@noodleseed/one 0.63.1 → 0.64.0

package/node_modules/@noodle-borg/service/dist/oauth/workos-events.js

@@ -0,0 +1,310 @@
+import { WorkOS } from '@workos-inc/node';
+import { normalizePlatformIdentityEmail } from '../platform-identity.js';
+const WORKOS_EVENT_TYPES = [
+    'user.created',
+    'user.updated',
+    'user.deleted',
+    'session.revoked',
+];
+/** Official SDK boundary for Events API reads; it has no mutation capability. */
+export class WorkOSEventsSdkClient {
+    #events;
+    constructor(apiKey, events) {
+        if (events !== undefined) {
+            this.#events = events;
+            return;
+        }
+        const sdkEvents = new WorkOS(apiKey).events;
+        this.#events = {
+            listEvents: async (input) => sdkEvents.listEvents(input.after === undefined
+                ? { events: input.events, order: input.order }
+                : { events: input.events, order: input.order, after: input.after }),
+        };
+    }
+    async listEvents(input) {
+        const page = await this.#events.listEvents({ ...input, events: [...input.events] });
+        return {
+            data: page.data.map((event) => ({
+                id: event.id,
+                event: event.event,
+                data: event.data,
+            })),
+            listMetadata: page.listMetadata.after === null || page.listMetadata.after === undefined
+                ? {}
+                : { after: page.listMetadata.after },
+        };
+    }
+}
+/** Explicit job boundary — this is never a live poller and makes no upstream mutation. */
+export class WorkOSEventProcessor {
+    #client;
+    #store;
+    #realm;
+    #maxPages;
+    constructor(input) {
+        const maxPages = input.maxPages ?? 10;
+        if (!Number.isInteger(maxPages) || maxPages < 1 || maxPages > 100)
+            throw new Error('WorkOS Events max pages must be between 1 and 100');
+        this.#client = input.client;
+        this.#store = input.store;
+        this.#realm = input.realm;
+        this.#maxPages = maxPages;
+    }
+    async processOnce() {
+        let cursor = await this.#store.getCursor();
+        let processed = 0;
+        let after = cursor;
+        const pageCursors = new Set();
+        for (let pageNumber = 0; pageNumber < this.#maxPages; pageNumber += 1) {
+            const page = await this.#client.listEvents({
+                events: WORKOS_EVENT_TYPES,
+                order: 'asc',
+                ...(after === undefined ? {} : { after }),
+            });
+            for (const event of page.data) {
+                const result = await this.#store.applyAndAdvance({
+                    event,
+                    realm: this.#realm,
+                    ...(cursor === undefined ? {} : { expectedCursor: cursor }),
+                });
+                if (result.stale)
+                    throw new Error('WorkOS Events catch-up incomplete');
+                cursor = event.id;
+                if (result.applied)
+                    processed += 1;
+            }
+            const next = page.listMetadata.after;
+            if (next === undefined)
+                return { processed, ...(cursor === undefined ? {} : { cursor }), caughtUp: true };
+            if (page.data.length === 0 || next === after || pageCursors.has(next))
+                throw new Error('WorkOS Events catch-up incomplete');
+            pageCursors.add(next);
+            after = next;
+        }
+        throw new Error('WorkOS Events catch-up incomplete');
+    }
+}
+/** Test/local durable-behavior model. The Postgres implementation below is the production persistence port. */
+export class InMemoryWorkOSIdentityEventStore {
+    #events = new Set();
+    #users = new Map();
+    #cursor;
+    getCursor() {
+        return Promise.resolve(this.#cursor);
+    }
+    /** Convenience for focused store tests; production workers use `applyAndAdvance`. */
+    async apply(event, realm) {
+        const cursor = this.#cursor;
+        return (await this.applyAndAdvance({
+            event,
+            realm,
+            ...(cursor === undefined ? {} : { expectedCursor: cursor }),
+        })).applied;
+    }
+    async applyAndAdvance(input) {
+        if (this.#cursor !== input.expectedCursor)
+            return { applied: false, stale: true };
+        const parsed = parseEvent(input.event);
+        if (parsed === undefined)
+            throw new Error('malformed WorkOS event');
+        const duplicate = this.#events.has(input.event.id);
+        let applied = false;
+        if (!duplicate && parsed.kind === 'user.deleted') {
+            const prior = this.#users.get(parsed.user.id);
+            if (prior !== undefined) {
+                this.#users.set(parsed.user.id, { ...prior, status: 'suspended' });
+                applied = true;
+            }
+        }
+        else if (!duplicate && parsed.kind !== 'session.revoked') {
+            const prior = this.#users.get(parsed.user.id);
+            if (prior === undefined || prior.updatedAt < parsed.user.updatedAt) {
+                this.#users.set(parsed.user.id, {
+                    email: parsed.user.email,
+                    status: parsed.kind === 'user.deleted' ? 'suspended' : 'active',
+                    updatedAt: parsed.user.updatedAt,
+                });
+                applied = true;
+            }
+        }
+        this.#events.add(input.event.id);
+        this.#cursor = input.event.id;
+        return { applied, stale: false };
+    }
+    appliedEvents() {
+        return [...this.#events].sort();
+    }
+    user(id) {
+        const user = this.#users.get(id);
+        return user === undefined ? undefined : { email: user.email, status: user.status };
+    }
+}
+/** Durable Task 2 event store. Receipt, effect, freshness, and cursor move in one transaction. */
+export class PostgresWorkOSIdentityEventStore {
+    #pool;
+    #stream;
+    constructor(pool, options = {}) {
+        this.#pool = pool;
+        this.#stream = options.stream ?? 'authkit-users';
+    }
+    async getCursor() {
+        const result = await this.#pool.query(`SELECT cursor FROM platform_identity_event_cursors
+       WHERE provider = 'workos' AND stream = $1`, [this.#stream]);
+        return result.rows[0]?.cursor;
+    }
+    async apply(event, realm) {
+        const cursor = await this.getCursor();
+        const result = await this.applyAndAdvance({
+            event,
+            realm,
+            ...(cursor === undefined ? {} : { expectedCursor: cursor }),
+        });
+        return result.applied;
+    }
+    async applyAndAdvance(input) {
+        const parsed = parseEvent(input.event);
+        if (parsed === undefined)
+            throw new Error('malformed WorkOS event');
+        const client = await this.#pool.connect();
+        try {
+            await client.query('BEGIN');
+            await client.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [
+                `workos-event-stream:${this.#stream}`,
+            ]);
+            const cursor = await client.query(`SELECT cursor FROM platform_identity_event_cursors
+         WHERE provider = 'workos' AND stream = $1 FOR UPDATE`, [this.#stream]);
+            if (cursor.rows[0]?.cursor !== input.expectedCursor) {
+                await client.query('COMMIT');
+                return { applied: false, stale: true };
+            }
+            const receipt = await client.query(`INSERT INTO platform_identity_event_receipts (provider, event_id, occurred_at)
+         VALUES ('workos', $1, $2::timestamptz)
+         ON CONFLICT (provider, event_id) DO NOTHING RETURNING event_id`, [input.event.id, parsed.updatedAt]);
+            let applied = false;
+            if (receipt.rows.length > 0)
+                applied = await applyWorkOSEventEffect(client, parsed, input.realm);
+            await client.query(`INSERT INTO platform_identity_event_cursors (provider, stream, cursor, updated_at)
+         VALUES ('workos', $1, $2, now())
+         ON CONFLICT (provider, stream)
+           DO UPDATE SET cursor = EXCLUDED.cursor, updated_at = EXCLUDED.updated_at`, [this.#stream, input.event.id]);
+            await client.query('COMMIT');
+            return { applied, stale: false };
+        }
+        catch (error) {
+            await client.query('ROLLBACK').catch(() => undefined);
+            throw error;
+        }
+        finally {
+            client.release();
+        }
+    }
+}
+function parseEvent(event) {
+    if (event.event === 'session.revoked') {
+        const userId = stringField(event.data, 'user_id', 'userId');
+        const updatedAt = timestampField(event.data);
+        return userId === undefined || updatedAt === undefined
+            ? undefined
+            : { kind: 'session.revoked', userId, updatedAt };
+    }
+    if (event.event !== 'user.created' &&
+        event.event !== 'user.updated' &&
+        event.event !== 'user.deleted')
+        return undefined;
+    const id = stringField(event.data, 'id');
+    const email = stringField(event.data, 'email');
+    const emailVerified = booleanField(event.data, 'email_verified', 'emailVerified');
+    const updatedAt = timestampField(event.data);
+    return id === undefined ||
+        email === undefined ||
+        emailVerified === undefined ||
+        updatedAt === undefined
+        ? undefined
+        : { kind: event.event, user: { id, email, emailVerified, updatedAt }, updatedAt };
+}
+async function applyWorkOSEventEffect(client, event, realm) {
+    const externalId = event.kind === 'session.revoked' ? event.userId : event.user.id;
+    // Session revocation and account deletion are receipt-idempotent security events, not profile updates.
+    // A newer `user.updated_at` watermark must never mask either effect.
+    if (event.kind === 'session.revoked' || event.kind === 'user.deleted') {
+        const link = await client.query(`SELECT principal_id FROM platform_identity_links
+       WHERE provider = 'workos' AND realm = $1 AND external_id = $2 AND disabled_at IS NULL FOR UPDATE`, [realm, externalId]);
+        const principalId = link.rows[0]?.principal_id;
+        if (principalId === undefined)
+            return false;
+        await client.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [
+            `platform-principal:${principalId}`,
+        ]);
+        if (event.kind === 'user.deleted') {
+            await client.query(`UPDATE platform_identity_links
+         SET disabled_at = now()
+         WHERE provider = 'workos' AND realm = $1 AND external_id = $2
+           AND principal_id = $3 AND disabled_at IS NULL`, [realm, externalId, principalId]);
+            await client.query(`UPDATE platform_verified_emails SET status = 'superseded', observed_at = now()
+         WHERE principal_id = $1 AND provider = 'workos' AND realm = $2 AND status = 'active'`, [principalId, realm]);
+            await client.query(`UPDATE platform_principals
+         SET status = 'suspended', suspended_at = now()
+         WHERE principal_id = $1 AND status = 'active'`, [principalId]);
+        }
+        await revokePlatformRefreshFamilies(client, principalId);
+        return true;
+    }
+    const version = await client.query(`INSERT INTO platform_identity_upstream_versions
+       (provider, realm, external_id, upstream_updated_at)
+     VALUES ('workos', $1, $2, $3::timestamptz)
+     ON CONFLICT (provider, realm, external_id) DO UPDATE
+       SET upstream_updated_at = EXCLUDED.upstream_updated_at
+     WHERE platform_identity_upstream_versions.upstream_updated_at < EXCLUDED.upstream_updated_at
+     RETURNING external_id`, [realm, externalId, event.updatedAt]);
+    if (version.rows.length === 0)
+        return false;
+    const link = await client.query(`SELECT principal_id FROM platform_identity_links
+     WHERE provider = 'workos' AND realm = $1 AND external_id = $2 AND disabled_at IS NULL FOR UPDATE`, [realm, externalId]);
+    const principalId = link.rows[0]?.principal_id;
+    if (principalId === undefined)
+        return false;
+    await client.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [
+        `platform-principal:${principalId}`,
+    ]);
+    if (!event.user.emailVerified) {
+        await client.query(`UPDATE platform_verified_emails SET status = 'superseded', observed_at = now()
+       WHERE principal_id = $1 AND provider = 'workos' AND realm = $2 AND status = 'active'`, [principalId, realm]);
+        await revokePlatformRefreshFamilies(client, principalId);
+        return true;
+    }
+    const normalizedEmail = normalizePlatformIdentityEmail(event.user.email);
+    await client.query(`UPDATE platform_verified_emails SET status = 'superseded', observed_at = now()
+     WHERE principal_id = $1 AND provider = 'workos' AND realm = $2
+       AND status = 'active' AND normalized_email <> $3`, [principalId, realm, normalizedEmail]);
+    await client.query(`INSERT INTO platform_verified_emails
+       (principal_id, original_email, normalized_email, provider, realm, status, verified_at, observed_at)
+     VALUES ($1, $2, $3, 'workos', $4, 'active', now(), now())
+     ON CONFLICT (principal_id, normalized_email, provider, realm)
+       DO UPDATE SET original_email = EXCLUDED.original_email, status = 'active', observed_at = EXCLUDED.observed_at`, [principalId, event.user.email, normalizedEmail, realm]);
+    return true;
+}
+async function revokePlatformRefreshFamilies(client, principalId) {
+    const relation = await client.query("SELECT to_regclass('oauth_refresh_tokens')::text AS relation");
+    if (relation.rows[0]?.relation !== null) {
+        await client.query("DELETE FROM oauth_refresh_tokens WHERE owner_subject = $1 AND identity_kind IS DISTINCT FROM 'customer'", [principalId]);
+    }
+}
+function stringField(data, ...names) {
+    for (const name of names) {
+        const value = data[name];
+        if (typeof value === 'string' && value.length > 0)
+            return value;
+    }
+    return undefined;
+}
+function booleanField(data, ...names) {
+    for (const name of names)
+        if (typeof data[name] === 'boolean')
+            return data[name];
+    return undefined;
+}
+function timestampField(data) {
+    const value = stringField(data, 'updated_at', 'updatedAt');
+    return value === undefined || Number.isNaN(Date.parse(value)) ? undefined : value;
+}
+//# sourceMappingURL=workos-events.js.map

package/node_modules/@noodle-borg/service/dist/oauth/workos-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos-events.js","sourceRoot":"","sources":["../../src/oauth/workos-events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AAEzE,MAAM,kBAAkB,GAAG;IACzB,cAAc;IACd,cAAc;IACd,cAAc;IACd,iBAAiB;CACT,CAAC;AAsDX,iFAAiF;AACjF,MAAM,OAAO,qBAAqB;IACvB,OAAO,CAAsB;IAEtC,YAAY,MAAc,EAAE,MAA4B;QACtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QAC5C,IAAI,CAAC,OAAO,GAAG;YACb,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAC1B,SAAS,CAAC,UAAU,CAClB,KAAK,CAAC,KAAK,KAAK,SAAS;gBACvB,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBAC9C,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACrE;SACJ,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAIhB;QAIC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpF,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC9B,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,IAAyC;aACtD,CAAC,CAAC;YACH,YAAY,EACV,IAAI,CAAC,YAAY,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,KAAK,SAAS;gBACvE,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE;SACzC,CAAC;IACJ,CAAC;CACF;AAED,0FAA0F;AAC1F,MAAM,OAAO,oBAAoB;IACtB,OAAO,CAAqB;IAC5B,MAAM,CAA2B;IACjC,MAAM,CAAS;IACf,SAAS,CAAS;IAE3B,YAAY,KAKX;QACC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,GAAG;YAC/D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,WAAW;QAKf,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3C,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,KAAK,GAAG,MAAM,CAAC;QACnB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,KAAK,IAAI,UAAU,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,IAAI,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;gBACzC,MAAM,EAAE,kBAAkB;gBAC1B,KAAK,EAAE,KAAK;gBACZ,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;aAC1C,CAAC,CAAC;YACH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;oBAC/C,KAAK;oBACL,KAAK,EAAE,IAAI,CAAC,MAAM;oBAClB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;iBAC5D,CAAC,CAAC;gBACH,IAAI,MAAM,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBACvE,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC;gBAClB,IAAI,MAAM,CAAC,OAAO;oBAAE,SAAS,IAAI,CAAC,CAAC;YACrC,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;YACrC,IAAI,IAAI,KAAK,SAAS;gBACpB,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACpF,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;gBACnE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACvD,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtB,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;CACF;AAED,+GAA+G;AAC/G,MAAM,OAAO,gCAAgC;IAClC,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5B,MAAM,GAAG,IAAI,GAAG,EAGtB,CAAC;IACJ,OAAO,CAAqB;IAE5B,SAAS;QACP,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,KAAK,CAAC,KAA0B,EAAE,KAAa;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,OAAO,CACL,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,KAAK;YACL,KAAK;YACL,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;SAC5D,CAAC,CACH,CAAC,OAAO,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAIrB;QACC,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,cAAc;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAClF,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;gBACnE,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE;oBAC9B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;oBACxB,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;oBAC/D,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;iBACjC,CAAC,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,aAAa;QACX,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,CACF,EAAU;QAEV,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACrF,CAAC;CACF;AAED,kGAAkG;AAClG,MAAM,OAAO,gCAAgC;IAClC,KAAK,CAAO;IACZ,OAAO,CAAS;IAEzB,YAAY,IAAU,EAAE,UAAwC,EAAE;QAChE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACnC;iDAC2C,EAC3C,CAAC,IAAI,CAAC,OAAO,CAAC,CACf,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAA0B,EAAE,KAAa;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC;YACxC,KAAK;YACL,KAAK;YACL,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;SAC5D,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAIrB;QACC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5B,MAAM,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE;gBAC1E,uBAAuB,IAAI,CAAC,OAAO,EAAE;aACtC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B;8DACsD,EACtD,CAAC,IAAI,CAAC,OAAO,CAAC,CACf,CAAC;YACF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;gBACpD,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACzC,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC;;wEAEgE,EAChE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CACnC,CAAC;YACF,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;gBACzB,OAAO,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,MAAM,CAAC,KAAK,CAChB;;;oFAG4E,EAC5E,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAC/B,CAAC;YACF,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;CACF;AAiBD,SAAS,UAAU,CAAC,KAA0B;IAC5C,IAAI,KAAK,CAAC,KAAK,KAAK,iBAAiB,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,MAAM,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;YACpD,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACrD,CAAC;IACD,IACE,KAAK,CAAC,KAAK,KAAK,cAAc;QAC9B,KAAK,CAAC,KAAK,KAAK,cAAc;QAC9B,KAAK,CAAC,KAAK,KAAK,cAAc;QAE9B,OAAO,SAAS,CAAC;IACnB,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,EAAE,KAAK,SAAS;QACrB,KAAK,KAAK,SAAS;QACnB,aAAa,KAAK,SAAS;QAC3B,SAAS,KAAK,SAAS;QACvB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC;AACtF,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,MAAkB,EAClB,KAAwB,EACxB,KAAa;IAEb,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IACnF,uGAAuG;IACvG,qEAAqE;IACrE,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAC7B;wGACkG,EAClG,CAAC,KAAK,EAAE,UAAU,CAAC,CACpB,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC;QAC/C,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC5C,MAAM,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE;YAC1E,sBAAsB,WAAW,EAAE;SACpC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAClC,MAAM,MAAM,CAAC,KAAK,CAChB;;;yDAGiD,EACjD,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,CAAC,CACjC,CAAC;YACF,MAAM,MAAM,CAAC,KAAK,CAChB;8FACsF,EACtF,CAAC,WAAW,EAAE,KAAK,CAAC,CACrB,CAAC;YACF,MAAM,MAAM,CAAC,KAAK,CAChB;;uDAE+C,EAC/C,CAAC,WAAW,CAAC,CACd,CAAC;QACJ,CAAC;QACD,MAAM,6BAA6B,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC;;;;;;2BAMuB,EACvB,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CACrC,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAC7B;sGACkG,EAClG,CAAC,KAAK,EAAE,UAAU,CAAC,CACpB,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC;IAC/C,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE;QAC1E,sBAAsB,WAAW,EAAE;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9B,MAAM,MAAM,CAAC,KAAK,CAChB;4FACsF,EACtF,CAAC,WAAW,EAAE,KAAK,CAAC,CACrB,CAAC;QACF,MAAM,6BAA6B,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,eAAe,GAAG,8BAA8B,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzE,MAAM,MAAM,CAAC,KAAK,CAChB;;wDAEoD,EACpD,CAAC,WAAW,EAAE,KAAK,EAAE,eAAe,CAAC,CACtC,CAAC;IACF,MAAM,MAAM,CAAC,KAAK,CAChB;;;;qHAIiH,EACjH,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,CACxD,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,MAAkB,EAClB,WAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,8DAA8D,CAC/D,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,MAAM,CAAC,KAAK,CAChB,yGAAyG,EACzG,CAAC,WAAW,CAAC,CACd,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,IAAuC,EACvC,GAAG,KAAwB;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAClE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CACnB,IAAuC,EACvC,GAAG,KAAwB;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,IAAI,CAAY,CAAC;IAC5F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,IAAuC;IAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IAC3D,OAAO,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACpF,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/workos.d.ts

@@ -0,0 +1,65 @@
+import type { UpstreamHumanOAuthAuthenticator } from './upstream-human.js';
+export interface WorkOSUser {
+    readonly id: string;
+    readonly email: string;
+    readonly emailVerified: boolean;
+    readonly locale: string | null;
+}
+/** Narrow injectable SDK port; tests exercise the credential-disposal boundary without a live WorkOS call. */
+export interface WorkOSUserManagementClient {
+    getAuthorizationUrl(input: {
+        readonly provider: 'authkit';
+        readonly clientId: string;
+        readonly redirectUri: string;
+        readonly state: string;
+    }): string;
+    authenticateWithCode(input: {
+        readonly code: string;
+        readonly clientId: string;
+    }): Promise<{
+        readonly user: WorkOSUser;
+        readonly accessToken: string;
+        readonly refreshToken: string;
+        readonly authenticationMethod?: string;
+        readonly impersonator?: unknown;
+    }>;
+}
+export interface WorkOSHumanAuthenticatorConfig {
+    readonly clientId: string;
+    readonly apiKey: string;
+    readonly redirectUri: string;
+    /** Stable WorkOS environment/connection realm used by immutable local identity links. */
+    readonly realm: string;
+    /** Explicit rollout gate. Launch defaults to Google + Magic Auth; later methods require a release change. */
+    readonly allowedAuthenticationMethods?: readonly WorkOSPlatformAuthenticationMethod[];
+}
+export type WorkOSPlatformAuthenticationMethod = 'GoogleOAuth' | 'MagicAuth' | 'GitHubOAuth' | 'Password' | 'SSO';
+/** Operator input is deliberately separate from the derived callback URL. */
+export interface WorkOSRuntimeConfig {
+    readonly clientId?: string;
+    readonly apiKey?: string;
+    readonly realm?: string;
+    readonly allowedAuthenticationMethods?: readonly WorkOSPlatformAuthenticationMethod[];
+}
+/**
+ * Validates the optional WorkOS unit as one all-or-nothing production setting. Constructing the SDK is local;
+ * no WorkOS network request is made during service boot.
+ */
+export declare function createConfiguredWorkOSHumanAuthenticator(issuer: string, config: WorkOSRuntimeConfig | undefined): WorkOSHumanAuthenticator | undefined;
+/** WorkOS AuthKit adapter. It intentionally exposes identity claims only, never upstream credentials. */
+export declare class WorkOSHumanAuthenticator implements UpstreamHumanOAuthAuthenticator {
+    #private;
+    readonly provider: "workos";
+    readonly realm: string;
+    constructor(config: WorkOSHumanAuthenticatorConfig, userManagement?: WorkOSUserManagementClient);
+    authorizationUrl(state: string): string;
+    exchange(code: string): Promise<{
+        readonly provider: 'workos';
+        readonly realm: string;
+        readonly subject: string;
+        readonly email: string;
+        readonly emailVerified: boolean;
+        readonly locale?: string;
+    }>;
+}
+//# sourceMappingURL=workos.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/workos.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos.d.ts","sourceRoot":"","sources":["../../src/oauth/workos.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AAE3E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,8GAA8G;AAC9G,MAAM,WAAW,0BAA0B;IACzC,mBAAmB,CAAC,KAAK,EAAE;QACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,GAAG,MAAM,CAAC;IACX,oBAAoB,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACzF,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;QAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;QACvC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;KACjC,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yFAAyF;IACzF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,6GAA6G;IAC7G,QAAQ,CAAC,4BAA4B,CAAC,EAAE,SAAS,kCAAkC,EAAE,CAAC;CACvF;AAED,MAAM,MAAM,kCAAkC,GAC1C,aAAa,GACb,WAAW,GACX,aAAa,GACb,UAAU,GACV,KAAK,CAAC;AAEV,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,4BAA4B,CAAC,EAAE,SAAS,kCAAkC,EAAE,CAAC;CACvF;AAED;;;GAGG;AACH,wBAAgB,wCAAwC,CACtD,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,mBAAmB,GAAG,SAAS,GACtC,wBAAwB,GAAG,SAAS,CActC;AAED,yGAAyG;AACzG,qBAAa,wBAAyB,YAAW,+BAA+B;;IAC9E,QAAQ,CAAC,QAAQ,EAAG,QAAQ,CAAU;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAQrB,MAAM,EAAE,8BAA8B,EACtC,cAAc,GAAE,0BAGC;IAYnB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IASjC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QACpC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;QAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CAyBH"}

package/node_modules/@noodle-borg/service/dist/oauth/workos.js

@@ -0,0 +1,85 @@
+import { WorkOS } from '@workos-inc/node';
+/**
+ * Validates the optional WorkOS unit as one all-or-nothing production setting. Constructing the SDK is local;
+ * no WorkOS network request is made during service boot.
+ */
+export function createConfiguredWorkOSHumanAuthenticator(issuer, config) {
+    if (config === undefined)
+        return undefined;
+    const clientId = requiredWorkOSConfig('client id', config.clientId);
+    const apiKey = requiredWorkOSConfig('api key', config.apiKey);
+    const realm = requiredWorkOSConfig('realm', config.realm);
+    return new WorkOSHumanAuthenticator({
+        clientId,
+        apiKey,
+        realm,
+        redirectUri: `${issuer.replace(/\/+$/, '')}/oauth/workos/callback`,
+        ...(config.allowedAuthenticationMethods === undefined
+            ? {}
+            : { allowedAuthenticationMethods: config.allowedAuthenticationMethods }),
+    });
+}
+/** WorkOS AuthKit adapter. It intentionally exposes identity claims only, never upstream credentials. */
+export class WorkOSHumanAuthenticator {
+    provider = 'workos';
+    realm;
+    #clientId;
+    #redirectUri;
+    #realm;
+    #userManagement;
+    #allowedAuthenticationMethods;
+    constructor(config, userManagement = new WorkOS({
+        apiKey: config.apiKey,
+        clientId: config.clientId,
+    }).userManagement) {
+        this.#clientId = config.clientId;
+        this.#redirectUri = config.redirectUri;
+        this.#realm = requiredWorkOSConfig('realm', config.realm);
+        this.realm = this.#realm;
+        this.#userManagement = userManagement;
+        this.#allowedAuthenticationMethods = new Set(config.allowedAuthenticationMethods ?? ['GoogleOAuth', 'MagicAuth']);
+    }
+    authorizationUrl(state) {
+        return this.#userManagement.getAuthorizationUrl({
+            provider: 'authkit',
+            clientId: this.#clientId,
+            redirectUri: this.#redirectUri,
+            state,
+        });
+    }
+    async exchange(code) {
+        const { user, authenticationMethod, impersonator } = await this.#userManagement.authenticateWithCode({
+            code,
+            clientId: this.#clientId,
+        });
+        if (authenticationMethod === undefined ||
+            !this.#allowedAuthenticationMethods.has(authenticationMethod) ||
+            impersonator !== undefined ||
+            user.emailVerified !== true) {
+            throw new Error('WorkOS authentication method is not permitted');
+        }
+        const subject = requiredWorkOSIdentityValue('user ID', user.id);
+        const email = requiredWorkOSIdentityValue('email', user.email);
+        return {
+            provider: 'workos',
+            realm: this.#realm,
+            subject,
+            email,
+            emailVerified: user.emailVerified,
+            ...(user.locale !== null ? { locale: user.locale } : {}),
+        };
+    }
+}
+function requiredWorkOSConfig(name, value) {
+    const normalized = value?.trim();
+    if (normalized === undefined || normalized.length === 0)
+        throw new Error(`WorkOS client id, api key, and realm must be configured together (missing ${name})`);
+    return normalized;
+}
+function requiredWorkOSIdentityValue(name, value) {
+    const normalized = value.trim();
+    if (normalized.length === 0)
+        throw new Error(`WorkOS ${name} is invalid`);
+    return normalized;
+}
+//# sourceMappingURL=workos.js.map

package/node_modules/@noodle-borg/service/dist/oauth/workos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos.js","sourceRoot":"","sources":["../../src/oauth/workos.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAoD1C;;;GAGG;AACH,MAAM,UAAU,wCAAwC,CACtD,MAAc,EACd,MAAuC;IAEvC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,IAAI,wBAAwB,CAAC;QAClC,QAAQ;QACR,MAAM;QACN,KAAK;QACL,WAAW,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB;QAClE,GAAG,CAAC,MAAM,CAAC,4BAA4B,KAAK,SAAS;YACnD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,4BAA4B,EAAE,MAAM,CAAC,4BAA4B,EAAE,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,yGAAyG;AACzG,MAAM,OAAO,wBAAwB;IAC1B,QAAQ,GAAG,QAAiB,CAAC;IAC7B,KAAK,CAAS;IACd,SAAS,CAAS;IAClB,YAAY,CAAS;IACrB,MAAM,CAAS;IACf,eAAe,CAA6B;IAC5C,6BAA6B,CAAsB;IAE5D,YACE,MAAsC,EACtC,iBAA6C,IAAI,MAAM,CAAC;QACtD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC,cAAc;QAEjB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QACzB,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;QACtC,IAAI,CAAC,6BAA6B,GAAG,IAAI,GAAG,CAC1C,MAAM,CAAC,4BAA4B,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CACpE,CAAC;IACJ,CAAC;IAED,gBAAgB,CAAC,KAAa;QAC5B,OAAO,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC;YAC9C,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QAQzB,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,YAAY,EAAE,GAChD,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC;YAC9C,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,SAAS;SACzB,CAAC,CAAC;QACL,IACE,oBAAoB,KAAK,SAAS;YAClC,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,oBAAoB,CAAC;YAC7D,YAAY,KAAK,SAAS;YAC1B,IAAI,CAAC,aAAa,KAAK,IAAI,EAC3B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,OAAO,GAAG,2BAA2B,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,OAAO;YACL,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,OAAO;YACP,KAAK;YACL,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,KAAyB;IACnE,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACjC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,6EAA6E,IAAI,GAAG,CACrF,CAAC;IACJ,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAY,EAAE,KAAa;IAC9D,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC;IAC1E,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/node_modules/@noodle-borg/service/dist/options.d.ts

@@ -24,6 +24,8 @@ import type { FeedbackIssueClient } from './github/feedback-issues.js';
 import type { PendingGithubInstallationStore } from './github/pending-installations.js';
 import type { LoadedServiceModule } from './modules/host.js';
 import type { DeveloperGrantStore } from './oauth/developer-grant.js';
+import type { PlatformAuthOperator } from './platform-auth-operator.js';
+import type { PlatformIdentityStore } from './platform-identity.js';
 import type { PolicyAssignmentStore, PolicyCounterStore } from './policy.js';
 import type { AlertRuleStore } from './store/alert-rules.js';
 import type { AuditSink } from './store/audit.js';
@@ -62,6 +64,10 @@ export interface ServiceOptions {
      * PostgreSQL persistence owns this store and rejects a separately injected control-plane backend.
      */
     readonly controlPlaneStore?: ControlPlaneStore;
+    /** Optional canonical-human store. When absent, control-plane authentication remains direct Google. */
+    readonly platformIdentityStore?: PlatformIdentityStore;
+    /** Durable PostgreSQL-backed platform-human migration operator. No in-memory fallback is permitted. */
+    readonly platformAuthOperator?: PlatformAuthOperator;
     /**
      * Durable atomic store for the one-time existing-organization billing preparation. No in-memory
      * default is provided because owner, app, policy, and billing revalidation must share one transaction.
@@ -213,7 +219,7 @@ export interface ServiceOptions {
     /**
      * The self-hosted authorization-server Express sub-app (OA-2). When set, the front-door delegates the AS
      * paths ({@link isAuthServerPath}: `/authorize`, `/token`, `/register`, the AS metadata + JWKS, and the
-     * Google callback + generic/developer grant consent routes) to it. Built by {@link serveService} from the
+     * upstream-human callbacks + generic/developer grant consent routes) to it. Built by {@link serveService} from the
      * `oauth` config.
      */
     readonly authServerApp?: (req: IncomingMessage, res: ServerResponse) => void;
@@ -230,7 +236,7 @@ export interface ServiceOptions {
     readonly controlPlaneSignupMode?: ControlPlaneSignupMode;
     /** Public-signup denylist domains. Takes effect before domain/allowlist/public admission. */
     readonly deniedSignupDomains?: readonly string[];
-    /** Public-signup denylist Google/Noodle subjects. Takes effect before domain/allowlist/public admission. */
+    /** Public-signup denylist external/canonical subjects. Applied before domain/allowlist/public admission. */
     readonly deniedSignupSubjects?: readonly string[];
     /** Boot-initialized service modules. Dynamic loading is owned by serveService, never request handlers. */
     readonly loadedModules?: readonly LoadedServiceModule[];
@@ -287,6 +293,9 @@ export interface ServiceOptions {
      * here before receiving run-scoped and GitHub installation credentials.
      */
     readonly githubBuilder?: {
+        /** Immutable Google `sub` for the exact Cloud Run builder service account. */
+        readonly subject: string;
+        /** Informational service-account email used by deployment configuration, never authorization. */
         readonly serviceAccountEmail: string;
         readonly audience: string;
         readonly verifier?: GithubBuilderIdentityVerifier;

package/node_modules/@noodle-borg/service/dist/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,KAAK,EACV,aAAa,EACb,MAAM,EACN,kBAAkB,EAClB,UAAU,EACX,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC/F,OAAO,KAAK,EAAE,2CAA2C,EAAE,MAAM,gDAAgD,CAAC;AAClH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAC7F,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AAC7F,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EACV,WAAW,EACX,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEpF,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,iGAAiG;IACjG,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IACnD,oGAAoG;IACpG,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC,qFAAqF;IACrF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,KAAK,CAAC;IAC5C,mGAAmG;IACnG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAC1B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,kEAAkE;IAClE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,0GAA0G;IAC1G,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,2BAA2B,CAAC;IAC7D,wGAAwG;IACxG,QAAQ,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC;IACzE,iGAAiG;IACjG,QAAQ,CAAC,iCAAiC,CAAC,EAAE,iCAAiC,CAAC;IAC/E;;;OAGG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IACjE,wGAAwG;IACxG,QAAQ,CAAC,gCAAgC,CAAC,EAAE,gCAAgC,CAAC;IAC7E;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,kCAAkC,CAAC,EAAE,kCAAkC,CAAC;IACjF,iGAAiG;IACjG,QAAQ,CAAC,2CAA2C,CAAC,EAAE,2CAA2C,CAAC;IACnG,uGAAuG;IACvG,QAAQ,CAAC,sBAAsB,CAAC,EAAE,mCAAmC,CAAC;IACtE,oGAAoG;IACpG,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD,sGAAsG;IACtG,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD,yGAAyG;IACzG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,qGAAqG;IACrG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD,uEAAuE;IACvE,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAC3C,kGAAkG;IAClG,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,kGAAkG;IAClG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,yGAAyG;IACzG,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,wFAAwF;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,sCAAsC,CAAC,EAAE,OAAO,CAAC;IAC1D;;;OAGG;IACH,QAAQ,CAAC,4BAA4B,CAAC,EAAE,aAAa,CAAC;IACtD,yFAAyF;IACzF,QAAQ,CAAC,+BAA+B,CAAC,EAAE,MAAM,CAAC;IAClD,qFAAqF;IACrF,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IAC7C,uFAAuF;IACvF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,uEAAuE;IACvE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,iGAAiG;IACjG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAClE;;;OAGG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;IAC7E;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;IAC9E,0FAA0F;IAC1F,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C,4GAA4G;IAC5G,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACjD,sGAAsG;IACtG,QAAQ,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IACzD,6FAA6F;IAC7F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,4GAA4G;IAC5G,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,0GAA0G;IAC1G,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,mBAAmB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC;IACzE;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IAC/C,mGAAmG;IACnG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,6FAA6F;IAC7F,QAAQ,CAAC,gCAAgC,CAAC,EAAE,MAAM,CAAC;IACnD;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,6BAA6B,CAAC;KACnD,CAAC;CACH"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,KAAK,EACV,aAAa,EACb,MAAM,EACN,kBAAkB,EAClB,UAAU,EACX,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC/F,OAAO,KAAK,EAAE,2CAA2C,EAAE,MAAM,gDAAgD,CAAC;AAClH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAC7F,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AAC7F,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EACV,WAAW,EACX,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEpF,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,iGAAiG;IACjG,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IACnD,oGAAoG;IACpG,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC,qFAAqF;IACrF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,KAAK,CAAC;IAC5C,mGAAmG;IACnG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAC1B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,kEAAkE;IAClE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,0GAA0G;IAC1G,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,uGAAuG;IACvG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD,uGAAuG;IACvG,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;OAGG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,2BAA2B,CAAC;IAC7D,wGAAwG;IACxG,QAAQ,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC;IACzE,iGAAiG;IACjG,QAAQ,CAAC,iCAAiC,CAAC,EAAE,iCAAiC,CAAC;IAC/E;;;OAGG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IACjE,wGAAwG;IACxG,QAAQ,CAAC,gCAAgC,CAAC,EAAE,gCAAgC,CAAC;IAC7E;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,kCAAkC,CAAC,EAAE,kCAAkC,CAAC;IACjF,iGAAiG;IACjG,QAAQ,CAAC,2CAA2C,CAAC,EAAE,2CAA2C,CAAC;IACnG,uGAAuG;IACvG,QAAQ,CAAC,sBAAsB,CAAC,EAAE,mCAAmC,CAAC;IACtE,oGAAoG;IACpG,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD,sGAAsG;IACtG,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD,yGAAyG;IACzG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,qGAAqG;IACrG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD,uEAAuE;IACvE,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAC3C,kGAAkG;IAClG,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,kGAAkG;IAClG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,yGAAyG;IACzG,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,wFAAwF;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,sCAAsC,CAAC,EAAE,OAAO,CAAC;IAC1D;;;OAGG;IACH,QAAQ,CAAC,4BAA4B,CAAC,EAAE,aAAa,CAAC;IACtD,yFAAyF;IACzF,QAAQ,CAAC,+BAA+B,CAAC,EAAE,MAAM,CAAC;IAClD,qFAAqF;IACrF,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IAC7C,uFAAuF;IACvF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,uEAAuE;IACvE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,iGAAiG;IACjG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAClE;;;OAGG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;IAC7E;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;IAC9E,0FAA0F;IAC1F,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C,4GAA4G;IAC5G,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACjD,sGAAsG;IACtG,QAAQ,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IACzD,6FAA6F;IAC7F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,4GAA4G;IAC5G,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,0GAA0G;IAC1G,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,mBAAmB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC;IACzE;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IAC/C,mGAAmG;IACnG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,6FAA6F;IAC7F,QAAQ,CAAC,gCAAgC,CAAC,EAAE,MAAM,CAAC;IACnD;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvB,8EAA8E;QAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,iGAAiG;QACjG,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,6BAA6B,CAAC;KACnD,CAAC;CACH"}

package/node_modules/@noodle-borg/service/dist/personal-workspace.d.ts

@@ -6,4 +6,6 @@ export interface PersonalWorkspace {
 }
 export declare function ensurePersonalWorkspace(controlPlane: ControlPlaneStore, identity: ControlPlaneIdentity): Promise<PersonalWorkspace>;
 export declare function personalOrgSlug(identity: Pick<ControlPlaneIdentity, 'subject' | 'email'>): string;
+/** Immutable suffix used to discover and bind legacy email-derived personal organization slugs. */
+export declare function personalOrgSlugSuffix(subject: string): string;
 //# sourceMappingURL=personal-workspace.d.ts.map

package/node_modules/@noodle-borg/service/dist/personal-workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"personal-workspace.d.ts","sourceRoot":"","sources":["../src/personal-workspace.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG/D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,iBAAiB,EAC/B,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CAS5B;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,MAAM,CAKjG"}
+{"version":3,"file":"personal-workspace.d.ts","sourceRoot":"","sources":["../src/personal-workspace.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG/D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,iBAAiB,EAC/B,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CAY5B;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,MAAM,CAIjG;AAED,mGAAmG;AACnG,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE7D"}

package/node_modules/@noodle-borg/service/dist/personal-workspace.js

@@ -5,6 +5,9 @@ export async function ensurePersonalWorkspace(controlPlane, identity) {
     return controlPlane.provisionPersonalWorkspace({
         slug,
         displayName: identity.email,
+        ...(identity.billingIdentity === undefined
+            ? {}
+            : { identityIssuer: identity.billingIdentity.identityIssuer }),
         subject: identity.subject,
         email: identity.email,
         ...(identity.givenName !== undefined ? { firstName: identity.givenName } : {}),
@@ -13,8 +16,11 @@ export async function ensurePersonalWorkspace(controlPlane, identity) {
 export function personalOrgSlug(identity) {
     const localPart = identity.email.split('@')[0] ?? 'user';
     const base = slugPart(localPart).slice(0, 52) || 'user';
-    const hash = createHash('sha256').update(identity.subject).digest('hex').slice(0, 8);
-    return validateSlug('org', `u-${base}-${hash}`);
+    return validateSlug('org', `u-${base}${personalOrgSlugSuffix(identity.subject)}`);
+}
+/** Immutable suffix used to discover and bind legacy email-derived personal organization slugs. */
+export function personalOrgSlugSuffix(subject) {
+    return `-${createHash('sha256').update(subject).digest('hex').slice(0, 8)}`;
 }
 function slugPart(value) {
     return value

package/node_modules/@noodle-borg/service/dist/personal-workspace.js.map

@@ -1 +1 @@
-{"version":3,"file":"personal-workspace.js","sourceRoot":"","sources":["../src/personal-workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAO1C,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAA+B,EAC/B,QAA8B;IAE9B,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,YAAY,CAAC,0BAA0B,CAAC;QAC7C,IAAI;QACJ,WAAW,EAAE,QAAQ,CAAC,KAAK;QAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAyD;IACvF,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrF,OAAO,YAAY,CAAC,KAAK,EAAE,KAAK,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK;SACT,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"personal-workspace.js","sourceRoot":"","sources":["../src/personal-workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAO1C,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAA+B,EAC/B,QAA8B;IAE9B,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,YAAY,CAAC,0BAA0B,CAAC;QAC7C,IAAI;QACJ,WAAW,EAAE,QAAQ,CAAC,KAAK;QAC3B,GAAG,CAAC,QAAQ,CAAC,eAAe,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,eAAe,CAAC,cAAc,EAAE,CAAC;QAChE,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAyD;IACvF,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;IACxD,OAAO,YAAY,CAAC,KAAK,EAAE,KAAK,IAAI,GAAG,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK;SACT,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC"}