@noodleseed/one 0.82.0 → 0.84.0

package/node_modules/@noodle-borg/service/dist/platform-account-reset-ownership-postgres.js

@@ -0,0 +1,314 @@
+import { canonicalJson, sha256Canonical } from './platform-account-reset-fingerprint.js';
+import { platformAccountResetAppKey as appKey, comparePlatformAccountResetText as compareText, groupPlatformAccountResetRows as groupBy, incrementPlatformAccountResetCount as increment, queryPlatformAccountResetRows as rows, } from './platform-account-reset-ownership-helpers.js';
+import { addPlatformAccountResetBillingProviders, addPlatformAccountResetCleanupResource, addPlatformAccountResetCredentialScopes, addPlatformAccountResetHostedAssets, addPlatformAccountResetRepositories, addPlatformAccountResetStateScopes, } from './platform-account-reset-ownership-resources-postgres.js';
+import { loadPlatformAccountResetFrozenOwnerOnlyApps } from './platform-account-reset-ownership-rollback-postgres.js';
+/**
+ * Classifies only explicit relational ownership. Email fields are deliberately absent from every ownership
+ * predicate; the preview layer handles contact hints separately as restrictive evidence.
+ */
+export async function loadPlatformAccountResetOwnershipSnapshot(pool, input) {
+    const targets = [...new Set(input.targetPrincipalIds)].sort(compareText);
+    const targetSet = new Set(targets);
+    const blockers = new Map();
+    const relationships = [];
+    const resources = [];
+    const personal = await rows(pool, `SELECT principal_subject, org_slug, billing_account_id
+       FROM personal_workspace_bindings
+      WHERE principal_subject = ANY($1::text[])`, [targets]);
+    const personalOrgOwners = new Map(personal.map((row) => [row.org_slug, row.principal_subject]));
+    const targetOwnerOnlyDeployments = await rows(pool, `SELECT org_slug, app_slug
+       FROM deploy_records
+      WHERE active AND archived_at IS NULL
+        AND access_mode = 'owner-only'
+        AND created_by_subject = ANY($1::text[])`, [targets]);
+    const frozenOwnerOnlyApps = input.quarantine === undefined
+        ? []
+        : await loadPlatformAccountResetFrozenOwnerOnlyApps(pool, input.quarantine.operationId, targets, input.quarantine.cleanupResources);
+    const membershipRows = await rows(pool, `SELECT org_slug, subject, role
+       FROM org_members
+      WHERE subject = ANY($1::text[])`, [targets]);
+    const involvedOrgs = [
+        ...new Set([
+            ...membershipRows.map((row) => row.org_slug),
+            ...personal.map((row) => row.org_slug),
+            ...targetOwnerOnlyDeployments.map((row) => row.org_slug),
+            ...frozenOwnerOnlyApps.map((row) => row.org_slug),
+        ]),
+    ].sort(compareText);
+    const owners = involvedOrgs.length === 0
+        ? []
+        : await rows(pool, `SELECT member.org_slug, member.subject, principal.status
+             FROM org_members member
+             LEFT JOIN platform_principals principal ON principal.principal_id = member.subject
+            WHERE member.org_slug = ANY($1::text[]) AND member.role = 'owner'`, [involvedOrgs]);
+    const ownersByOrg = groupBy(owners, (row) => row.org_slug);
+    const membershipsByOrg = groupBy(membershipRows, (row) => row.org_slug);
+    const ownedOrgs = new Map();
+    const preservedOrgs = new Set();
+    let validPersonalOrganizations = 0;
+    for (const org of involvedOrgs) {
+        const orgOwners = ownersByOrg.get(org) ?? [];
+        if (orgOwners.some((owner) => owner.status === null)) {
+            increment(blockers, 'ownership_ambiguous');
+            relationships.push({ disposition: 'blocker', kind: 'owner_status', org });
+            continue;
+        }
+        const personalOwner = personalOrgOwners.get(org);
+        if (personalOwner !== undefined) {
+            const expectedMemberships = (membershipsByOrg.get(org) ?? []).filter((member) => member.subject === personalOwner && member.role === 'owner');
+            if (expectedMemberships.length !== 1 ||
+                orgOwners.some((owner) => owner.subject !== personalOwner)) {
+                increment(blockers, 'ownership_ambiguous');
+                relationships.push({ disposition: 'blocker', kind: 'personal_membership', org });
+                continue;
+            }
+            ownedOrgs.set(org, 'personal_org');
+            validPersonalOrganizations += 1;
+            relationships.push({
+                disposition: 'personal_org',
+                org,
+                principalId: personalOwner,
+            });
+            continue;
+        }
+        const targetOwners = orgOwners.filter((owner) => targetSet.has(owner.subject));
+        const foreignOwners = orgOwners.filter((owner) => !targetSet.has(owner.subject));
+        const activeForeignOwners = foreignOwners.filter((owner) => owner.status === 'active');
+        if (activeForeignOwners.length !== 0) {
+            preservedOrgs.add(org);
+            relationships.push({
+                disposition: 'preserved_shared_org',
+                org,
+                targetPrincipals: (membershipsByOrg.get(org) ?? []).map((member) => member.subject),
+            });
+            continue;
+        }
+        if (foreignOwners.length !== 0) {
+            increment(blockers, 'ownership_ambiguous');
+            relationships.push({ disposition: 'blocker', kind: 'inactive_foreign_owner', org });
+            continue;
+        }
+        if (targetOwners.length !== 0 && targetOwners.length === orgOwners.length) {
+            ownedOrgs.set(org, 'sole_owned_org');
+            relationships.push({
+                disposition: 'sole_owned_org',
+                org,
+                targetPrincipals: targetOwners.map((owner) => owner.subject),
+            });
+            continue;
+        }
+        increment(blockers, 'shared_org_owner_required');
+        relationships.push({ disposition: 'blocker', kind: 'remaining_owner', org });
+    }
+    const apps = involvedOrgs.length === 0
+        ? []
+        : await rows(pool, `SELECT org_slug, slug FROM apps WHERE org_slug = ANY($1::text[])`, [involvedOrgs]);
+    const storedDeployments = involvedOrgs.length === 0
+        ? []
+        : await rows(pool, `SELECT deployment_id, org_slug, app_slug, environment, active, archived_at,
+                  access_mode, created_by_subject, hosted_assets,
+                  CASE WHEN $2::text IS NULL THEN false
+                       ELSE archived_at = (
+                         SELECT quarantined_at FROM platform_account_reset_operations
+                          WHERE operation_id = $2
+                       )
+                   END AS operation_archived
+             FROM deploy_records
+            WHERE org_slug = ANY($1::text[])`, [involvedOrgs, input.quarantine?.operationId ?? null]);
+    const operationArchivedDeployments = new Set((input.quarantine?.cleanupResources ?? [])
+        .filter((resource) => resource.provider === 'postgres' &&
+        resource.resourceKind === 'deployment' &&
+        resource.locator.archived === false)
+        .map((resource) => resource.locator.deploymentId)
+        .filter((deploymentId) => typeof deploymentId === 'string'));
+    const allDeployments = storedDeployments.map((deployment) => input.quarantine !== undefined &&
+        operationArchivedDeployments.has(deployment.deployment_id) &&
+        deployment.operation_archived
+        ? { ...deployment, archived_at: null }
+        : deployment);
+    const activeByApp = groupBy(allDeployments.filter((row) => row.active && row.archived_at === null), appKey);
+    const eligibleApps = new Set();
+    let targetOwnerOnlyApps = 0;
+    for (const app of apps) {
+        const key = appKey(app);
+        const ownedDisposition = ownedOrgs.get(app.org_slug);
+        if (ownedDisposition !== undefined) {
+            eligibleApps.add(key);
+            relationships.push({
+                disposition: ownedDisposition,
+                kind: 'app',
+                org: app.org_slug,
+                app: app.slug,
+            });
+            continue;
+        }
+        if (!preservedOrgs.has(app.org_slug))
+            continue;
+        const active = activeByApp.get(key) ?? [];
+        const targetOwnerOnly = active.filter((deployment) => deployment.access_mode === 'owner-only' &&
+            deployment.created_by_subject !== null &&
+            targetSet.has(deployment.created_by_subject));
+        const conflicting = active.some((deployment) => deployment.access_mode !== 'owner-only' ||
+            deployment.created_by_subject === null ||
+            !targetSet.has(deployment.created_by_subject));
+        if (targetOwnerOnly.length !== 0 && conflicting) {
+            increment(blockers, 'ownership_ambiguous');
+            relationships.push({
+                disposition: 'blocker',
+                kind: 'mixed_app_ownership',
+                org: app.org_slug,
+                app: app.slug,
+            });
+        }
+        else if (targetOwnerOnly.length !== 0) {
+            eligibleApps.add(key);
+            targetOwnerOnlyApps += 1;
+            relationships.push({
+                disposition: 'target_owner_only_app',
+                org: app.org_slug,
+                app: app.slug,
+            });
+        }
+        else if (active.some((deployment) => deployment.access_mode === 'org-members')) {
+            relationships.push({
+                disposition: 'preserved_org_members_app',
+                org: app.org_slug,
+                app: app.slug,
+            });
+        }
+    }
+    for (const [org, disposition] of ownedOrgs) {
+        addPlatformAccountResetCleanupResource(resources, 'postgres', 'organization', {
+            org,
+            disposition,
+            targetPrincipals: (membershipsByOrg.get(org) ?? []).map((row) => row.subject),
+        });
+    }
+    for (const org of preservedOrgs) {
+        for (const member of membershipsByOrg.get(org) ?? []) {
+            addPlatformAccountResetCleanupResource(resources, 'postgres', 'preserved_membership', {
+                org,
+                principalId: member.subject,
+                role: member.role,
+            });
+        }
+    }
+    for (const app of apps) {
+        if (!eligibleApps.has(appKey(app)))
+            continue;
+        addPlatformAccountResetCleanupResource(resources, 'postgres', 'application', {
+            org: app.org_slug,
+            app: app.slug,
+        });
+    }
+    const eligibleDeployments = allDeployments.filter((row) => eligibleApps.has(appKey(row)));
+    const eligibleDeploymentIds = new Set(eligibleDeployments.map((row) => row.deployment_id));
+    for (const deployment of eligibleDeployments) {
+        addPlatformAccountResetCleanupResource(resources, 'postgres', 'deployment', {
+            deploymentId: deployment.deployment_id,
+            org: deployment.org_slug,
+            app: deployment.app_slug,
+            environment: deployment.environment,
+            active: deployment.active,
+            archived: deployment.archived_at !== null,
+        });
+    }
+    await addPlatformAccountResetHostedAssets(pool, resources, () => increment(blockers, 'ownership_ambiguous'), eligibleDeployments, eligibleDeploymentIds);
+    await addPlatformAccountResetRepositories(pool, resources, eligibleApps);
+    await addPlatformAccountResetStateScopes(pool, resources, eligibleDeploymentIds);
+    const selectedBillingAccounts = [...new Set(personal.map((row) => row.billing_account_id))].sort(compareText);
+    if (selectedBillingAccounts.length !== 0) {
+        const billingHomes = await rows(pool, `SELECT org_slug, billing_account_id,
+              home_owner_identity_issuer, home_owner_subject
+         FROM org_billing_home_accounts
+        WHERE billing_account_id = ANY($1::text[])`, [selectedBillingAccounts]);
+        for (const home of billingHomes) {
+            if (!ownedOrgs.has(home.org_slug))
+                increment(blockers, 'ownership_ambiguous');
+            else
+                addPlatformAccountResetCleanupResource(resources, 'postgres', 'billing_home_account', {
+                    org: home.org_slug,
+                    billingAccountId: home.billing_account_id,
+                    homeOwnerIdentityIssuer: home.home_owner_identity_issuer,
+                    homeOwnerSubject: home.home_owner_subject,
+                });
+        }
+        const billingLinks = await rows(pool, `SELECT org_slug, billing_account_id, home_free_billing_account_id,
+              fallback_billing_account_id, version,
+              linked_by_identity_issuer, linked_by_subject
+         FROM org_billing_links
+        WHERE active
+          AND (
+            billing_account_id = ANY($1::text[])
+            OR home_free_billing_account_id = ANY($1::text[])
+            OR fallback_billing_account_id = ANY($1::text[])
+          )`, [selectedBillingAccounts]);
+        for (const link of billingLinks) {
+            if (!ownedOrgs.has(link.org_slug)) {
+                increment(blockers, 'ownership_ambiguous');
+                continue;
+            }
+            addPlatformAccountResetCleanupResource(resources, 'postgres', 'org_billing_link', {
+                org: link.org_slug,
+                billingAccountId: link.billing_account_id,
+                homeFreeBillingAccountId: link.home_free_billing_account_id,
+                fallbackBillingAccountId: link.fallback_billing_account_id,
+                version: link.version,
+                linkedByIdentityIssuer: link.linked_by_identity_issuer,
+                linkedBySubject: link.linked_by_subject,
+            });
+        }
+    }
+    for (const account of selectedBillingAccounts)
+        addPlatformAccountResetCleanupResource(resources, 'postgres', 'billing_account', {
+            billingAccountId: account,
+        });
+    await addPlatformAccountResetBillingProviders(pool, resources, selectedBillingAccounts);
+    await addPlatformAccountResetCredentialScopes(pool, resources, targets, input.quarantine?.cleanupResources);
+    const normalizedResources = resources.sort((left, right) => canonicalJson(left).localeCompare(canonicalJson(right)));
+    const cleanupSetFingerprint = sha256Canonical({
+        schemaVersion: 1,
+        label: 'platform_account_reset_cleanup_set',
+        resources: normalizedResources,
+    });
+    const ownershipFingerprint = sha256Canonical({
+        schemaVersion: 1,
+        label: 'platform_account_reset_ownership',
+        relationships,
+    });
+    const counts = {
+        personalOrganizationCount: validPersonalOrganizations,
+        soleOwnedOrganizationCount: [...ownedOrgs.values()].filter((disposition) => disposition === 'sole_owned_org').length,
+        ownerOnlyAppCount: targetOwnerOnlyApps,
+        preservedSharedOrganizationCount: preservedOrgs.size,
+        membershipCount: membershipRows.length,
+        billingAccountCount: selectedBillingAccounts.length,
+        credentialCount: normalizedResources.filter((resource) => [
+            'developer_grant',
+            'oauth_consent',
+            'device_authorization',
+            'refresh_subject',
+            'authorization_code',
+        ].includes(resource.resourceKind)).length,
+        providerObjectCount: normalizedResources.filter((resource) => resource.provider !== 'postgres' || resource.resourceKind === 'state_scope').length,
+    };
+    const blockerList = [...blockers]
+        .map(([code, count]) => ({ code, count }))
+        .sort((left, right) => left.code.localeCompare(right.code));
+    return {
+        counts,
+        blockers: blockerList,
+        cleanupResources: normalizedResources,
+        ownershipFingerprint,
+        cleanupSetFingerprint,
+        fingerprint: sha256Canonical({
+            schemaVersion: 1,
+            label: 'platform_account_reset_ownership_snapshot',
+            counts,
+            blockers: blockerList,
+            ownershipFingerprint,
+            cleanupSetFingerprint,
+        }),
+    };
+}
+//# sourceMappingURL=platform-account-reset-ownership-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-ownership-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-ownership-postgres.js","sourceRoot":"","sources":["../src/platform-account-reset-ownership-postgres.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AACzF,OAAO,EACL,0BAA0B,IAAI,MAAM,EACpC,+BAA+B,IAAI,WAAW,EAC9C,6BAA6B,IAAI,OAAO,EACxC,kCAAkC,IAAI,SAAS,EAC/C,6BAA6B,IAAI,IAAI,GACtC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,uCAAuC,EACvC,sCAAsC,EACtC,uCAAuC,EACvC,mCAAmC,EACnC,mCAAmC,EACnC,kCAAkC,GACnC,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,2CAA2C,EAAE,MAAM,yDAAyD,CAAC;AAiGtH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,IAA+B,EAC/B,KAMC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,MAAM,aAAa,GAA6C,EAAE,CAAC;IACnE,MAAM,SAAS,GAA0C,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CACzB,IAAI,EACJ;;gDAE4C,EAC5C,CAAC,OAAO,CAAC,CACV,CAAC;IACF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAChG,MAAM,0BAA0B,GAAG,MAAM,IAAI,CAC3C,IAAI,EACJ;;;;iDAI6C,EAC7C,CAAC,OAAO,CAAC,CACV,CAAC;IACF,MAAM,mBAAmB,GACvB,KAAK,CAAC,UAAU,KAAK,SAAS;QAC5B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,MAAM,2CAA2C,CAC/C,IAAI,EACJ,KAAK,CAAC,UAAU,CAAC,WAAW,EAC5B,OAAO,EACP,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAClC,CAAC;IACR,MAAM,cAAc,GAAG,MAAM,IAAI,CAC/B,IAAI,EACJ;;sCAEkC,EAClC,CAAC,OAAO,CAAC,CACV,CAAC;IACF,MAAM,YAAY,GAAG;QACnB,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC5C,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;YACtC,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;YACxD,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;SAClD,CAAC;KACH,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpB,MAAM,MAAM,GACV,YAAY,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,MAAM,IAAI,CACR,IAAI,EACJ;;;8EAGoE,EACpE,CAAC,YAAY,CAAC,CACf,CAAC;IACR,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6C,CAAC;IACvE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,IAAI,0BAA0B,GAAG,CAAC,CAAC;IAEnC,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;YACrD,SAAS,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;YAC3C,aAAa,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1E,SAAS;QACX,CAAC;QACD,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,mBAAmB,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAClE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,aAAa,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CACxE,CAAC;YACF,IACE,mBAAmB,CAAC,MAAM,KAAK,CAAC;gBAChC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,aAAa,CAAC,EAC1D,CAAC;gBACD,SAAS,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;gBAC3C,aAAa,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;gBACjF,SAAS;YACX,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YACnC,0BAA0B,IAAI,CAAC,CAAC;YAChC,aAAa,CAAC,IAAI,CAAC;gBACjB,WAAW,EAAE,cAAc;gBAC3B,GAAG;gBACH,WAAW,EAAE,aAAa;aAC3B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/E,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACjF,MAAM,mBAAmB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QACvF,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,aAAa,CAAC,IAAI,CAAC;gBACjB,WAAW,EAAE,sBAAsB;gBACnC,GAAG;gBACH,gBAAgB,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;aACpF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,SAAS,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;YAC3C,aAAa,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,CAAC,CAAC;YACpF,SAAS;QACX,CAAC;QACD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;YAC1E,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACrC,aAAa,CAAC,IAAI,CAAC;gBACjB,WAAW,EAAE,gBAAgB;gBAC7B,GAAG;gBACH,gBAAgB,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;aAC7D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,SAAS,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;QACjD,aAAa,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,IAAI,GACR,YAAY,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,MAAM,IAAI,CACR,IAAI,EACJ,kEAAkE,EAClE,CAAC,YAAY,CAAC,CACf,CAAC;IACR,MAAM,iBAAiB,GACrB,YAAY,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,MAAM,IAAI,CACR,IAAI,EACJ;;;;;;;;;6CASmC,EACnC,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,EAAE,WAAW,IAAI,IAAI,CAAC,CACtD,CAAC;IACR,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAC1C,CAAC,KAAK,CAAC,UAAU,EAAE,gBAAgB,IAAI,EAAE,CAAC;SACvC,MAAM,CACL,CAAC,QAAQ,EAAE,EAAE,CACX,QAAQ,CAAC,QAAQ,KAAK,UAAU;QAChC,QAAQ,CAAC,YAAY,KAAK,YAAY;QACtC,QAAQ,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,CACtC;SACA,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC;SAChD,MAAM,CAAC,CAAC,YAAY,EAA0B,EAAE,CAAC,OAAO,YAAY,KAAK,QAAQ,CAAC,CACtF,CAAC;IACF,MAAM,cAAc,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAC1D,KAAK,CAAC,UAAU,KAAK,SAAS;QAC9B,4BAA4B,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC;QAC1D,UAAU,CAAC,kBAAkB;QAC3B,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE;QACtC,CAAC,CAAC,UAAU,CACf,CAAC;IACF,MAAM,WAAW,GAAG,OAAO,CACzB,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,EACtE,MAAM,CACP,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,gBAAgB,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC;gBACjB,WAAW,EAAE,gBAAgB;gBAC7B,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,GAAG,CAAC,QAAQ;gBACjB,GAAG,EAAE,GAAG,CAAC,IAAI;aACd,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QAC/C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CACnC,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,WAAW,KAAK,YAAY;YACvC,UAAU,CAAC,kBAAkB,KAAK,IAAI;YACtC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAC/C,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC7B,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,WAAW,KAAK,YAAY;YACvC,UAAU,CAAC,kBAAkB,KAAK,IAAI;YACtC,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAChD,CAAC;QACF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC;YAChD,SAAS,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;YAC3C,aAAa,CAAC,IAAI,CAAC;gBACjB,WAAW,EAAE,SAAS;gBACtB,IAAI,EAAE,qBAAqB;gBAC3B,GAAG,EAAE,GAAG,CAAC,QAAQ;gBACjB,GAAG,EAAE,GAAG,CAAC,IAAI;aACd,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtB,mBAAmB,IAAI,CAAC,CAAC;YACzB,aAAa,CAAC,IAAI,CAAC;gBACjB,WAAW,EAAE,uBAAuB;gBACpC,GAAG,EAAE,GAAG,CAAC,QAAQ;gBACjB,GAAG,EAAE,GAAG,CAAC,IAAI;aACd,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,KAAK,aAAa,CAAC,EAAE,CAAC;YACjF,aAAa,CAAC,IAAI,CAAC;gBACjB,WAAW,EAAE,2BAA2B;gBACxC,GAAG,EAAE,GAAG,CAAC,QAAQ;gBACjB,GAAG,EAAE,GAAG,CAAC,IAAI;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,SAAS,EAAE,CAAC;QAC3C,sCAAsC,CAAC,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE;YAC5E,GAAG;YACH,WAAW;YACX,gBAAgB,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC;SAC9E,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,KAAK,MAAM,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YACrD,sCAAsC,CAAC,SAAS,EAAE,UAAU,EAAE,sBAAsB,EAAE;gBACpF,GAAG;gBACH,WAAW,EAAE,MAAM,CAAC,OAAO;gBAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAAE,SAAS;QAC7C,sCAAsC,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE;YAC3E,GAAG,EAAE,GAAG,CAAC,QAAQ;YACjB,GAAG,EAAE,GAAG,CAAC,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IAED,MAAM,mBAAmB,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC3F,KAAK,MAAM,UAAU,IAAI,mBAAmB,EAAE,CAAC;QAC7C,sCAAsC,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE;YAC1E,YAAY,EAAE,UAAU,CAAC,aAAa;YACtC,GAAG,EAAE,UAAU,CAAC,QAAQ;YACxB,GAAG,EAAE,UAAU,CAAC,QAAQ;YACxB,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,UAAU,CAAC,WAAW,KAAK,IAAI;SAC1C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,mCAAmC,CACvC,IAAI,EACJ,SAAS,EACT,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,qBAAqB,CAAC,EAChD,mBAAmB,EACnB,qBAAqB,CACtB,CAAC;IACF,MAAM,mCAAmC,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACzE,MAAM,kCAAkC,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAEjF,MAAM,uBAAuB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAC9F,WAAW,CACZ,CAAC;IACF,IAAI,uBAAuB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,YAAY,GAAG,MAAM,IAAI,CAC7B,IAAI,EACJ;;;mDAG6C,EAC7C,CAAC,uBAAuB,CAAC,CAC1B,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,SAAS,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;;gBAE5E,sCAAsC,CAAC,SAAS,EAAE,UAAU,EAAE,sBAAsB,EAAE;oBACpF,GAAG,EAAE,IAAI,CAAC,QAAQ;oBAClB,gBAAgB,EAAE,IAAI,CAAC,kBAAkB;oBACzC,uBAAuB,EAAE,IAAI,CAAC,0BAA0B;oBACxD,gBAAgB,EAAE,IAAI,CAAC,kBAAkB;iBAC1C,CAAC,CAAC;QACP,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAC7B,IAAI,EACJ;;;;;;;;;YASM,EACN,CAAC,uBAAuB,CAAC,CAC1B,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClC,SAAS,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;gBAC3C,SAAS;YACX,CAAC;YACD,sCAAsC,CAAC,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE;gBAChF,GAAG,EAAE,IAAI,CAAC,QAAQ;gBAClB,gBAAgB,EAAE,IAAI,CAAC,kBAAkB;gBACzC,wBAAwB,EAAE,IAAI,CAAC,4BAA4B;gBAC3D,wBAAwB,EAAE,IAAI,CAAC,2BAA2B;gBAC1D,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,sBAAsB,EAAE,IAAI,CAAC,yBAAyB;gBACtD,eAAe,EAAE,IAAI,CAAC,iBAAiB;aACxC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,uBAAuB;QAC3C,sCAAsC,CAAC,SAAS,EAAE,UAAU,EAAE,iBAAiB,EAAE;YAC/E,gBAAgB,EAAE,OAAO;SAC1B,CAAC,CAAC;IACL,MAAM,uCAAuC,CAAC,IAAI,EAAE,SAAS,EAAE,uBAAuB,CAAC,CAAC;IACxF,MAAM,uCAAuC,CAC3C,IAAI,EACJ,SAAS,EACT,OAAO,EACP,KAAK,CAAC,UAAU,EAAE,gBAAgB,CACnC,CAAC;IAEF,MAAM,mBAAmB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACzD,aAAa,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CACxD,CAAC;IACF,MAAM,qBAAqB,GAAG,eAAe,CAAC;QAC5C,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,oCAAoC;QAC3C,SAAS,EAAE,mBAAmB;KAC/B,CAAC,CAAC;IACH,MAAM,oBAAoB,GAAG,eAAe,CAAC;QAC3C,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,kCAAkC;QACzC,aAAa;KACd,CAAC,CAAC;IACH,MAAM,MAAM,GAAG;QACb,yBAAyB,EAAE,0BAA0B;QACrD,0BAA0B,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CACxD,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,gBAAgB,CAClD,CAAC,MAAM;QACR,iBAAiB,EAAE,mBAAmB;QACtC,gCAAgC,EAAE,aAAa,CAAC,IAAI;QACpD,eAAe,EAAE,cAAc,CAAC,MAAM;QACtC,mBAAmB,EAAE,uBAAuB,CAAC,MAAM;QACnD,eAAe,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CACvD;YACE,iBAAiB;YACjB,eAAe;YACf,sBAAsB;YACtB,iBAAiB;YACjB,oBAAoB;SACrB,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAClC,CAAC,MAAM;QACR,mBAAmB,EAAE,mBAAmB,CAAC,MAAM,CAC7C,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,YAAY,KAAK,aAAa,CAC1F,CAAC,MAAM;KACT,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,GAAG,QAAQ,CAAC;SAC9B,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;SACzC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,WAAW;QACrB,gBAAgB,EAAE,mBAAmB;QACrC,oBAAoB;QACpB,qBAAqB;QACrB,WAAW,EAAE,eAAe,CAAC;YAC3B,aAAa,EAAE,CAAC;YAChB,KAAK,EAAE,2CAA2C;YAClD,MAAM;YACN,QAAQ,EAAE,WAAW;YACrB,oBAAoB;YACpB,qBAAqB;SACtB,CAAC;KACH,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-account-reset-ownership-resources-postgres.d.ts

@@ -0,0 +1,14 @@
+import type { PlatformAccountResetCleanupResource } from './platform-account-reset-ownership-postgres.js';
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+interface DeploymentResourceRow {
+    readonly deployment_id: string;
+    readonly hosted_assets: unknown;
+}
+export declare function addPlatformAccountResetHostedAssets(pool: PlatformIdentityQueryable, resources: PlatformAccountResetCleanupResource[], onAmbiguous: () => void, eligibleDeployments: readonly DeploymentResourceRow[], eligibleDeploymentIds: ReadonlySet<string>): Promise<void>;
+export declare function addPlatformAccountResetRepositories(pool: PlatformIdentityQueryable, resources: PlatformAccountResetCleanupResource[], eligibleApps: ReadonlySet<string>): Promise<void>;
+export declare function addPlatformAccountResetStateScopes(pool: PlatformIdentityQueryable, resources: PlatformAccountResetCleanupResource[], deploymentIds: ReadonlySet<string>): Promise<void>;
+export declare function addPlatformAccountResetBillingProviders(pool: PlatformIdentityQueryable, resources: PlatformAccountResetCleanupResource[], billingAccountIds: readonly string[]): Promise<void>;
+export declare function addPlatformAccountResetCredentialScopes(pool: PlatformIdentityQueryable, resources: PlatformAccountResetCleanupResource[], targets: readonly string[], frozenResources?: readonly PlatformAccountResetCleanupResource[]): Promise<void>;
+export declare function addPlatformAccountResetCleanupResource(resources: PlatformAccountResetCleanupResource[], provider: PlatformAccountResetCleanupResource['provider'], resourceKind: string, locator: Readonly<Record<string, unknown>>): void;
+export {};
+//# sourceMappingURL=platform-account-reset-ownership-resources-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-ownership-resources-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-ownership-resources-postgres.d.ts","sourceRoot":"","sources":["../src/platform-account-reset-ownership-resources-postgres.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AAC1G,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC;AAuBD,wBAAsB,mCAAmC,CACvD,IAAI,EAAE,yBAAyB,EAC/B,SAAS,EAAE,mCAAmC,EAAE,EAChD,WAAW,EAAE,MAAM,IAAI,EACvB,mBAAmB,EAAE,SAAS,qBAAqB,EAAE,EACrD,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAAC,GACzC,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAED,wBAAsB,mCAAmC,CACvD,IAAI,EAAE,yBAAyB,EAC/B,SAAS,EAAE,mCAAmC,EAAE,EAChD,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC,CAuCf;AAED,wBAAsB,kCAAkC,CACtD,IAAI,EAAE,yBAAyB,EAC/B,SAAS,EAAE,mCAAmC,EAAE,EAChD,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,GACjC,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,wBAAsB,uCAAuC,CAC3D,IAAI,EAAE,yBAAyB,EAC/B,SAAS,EAAE,mCAAmC,EAAE,EAChD,iBAAiB,EAAE,SAAS,MAAM,EAAE,GACnC,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED,wBAAsB,uCAAuC,CAC3D,IAAI,EAAE,yBAAyB,EAC/B,SAAS,EAAE,mCAAmC,EAAE,EAChD,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,eAAe,CAAC,EAAE,SAAS,mCAAmC,EAAE,GAC/D,OAAO,CAAC,IAAI,CAAC,CAoGf;AAUD,wBAAgB,sCAAsC,CACpD,SAAS,EAAE,mCAAmC,EAAE,EAChD,QAAQ,EAAE,mCAAmC,CAAC,UAAU,CAAC,EACzD,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACzC,IAAI,CAgBN"}

package/node_modules/@noodle-borg/service/dist/platform-account-reset-ownership-resources-postgres.js

@@ -0,0 +1,210 @@
+import { sha256Canonical } from './platform-account-reset-fingerprint.js';
+import { platformAccountResetAppKey as appKey, comparePlatformAccountResetText as compareText, queryPlatformAccountResetRows as rows, } from './platform-account-reset-ownership-helpers.js';
+export async function addPlatformAccountResetHostedAssets(pool, resources, onAmbiguous, eligibleDeployments, eligibleDeploymentIds) {
+    const allDeployments = await rows(pool, 'SELECT deployment_id, hosted_assets FROM deploy_records');
+    const references = new Map();
+    for (const deployment of allDeployments) {
+        for (const objectKey of parseAssetKeys(deployment.hosted_assets).keys) {
+            const deploymentIds = references.get(objectKey) ?? new Set();
+            deploymentIds.add(deployment.deployment_id);
+            references.set(objectKey, deploymentIds);
+        }
+    }
+    for (const deployment of eligibleDeployments) {
+        const parsed = parseAssetKeys(deployment.hosted_assets);
+        if (!parsed.valid) {
+            onAmbiguous();
+            continue;
+        }
+        for (const objectKey of parsed.keys) {
+            const deploymentIds = [...(references.get(objectKey) ?? [])].sort(compareText);
+            if (deploymentIds.some((id) => !eligibleDeploymentIds.has(id))) {
+                onAmbiguous();
+                continue;
+            }
+            addPlatformAccountResetCleanupResource(resources, 'object_storage', 'hosted_asset', {
+                objectKey,
+                deploymentIds,
+            });
+        }
+    }
+}
+export async function addPlatformAccountResetRepositories(pool, resources, eligibleApps) {
+    const all = await rows(pool, `SELECT github_repository_id, installation_id, org_slug, app_slug, enabled
+       FROM repo_connections`);
+    const normalized = all.map((row) => ({
+        ...row,
+        github_repository_id: canonicalGitHubId(row.github_repository_id),
+        installation_id: canonicalGitHubId(row.installation_id),
+    }));
+    const selected = normalized.filter((row) => eligibleApps.has(appKey(row)));
+    for (const repository of selected) {
+        addPlatformAccountResetCleanupResource(resources, 'github', 'repository_connection', {
+            githubRepositoryId: repository.github_repository_id,
+            installationId: repository.installation_id,
+            enabled: repository.enabled,
+            org: repository.org_slug,
+            app: repository.app_slug,
+        });
+    }
+    for (const installationId of [...new Set(selected.map((row) => row.installation_id))].sort(compareCanonicalDecimal)) {
+        addPlatformAccountResetCleanupResource(resources, 'github', 'installation_reachability', {
+            installationId,
+            selectedRepositoryIds: selected
+                .filter((row) => row.installation_id === installationId)
+                .map((row) => row.github_repository_id)
+                .sort(compareCanonicalDecimal),
+            survivingRepositoryIds: normalized
+                .filter((row) => row.installation_id === installationId && !eligibleApps.has(appKey(row)) && row.enabled)
+                .map((row) => row.github_repository_id)
+                .sort(compareCanonicalDecimal),
+        });
+    }
+}
+export async function addPlatformAccountResetStateScopes(pool, resources, deploymentIds) {
+    if (deploymentIds.size === 0)
+        return;
+    const state = await rows(pool, `SELECT deployment_id, handle_name, owner_key, state_key
+       FROM state_handle_records
+      WHERE deployment_id = ANY($1::text[])`, [[...deploymentIds]]);
+    for (const row of state)
+        addPlatformAccountResetCleanupResource(resources, 'postgres', 'state_scope', {
+            deploymentId: row.deployment_id,
+            handleName: row.handle_name,
+            ownerKey: row.owner_key,
+            stateKey: row.state_key,
+        });
+}
+export async function addPlatformAccountResetBillingProviders(pool, resources, billingAccountIds) {
+    if (billingAccountIds.length === 0)
+        return;
+    const customers = await rows(pool, `SELECT billing_account_id, mode, customer_id AS provider_id
+       FROM billing_stripe_customers
+      WHERE billing_account_id = ANY($1::text[])`, [billingAccountIds]);
+    const subscriptions = await rows(pool, `SELECT billing_account_id, mode, provider_subscription_id AS provider_id
+       FROM billing_stripe_subscription_bindings
+      WHERE billing_account_id = ANY($1::text[])`, [billingAccountIds]);
+    for (const row of customers)
+        addPlatformAccountResetCleanupResource(resources, 'stripe', 'billing_customer', {
+            billingAccountId: row.billing_account_id,
+            mode: row.mode,
+            customerId: row.provider_id,
+        });
+    for (const row of subscriptions)
+        addPlatformAccountResetCleanupResource(resources, 'stripe', 'billing_subscription', {
+            billingAccountId: row.billing_account_id,
+            mode: row.mode,
+            subscriptionId: row.provider_id,
+        });
+}
+export async function addPlatformAccountResetCredentialScopes(pool, resources, targets, frozenResources) {
+    if (frozenResources !== undefined) {
+        for (const resource of frozenResources) {
+            if (resource.provider === 'postgres' && CREDENTIAL_RESOURCE_KINDS.has(resource.resourceKind))
+                addPlatformAccountResetCleanupResource(resources, resource.provider, resource.resourceKind, resource.locator);
+        }
+        return;
+    }
+    const grants = await rows(pool, `SELECT id, subject FROM developer_access_grants
+      WHERE subject = ANY($1::text[]) AND revoked_at IS NULL
+        AND (expires_at IS NULL OR expires_at > now())`, [targets]);
+    for (const row of grants)
+        addPlatformAccountResetCleanupResource(resources, 'postgres', 'developer_grant', {
+            grantId: row.id,
+            principalId: row.subject,
+        });
+    const consent = await rows(pool, `SELECT DISTINCT client_id, owner_subject, resource
+       FROM (
+         SELECT client_id, owner_subject, resource
+           FROM oauth_consent_grant_provenance
+          WHERE owner_subject = ANY($1::text[]) AND identity_kind = 'platform'
+         UNION ALL
+         SELECT client_id, owner_subject, resource
+           FROM oauth_consent_grants
+          WHERE owner_subject = ANY($1::text[]) AND identity_kind = 'platform'
+       ) consent`, [targets]);
+    for (const row of consent)
+        addPlatformAccountResetCleanupResource(resources, 'postgres', 'oauth_consent', {
+            clientId: row.client_id,
+            principalId: row.owner_subject,
+            resource: row.resource,
+        });
+    const devices = await rows(pool, `SELECT device_code, owner_subject FROM oauth_device_authorizations
+      WHERE owner_subject = ANY($1::text[])
+        AND identity_kind IS DISTINCT FROM 'customer'
+        AND status IN ('pending', 'approved') AND expires_at > now()`, [targets]);
+    for (const row of devices)
+        addPlatformAccountResetCleanupResource(resources, 'postgres', 'device_authorization', {
+            deviceCode: row.device_code,
+            principalId: row.owner_subject,
+        });
+    const refresh = await rows(pool, `SELECT owner_subject,
+            array_agg(DISTINCT family_id) FILTER (WHERE family_id IS NOT NULL) AS family_ids
+       FROM oauth_refresh_tokens
+      WHERE owner_subject = ANY($1::text[])
+        AND identity_kind IS DISTINCT FROM 'customer'
+        AND expires_at > now() AND rotated_at IS NULL AND superseded_by IS NULL
+      GROUP BY owner_subject`, [targets]);
+    for (const row of refresh)
+        addPlatformAccountResetCleanupResource(resources, 'postgres', 'refresh_subject', {
+            principalId: row.owner_subject,
+            familyIds: row.family_ids ?? [],
+        });
+    const codes = await rows(pool, `SELECT code, owner_subject FROM oauth_authorization_codes
+      WHERE owner_subject = ANY($1::text[])
+        AND identity_kind IS DISTINCT FROM 'customer' AND expires_at > now()`, [targets]);
+    for (const row of codes)
+        addPlatformAccountResetCleanupResource(resources, 'postgres', 'authorization_code', {
+            codeFingerprint: sha256Canonical({
+                schemaVersion: 1,
+                label: 'oauth_authorization_code',
+                code: row.code,
+            }),
+            principalId: row.owner_subject,
+        });
+}
+const CREDENTIAL_RESOURCE_KINDS = new Set([
+    'developer_grant',
+    'oauth_consent',
+    'device_authorization',
+    'refresh_subject',
+    'authorization_code',
+]);
+export function addPlatformAccountResetCleanupResource(resources, provider, resourceKind, locator) {
+    const locatorFingerprint = sha256Canonical({
+        schemaVersion: 1,
+        label: `platform_account_reset_locator:${provider}:${resourceKind}`,
+        locator,
+    });
+    if (resources.some((resource) => resource.provider === provider &&
+        resource.resourceKind === resourceKind &&
+        resource.locatorFingerprint === locatorFingerprint))
+        return;
+    resources.push({ provider, resourceKind, locator, locatorFingerprint });
+}
+function parseAssetKeys(value) {
+    if (value === null)
+        return { valid: true, keys: [] };
+    if (!Array.isArray(value))
+        return { valid: false, keys: [] };
+    const keys = [];
+    for (const entry of value) {
+        if (typeof entry !== 'object' ||
+            entry === null ||
+            !('objectKey' in entry) ||
+            typeof entry.objectKey !== 'string' ||
+            entry.objectKey.length === 0)
+            return { valid: false, keys: [] };
+        keys.push(entry.objectKey);
+    }
+    return { valid: true, keys: [...new Set(keys)].sort(compareText) };
+}
+function canonicalGitHubId(value) {
+    if (!/^[1-9][0-9]*$/.test(value))
+        throw new Error('GitHub identifier is not canonical');
+    return value;
+}
+function compareCanonicalDecimal(left, right) {
+    return left.length - right.length || compareText(left, right);
+}
+//# sourceMappingURL=platform-account-reset-ownership-resources-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-ownership-resources-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-ownership-resources-postgres.js","sourceRoot":"","sources":["../src/platform-account-reset-ownership-resources-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EACL,0BAA0B,IAAI,MAAM,EACpC,+BAA+B,IAAI,WAAW,EAC9C,6BAA6B,IAAI,IAAI,GACtC,MAAM,+CAA+C,CAAC;AA8BvD,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,IAA+B,EAC/B,SAAgD,EAChD,WAAuB,EACvB,mBAAqD,EACrD,qBAA0C;IAE1C,MAAM,cAAc,GAAG,MAAM,IAAI,CAC/B,IAAI,EACJ,yDAAyD,CAC1D,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAuB,CAAC;IAClD,KAAK,MAAM,UAAU,IAAI,cAAc,EAAE,CAAC;QACxC,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC;YACtE,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YACrE,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YAC5C,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,mBAAmB,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,WAAW,EAAE,CAAC;YACd,SAAS;QACX,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC/E,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC/D,WAAW,EAAE,CAAC;gBACd,SAAS;YACX,CAAC;YACD,sCAAsC,CAAC,SAAS,EAAE,gBAAgB,EAAE,cAAc,EAAE;gBAClF,SAAS;gBACT,aAAa;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,IAA+B,EAC/B,SAAgD,EAChD,YAAiC;IAEjC,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,IAAI,EACJ;6BACyB,CAC1B,CAAC;IACF,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnC,GAAG,GAAG;QACN,oBAAoB,EAAE,iBAAiB,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACjE,eAAe,EAAE,iBAAiB,CAAC,GAAG,CAAC,eAAe,CAAC;KACxD,CAAC,CAAC,CAAC;IACJ,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3E,KAAK,MAAM,UAAU,IAAI,QAAQ,EAAE,CAAC;QAClC,sCAAsC,CAAC,SAAS,EAAE,QAAQ,EAAE,uBAAuB,EAAE;YACnF,kBAAkB,EAAE,UAAU,CAAC,oBAAoB;YACnD,cAAc,EAAE,UAAU,CAAC,eAAe;YAC1C,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,GAAG,EAAE,UAAU,CAAC,QAAQ;YACxB,GAAG,EAAE,UAAU,CAAC,QAAQ;SACzB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,cAAc,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CACxF,uBAAuB,CACxB,EAAE,CAAC;QACF,sCAAsC,CAAC,SAAS,EAAE,QAAQ,EAAE,2BAA2B,EAAE;YACvF,cAAc;YACd,qBAAqB,EAAE,QAAQ;iBAC5B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,KAAK,cAAc,CAAC;iBACvD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC;iBACtC,IAAI,CAAC,uBAAuB,CAAC;YAChC,sBAAsB,EAAE,UAAU;iBAC/B,MAAM,CACL,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,eAAe,KAAK,cAAc,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAC1F;iBACA,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC;iBACtC,IAAI,CAAC,uBAAuB,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,IAA+B,EAC/B,SAAgD,EAChD,aAAkC;IAElC,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IACrC,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,IAAI,EACJ;;4CAEwC,EACxC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CACrB,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,KAAK;QACrB,sCAAsC,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE;YAC3E,YAAY,EAAE,GAAG,CAAC,aAAa;YAC/B,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,QAAQ,EAAE,GAAG,CAAC,SAAS;SACxB,CAAC,CAAC;AACP,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,IAA+B,EAC/B,SAAgD,EAChD,iBAAoC;IAEpC,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC3C,MAAM,SAAS,GAAG,MAAM,IAAI,CAC1B,IAAI,EACJ;;iDAE6C,EAC7C,CAAC,iBAAiB,CAAC,CACpB,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,IAAI,CAC9B,IAAI,EACJ;;iDAE6C,EAC7C,CAAC,iBAAiB,CAAC,CACpB,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,SAAS;QACzB,sCAAsC,CAAC,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE;YAC9E,gBAAgB,EAAE,GAAG,CAAC,kBAAkB;YACxC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,WAAW;SAC5B,CAAC,CAAC;IACL,KAAK,MAAM,GAAG,IAAI,aAAa;QAC7B,sCAAsC,CAAC,SAAS,EAAE,QAAQ,EAAE,sBAAsB,EAAE;YAClF,gBAAgB,EAAE,GAAG,CAAC,kBAAkB;YACxC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,cAAc,EAAE,GAAG,CAAC,WAAW;SAChC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,IAA+B,EAC/B,SAAgD,EAChD,OAA0B,EAC1B,eAAgE;IAEhE,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;YACvC,IAAI,QAAQ,CAAC,QAAQ,KAAK,UAAU,IAAI,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAC1F,sCAAsC,CACpC,SAAS,EACT,QAAQ,CAAC,QAAQ,EACjB,QAAQ,CAAC,YAAY,EACrB,QAAQ,CAAC,OAAO,CACjB,CAAC;QACN,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,IAAI,EACJ;;uDAEmD,EACnD,CAAC,OAAO,CAAC,CACV,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,MAAM;QACtB,sCAAsC,CAAC,SAAS,EAAE,UAAU,EAAE,iBAAiB,EAAE;YAC/E,OAAO,EAAE,GAAG,CAAC,EAAE;YACf,WAAW,EAAE,GAAG,CAAC,OAAO;SACzB,CAAC,CAAC;IACL,MAAM,OAAO,GAAG,MAAM,IAAI,CAKxB,IAAI,EACJ;;;;;;;;;iBASa,EACb,CAAC,OAAO,CAAC,CACV,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,OAAO;QACvB,sCAAsC,CAAC,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE;YAC7E,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,WAAW,EAAE,GAAG,CAAC,aAAa;YAC9B,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACvB,CAAC,CAAC;IACL,MAAM,OAAO,GAAG,MAAM,IAAI,CAIxB,IAAI,EACJ;;;qEAGiE,EACjE,CAAC,OAAO,CAAC,CACV,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,OAAO;QACvB,sCAAsC,CAAC,SAAS,EAAE,UAAU,EAAE,sBAAsB,EAAE;YACpF,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,WAAW,EAAE,GAAG,CAAC,aAAa;SAC/B,CAAC,CAAC;IACL,MAAM,OAAO,GAAG,MAAM,IAAI,CAIxB,IAAI,EACJ;;;;;;6BAMyB,EACzB,CAAC,OAAO,CAAC,CACV,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,OAAO;QACvB,sCAAsC,CAAC,SAAS,EAAE,UAAU,EAAE,iBAAiB,EAAE;YAC/E,WAAW,EAAE,GAAG,CAAC,aAAa;YAC9B,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE;SAChC,CAAC,CAAC;IACL,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,IAAI,EACJ;;6EAEyE,EACzE,CAAC,OAAO,CAAC,CACV,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,KAAK;QACrB,sCAAsC,CAAC,SAAS,EAAE,UAAU,EAAE,oBAAoB,EAAE;YAClF,eAAe,EAAE,eAAe,CAAC;gBAC/B,aAAa,EAAE,CAAC;gBAChB,KAAK,EAAE,0BAA0B;gBACjC,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC;YACF,WAAW,EAAE,GAAG,CAAC,aAAa;SAC/B,CAAC,CAAC;AACP,CAAC;AAED,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,iBAAiB;IACjB,eAAe;IACf,sBAAsB;IACtB,iBAAiB;IACjB,oBAAoB;CACrB,CAAC,CAAC;AAEH,MAAM,UAAU,sCAAsC,CACpD,SAAgD,EAChD,QAAyD,EACzD,YAAoB,EACpB,OAA0C;IAE1C,MAAM,kBAAkB,GAAG,eAAe,CAAC;QACzC,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,kCAAkC,QAAQ,IAAI,YAAY,EAAE;QACnE,OAAO;KACR,CAAC,CAAC;IACH,IACE,SAAS,CAAC,IAAI,CACZ,CAAC,QAAQ,EAAE,EAAE,CACX,QAAQ,CAAC,QAAQ,KAAK,QAAQ;QAC9B,QAAQ,CAAC,YAAY,KAAK,YAAY;QACtC,QAAQ,CAAC,kBAAkB,KAAK,kBAAkB,CACrD;QAED,OAAO;IACT,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IAIpC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC7D,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACd,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC;YACvB,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YACnC,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAE5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY,EAAE,KAAa;IAC1D,OAAO,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-account-reset-ownership-rollback-postgres.d.ts

@@ -0,0 +1,11 @@
+import type { PlatformAccountResetCleanupResource } from './platform-account-reset-ownership-postgres.js';
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+/**
+ * Reintroduces only exact frozen owner-only app locators into rollback discovery. The current row must
+ * still carry this operation's quarantine archive stamp; broader archived deployment scans are forbidden.
+ */
+export declare function loadPlatformAccountResetFrozenOwnerOnlyApps(pool: PlatformIdentityQueryable, operationId: string, targetPrincipalIds: readonly string[], cleanupResources: readonly PlatformAccountResetCleanupResource[]): Promise<readonly {
+    readonly org_slug: string;
+    readonly app_slug: string;
+}[]>;
+//# sourceMappingURL=platform-account-reset-ownership-rollback-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-ownership-rollback-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-ownership-rollback-postgres.d.ts","sourceRoot":"","sources":["../src/platform-account-reset-ownership-rollback-postgres.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AAC1G,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAyBjF;;;GAGG;AACH,wBAAsB,2CAA2C,CAC/D,IAAI,EAAE,yBAAyB,EAC/B,WAAW,EAAE,MAAM,EACnB,kBAAkB,EAAE,SAAS,MAAM,EAAE,EACrC,gBAAgB,EAAE,SAAS,mCAAmC,EAAE,GAC/D,OAAO,CAAC,SAAS;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAAE,CAAC,CA0D9E"}