lease.principalId) {
+            return conflictUser();
+        }
+        if (linkedUser !== undefined && matches(linkedUser, lease))
+            return linkedUser;
+        // The immutable local link—not the email result—authorizes this exact remote user update. An empty email
+        // page is tolerated because WorkOS reads may be eventually consistent immediately after signup.
+        return this.#directory.updateVerifiedUser({
+            userId: workosUserId,
+            externalId: lease.principalId,
+            normalizedEmail: lease.normalizedEmail,
+        });
+    }
+    async #block(lease, outcomeCode) {
+        await this.#store.finish(lease, { state: 'blocked', outcomeCode });
+        return 'blocked';
+    }
+}
+function matches(user, lease) {
+    return (user.verified &&
+        user.externalId === lease.principalId &&
+        normalizePlatformIdentityEmail(user.normalizedEmail) === lease.normalizedEmail &&
+        (lease.workosUserId === undefined || user.id === lease.workosUserId));
+}
+function conflictUser() {
+    return {
+        id: '',
+        externalId: undefined,
+        normalizedEmail: 'conflict@invalid.local',
+        verified: false,
+    };
+}
+function directoryFailure(error) {
+    if (typeof error !== 'object' || error === null || !('kind' in error))
+        return undefined;
+    const kind = error.kind;
+    if (!isDirectoryFailureKind(kind))
+        return undefined;
+    const retryAt = 'retryAt' in error ? error.retryAt : undefined;
+    return {
+        kind,
+        ...(typeof retryAt === 'string' ? { retryAt } : {}),
+    };
+}
+function retryAt(now, attempt, providerRetryAt) {
+    const seconds = Math.min(3_600, 15 * 2 ** Math.max(0, Math.min(attempt - 1, 8)));
+    const local = now.getTime() + seconds * 1_000;
+    const parsed = providerRetryAt === undefined ? Number.NaN : Date.parse(providerRetryAt);
+    const provider = Number.isFinite(parsed)
+        ? Math.min(now.getTime() + 3_600_000, Math.max(now.getTime() + 1_000, parsed))
+        : local;
+    return new Date(Math.max(local, provider)).toISOString();
+}
+function isDirectoryFailureKind(value) {
+    return (value === 'conflict' ||
+        value === 'rate_limited' ||
+        value === 'transient' ||
+        value === 'permanent' ||
+        value === 'unauthorized');
+}
+//# sourceMappingURL=platform-identity-sync.js.map

package/node_modules/@noodle-borg/service/dist/platform-identity-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-identity-sync.js","sourceRoot":"","sources":["../src/platform-identity-sync.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AA4BxE,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAEvC;IADX,YACW,IAI4B;QAErC,KAAK,CAAC,IAAI,CAAC,CAAC;QANH,SAAI,GAAJ,IAAI,CAIwB;QAGrC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAuFD;;;;GAIG;AACH,MAAM,OAAO,6BAA6B;IAC/B,MAAM,CAA4B;IAClC,UAAU,CAAgC;IAC1C,IAAI,CAAa;IACjB,aAAa,CAAS;IAE/B,YAAY,KAKX;QACC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAK,GAAG,EAAE;QAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG;YACtD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QACzF,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;QACxF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,KAAK,KAAK,WAAW;gBAAE,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;iBAC5C,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;;gBAC7C,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,KAAgC;QAEhC,IAAI,CAAC;YACH,MAAM,MAAM,GACV,KAAK,CAAC,YAAY,KAAK,SAAS;gBAC9B,CAAC,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC;gBAC3C,CAAC,CAAC,MAAM,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;YACrE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;gBAAE,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;YACzF,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE;gBAC9B,KAAK,EAAE,WAAW;gBAClB,WAAW,EAAE,WAAW;gBACxB,YAAY,EAAE,MAAM,CAAC,EAAE;aACxB,CAAC,CAAC;YACH,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,KAAK,CAAC;YACvC,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;YACzB,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;gBACpD,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE;oBAC9B,KAAK,EAAE,SAAS;oBAChB,WAAW,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,uBAAuB;iBACnF,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,WAAW,GACf,IAAI,KAAK,UAAU;gBACjB,CAAC,CAAC,mBAAmB;gBACrB,CAAC,CAAC,IAAI,KAAK,cAAc;oBACvB,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,oBAAoB,CAAC;YAC7B,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE;gBAC9B,KAAK,EAAE,OAAO;gBACd,WAAW;gBACX,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,KAAgC;QAEhC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACnF,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC;gBACjC,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;oBACjC,MAAM,EAAE,YAAY,CAAC,EAAE;oBACvB,UAAU,EAAE,KAAK,CAAC,WAAW;oBAC7B,eAAe,EAAE,KAAK,CAAC,eAAe;iBACvC,CAAC,CAAC;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACxF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,4FAA4F;YAC5F,OAAO,YAAY,EAAE,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;YACxC,UAAU,EAAE,KAAK,CAAC,WAAW;YAC7B,eAAe,EAAE,KAAK,CAAC,eAAe;SACvC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC5B,KAAgC,EAChC,YAAoB;QAEpB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACnF,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,YAAY,CAAC,EAAE,KAAK,YAAY;gBAAE,OAAO,YAAY,EAAE,CAAC;YAC5D,OAAO,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC;gBACjC,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;oBACjC,MAAM,EAAE,YAAY;oBACpB,UAAU,EAAE,KAAK,CAAC,WAAW;oBAC7B,eAAe,EAAE,KAAK,CAAC,eAAe;iBACvC,CAAC,CAAC;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACxF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,YAAY,CAAC;YAAE,OAAO,YAAY,EAAE,CAAC;QACtF,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;QAC9E,IAAI,UAAU,EAAE,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,UAAU,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;YACxF,OAAO,YAAY,EAAE,CAAC;QACxB,CAAC;QACD,IAAI,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC;QAC9E,yGAAyG;QACzG,gGAAgG;QAChG,OAAO,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;YACxC,MAAM,EAAE,YAAY;YACpB,UAAU,EAAE,KAAK,CAAC,WAAW;YAC7B,eAAe,EAAE,KAAK,CAAC,eAAe;SACvC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAAgC,EAChC,WAAuC;QAEvC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,SAAS,OAAO,CAAC,IAA+B,EAAE,KAAgC;IAChF,OAAO,CACL,IAAI,CAAC,QAAQ;QACb,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,WAAW;QACrC,8BAA8B,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,KAAK,CAAC,eAAe;QAC9E,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,YAAY,CAAC,CACrE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,OAAO;QACL,EAAE,EAAE,EAAE;QACN,UAAU,EAAE,SAAS;QACrB,eAAe,EAAE,wBAAwB;QACzC,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxF,MAAM,IAAI,GAAI,KAAqC,CAAC,IAAI,CAAC;IACzD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,OAAO,GACX,SAAS,IAAI,KAAK,CAAC,CAAC,CAAE,KAAwC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,OAAO;QACL,IAAI;QACJ,GAAG,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,GAAS,EAAE,OAAe,EAAE,eAAwB;IACnE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,KAAK,CAAC;IAC9C,MAAM,MAAM,GAAG,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACxF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QACtC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC;QAC9E,CAAC,CAAC,KAAK,CAAC;IACV,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,OAAO,CACL,KAAK,KAAK,UAAU;QACpB,KAAK,KAAK,cAAc;QACxB,KAAK,KAAK,WAAW;QACrB,KAAK,KAAK,WAAW;QACrB,KAAK,KAAK,cAAc,CACzB,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-identity.d.ts

@@ -0,0 +1,110 @@
+import type { BillingIdentityRef } from './billing/model.js';
+export declare const PLATFORM_PRINCIPAL_BILLING_ISSUER = "urn:noodleseed:principal:v1";
+export declare const GOOGLE_PLATFORM_IDENTITY_ISSUER = "https://accounts.google.com";
+export type PlatformPrincipalStatus = 'active' | 'suspended';
+/** A verified human returned by an upstream federation provider, never an upstream credential. */
+export interface UpstreamHumanIdentity {
+    readonly provider: string;
+    readonly realm: string;
+    readonly subject: string;
+    readonly email: string;
+    readonly emailVerified: boolean;
+}
+/** Provider-neutral boundary: authenticators yield verified identity claims, never upstream bearer tokens. */
+export interface UpstreamHumanAuthenticator {
+    authenticate(input: {
+        readonly bearerToken: string;
+    }): Promise<UpstreamHumanIdentity | undefined>;
+}
+export interface PlatformPrincipal {
+    readonly id: string;
+    readonly status: PlatformPrincipalStatus;
+    readonly billingIdentity: BillingIdentityRef;
+    readonly createdAt: string;
+}
+export interface PlatformIdentityLink {
+    readonly principalId: string;
+    readonly provider: string;
+    readonly realm: string;
+    readonly subject: string;
+    readonly createdAt: string;
+    readonly disabledAt?: string;
+}
+export interface PlatformIdentitySyncOutboxEntry {
+    readonly idempotencyKey: string;
+    readonly principalId: string;
+    readonly eventType: 'google_identity_upsert' | 'verified_email_changed' | 'workos_external_id_reconcile';
+    readonly createdAt: string;
+}
+export interface ResolvedPlatformIdentity {
+    /** Canonical Noodle subject. Existing Google identities retain their byte-for-byte Google sub. */
+    readonly subject: string;
+    readonly billingIdentity: BillingIdentityRef;
+}
+export declare class PlatformIdentityError extends Error {
+    readonly code: 'identity_email_unverified' | 'identity_link_required' | 'identity_link_disabled' | 'identity_link_remap_forbidden' | 'identity_signup_denied' | 'principal_suspended';
+    constructor(code: PlatformIdentityError['code']);
+}
+/** Persistence boundary for canonical human principals. It intentionally accepts identity claims, not tokens. */
+export interface PlatformIdentityStore {
+    resolve(input: UpstreamHumanIdentity): Promise<ResolvedPlatformIdentity>;
+    /** Immutable-link lookup only. It never joins on email and never creates a principal. */
+    resolveLinked(input: UpstreamHumanIdentity): Promise<ResolvedPlatformIdentity | undefined>;
+    hasVerifiedEmailEvidence(email: string): Promise<boolean>;
+    /** Look up a canonical principal for a Noodle-issued subject without creating/backfilling it. */
+    resolveExisting(principalId: string): Promise<ResolvedPlatformIdentity | undefined>;
+    assertActive(principalId: string): Promise<void>;
+}
+/** Provider-neutral entry point used by federation and direct human-control-plane gates. */
+export declare class PlatformPrincipalResolver {
+    #private;
+    constructor(store: PlatformIdentityStore);
+    resolve(input: UpstreamHumanIdentity): Promise<ResolvedPlatformIdentity>;
+    resolveLinked(input: UpstreamHumanIdentity): Promise<ResolvedPlatformIdentity | undefined>;
+    hasVerifiedEmailEvidence(email: string): Promise<boolean>;
+    resolveExisting(principalId: string): Promise<ResolvedPlatformIdentity | undefined>;
+    assertActive(principalId: string): Promise<void>;
+}
+/**
+ * Test/local implementation of the identity store. Per-identity de-duplication plus a non-Google email
+ * queue make concurrent account creation deterministic while preserving the durable store's collision rules.
+ */
+export declare class InMemoryPlatformIdentityStore implements PlatformIdentityStore {
+    #private;
+    constructor(options?: {
+        readonly now?: () => Date;
+    });
+    resolve(input: UpstreamHumanIdentity): Promise<ResolvedPlatformIdentity>;
+    linkIdentity(input: {
+        readonly principalId: string;
+        readonly provider: string;
+        readonly realm: string;
+        readonly subject: string;
+    }): Promise<PlatformIdentityLink>;
+    suspendPrincipal(principalId: string): Promise<void>;
+    assertActive(principalId: string): Promise<void>;
+    resolveExisting(principalId: string): Promise<ResolvedPlatformIdentity | undefined>;
+    resolveLinked(input: UpstreamHumanIdentity): Promise<ResolvedPlatformIdentity | undefined>;
+    hasVerifiedEmailEvidence(email: string): Promise<boolean>;
+    disableIdentity(input: {
+        readonly provider: string;
+        readonly realm: string;
+        readonly subject: string;
+    }): Promise<void>;
+    listPrincipals(): Promise<readonly PlatformPrincipal[]>;
+    listIdentityLinks(principalId: string): Promise<readonly PlatformIdentityLink[]>;
+    listVerifiedEmails(principalId: string): Promise<readonly string[]>;
+    listSyncOutbox(): Promise<readonly PlatformIdentitySyncOutboxEntry[]>;
+}
+/** Trim + lowercase only. Provider-specific aliases such as Gmail dots and plus tags are never rewritten. */
+export declare function normalizePlatformIdentityEmail(value: string): string;
+/**
+ * Bridges the additive control-plane field to billing during the migration. Old sessions and local gates keep
+ * their historical Google key; a resolved identity carries its immutable key instead of reconstructing one
+ * at each billing route.
+ */
+export declare function billingIdentityForControlPlaneIdentity(input: {
+    readonly subject: string;
+    readonly billingIdentity?: BillingIdentityRef;
+}): BillingIdentityRef;
+//# sourceMappingURL=platform-identity.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-identity.d.ts","sourceRoot":"","sources":["../src/platform-identity.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,eAAO,MAAM,iCAAiC,gCAAgC,CAAC;AAC/E,eAAO,MAAM,+BAA+B,gCAAgC,CAAC;AAE7E,MAAM,MAAM,uBAAuB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE7D,kGAAkG;AAClG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC;AAED,8GAA8G;AAC9G,MAAM,WAAW,0BAA0B;IACzC,YAAY,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAC;CACnG;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,kBAAkB,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EACd,wBAAwB,GACxB,wBAAwB,GACxB,8BAA8B,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACvC,kGAAkG;IAClG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,eAAe,EAAE,kBAAkB,CAAC;CAC9C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EACT,2BAA2B,GAC3B,wBAAwB,GACxB,wBAAwB,GACxB,+BAA+B,GAC/B,wBAAwB,GACxB,qBAAqB,CAAC;gBAEd,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC;CAKhD;AAED,iHAAiH;AACjH,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACzE,yFAAyF;IACzF,aAAa,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAC;IAC3F,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,iGAAiG;IACjG,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACpF,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAED,4FAA4F;AAC5F,qBAAa,yBAAyB;;gBAGxB,KAAK,EAAE,qBAAqB;IAIxC,OAAO,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAIxE,aAAa,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAI1F,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIzD,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAInF,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGjD;AAED;;;GAGG;AACH,qBAAa,6BAA8B,YAAW,qBAAqB;;gBAU7D,OAAO,GAAE;QAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;KAAO;IAIvD,OAAO,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IA2DlE,YAAY,CAAC,KAAK,EAAE;QACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAiC3B,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKpD,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhD,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAOnF,aAAa,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAUhG,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAInD,eAAe,CAAC,KAAK,EAAE;QAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,GAAG,OAAO,CAAC,IAAI,CAAC;IASjB,cAAc,IAAI,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC;IAIvD,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC;IAMhF,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAMnE,cAAc,IAAI,OAAO,CAAC,SAAS,+BAA+B,EAAE,CAAC;CA0FtE;AAED,6GAA6G;AAC7G,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMpE;AAED;;;;GAIG;AACH,wBAAgB,sCAAsC,CAAC,KAAK,EAAE;IAC5D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC;CAC/C,GAAG,kBAAkB,CAOrB"}