@noodleseed/one 0.63.1 → 0.64.0

package/node_modules/@noodle-borg/service/dist/platform-auth-configuration.d.ts

@@ -0,0 +1,67 @@
+import { type Aggregate, type DurableState, type Lineage, previewRequest } from './platform-auth-rollout-support.js';
+export interface WorkOSConfigurationIdentity {
+    readonly clientId: string;
+    readonly realm: string;
+}
+export interface DurableWorkOSRolloutConfiguration {
+    readonly workosPercentage: number;
+    readonly workosRecoveryClientIds: readonly string[];
+    readonly workosRecoveryEnabled: boolean;
+    readonly lifecycle: 'google' | 'workos' | 'finalized';
+    readonly workosClientFingerprint: string | null;
+    readonly workosRealmFingerprint: string | null;
+}
+export interface WorkOSConfigurationFingerprints {
+    readonly client: string;
+    readonly realm: string;
+}
+export type StoredWorkOSRolloutState = DurableState & {
+    readonly workosClientFingerprint: string | null;
+    readonly workosRealmFingerprint: string | null;
+};
+interface WorkOSRolloutBindingState {
+    readonly workosPercentage: number;
+    readonly workosRecoveryClientIds: readonly string[];
+    readonly workosRecoveryEnabled: boolean;
+    readonly lifecycle: 'google' | 'workos' | 'finalized';
+    readonly workosClientFingerprint: string | null;
+    readonly workosRealmFingerprint: string | null;
+}
+interface WorkOSRolloutBindingTarget {
+    readonly percentage: number;
+    readonly recoveryClientIds: readonly string[];
+}
+export type WorkOSRolloutBindingResolution = {
+    readonly valid: false;
+} | {
+    readonly valid: true;
+    readonly fingerprints: WorkOSConfigurationFingerprints | undefined;
+};
+/** One-way configuration identity used only for local continuity checks; raw identifiers are never persisted. */
+export declare function platformAuthConfigurationFingerprint(value: string): string;
+/** Fail closed before any transaction can select WorkOS under a different environment configuration. */
+export declare function assertWorkOSRolloutConfigurationContinuity(rollout: DurableWorkOSRolloutConfiguration, configured: WorkOSConfigurationIdentity | undefined): void;
+/** Resolve the immutable fingerprints a rollout mutation must bind without exposing raw configuration. */
+export declare function resolveWorkOSRolloutConfigurationFingerprints(state: WorkOSRolloutBindingState, target: WorkOSRolloutBindingTarget, configured: WorkOSConfigurationIdentity | undefined, requestedRealm: string): WorkOSRolloutBindingResolution;
+export declare function configurationBoundPreviewRequest(state: DurableState, aggregate: Aggregate, lineage: Lineage, input: Parameters<typeof previewRequest>[3], configuration: WorkOSConfigurationFingerprints | undefined): {
+    workosClientFingerprint: string | null;
+    rollbackRehearsalChecksum: string | null;
+    stagingWorkosOnlySmokeChecksum: string | null;
+    state: DurableState;
+    aggregate: Aggregate;
+    lineage: {
+        inventoryRunHash: string;
+        inventoryChecksum: string;
+        importRunHash: string;
+        importLineageChecksum: string;
+        workosRealmFingerprint: string;
+    };
+    operation: "activate" | "rollback" | "finalize";
+    percentage: number;
+    cohortMode: "replace" | "preserve";
+    canaryClientIds: readonly string[];
+    recoveryClientIds: readonly string[];
+    releaseSha: string;
+};
+export {};
+//# sourceMappingURL=platform-auth-configuration.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-configuration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-configuration.d.ts","sourceRoot":"","sources":["../src/platform-auth-configuration.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,OAAO,EACZ,cAAc,EACf,MAAM,oCAAoC,CAAC;AAE5C,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpD,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;IACtD,QAAQ,CAAC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;CAChD;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,wBAAwB,GAAG,YAAY,GAAG;IACpD,QAAQ,CAAC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF,UAAU,yBAAyB;IACjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpD,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;IACtD,QAAQ,CAAC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;CAChD;AAED,UAAU,0BAA0B;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,MAAM,MAAM,8BAA8B,GACtC;IAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACzB;IACE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IACrB,QAAQ,CAAC,YAAY,EAAE,+BAA+B,GAAG,SAAS,CAAC;CACpE,CAAC;AAEN,iHAAiH;AACjH,wBAAgB,oCAAoC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wGAAwG;AACxG,wBAAgB,0CAA0C,CACxD,OAAO,EAAE,iCAAiC,EAC1C,UAAU,EAAE,2BAA2B,GAAG,SAAS,GAClD,IAAI,CAiBN;AAED,0GAA0G;AAC1G,wBAAgB,6CAA6C,CAC3D,KAAK,EAAE,yBAAyB,EAChC,MAAM,EAAE,0BAA0B,EAClC,UAAU,EAAE,2BAA2B,GAAG,SAAS,EACnD,cAAc,EAAE,MAAM,GACrB,8BAA8B,CAyBhC;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,YAAY,EACnB,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,EAC3C,aAAa,EAAE,+BAA+B,GAAG,SAAS;;;;;;;;;;;;;;;;;;;EAM3D"}

package/node_modules/@noodle-borg/service/dist/platform-auth-configuration.js

@@ -0,0 +1,54 @@
+import { createHash } from 'node:crypto';
+import { previewRequest, } from './platform-auth-rollout-support.js';
+/** One-way configuration identity used only for local continuity checks; raw identifiers are never persisted. */
+export function platformAuthConfigurationFingerprint(value) {
+    return createHash('sha256').update(JSON.stringify(value.trim())).digest('hex');
+}
+/** Fail closed before any transaction can select WorkOS under a different environment configuration. */
+export function assertWorkOSRolloutConfigurationContinuity(rollout, configured) {
+    const canRouteWorkOS = rollout.workosPercentage > 0 ||
+        rollout.lifecycle !== 'google' ||
+        rollout.workosRecoveryClientIds.length > 0 ||
+        rollout.workosRecoveryEnabled;
+    if (!canRouteWorkOS)
+        return;
+    if (configured === undefined ||
+        rollout.workosClientFingerprint === null ||
+        rollout.workosRealmFingerprint === null ||
+        rollout.workosClientFingerprint !== platformAuthConfigurationFingerprint(configured.clientId) ||
+        rollout.workosRealmFingerprint !== platformAuthConfigurationFingerprint(configured.realm)) {
+        throw new Error('WorkOS rollout configuration continuity check failed');
+    }
+}
+/** Resolve the immutable fingerprints a rollout mutation must bind without exposing raw configuration. */
+export function resolveWorkOSRolloutConfigurationFingerprints(state, target, configured, requestedRealm) {
+    const wasRouting = state.workosPercentage > 0 ||
+        state.lifecycle !== 'google' ||
+        state.workosRecoveryClientIds.length > 0 ||
+        state.workosRecoveryEnabled;
+    const willRoute = target.percentage > 0 || target.recoveryClientIds.length > 0;
+    if (!wasRouting && !willRoute)
+        return { valid: true, fingerprints: undefined };
+    if (configured === undefined || configured.clientId.trim().length === 0)
+        return { valid: false };
+    const fingerprints = {
+        client: platformAuthConfigurationFingerprint(configured.clientId),
+        realm: platformAuthConfigurationFingerprint(configured.realm),
+    };
+    if (configured.realm.trim() !== requestedRealm.trim() ||
+        (wasRouting &&
+            (state.workosClientFingerprint === null || state.workosRealmFingerprint === null)) ||
+        (state.workosClientFingerprint !== null &&
+            state.workosClientFingerprint !== fingerprints.client) ||
+        (state.workosRealmFingerprint !== null && state.workosRealmFingerprint !== fingerprints.realm)) {
+        return { valid: false };
+    }
+    return { valid: true, fingerprints };
+}
+export function configurationBoundPreviewRequest(state, aggregate, lineage, input, configuration) {
+    return {
+        ...previewRequest(state, aggregate, lineage, input),
+        workosClientFingerprint: configuration?.client ?? null,
+    };
+}
+//# sourceMappingURL=platform-auth-configuration.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-configuration.js","sourceRoot":"","sources":["../src/platform-auth-configuration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAIL,cAAc,GACf,MAAM,oCAAoC,CAAC;AA+C5C,iHAAiH;AACjH,MAAM,UAAU,oCAAoC,CAAC,KAAa;IAChE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjF,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,0CAA0C,CACxD,OAA0C,EAC1C,UAAmD;IAEnD,MAAM,cAAc,GAClB,OAAO,CAAC,gBAAgB,GAAG,CAAC;QAC5B,OAAO,CAAC,SAAS,KAAK,QAAQ;QAC9B,OAAO,CAAC,uBAAuB,CAAC,MAAM,GAAG,CAAC;QAC1C,OAAO,CAAC,qBAAqB,CAAC;IAChC,IAAI,CAAC,cAAc;QAAE,OAAO;IAE5B,IACE,UAAU,KAAK,SAAS;QACxB,OAAO,CAAC,uBAAuB,KAAK,IAAI;QACxC,OAAO,CAAC,sBAAsB,KAAK,IAAI;QACvC,OAAO,CAAC,uBAAuB,KAAK,oCAAoC,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC7F,OAAO,CAAC,sBAAsB,KAAK,oCAAoC,CAAC,UAAU,CAAC,KAAK,CAAC,EACzF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,6CAA6C,CAC3D,KAAgC,EAChC,MAAkC,EAClC,UAAmD,EACnD,cAAsB;IAEtB,MAAM,UAAU,GACd,KAAK,CAAC,gBAAgB,GAAG,CAAC;QAC1B,KAAK,CAAC,SAAS,KAAK,QAAQ;QAC5B,KAAK,CAAC,uBAAuB,CAAC,MAAM,GAAG,CAAC;QACxC,KAAK,CAAC,qBAAqB,CAAC;IAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,GAAG,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/E,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;IAC/E,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAEjG,MAAM,YAAY,GAAG;QACnB,MAAM,EAAE,oCAAoC,CAAC,UAAU,CAAC,QAAQ,CAAC;QACjE,KAAK,EAAE,oCAAoC,CAAC,UAAU,CAAC,KAAK,CAAC;KAC9D,CAAC;IACF,IACE,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,cAAc,CAAC,IAAI,EAAE;QACjD,CAAC,UAAU;YACT,CAAC,KAAK,CAAC,uBAAuB,KAAK,IAAI,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,CAAC,CAAC;QACpF,CAAC,KAAK,CAAC,uBAAuB,KAAK,IAAI;YACrC,KAAK,CAAC,uBAAuB,KAAK,YAAY,CAAC,MAAM,CAAC;QACxD,CAAC,KAAK,CAAC,sBAAsB,KAAK,IAAI,IAAI,KAAK,CAAC,sBAAsB,KAAK,YAAY,CAAC,KAAK,CAAC,EAC9F,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAAmB,EACnB,SAAoB,EACpB,OAAgB,EAChB,KAA2C,EAC3C,aAA0D;IAE1D,OAAO;QACL,GAAG,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC;QACnD,uBAAuB,EAAE,aAAa,EAAE,MAAM,IAAI,IAAI;KACvD,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-frozen-candidate-postgres.d.ts

@@ -0,0 +1,25 @@
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+export interface BoundFrozenImportCandidate {
+    readonly source_realm: string;
+    readonly principal_id: string | null;
+    readonly normalized_email: string;
+    readonly email_fingerprint: string;
+    readonly provenance: readonly string[];
+    readonly blocker_codes: readonly string[];
+    readonly source_fingerprint: string;
+    readonly candidate_fingerprint: string;
+}
+/**
+ * Loads one candidate through the frozen inventory primary key. Completed inventory/candidate rows are
+ * append-only, so validating their persisted aggregate lineage is constant work after inventory finalization.
+ */
+export declare function loadBoundFrozenImportCandidate(pool: PlatformIdentityQueryable, input: {
+    readonly inventoryRunId: string;
+    readonly inventoryChecksum: string;
+    readonly releaseSha: string;
+    readonly workosRealmFingerprint: string;
+    readonly lineageChecksum: string;
+    readonly principalId: string;
+    readonly normalizedEmail: string;
+}): Promise<BoundFrozenImportCandidate>;
+//# sourceMappingURL=platform-auth-frozen-candidate-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-frozen-candidate-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-frozen-candidate-postgres.d.ts","sourceRoot":"","sources":["../src/platform-auth-frozen-candidate-postgres.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;CACxC;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,yBAAyB,EAC/B,KAAK,EAAE;IACL,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,GACA,OAAO,CAAC,0BAA0B,CAAC,CA2ErC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-frozen-candidate-postgres.js

@@ -0,0 +1,61 @@
+import { PlatformAuthMigrationError } from './platform-auth-migration.js';
+import { candidateDigest, migrationHash } from './platform-auth-migration-runs-postgres.js';
+/**
+ * Loads one candidate through the frozen inventory primary key. Completed inventory/candidate rows are
+ * append-only, so validating their persisted aggregate lineage is constant work after inventory finalization.
+ */
+export async function loadBoundFrozenImportCandidate(pool, input) {
+    const result = await pool.query(`SELECT candidate.source_subject, candidate.source_realm, candidate.principal_id,
+            candidate.normalized_email, candidate.email_fingerprint, candidate.provenance,
+            candidate.blocker_codes, candidate.source_fingerprint,
+            candidate.candidate_fingerprint, inventory.frozen_checksum,
+            inventory.source_fingerprint AS source_set_fingerprint,
+            inventory.excluded_fingerprint, inventory.release_sha,
+            inventory.workos_realm_fingerprint, inventory.google_realm,
+            inventory.inventory_format
+       FROM platform_auth_inventory_candidates candidate
+       JOIN identity_migration_runs inventory ON inventory.id = candidate.migration_run_id
+      WHERE candidate.migration_run_id = $1 AND candidate.source_subject = $2
+        AND inventory.kind = 'inventory' AND inventory.state = 'completed'
+      FOR SHARE OF candidate, inventory`, [input.inventoryRunId, input.principalId]);
+    const candidate = result.rows[0];
+    const expectedSourceFingerprint = migrationHash({
+        subject: input.principalId,
+        realm: candidate?.source_realm,
+        provenance: candidate?.provenance,
+    });
+    const legacySourceFingerprint = migrationHash({
+        subject: input.principalId,
+        provenance: candidate?.provenance,
+    });
+    if (candidate === undefined ||
+        candidate.frozen_checksum !== input.inventoryChecksum ||
+        candidate.release_sha !== input.releaseSha ||
+        candidate.workos_realm_fingerprint !== input.workosRealmFingerprint ||
+        candidate.google_realm === null ||
+        candidate.source_realm !== candidate.google_realm ||
+        candidate.source_set_fingerprint === null ||
+        (candidate.inventory_format !== 'v2' &&
+            candidate.inventory_format !== 'v1' &&
+            candidate.inventory_format !== 'legacy_v0') ||
+        (candidate.inventory_format !== 'legacy_v0' && candidate.excluded_fingerprint === null) ||
+        (candidate.source_fingerprint !== expectedSourceFingerprint &&
+            (candidate.inventory_format !== 'legacy_v0' ||
+                candidate.source_fingerprint !== legacySourceFingerprint)) ||
+        input.lineageChecksum !==
+            migrationHash({
+                inventoryRunHash: migrationHash(input.inventoryRunId),
+                inventoryChecksum: input.inventoryChecksum,
+                candidateSetChecksum: candidate.source_set_fingerprint,
+                workosRealmFingerprint: input.workosRealmFingerprint,
+                releaseSha: input.releaseSha,
+            }) ||
+        (candidate.principal_id !== null && candidate.principal_id !== input.principalId) ||
+        candidate.normalized_email !== input.normalizedEmail ||
+        candidate.email_fingerprint !== migrationHash(input.normalizedEmail) ||
+        candidate.blocker_codes.length !== 0 ||
+        candidate.candidate_fingerprint !== candidateDigest(candidate))
+        throw new PlatformAuthMigrationError('reconciliation_drift');
+    return candidate;
+}
+//# sourceMappingURL=platform-auth-frozen-candidate-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-frozen-candidate-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-frozen-candidate-postgres.js","sourceRoot":"","sources":["../src/platform-auth-frozen-candidate-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,4CAA4C,CAAC;AAc5F;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,IAA+B,EAC/B,KAQC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAkB7B;;;;;;;;;;;;wCAYoC,EACpC,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAC1C,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,yBAAyB,GAAG,aAAa,CAAC;QAC9C,OAAO,EAAE,KAAK,CAAC,WAAW;QAC1B,KAAK,EAAE,SAAS,EAAE,YAAY;QAC9B,UAAU,EAAE,SAAS,EAAE,UAAU;KAClC,CAAC,CAAC;IACH,MAAM,uBAAuB,GAAG,aAAa,CAAC;QAC5C,OAAO,EAAE,KAAK,CAAC,WAAW;QAC1B,UAAU,EAAE,SAAS,EAAE,UAAU;KAClC,CAAC,CAAC;IACH,IACE,SAAS,KAAK,SAAS;QACvB,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,iBAAiB;QACrD,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,UAAU;QAC1C,SAAS,CAAC,wBAAwB,KAAK,KAAK,CAAC,sBAAsB;QACnE,SAAS,CAAC,YAAY,KAAK,IAAI;QAC/B,SAAS,CAAC,YAAY,KAAK,SAAS,CAAC,YAAY;QACjD,SAAS,CAAC,sBAAsB,KAAK,IAAI;QACzC,CAAC,SAAS,CAAC,gBAAgB,KAAK,IAAI;YAClC,SAAS,CAAC,gBAAgB,KAAK,IAAI;YACnC,SAAS,CAAC,gBAAgB,KAAK,WAAW,CAAC;QAC7C,CAAC,SAAS,CAAC,gBAAgB,KAAK,WAAW,IAAI,SAAS,CAAC,oBAAoB,KAAK,IAAI,CAAC;QACvF,CAAC,SAAS,CAAC,kBAAkB,KAAK,yBAAyB;YACzD,CAAC,SAAS,CAAC,gBAAgB,KAAK,WAAW;gBACzC,SAAS,CAAC,kBAAkB,KAAK,uBAAuB,CAAC,CAAC;QAC9D,KAAK,CAAC,eAAe;YACnB,aAAa,CAAC;gBACZ,gBAAgB,EAAE,aAAa,CAAC,KAAK,CAAC,cAAc,CAAC;gBACrD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,oBAAoB,EAAE,SAAS,CAAC,sBAAsB;gBACtD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;gBACpD,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC;QACJ,CAAC,SAAS,CAAC,YAAY,KAAK,IAAI,IAAI,SAAS,CAAC,YAAY,KAAK,KAAK,CAAC,WAAW,CAAC;QACjF,SAAS,CAAC,gBAAgB,KAAK,KAAK,CAAC,eAAe;QACpD,SAAS,CAAC,iBAAiB,KAAK,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC;QACpE,SAAS,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QACpC,SAAS,CAAC,qBAAqB,KAAK,eAAe,CAAC,SAAS,CAAC;QAE9D,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;IAC/D,OAAO,SAAuC,CAAC;AACjD,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-legacy-sources-postgres.d.ts

@@ -0,0 +1,32 @@
+import { type PlatformAuthInventorySourceManifest } from './platform-auth-inventory-sources.js';
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+export type PlatformAuthInventoryProvenance = 'principal' | 'google_link' | 'google_billing' | 'org_membership' | 'refresh_family' | 'developer_grant' | 'owner_only_deployer' | 'consent_grant' | 'device_authorization' | 'welcome_provisioning';
+export interface PlatformAuthLegacyInventorySource {
+    readonly subject: string;
+    readonly provenance: ReadonlySet<PlatformAuthInventoryProvenance>;
+    readonly principalId?: string;
+    readonly realm?: string;
+    readonly identityDrift: boolean;
+    readonly excludedEvidence: boolean;
+}
+/** Source discovery retained only for compatibility tests and pre-paged inventory runs. */
+export declare class PostgresPlatformAuthLegacyInventorySources {
+    #private;
+    constructor(options: {
+        readonly googleRealm: string;
+        readonly sourceAvailability?: PlatformAuthInventorySourceManifest;
+        readonly excludedSubjects: readonly {
+            readonly subject: string;
+            readonly kind: 'workload' | 'synthetic';
+        }[];
+    });
+    discover(pool: PlatformIdentityQueryable): Promise<{
+        readonly sources: Map<string, PlatformAuthLegacyInventorySource>;
+        readonly excludedCount: number;
+        readonly excludedFingerprint: string;
+    }>;
+    assertManifest(pool: PlatformIdentityQueryable): Promise<void>;
+    emails(pool: PlatformIdentityQueryable, sources: readonly PlatformAuthLegacyInventorySource[]): Promise<Map<string, readonly string[]>>;
+    emailOwners(pool: PlatformIdentityQueryable): Promise<Map<string, Set<string>>>;
+}
+//# sourceMappingURL=platform-auth-inventory-legacy-sources-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-legacy-sources-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-inventory-legacy-sources-postgres.d.ts","sourceRoot":"","sources":["../src/platform-auth-inventory-legacy-sources-postgres.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,mCAAmC,EACzC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,MAAM,MAAM,+BAA+B,GACvC,WAAW,GACX,aAAa,GACb,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,qBAAqB,GACrB,eAAe,GACf,sBAAsB,GACtB,sBAAsB,CAAC;AAE3B,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,+BAA+B,CAAC,CAAC;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED,2FAA2F;AAC3F,qBAAa,0CAA0C;;gBAQzC,OAAO,EAAE;QACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,mCAAmC,CAAC;QAClE,QAAQ,CAAC,gBAAgB,EAAE,SAAS;YAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;YACzB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAAC;SACzC,EAAE,CAAC;KACL;IAMK,QAAQ,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC;QACvD,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;QACjE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;KACtC,CAAC;IAkII,cAAc,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IA0C9D,MAAM,CACV,IAAI,EAAE,yBAAyB,EAC/B,OAAO,EAAE,SAAS,iCAAiC,EAAE,GACpD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IAuBpC,WAAW,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;CAsFtF"}

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-legacy-sources-postgres.js

@@ -0,0 +1,231 @@
+import { createHash } from 'node:crypto';
+import { compareInventoryText } from './platform-auth-inventory-paging.js';
+import { PLATFORM_AUTH_INVENTORY_NON_AUTHORITY_SOURCES, PLATFORM_AUTH_INVENTORY_SOURCE_COLUMNS, PLATFORM_AUTH_INVENTORY_SOURCES, } from './platform-auth-inventory-sources.js';
+import { PlatformAuthMigrationError } from './platform-auth-migration.js';
+/** Source discovery retained only for compatibility tests and pre-paged inventory runs. */
+export class PostgresPlatformAuthLegacyInventorySources {
+    #googleRealm;
+    #manifest;
+    #excludedSubjects;
+    constructor(options) {
+        this.#googleRealm = options.googleRealm;
+        this.#manifest = options.sourceAvailability;
+        this.#excludedSubjects = options.excludedSubjects;
+    }
+    async discover(pool) {
+        const sources = new Map();
+        const excluded = new Set();
+        const suspended = new Set();
+        const suspendedWithAuthority = new Set();
+        const add = (input) => {
+            if (input.subject.length === 0)
+                return;
+            const previous = sources.get(input.subject);
+            const principalId = previous?.principalId ?? input.principalId;
+            const realm = previous?.realm ?? input.realm;
+            sources.set(input.subject, {
+                subject: input.subject,
+                provenance: new Set([...(previous?.provenance ?? []), input.provenance]),
+                identityDrift: previous?.identityDrift === true || input.identityDrift === true,
+                excludedEvidence: previous?.excludedEvidence === true || input.excludedEvidence === true,
+                ...(principalId === undefined ? {} : { principalId }),
+                realm: realm ?? this.#googleRealm,
+            });
+        };
+        const principalLinks = await pool.query(`SELECT p.principal_id, l.external_id, l.realm, p.status, p.billing_identity_issuer,
+              p.billing_subject, l.disabled_at FROM platform_principals p
+        JOIN platform_identity_links l ON l.principal_id = p.principal_id
+       WHERE l.provider = 'google' AND l.realm = $1`, [this.#googleRealm]);
+        for (const row of principalLinks.rows) {
+            if (row.status === 'suspended') {
+                suspended.add(row.external_id);
+                continue;
+            }
+            const identityDrift = !(row.disabled_at === null &&
+                row.principal_id === row.external_id &&
+                row.billing_identity_issuer === 'https://accounts.google.com' &&
+                row.billing_subject === row.external_id);
+            add({
+                subject: row.external_id,
+                provenance: 'principal',
+                principalId: row.principal_id,
+                realm: row.realm,
+                identityDrift,
+            });
+            add({
+                subject: row.external_id,
+                provenance: 'google_link',
+                principalId: row.principal_id,
+                realm: row.realm,
+                identityDrift,
+            });
+        }
+        await this.#addRoots(pool, add);
+        const excludedRows = [
+            ...(await this.#rows(pool, 'oauth_refresh_tokens', "SELECT owner_subject AS subject FROM oauth_refresh_tokens WHERE identity_kind = 'customer'")),
+            ...(await this.#rows(pool, 'oauth_device_authorizations', "SELECT owner_subject AS subject FROM oauth_device_authorizations WHERE owner_subject IS NOT NULL AND identity_kind = 'customer'")),
+            ...(await this.#rows(pool, 'oauth_delegated_credentials', 'SELECT subject FROM oauth_delegated_credentials')),
+        ];
+        for (const row of excludedRows)
+            excluded.add(row.subject);
+        for (const subject of excluded) {
+            const existing = sources.get(subject);
+            if (existing !== undefined)
+                add({
+                    subject,
+                    provenance: [...existing.provenance][0] ?? 'principal',
+                    excludedEvidence: true,
+                });
+        }
+        for (const subject of suspended) {
+            if (sources.has(subject))
+                suspendedWithAuthority.add(subject);
+            excluded.add(subject);
+            sources.delete(subject);
+        }
+        const configuredExclusions = new Map();
+        for (const entry of this.#excludedSubjects) {
+            configuredExclusions.set(entry.subject, entry.kind);
+            excluded.add(entry.subject);
+            sources.delete(entry.subject);
+        }
+        const artifactEvidence = {
+            nonAuthoritySources: PLATFORM_AUTH_INVENTORY_NON_AUTHORITY_SOURCES.filter((source) => this.#manifest?.[source] === 'configured'),
+        };
+        return {
+            sources,
+            excludedCount: [...excluded].filter((subject) => !sources.has(subject)).length,
+            excludedFingerprint: legacyHash({
+                subjects: [...excluded].sort(compareInventoryText).map((subject) => ({
+                    subjectFingerprint: legacyHash(subject),
+                    kind: configuredExclusions.get(subject) ??
+                        (suspendedWithAuthority.has(subject)
+                            ? 'suspended_principal_with_authority'
+                            : suspended.has(subject)
+                                ? 'suspended_principal'
+                                : 'non_platform_identity'),
+                })),
+                artifactEvidence,
+            }),
+        };
+    }
+    async assertManifest(pool) {
+        const manifest = this.#manifest;
+        if (manifest === undefined ||
+            Object.keys(manifest).length !== PLATFORM_AUTH_INVENTORY_SOURCES.length ||
+            PLATFORM_AUTH_INVENTORY_SOURCES.some((source) => manifest[source] !== 'configured' && manifest[source] !== 'not_applicable') ||
+            new Set(this.#excludedSubjects.map((entry) => entry.subject)).size !==
+                this.#excludedSubjects.length ||
+            this.#excludedSubjects.some((entry) => entry.subject.trim() !== entry.subject ||
+                entry.subject.length === 0 ||
+                entry.subject.length > 256) ||
+            ((manifest.billing_account_members === 'configured' ||
+                manifest.billing_account_defaults === 'configured') &&
+                manifest.billing_accounts !== 'configured'))
+            throw new PlatformAuthMigrationError('inventory_unavailable');
+        for (const source of PLATFORM_AUTH_INVENTORY_SOURCES) {
+            if (manifest[source] !== 'configured')
+                continue;
+            const columns = await pool.query(`SELECT attribute.attname AS name,
+                format_type(attribute.atttypid, attribute.atttypmod) AS type
+           FROM pg_attribute attribute
+          WHERE attribute.attrelid = to_regclass($1)
+            AND attribute.attnum > 0 AND NOT attribute.attisdropped`, [source]);
+            const actual = new Map(columns.rows.map((column) => [column.name, column.type]));
+            if (columns.rows.length === 0 ||
+                PLATFORM_AUTH_INVENTORY_SOURCE_COLUMNS[source].some(([name, type]) => actual.get(name) !== type))
+                throw new PlatformAuthMigrationError('inventory_unavailable');
+        }
+    }
+    async emails(pool, sources) {
+        const rows = await pool.query(`SELECT l.external_id, e.normalized_email FROM platform_identity_links l
+        JOIN platform_verified_emails e ON e.principal_id = l.principal_id
+         AND e.provider = 'google' AND e.realm = l.realm
+       WHERE l.provider = 'google' AND l.realm = $1
+         AND l.disabled_at IS NULL AND e.status = 'active'`, [this.#googleRealm]);
+        const known = new Set(sources.map((source) => source.subject));
+        const result = new Map();
+        for (const row of rows.rows) {
+            if (!known.has(row.external_id))
+                continue;
+            const emails = result.get(row.external_id) ?? [];
+            if (!emails.includes(row.normalized_email))
+                emails.push(row.normalized_email);
+            result.set(row.external_id, emails.sort(compareInventoryText));
+        }
+        return result;
+    }
+    async emailOwners(pool) {
+        const rows = await pool.query(`SELECT principal_id, normalized_email FROM platform_verified_emails
+        WHERE provider = 'google' AND realm = $1 AND status = 'active'`, [this.#googleRealm]);
+        const result = new Map();
+        for (const row of rows.rows) {
+            const owners = result.get(row.normalized_email) ?? new Set();
+            owners.add(row.principal_id);
+            result.set(row.normalized_email, owners);
+        }
+        return result;
+    }
+    async #addRoots(pool, add) {
+        const roots = [
+            ['org_members', 'org_membership', 'SELECT subject FROM org_members'],
+            [
+                'billing_account_members',
+                'google_billing',
+                `SELECT member.subject FROM billing_account_members member JOIN billing_accounts account ON account.id = member.billing_account_id WHERE member.identity_issuer = 'https://accounts.google.com' AND member.role = 'owner' AND account.state = 'active'`,
+            ],
+            [
+                'billing_account_defaults',
+                'google_billing',
+                `SELECT defaults.subject FROM billing_account_defaults defaults JOIN billing_accounts account ON account.id = defaults.billing_account_id JOIN billing_account_members member ON member.billing_account_id = defaults.billing_account_id AND member.identity_issuer = defaults.identity_issuer AND member.subject = defaults.subject WHERE defaults.identity_issuer = 'https://accounts.google.com' AND member.role = 'owner' AND account.state = 'active'`,
+            ],
+            [
+                'oauth_refresh_tokens',
+                'refresh_family',
+                `SELECT owner_subject AS subject FROM oauth_refresh_tokens WHERE identity_kind IS DISTINCT FROM 'customer' AND expires_at > now() AND rotated_at IS NULL AND superseded_by IS NULL`,
+            ],
+            [
+                'developer_access_grants',
+                'developer_grant',
+                'SELECT subject FROM developer_access_grants WHERE revoked_at IS NULL AND (expires_at IS NULL OR expires_at > now())',
+            ],
+            [
+                'deploy_records',
+                'owner_only_deployer',
+                `SELECT created_by_subject AS subject FROM deploy_records WHERE active = true AND access_mode = 'owner-only' AND created_by_subject IS NOT NULL AND deployment_source IS DISTINCT FROM 'github' AND archived_at IS NULL`,
+            ],
+            [
+                'oauth_consent_grants',
+                'consent_grant',
+                'SELECT owner_subject AS subject FROM oauth_consent_grants',
+            ],
+            [
+                'oauth_device_authorizations',
+                'device_authorization',
+                `SELECT owner_subject AS subject FROM oauth_device_authorizations WHERE owner_subject IS NOT NULL AND identity_kind IS DISTINCT FROM 'customer' AND status IN ('pending', 'approved') AND expires_at > now()`,
+            ],
+            [
+                'welcome_email_outbox',
+                'welcome_provisioning',
+                'SELECT subject FROM welcome_email_outbox',
+            ],
+        ];
+        for (const [source, provenance, query] of roots)
+            for (const row of await this.#rows(pool, source, query))
+                add({ subject: row.subject, provenance });
+    }
+    async #rows(pool, source, query) {
+        if (this.#manifest?.[source] !== 'configured')
+            return [];
+        try {
+            return (await pool.query(query)).rows;
+        }
+        catch {
+            throw new PlatformAuthMigrationError('inventory_unavailable');
+        }
+    }
+}
+function legacyHash(value) {
+    return createHash('sha256').update(JSON.stringify(value)).digest('hex');
+}
+//# sourceMappingURL=platform-auth-inventory-legacy-sources-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-legacy-sources-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-inventory-legacy-sources-postgres.js","sourceRoot":"","sources":["../src/platform-auth-inventory-legacy-sources-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EACL,6CAA6C,EAC7C,sCAAsC,EACtC,+BAA+B,GAGhC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAwB1E,2FAA2F;AAC3F,MAAM,OAAO,0CAA0C;IAC5C,YAAY,CAAS;IACrB,SAAS,CAAkD;IAC3D,iBAAiB,CAGtB;IAEJ,YAAY,OAOX;QACC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAC5C,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAA+B;QAK5C,MAAM,OAAO,GAAG,IAAI,GAAG,EAA6C,CAAC;QACrE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAC;QACjD,MAAM,GAAG,GAAG,CAAC,KAOZ,EAAE,EAAE;YACH,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,WAAW,GAAG,QAAQ,EAAE,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC;YAC/D,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE;gBACzB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;gBACxE,aAAa,EAAE,QAAQ,EAAE,aAAa,KAAK,IAAI,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI;gBAC/E,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,KAAK,IAAI,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI;gBACxF,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;gBACrD,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC,YAAY;aAClC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CASrC;;;oDAG8C,EAC9C,CAAC,IAAI,CAAC,YAAY,CAAC,CACpB,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC/B,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC/B,SAAS;YACX,CAAC;YACD,MAAM,aAAa,GAAG,CAAC,CACrB,GAAG,CAAC,WAAW,KAAK,IAAI;gBACxB,GAAG,CAAC,YAAY,KAAK,GAAG,CAAC,WAAW;gBACpC,GAAG,CAAC,uBAAuB,KAAK,6BAA6B;gBAC7D,GAAG,CAAC,eAAe,KAAK,GAAG,CAAC,WAAW,CACxC,CAAC;YACF,GAAG,CAAC;gBACF,OAAO,EAAE,GAAG,CAAC,WAAW;gBACxB,UAAU,EAAE,WAAW;gBACvB,WAAW,EAAE,GAAG,CAAC,YAAY;gBAC7B,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,aAAa;aACd,CAAC,CAAC;YACH,GAAG,CAAC;gBACF,OAAO,EAAE,GAAG,CAAC,WAAW;gBACxB,UAAU,EAAE,aAAa;gBACzB,WAAW,EAAE,GAAG,CAAC,YAAY;gBAC7B,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,aAAa;aACd,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChC,MAAM,YAAY,GAAG;YACnB,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAClB,IAAI,EACJ,sBAAsB,EACtB,4FAA4F,CAC7F,CAAC;YACF,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAClB,IAAI,EACJ,6BAA6B,EAC7B,iIAAiI,CAClI,CAAC;YACF,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAClB,IAAI,EACJ,6BAA6B,EAC7B,iDAAiD,CAClD,CAAC;SACH,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,YAAY;YAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,QAAQ,KAAK,SAAS;gBACxB,GAAG,CAAC;oBACF,OAAO;oBACP,UAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW;oBACtD,gBAAgB,EAAE,IAAI;iBACvB,CAAC,CAAC;QACP,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC9D,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAoC,CAAC;QACzE,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3C,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACpD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,gBAAgB,GAAG;YACvB,mBAAmB,EAAE,6CAA6C,CAAC,MAAM,CACvE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY,CACtD;SACF,CAAC;QACF,OAAO;YACL,OAAO;YACP,aAAa,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YAC9E,mBAAmB,EAAE,UAAU,CAAC;gBAC9B,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBACnE,kBAAkB,EAAE,UAAU,CAAC,OAAO,CAAC;oBACvC,IAAI,EACF,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC;wBACjC,CAAC,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC;4BAClC,CAAC,CAAC,oCAAoC;4BACtC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;gCACtB,CAAC,CAAC,qBAAqB;gCACvB,CAAC,CAAC,uBAAuB,CAAC;iBACjC,CAAC,CAAC;gBACH,gBAAgB;aACjB,CAAC;SACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAA+B;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IACE,QAAQ,KAAK,SAAS;YACtB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,+BAA+B,CAAC,MAAM;YACvE,+BAA+B,CAAC,IAAI,CAClC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,gBAAgB,CACvF;YACD,IAAI,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;gBAChE,IAAI,CAAC,iBAAiB,CAAC,MAAM;YAC/B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,OAAO;gBACtC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,CAC7B;YACD,CAAC,CAAC,QAAQ,CAAC,uBAAuB,KAAK,YAAY;gBACjD,QAAQ,CAAC,wBAAwB,KAAK,YAAY,CAAC;gBACnD,QAAQ,CAAC,gBAAgB,KAAK,YAAY,CAAC;YAE7C,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;QAChE,KAAK,MAAM,MAAM,IAAI,+BAA+B,EAAE,CAAC;YACrD,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,YAAY;gBAAE,SAAS;YAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAC9B;;;;oEAI4D,EAC5D,CAAC,MAAM,CAAC,CACT,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjF,IACE,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBACzB,sCAAsC,CAAC,MAAM,CAAC,CAAC,IAAI,CACjD,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAC5C;gBAED,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAA+B,EAC/B,OAAqD;QAErD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAI3B;;;;2DAIqD,EACrD,CAAC,IAAI,CAAC,YAAY,CAAC,CACpB,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;YAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC9E,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAA+B;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAI3B;uEACiE,EACjE,CAAC,IAAI,CAAC,YAAY,CAAC,CACpB,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YACrE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,SAAS,CACb,IAA+B,EAC/B,GAGU;QAEV,MAAM,KAAK,GACT;YACE,CAAC,aAAa,EAAE,gBAAgB,EAAE,iCAAiC,CAAC;YACpE;gBACE,yBAAyB;gBACzB,gBAAgB;gBAChB,uPAAuP;aACxP;YACD;gBACE,0BAA0B;gBAC1B,gBAAgB;gBAChB,2bAA2b;aAC5b;YACD;gBACE,sBAAsB;gBACtB,gBAAgB;gBAChB,mLAAmL;aACpL;YACD;gBACE,yBAAyB;gBACzB,iBAAiB;gBACjB,qHAAqH;aACtH;YACD;gBACE,gBAAgB;gBAChB,qBAAqB;gBACrB,wNAAwN;aACzN;YACD;gBACE,sBAAsB;gBACtB,eAAe;gBACf,2DAA2D;aAC5D;YACD;gBACE,6BAA6B;gBAC7B,sBAAsB;gBACtB,6MAA6M;aAC9M;YACD;gBACE,sBAAsB;gBACtB,sBAAsB;gBACtB,0CAA0C;aAC3C;SACF,CAAC;QACJ,KAAK,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,KAAK;YAC7C,KAAK,MAAM,GAAG,IAAI,MAAM,IAAI,CAAC,KAAK,CAA+B,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC;gBACnF,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,KAAK,CACT,IAA+B,EAC/B,MAAmC,EACnC,KAAa;QAEb,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY;YAAE,OAAO,EAAE,CAAC;QACzD,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;CACF;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-local-postgres.d.ts

@@ -0,0 +1,29 @@
+import { type InventoryProgressRow } from './platform-auth-inventory-paging.js';
+import type { PlatformAuthInventorySourceManifest } from './platform-auth-inventory-sources.js';
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+type Pool = PlatformIdentityQueryable & {
+    connect?: () => Promise<PlatformIdentityQueryable & {
+        release?: () => void;
+    }>;
+};
+export declare class PostgresPlatformAuthInventoryLocalFreezer {
+    #private;
+    constructor(pool: Pool, options: {
+        readonly googleRealm: string;
+        readonly workosRealmFingerprint: string;
+        readonly sourceAvailability?: PlatformAuthInventorySourceManifest;
+        readonly excludedSubjects: readonly {
+            readonly subject: string;
+            readonly kind: 'workload' | 'synthetic';
+        }[];
+    });
+    advance(input: {
+        readonly runId: string;
+        readonly leaseToken: string;
+    }): Promise<{
+        readonly progress: InventoryProgressRow;
+        readonly checksum: string | null;
+    }>;
+}
+export {};
+//# sourceMappingURL=platform-auth-inventory-local-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-local-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-inventory-local-postgres.d.ts","sourceRoot":"","sources":["../src/platform-auth-inventory-local-postgres.ts"],"names":[],"mappings":"AAOA,OAAO,EAEL,KAAK,oBAAoB,EAK1B,MAAM,qCAAqC,CAAC;AAU7C,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAIhG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,KAAK,IAAI,GAAG,yBAAyB,GAAG;IACtC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,yBAAyB,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC,CAAC;CAC/E,CAAC;AACF,qBAAa,yCAAyC;;gBAQlD,IAAI,EAAE,IAAI,EACV,OAAO,EAAE;QACP,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;QACxC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,mCAAmC,CAAC;QAClE,QAAQ,CAAC,gBAAgB,EAAE,SAAS;YAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;YACzB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAAC;SACzC,EAAE,CAAC;KACL;IAeG,OAAO,CAAC,KAAK,EAAE;QACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAua3F"}