@noodleseed/one 0.63.1 → 0.65.0

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-local-postgres.js

@@ -0,0 +1,350 @@
+import { PostgresPlatformAuthInventoryLocalSubjects, } from './platform-auth-inventory-local-subjects-postgres.js';
+import { blockerCounts, inventoryChain, inventoryHash, inventoryHasLocalWork, PLATFORM_AUTH_INVENTORY_LOCAL_BATCH_SIZE, } from './platform-auth-inventory-paging.js';
+import { lockPlatformAuthInventoryLocalProgress, markPlatformAuthInventoryTerminal, PROGRESS_COLUMNS, } from './platform-auth-inventory-progress-postgres.js';
+import { readPlatformAuthInventorySourceEpoch, runPlatformAuthInventorySourceFenceTransaction, } from './platform-auth-inventory-source-fence-postgres.js';
+import { PLATFORM_AUTH_INVENTORY_NON_AUTHORITY_SOURCES } from './platform-auth-inventory-sources.js';
+import { PlatformAuthMigrationError } from './platform-auth-migration.js';
+export class PostgresPlatformAuthInventoryLocalFreezer {
+    #pool;
+    #googleRealm;
+    #workosRealmFingerprint;
+    #sourceManifest;
+    #subjects;
+    constructor(pool, options) {
+        this.#pool = pool;
+        this.#googleRealm = options.googleRealm;
+        this.#workosRealmFingerprint = options.workosRealmFingerprint;
+        this.#sourceManifest = options.sourceAvailability;
+        this.#subjects = new PostgresPlatformAuthInventoryLocalSubjects({
+            googleRealm: this.#googleRealm,
+            ...(options.sourceAvailability === undefined
+                ? {}
+                : { sourceAvailability: options.sourceAvailability }),
+            excludedSubjects: options.excludedSubjects,
+        });
+    }
+    async advance(input) {
+        const outcome = await runPlatformAuthInventorySourceFenceTransaction(this.#pool, async (connection) => {
+            let progress = await lockPlatformAuthInventoryLocalProgress(connection, input.runId, input.leaseToken);
+            await this.#subjects.assertManifest(connection);
+            const sourceEpoch = await readPlatformAuthInventorySourceEpoch(connection);
+            if (progress.local_source_epoch === null) {
+                if (inventoryHasLocalWork(progress)) {
+                    return {
+                        terminal: true,
+                        progress: await markPlatformAuthInventoryTerminal(connection, input.runId, input.leaseToken),
+                        checksum: null,
+                    };
+                }
+                const captured = await connection.query(`UPDATE platform_auth_inventory_progress
+              SET local_source_epoch = $3, local_snapshot_at = transaction_timestamp(),
+                  updated_at = now()
+            WHERE migration_run_id = $1 AND lease_token_hash = $2
+          RETURNING ${PROGRESS_COLUMNS}`, [input.runId, inventoryHash(input.leaseToken), sourceEpoch]);
+                const row = captured.rows[0];
+                if (row === undefined)
+                    throw new Error('stale_inventory_lease');
+                progress = row;
+            }
+            else if (progress.local_source_epoch !== sourceEpoch) {
+                return {
+                    terminal: true,
+                    progress: await markPlatformAuthInventoryTerminal(connection, input.runId, input.leaseToken),
+                    checksum: null,
+                };
+            }
+            if (progress.local_snapshot_at === null)
+                throw new PlatformAuthMigrationError('inventory_unavailable');
+            const batch = await this.#subjects.nextBatch(connection, progress.local_after_subject ?? undefined, PLATFORM_AUTH_INVENTORY_LOCAL_BATCH_SIZE, progress.local_snapshot_at);
+            const { candidates, exclusions } = await this.#freezeBatch(connection, input.runId, batch);
+            await this.#insertCandidates(connection, input.runId, candidates);
+            await this.#insertExclusions(connection, input.runId, exclusions);
+            let candidateChain = progress.candidate_chain_hash;
+            for (const candidate of candidates)
+                candidateChain = inventoryChain(candidateChain, candidate.chainEntry);
+            let excludedChain = progress.excluded_chain_hash;
+            for (const exclusion of exclusions)
+                excludedChain = inventoryChain(excludedChain, exclusion.chainEntry);
+            const counts = blockerCounts(progress.blocker_counts);
+            for (const candidate of candidates)
+                for (const code of candidate.blockerCodes)
+                    counts[code] = (counts[code] ?? 0) + 1;
+            const localSubjectCount = progress.local_subject_count + batch.subjects.length;
+            const candidateCount = progress.candidate_count + candidates.length;
+            const excludedCount = progress.excluded_count + exclusions.length;
+            if ((await readPlatformAuthInventorySourceEpoch(connection)) !== progress.local_source_epoch) {
+                return {
+                    terminal: true,
+                    progress: await markPlatformAuthInventoryTerminal(connection, input.runId, input.leaseToken),
+                    checksum: null,
+                };
+            }
+            if (batch.hasMore) {
+                const updated = await connection.query(`UPDATE platform_auth_inventory_progress
+              SET local_after_subject = $3, local_subject_count = $4,
+                  candidate_count = $5, excluded_count = $6,
+                  candidate_chain_hash = $7, excluded_chain_hash = $8,
+                  blocker_counts = $9::jsonb, lease_token_hash = NULL,
+                  lease_expires_at = NULL, updated_at = now()
+            WHERE migration_run_id = $1 AND lease_token_hash = $2
+          RETURNING ${PROGRESS_COLUMNS}`, [
+                    input.runId,
+                    inventoryHash(input.leaseToken),
+                    batch.subjects.at(-1)?.subject ?? progress.local_after_subject,
+                    localSubjectCount,
+                    candidateCount,
+                    excludedCount,
+                    candidateChain,
+                    excludedChain,
+                    JSON.stringify(counts),
+                ]);
+                const row = updated.rows[0];
+                if (row === undefined)
+                    throw new Error('stale_inventory_lease');
+                return { terminal: false, progress: row, checksum: null };
+            }
+            const artifactEvidence = {
+                nonAuthoritySources: PLATFORM_AUTH_INVENTORY_NON_AUTHORITY_SOURCES.filter((source) => this.#sourceManifest?.[source] === 'configured'),
+            };
+            const safe = { candidateCount, excludedCount, blockers: counts };
+            const excludedFingerprint = inventoryHash({
+                excludedChain,
+                artifactEvidence,
+                workosSnapshot: progress.remote_chain_hash,
+            });
+            const checksum = inventoryHash({
+                algorithm: 'inventory-v2',
+                googleRealm: this.#googleRealm,
+                workosRealm: this.#workosRealmFingerprint,
+                safe,
+                excludedFingerprint,
+                candidateChain,
+            });
+            const completed = await connection.query(`UPDATE identity_migration_runs
+            SET frozen_checksum = $3, source_fingerprint = $4,
+                excluded_fingerprint = $5, google_realm = $6,
+                inventory_format = 'v2', safe_result = $7::jsonb,
+                state = 'completed', completed_at = now()
+          WHERE id = $1 AND kind = 'inventory' AND state = 'running'
+            AND workos_realm_fingerprint = $2
+        RETURNING id`, [
+                input.runId,
+                this.#workosRealmFingerprint,
+                checksum,
+                candidateChain,
+                excludedFingerprint,
+                this.#googleRealm,
+                JSON.stringify(safe),
+            ]);
+            if (completed.rows[0] === undefined)
+                throw new PlatformAuthMigrationError('inventory_unavailable');
+            const updated = await connection.query(`UPDATE platform_auth_inventory_progress
+            SET phase = 'completed', local_after_subject = $3,
+                local_subject_count = $4, candidate_count = $5, excluded_count = $6,
+                candidate_chain_hash = $7, excluded_chain_hash = $8,
+                artifact_counts = $9::jsonb, blocker_counts = $10::jsonb,
+                lease_token_hash = NULL, lease_expires_at = NULL, updated_at = now()
+          WHERE migration_run_id = $1 AND lease_token_hash = $2
+        RETURNING ${PROGRESS_COLUMNS}`, [
+                input.runId,
+                inventoryHash(input.leaseToken),
+                batch.subjects.at(-1)?.subject ?? progress.local_after_subject,
+                localSubjectCount,
+                candidateCount,
+                excludedCount,
+                candidateChain,
+                excludedChain,
+                JSON.stringify(artifactEvidence),
+                JSON.stringify(counts),
+            ]);
+            const row = updated.rows[0];
+            if (row === undefined)
+                throw new Error('stale_inventory_lease');
+            return { terminal: false, progress: row, checksum };
+        });
+        if (outcome.terminal)
+            throw new PlatformAuthMigrationError('inventory_unavailable');
+        return { progress: outcome.progress, checksum: outcome.checksum };
+    }
+    async #freezeBatch(pool, runId, batch) {
+        const candidates = batch.subjects.filter((subject) => subject.provenance.size > 0 &&
+            (subject.exclusionKind === undefined || subject.exclusionKind === 'non_platform_identity'));
+        const emails = await this.#verifiedEmails(pool, candidates.map((subject) => subject.subject));
+        const ownerCounts = await this.#emailOwnerCounts(pool, [...emails.values()]
+            .filter((email) => email.count === 1 && email.normalizedEmail !== null)
+            .map((email) => email.normalizedEmail));
+        const conflictSubjects = await this.#remoteConflicts(pool, runId, candidates.flatMap((subject) => {
+            const email = emails.get(subject.subject);
+            return email?.count === 1 && email.normalizedEmail !== null
+                ? [{ subject: subject.subject, email: email.normalizedEmail }]
+                : [];
+        }));
+        const frozenCandidates = candidates.map((source) => {
+            const emailEvidence = emails.get(source.subject) ?? { count: 0, normalizedEmail: null };
+            const codes = [];
+            if (source.identityDrift || source.excludedEvidence)
+                codes.push('ambiguous_platform_customer_evidence');
+            if (emailEvidence.count === 0)
+                codes.push('missing_verified_email');
+            if (emailEvidence.count > 1)
+                codes.push('multiple_current_verified_emails');
+            if (source.subject.length > 64)
+                codes.push('external_id_too_long');
+            if (emailEvidence.normalizedEmail !== null &&
+                (ownerCounts.get(emailEvidence.normalizedEmail) ?? 0) > 1)
+                codes.push('shared_verified_email');
+            if (conflictSubjects.has(source.subject))
+                codes.push('conflicting_workos_user');
+            const provenance = [...source.provenance].sort();
+            const sourceRealm = source.realm ?? this.#googleRealm;
+            const sourceFingerprint = inventoryHash({
+                subject: source.subject,
+                realm: sourceRealm,
+                provenance,
+            });
+            const normalizedEmail = emailEvidence.count === 1 ? emailEvidence.normalizedEmail : null;
+            const emailFingerprint = normalizedEmail === null ? null : inventoryHash(normalizedEmail);
+            const candidateFingerprint = inventoryHash({
+                sourceFingerprint,
+                principalFingerprint: source.principalId === undefined ? undefined : inventoryHash(source.principalId),
+                emailFingerprint: emailFingerprint ?? undefined,
+                provenance,
+                blockerCodes: codes,
+            });
+            const chainEntry = {
+                sourceFingerprint,
+                emailFingerprint: emailFingerprint ?? undefined,
+                provenance,
+                blockerCodes: codes,
+                candidateFingerprint,
+            };
+            return {
+                sourceSubject: source.subject,
+                sourceRealm,
+                principalId: source.principalId ?? null,
+                normalizedEmail,
+                emailFingerprint,
+                provenance,
+                blockerCodes: codes,
+                sourceFingerprint,
+                candidateFingerprint,
+                chainEntry,
+            };
+        });
+        const exclusions = batch.subjects
+            .filter((subject) => subject.exclusionKind !== undefined &&
+            (subject.exclusionKind !== 'non_platform_identity' || subject.provenance.size === 0))
+            .map((subject) => {
+            const kind = subject.exclusionKind;
+            const subjectFingerprint = inventoryHash(subject.subject);
+            const chainEntry = { subjectFingerprint, kind };
+            return {
+                subjectFingerprint,
+                kind,
+                entryFingerprint: inventoryHash(chainEntry),
+                chainEntry,
+            };
+        });
+        return { candidates: frozenCandidates, exclusions };
+    }
+    async #verifiedEmails(pool, subjects) {
+        if (subjects.length === 0)
+            return new Map();
+        const rows = await pool.query(`SELECT link.external_id AS subject, count(DISTINCT email.normalized_email)::text AS count,
+              min(email.normalized_email) AS normalized_email
+         FROM platform_identity_links link
+         LEFT JOIN platform_verified_emails email
+           ON email.principal_id = link.principal_id AND email.provider = 'google'
+          AND email.realm = link.realm AND email.status = 'active'
+        WHERE link.provider = 'google' AND link.realm = $1
+          AND link.disabled_at IS NULL AND link.external_id = ANY($2::text[])
+        GROUP BY link.external_id`, [this.#googleRealm, subjects]);
+        return new Map(rows.rows.map((row) => [
+            row.subject,
+            { count: Number(row.count), normalizedEmail: row.normalized_email },
+        ]));
+    }
+    async #emailOwnerCounts(pool, emails) {
+        if (emails.length === 0)
+            return new Map();
+        const rows = await pool.query(`SELECT normalized_email, count(DISTINCT principal_id)::text AS count
+         FROM platform_verified_emails
+        WHERE provider = 'google' AND realm = $1 AND status = 'active'
+          AND normalized_email = ANY($2::text[])
+        GROUP BY normalized_email`, [this.#googleRealm, emails]);
+        return new Map(rows.rows.map((row) => [row.normalized_email, Number(row.count)]));
+    }
+    async #remoteConflicts(pool, runId, candidates) {
+        if (candidates.length === 0)
+            return new Set();
+        const rows = await pool.query(`WITH candidate(subject, email) AS (
+         SELECT * FROM unnest($2::text[], $3::text[])
+       )
+       SELECT candidate.subject FROM candidate
+        WHERE (SELECT count(*) FROM platform_auth_inventory_remote_users remote
+                WHERE remote.migration_run_id = $1
+                  AND remote.normalized_email = candidate.email) > 1
+           OR EXISTS (
+                SELECT 1 FROM platform_auth_inventory_remote_users remote
+                 WHERE remote.migration_run_id = $1
+                   AND remote.normalized_email = candidate.email
+                   AND (NOT remote.verified OR remote.external_id IS DISTINCT FROM candidate.subject)
+              )
+           OR EXISTS (
+                SELECT 1 FROM platform_auth_inventory_remote_users remote
+                 WHERE remote.migration_run_id = $1 AND remote.external_id = candidate.subject
+                   AND (NOT remote.verified OR remote.normalized_email <> candidate.email)
+              )`, [
+            runId,
+            candidates.map((candidate) => candidate.subject),
+            candidates.map((candidate) => candidate.email),
+        ]);
+        return new Set(rows.rows.map((row) => row.subject));
+    }
+    async #insertCandidates(pool, runId, candidates) {
+        if (candidates.length === 0)
+            return;
+        await pool.query(`INSERT INTO platform_auth_inventory_candidates
+         (migration_run_id, source_subject, source_realm, principal_id, normalized_email,
+          email_fingerprint, provenance, blocker_codes, source_fingerprint, candidate_fingerprint)
+       SELECT $1, candidate.source_subject, candidate.source_realm, candidate.principal_id,
+              candidate.normalized_email, candidate.email_fingerprint,
+              ARRAY(SELECT jsonb_array_elements_text(candidate.provenance)),
+              ARRAY(SELECT jsonb_array_elements_text(candidate.blocker_codes)),
+              candidate.source_fingerprint, candidate.candidate_fingerprint
+         FROM jsonb_to_recordset($2::jsonb) AS candidate(
+           source_subject text, source_realm text, principal_id text, normalized_email text,
+           email_fingerprint text, provenance jsonb, blocker_codes jsonb,
+           source_fingerprint text, candidate_fingerprint text)`, [
+            runId,
+            JSON.stringify(candidates.map((candidate) => ({
+                source_subject: candidate.sourceSubject,
+                source_realm: candidate.sourceRealm,
+                principal_id: candidate.principalId,
+                normalized_email: candidate.normalizedEmail,
+                email_fingerprint: candidate.emailFingerprint,
+                provenance: candidate.provenance,
+                blocker_codes: candidate.blockerCodes,
+                source_fingerprint: candidate.sourceFingerprint,
+                candidate_fingerprint: candidate.candidateFingerprint,
+            }))),
+        ]);
+    }
+    async #insertExclusions(pool, runId, exclusions) {
+        if (exclusions.length === 0)
+            return;
+        await pool.query(`INSERT INTO platform_auth_inventory_exclusions
+         (migration_run_id, subject_fingerprint, exclusion_kind, entry_fingerprint)
+       SELECT $1, subject_fingerprint, exclusion_kind, entry_fingerprint
+         FROM jsonb_to_recordset($2::jsonb)
+           AS exclusion(subject_fingerprint text, exclusion_kind text, entry_fingerprint text)`, [
+            runId,
+            JSON.stringify(exclusions.map((exclusion) => ({
+                subject_fingerprint: exclusion.subjectFingerprint,
+                exclusion_kind: exclusion.kind,
+                entry_fingerprint: exclusion.entryFingerprint,
+            }))),
+        ]);
+    }
+}
+//# sourceMappingURL=platform-auth-inventory-local-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-local-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-inventory-local-postgres.js","sourceRoot":"","sources":["../src/platform-auth-inventory-local-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,0CAA0C,GAE3C,MAAM,sDAAsD,CAAC;AAC9D,OAAO,EACL,aAAa,EAEb,cAAc,EACd,aAAa,EACb,qBAAqB,EACrB,wCAAwC,GACzC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,sCAAsC,EACtC,iCAAiC,EACjC,gBAAgB,GACjB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,oCAAoC,EACpC,8CAA8C,GAC/C,MAAM,oDAAoD,CAAC;AAE5D,OAAO,EAAE,6CAA6C,EAAE,MAAM,sCAAsC,CAAC;AAErG,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAM1E,MAAM,OAAO,yCAAyC;IAC3C,KAAK,CAAO;IACZ,YAAY,CAAS;IACrB,uBAAuB,CAAS;IAChC,eAAe,CAAkD;IACjE,SAAS,CAA6C;IAE/D,YACE,IAAU,EACV,OAQC;QAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;QAC9D,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,IAAI,0CAA0C,CAAC;YAC9D,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACvD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAGb;QACC,MAAM,OAAO,GAAG,MAAM,8CAA8C,CAClE,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,UAAU,EAAE,EAAE;YACnB,IAAI,QAAQ,GAAG,MAAM,sCAAsC,CACzD,UAAU,EACV,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,UAAU,CACjB,CAAC;YACF,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;YAChD,MAAM,WAAW,GAAG,MAAM,oCAAoC,CAAC,UAAU,CAAC,CAAC;YAC3E,IAAI,QAAQ,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;gBACzC,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACpC,OAAO;wBACL,QAAQ,EAAE,IAAa;wBACvB,QAAQ,EAAE,MAAM,iCAAiC,CAC/C,UAAU,EACV,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,UAAU,CACjB;wBACD,QAAQ,EAAE,IAAI;qBACf,CAAC;gBACJ,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CACrC;;;;sBAIU,gBAAgB,EAAE,EAC5B,CAAC,KAAK,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,CAC5D,CAAC;gBACF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC7B,IAAI,GAAG,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBAChE,QAAQ,GAAG,GAAG,CAAC;YACjB,CAAC;iBAAM,IAAI,QAAQ,CAAC,kBAAkB,KAAK,WAAW,EAAE,CAAC;gBACvD,OAAO;oBACL,QAAQ,EAAE,IAAa;oBACvB,QAAQ,EAAE,MAAM,iCAAiC,CAC/C,UAAU,EACV,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,UAAU,CACjB;oBACD,QAAQ,EAAE,IAAI;iBACf,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,iBAAiB,KAAK,IAAI;gBACrC,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;YAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAC1C,UAAU,EACV,QAAQ,CAAC,mBAAmB,IAAI,SAAS,EACzC,wCAAwC,EACxC,QAAQ,CAAC,iBAAiB,CAC3B,CAAC;YACF,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC3F,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAClE,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAClE,IAAI,cAAc,GAAG,QAAQ,CAAC,oBAAoB,CAAC;YACnD,KAAK,MAAM,SAAS,IAAI,UAAU;gBAChC,cAAc,GAAG,cAAc,CAAC,cAAc,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;YACxE,IAAI,aAAa,GAAG,QAAQ,CAAC,mBAAmB,CAAC;YACjD,KAAK,MAAM,SAAS,IAAI,UAAU;gBAChC,aAAa,GAAG,cAAc,CAAC,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;YACtE,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YACtD,KAAK,MAAM,SAAS,IAAI,UAAU;gBAChC,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,YAAY;oBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACpF,MAAM,iBAAiB,GAAG,QAAQ,CAAC,mBAAmB,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC/E,MAAM,cAAc,GAAG,QAAQ,CAAC,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC;YACpE,MAAM,aAAa,GAAG,QAAQ,CAAC,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC;YAClE,IACE,CAAC,MAAM,oCAAoC,CAAC,UAAU,CAAC,CAAC,KAAK,QAAQ,CAAC,kBAAkB,EACxF,CAAC;gBACD,OAAO;oBACL,QAAQ,EAAE,IAAa;oBACvB,QAAQ,EAAE,MAAM,iCAAiC,CAC/C,UAAU,EACV,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,UAAU,CACjB;oBACD,QAAQ,EAAE,IAAI;iBACf,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CACpC;;;;;;;sBAOU,gBAAgB,EAAE,EAC5B;oBACE,KAAK,CAAC,KAAK;oBACX,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;oBAC/B,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,QAAQ,CAAC,mBAAmB;oBAC9D,iBAAiB;oBACjB,cAAc;oBACd,aAAa;oBACb,cAAc;oBACd,aAAa;oBACb,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;iBACvB,CACF,CAAC;gBACF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC5B,IAAI,GAAG,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBAChE,OAAO,EAAE,QAAQ,EAAE,KAAc,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACrE,CAAC;YACD,MAAM,gBAAgB,GAAG;gBACvB,mBAAmB,EAAE,6CAA6C,CAAC,MAAM,CACvE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY,CAC5D;aACF,CAAC;YACF,MAAM,IAAI,GAAG,EAAE,cAAc,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YACjE,MAAM,mBAAmB,GAAG,aAAa,CAAC;gBACxC,aAAa;gBACb,gBAAgB;gBAChB,cAAc,EAAE,QAAQ,CAAC,iBAAiB;aAC3C,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,aAAa,CAAC;gBAC7B,SAAS,EAAE,cAAc;gBACzB,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,WAAW,EAAE,IAAI,CAAC,uBAAuB;gBACzC,IAAI;gBACJ,mBAAmB;gBACnB,cAAc;aACf,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,KAAK,CACtC;;;;;;;qBAOW,EACX;gBACE,KAAK,CAAC,KAAK;gBACX,IAAI,CAAC,uBAAuB;gBAC5B,QAAQ;gBACR,cAAc;gBACd,mBAAmB;gBACnB,IAAI,CAAC,YAAY;gBACjB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aACrB,CACF,CAAC;YACF,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;gBACjC,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;YAChE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CACpC;;;;;;;oBAOU,gBAAgB,EAAE,EAC5B;gBACE,KAAK,CAAC,KAAK;gBACX,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;gBAC/B,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,QAAQ,CAAC,mBAAmB;gBAC9D,iBAAiB;gBACjB,cAAc;gBACd,aAAa;gBACb,cAAc;gBACd,aAAa;gBACb,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC;gBAChC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;aACvB,CACF,CAAC;YACF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,GAAG,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAChE,OAAO,EAAE,QAAQ,EAAE,KAAc,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QAC/D,CAAC,CACF,CAAC;QACF,IAAI,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;QACpF,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,IAA+B,EAC/B,KAAa,EACb,KAAwD;QAKxD,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CACtC,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC;YAC3B,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,aAAa,KAAK,uBAAuB,CAAC,CAC7F,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CACvC,IAAI,EACJ,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAC7C,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAC9C,IAAI,EACJ,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;aACjB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC;aACtE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAyB,CAAC,CACnD,CAAC;QACF,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAClD,IAAI,EACJ,KAAK,EACL,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1C,OAAO,KAAK,EAAE,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI;gBACzD,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;gBAC9D,CAAC,CAAC,EAAE,CAAC;QACT,CAAC,CAAC,CACH,CAAC;QACF,MAAM,gBAAgB,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAmB,EAAE;YAClE,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;YACxF,MAAM,KAAK,GAA8B,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,gBAAgB;gBACjD,KAAK,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACrD,IAAI,aAAa,CAAC,KAAK,KAAK,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACpE,IAAI,aAAa,CAAC,KAAK,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;YAC5E,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACnE,IACE,aAAa,CAAC,eAAe,KAAK,IAAI;gBACtC,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;gBAEzD,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACtC,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YAChF,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;YACjD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC;YACtD,MAAM,iBAAiB,GAAG,aAAa,CAAC;gBACtC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK,EAAE,WAAW;gBAClB,UAAU;aACX,CAAC,CAAC;YACH,MAAM,eAAe,GAAG,aAAa,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;YACzF,MAAM,gBAAgB,GAAG,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;YAC1F,MAAM,oBAAoB,GAAG,aAAa,CAAC;gBACzC,iBAAiB;gBACjB,oBAAoB,EAClB,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC;gBAClF,gBAAgB,EAAE,gBAAgB,IAAI,SAAS;gBAC/C,UAAU;gBACV,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;YACH,MAAM,UAAU,GAAG;gBACjB,iBAAiB;gBACjB,gBAAgB,EAAE,gBAAgB,IAAI,SAAS;gBAC/C,UAAU;gBACV,YAAY,EAAE,KAAK;gBACnB,oBAAoB;aACrB,CAAC;YACF,OAAO;gBACL,aAAa,EAAE,MAAM,CAAC,OAAO;gBAC7B,WAAW;gBACX,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;gBACvC,eAAe;gBACf,gBAAgB;gBAChB,UAAU;gBACV,YAAY,EAAE,KAAK;gBACnB,iBAAiB;gBACjB,oBAAoB;gBACpB,UAAU;aACX,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ;aAC9B,MAAM,CACL,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,aAAa,KAAK,SAAS;YACnC,CAAC,OAAO,CAAC,aAAa,KAAK,uBAAuB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC,CACvF;aACA,GAAG,CAAC,CAAC,OAAO,EAAmB,EAAE;YAChC,MAAM,IAAI,GAAG,OAAO,CAAC,aAA8B,CAAC;YACpD,MAAM,kBAAkB,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1D,MAAM,UAAU,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;YAChD,OAAO;gBACL,kBAAkB;gBAClB,IAAI;gBACJ,gBAAgB,EAAE,aAAa,CAAC,UAAU,CAAC;gBAC3C,UAAU;aACX,CAAC;QACJ,CAAC,CAAC,CAAC;QACL,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,IAA+B,EAC/B,QAA2B;QAE3B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAK3B;;;;;;;;kCAQ4B,EAC5B,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAC9B,CAAC;QACF,OAAO,IAAI,GAAG,CACZ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;YACrB,GAAG,CAAC,OAAO;YACX,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,gBAAgB,EAAE;SACpE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,IAA+B,EAC/B,MAAyB;QAEzB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAC3B;;;;kCAI4B,EAC5B,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAC5B,CAAC;QACF,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,IAA+B,EAC/B,KAAa,EACb,UAA2E;QAE3E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAC3B;;;;;;;;;;;;;;;;;gBAiBU,EACV;YACE,KAAK;YACL,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC;YAChD,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC;SAC/C,CACF,CAAC;QACF,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,IAA+B,EAC/B,KAAa,EACb,UAAsC;QAEtC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACpC,MAAM,IAAI,CAAC,KAAK,CACd;;;;;;;;;;;gEAW0D,EAC1D;YACE,KAAK;YACL,IAAI,CAAC,SAAS,CACZ,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC7B,cAAc,EAAE,SAAS,CAAC,aAAa;gBACvC,YAAY,EAAE,SAAS,CAAC,WAAW;gBACnC,YAAY,EAAE,SAAS,CAAC,WAAW;gBACnC,gBAAgB,EAAE,SAAS,CAAC,eAAe;gBAC3C,iBAAiB,EAAE,SAAS,CAAC,gBAAgB;gBAC7C,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,aAAa,EAAE,SAAS,CAAC,YAAY;gBACrC,kBAAkB,EAAE,SAAS,CAAC,iBAAiB;gBAC/C,qBAAqB,EAAE,SAAS,CAAC,oBAAoB;aACtD,CAAC,CAAC,CACJ;SACF,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,IAA+B,EAC/B,KAAa,EACb,UAAsC;QAEtC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACpC,MAAM,IAAI,CAAC,KAAK,CACd;;;;+FAIyF,EACzF;YACE,KAAK;YACL,IAAI,CAAC,SAAS,CACZ,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC7B,mBAAmB,EAAE,SAAS,CAAC,kBAAkB;gBACjD,cAAc,EAAE,SAAS,CAAC,IAAI;gBAC9B,iBAAiB,EAAE,SAAS,CAAC,gBAAgB;aAC9C,CAAC,CAAC,CACJ;SACF,CACF,CAAC;IACJ,CAAC;CACF"}

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-local-subjects-postgres.d.ts

@@ -0,0 +1,50 @@
+import { type PlatformAuthInventorySourceManifest } from './platform-auth-inventory-sources.js';
+import { type PlatformAuthBlockerCode } from './platform-auth-migration.js';
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+export type InventoryLocalProvenance = 'principal' | 'google_link' | 'google_billing' | 'org_membership' | 'refresh_family' | 'developer_grant' | 'owner_only_deployer' | 'consent_grant' | 'device_authorization' | 'welcome_provisioning';
+export type InventoryLocalExclusionKind = 'non_platform_identity' | 'suspended_principal' | 'suspended_principal_with_authority' | 'workload' | 'synthetic';
+export interface InventoryLocalSubjectEvidence {
+    readonly subject: string;
+    readonly provenance: Set<InventoryLocalProvenance>;
+    principalId?: string;
+    realm?: string;
+    identityDrift: boolean;
+    excludedEvidence: boolean;
+    exclusionKind?: InventoryLocalExclusionKind;
+}
+export interface InventoryFrozenCandidate {
+    readonly sourceSubject: string;
+    readonly sourceRealm: string;
+    readonly principalId: string | null;
+    readonly normalizedEmail: string | null;
+    readonly emailFingerprint: string | null;
+    readonly provenance: readonly InventoryLocalProvenance[];
+    readonly blockerCodes: readonly PlatformAuthBlockerCode[];
+    readonly sourceFingerprint: string;
+    readonly candidateFingerprint: string;
+    readonly chainEntry: object;
+}
+export interface InventoryFrozenExclusion {
+    readonly subjectFingerprint: string;
+    readonly kind: InventoryLocalExclusionKind;
+    readonly entryFingerprint: string;
+    readonly chainEntry: object;
+}
+/** Keyset-pages the union of platform authority roots and explicit non-human/customer exclusions. */
+export declare class PostgresPlatformAuthInventoryLocalSubjects {
+    #private;
+    constructor(options: {
+        readonly googleRealm: string;
+        readonly sourceAvailability?: PlatformAuthInventorySourceManifest;
+        readonly excludedSubjects: readonly {
+            readonly subject: string;
+            readonly kind: 'workload' | 'synthetic';
+        }[];
+    });
+    nextBatch(pool: PlatformIdentityQueryable, after: string | undefined, limit: number, snapshotAt: Date | string): Promise<{
+        readonly subjects: readonly InventoryLocalSubjectEvidence[];
+        readonly hasMore: boolean;
+    }>;
+    assertManifest(pool: PlatformIdentityQueryable): Promise<void>;
+}
+//# sourceMappingURL=platform-auth-inventory-local-subjects-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-auth-inventory-local-subjects-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth-inventory-local-subjects-postgres.d.ts","sourceRoot":"","sources":["../src/platform-auth-inventory-local-subjects-postgres.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,mCAAmC,EACzC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,MAAM,MAAM,wBAAwB,GAChC,WAAW,GACX,aAAa,GACb,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,qBAAqB,GACrB,eAAe,GACf,sBAAsB,GACtB,sBAAsB,CAAC;AAC3B,MAAM,MAAM,2BAA2B,GACnC,uBAAuB,GACvB,qBAAqB,GACrB,oCAAoC,GACpC,UAAU,GACV,WAAW,CAAC;AAChB,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,2BAA2B,CAAC;CAC7C;AACD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,SAAS,wBAAwB,EAAE,CAAC;IACzD,QAAQ,CAAC,YAAY,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAC1D,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AACD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,qGAAqG;AACrG,qBAAa,0CAA0C;;gBAQzC,OAAO,EAAE;QACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,mCAAmC,CAAC;QAClE,QAAQ,CAAC,gBAAgB,EAAE,SAAS;YAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;YACzB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAAC;SACzC,EAAE,CAAC;KACL;IAMK,SAAS,CACb,IAAI,EAAE,yBAAyB,EAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,IAAI,GAAG,MAAM,GACxB,OAAO,CAAC;QACT,QAAQ,CAAC,QAAQ,EAAE,SAAS,6BAA6B,EAAE,CAAC;QAC5D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;KAC3B,CAAC;IAwFI,cAAc,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;CA6LrE"}