@noodleseed/one 0.83.0 → 0.84.0

package/node_modules/@noodle-borg/service/dist/platform-account-reset-rollback-local-postgres.js

@@ -0,0 +1,248 @@
+import { PlatformAccountResetResultSchema, } from './platform-account-reset.js';
+import { sha256Canonical } from './platform-account-reset-fingerprint.js';
+import { PlatformAccountResetPreviewError } from './platform-account-reset-preview-result.js';
+import { assertPlatformAccountResetRollbackEligibility } from './platform-account-reset-rollback-eligibility-postgres.js';
+import { lockPlatformAuthInventorySourceFenceTargets, readPlatformAuthInventorySourceEpoch, } from './platform-auth-inventory-source-fence-postgres.js';
+export async function inspectPlatformAccountResetRollbackLocalEvidence(connection, operationId, options) {
+    const operationResult = await connection.query(`SELECT lifecycle, release_sha, rollout_generation::text, workos_realm,
+            target_set_fingerprint, quarantine_safe_result, quarantined_at,
+            finalize_after, quarantine_idempotency_key_hash,
+            quarantine_request_fingerprint, quarantine_reason_fingerprint
+       FROM platform_account_reset_operations
+      WHERE operation_id = $1
+        AND lifecycle = 'quarantined'
+        AND finalize_after > clock_timestamp()
+      FOR SHARE`, [operationId]);
+    const operation = operationResult.rows[0];
+    if (operation === undefined)
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+    if (operation.release_sha !== options.releaseSha)
+        throw new PlatformAccountResetPreviewError('release_mismatch');
+    if (operation.workos_realm !== options.workosRealm)
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+    const quarantinedAt = validDate(operation.quarantined_at);
+    const finalizeAfter = validDate(operation.finalize_after);
+    const targetsResult = await connection.query(`SELECT principal_id, lifecycle, source_snapshot_fingerprint
+       FROM platform_account_reset_targets
+      WHERE operation_id = $1 ORDER BY principal_id FOR SHARE`, [operationId]);
+    if (targetsResult.rows.length !== 3 ||
+        targetsResult.rows.some((row) => row.lifecycle !== 'quarantined'))
+        throw new PlatformAccountResetPreviewError('target_count_invalid');
+    const targets = targetsResult.rows.map((row) => row.principal_id);
+    await lockPlatformAuthInventorySourceFenceTargets(connection, targets);
+    const targetFingerprints = targets.map((target) => sha256Canonical(target));
+    const sourceEpoch = Number(await readPlatformAuthInventorySourceEpoch(connection));
+    const rollout = await connection.query(`SELECT generation::text, lifecycle, workos_percentage
+       FROM platform_auth_rollout_state WHERE singleton = true FOR SHARE`);
+    const rolloutState = rollout.rows[0];
+    if (rolloutState === undefined ||
+        Number(rolloutState.generation) !== Number(operation.rollout_generation))
+        throw new PlatformAccountResetPreviewError('generation_mismatch');
+    if (rolloutState.lifecycle !== 'google' || rolloutState.workos_percentage !== 0)
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+    const reservations = await connection.query(`SELECT principal_id, normalized_email, realm, expires_at, created_at, released_at
+       FROM platform_account_reset_email_reservations
+      WHERE operation_id = $1 ORDER BY principal_id FOR SHARE`, [operationId]);
+    if (reservations.rows.length !== 3 ||
+        reservations.rows.some((row) => row.realm !== options.workosRealm ||
+            row.released_at !== null ||
+            validDate(row.created_at).getTime() !== quarantinedAt.getTime() ||
+            validDate(row.expires_at).getTime() !== finalizeAfter.getTime()))
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+    const contacts = new Map(reservations.rows.map((row) => [row.principal_id, row.normalized_email]));
+    if (contacts.size !== 3 || targets.some((target) => !contacts.has(target)))
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+    const principals = await connection.query(`SELECT principal_id, status, suspended_at, billing_identity_issuer, billing_subject
+       FROM platform_principals
+      WHERE principal_id = ANY($1::text[]) ORDER BY principal_id FOR SHARE`, [targets]);
+    if (principals.rows.length !== 3 ||
+        principals.rows.some((row) => row.status !== 'suspended' ||
+            validDate(row.suspended_at).getTime() !== quarantinedAt.getTime() ||
+            row.billing_identity_issuer !== 'https://accounts.google.com' ||
+            row.billing_subject !== row.principal_id))
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+    const links = await connection.query(`SELECT principal_id, provider, realm, external_id, disabled_at
+       FROM platform_identity_links
+      WHERE principal_id = ANY($1::text[])
+      ORDER BY principal_id, provider, realm, external_id FOR SHARE`, [targets]);
+    for (const target of targets) {
+        const google = links.rows.filter((row) => row.principal_id === target &&
+            row.provider === 'google' &&
+            row.realm === options.googleRealm &&
+            row.disabled_at === null &&
+            row.external_id === target);
+        if (google.length !== 1)
+            throw new PlatformAccountResetPreviewError('principal_not_legacy_google');
+    }
+    await assertNoActiveWorkosLineage(connection, targets, targetFingerprints);
+    await assertCredentialsRevoked(connection, targets);
+    const ledgerResult = await connection.query(`SELECT provider, resource_kind, provider_locator, locator_fingerprint, state,
+            lease_token_hash, lease_expires_at, attempt_count, retry_at, outcome_code,
+            quarantine_archive_at
+       FROM platform_account_reset_cleanup_ledger
+      WHERE operation_id = $1
+      ORDER BY provider, resource_kind, locator_fingerprint FOR SHARE`, [operationId]);
+    const resources = [];
+    const expectedDeployments = [];
+    for (const row of ledgerResult.rows) {
+        const locator = parseLocator(row);
+        resources.push({
+            provider: row.provider,
+            resourceKind: row.resource_kind,
+            locator,
+            locatorFingerprint: row.locator_fingerprint,
+        });
+        if (row.provider === 'postgres' &&
+            row.resource_kind === 'deployment' &&
+            locator.archived === false) {
+            if (typeof locator.deploymentId !== 'string' ||
+                validDate(row.quarantine_archive_at).getTime() !== quarantinedAt.getTime())
+                throw new PlatformAccountResetPreviewError('operation_conflict');
+            expectedDeployments.push(locator.deploymentId);
+        }
+    }
+    const deployments = await connection.query(`SELECT deployment_id, archived_at FROM deploy_records
+      WHERE deployment_id = ANY($1::text[]) ORDER BY deployment_id FOR SHARE`, [expectedDeployments]);
+    if (deployments.rows.length !== expectedDeployments.length ||
+        deployments.rows.some((row) => validDate(row.archived_at).getTime() !== quarantinedAt.getTime()))
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+    const baseResult = PlatformAccountResetResultSchema.safeParse(operation.quarantine_safe_result);
+    if (!baseResult.success)
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+    const eligibilityFingerprint = await assertPlatformAccountResetRollbackEligibility(connection, {
+        operationId,
+        targets,
+        frozenContacts: contacts,
+        frozenCleanupResources: resources,
+        sourceAvailability: options.sourceAvailability,
+        baseResult: baseResult.data,
+    });
+    const localEvidence = {
+        schemaVersion: 1,
+        label: 'platform_account_reset_rollback_local_evidence',
+        operation: {
+            releaseSha: operation.release_sha,
+            rolloutGeneration: Number(operation.rollout_generation),
+            targetSetFingerprint: operation.target_set_fingerprint,
+            quarantinedAt: quarantinedAt.toISOString(),
+            finalizeAfter: finalizeAfter.toISOString(),
+            quarantineIdempotencyKeyHash: operation.quarantine_idempotency_key_hash,
+            quarantineRequestFingerprint: operation.quarantine_request_fingerprint,
+            quarantineReasonFingerprint: operation.quarantine_reason_fingerprint,
+        },
+        sourceEpoch,
+        eligibilityFingerprint,
+        targetRows: targetsResult.rows,
+        reservations: reservations.rows.map((row) => ({
+            ...row,
+            expires_at: validDate(row.expires_at).toISOString(),
+            created_at: validDate(row.created_at).toISOString(),
+            released_at: optionalDate(row.released_at),
+        })),
+        principals: principals.rows.map((row) => ({
+            ...row,
+            suspended_at: optionalDate(row.suspended_at),
+        })),
+        links: links.rows.map((row) => ({
+            ...row,
+            disabled_at: optionalDate(row.disabled_at),
+        })),
+        cleanupLedger: ledgerResult.rows.map((row) => ({
+            ...row,
+            lease_expires_at: optionalDate(row.lease_expires_at),
+            retry_at: optionalDate(row.retry_at),
+            quarantine_archive_at: optionalDate(row.quarantine_archive_at),
+        })),
+        deployments: deployments.rows.map((row) => ({
+            ...row,
+            archived_at: optionalDate(row.archived_at),
+        })),
+    };
+    return {
+        operationId,
+        sourceEpoch,
+        rolloutGeneration: Number(operation.rollout_generation),
+        releaseSha: operation.release_sha,
+        targetSetFingerprint: operation.target_set_fingerprint,
+        targets,
+        contacts,
+        workosResources: resources.filter((resource) => resource.provider === 'workos'),
+        baseResult: baseResult.data,
+        evidenceFingerprint: sha256Canonical(localEvidence),
+    };
+}
+async function assertNoActiveWorkosLineage(connection, targets, targetFingerprints) {
+    const evidence = await connection.query(`SELECT 1
+       FROM platform_identity_links
+      WHERE principal_id = ANY($1::text[]) AND provider = 'workos' AND disabled_at IS NULL
+     UNION ALL
+     SELECT 1 FROM workos_import_ledger
+      WHERE principal_id = ANY($1::text[])
+     UNION ALL
+     SELECT 1 FROM workos_import_attempt_evidence
+      WHERE principal_id = ANY($1::text[])
+         OR principal_fingerprint = ANY($2::text[])
+     UNION ALL
+     SELECT 1
+       FROM platform_auth_inventory_candidates candidate
+       JOIN identity_migration_runs inventory
+         ON inventory.id = candidate.migration_run_id
+       JOIN identity_migration_runs import_run
+         ON import_run.inventory_run_id = inventory.id
+        AND import_run.kind = 'import'
+      WHERE (candidate.principal_id = ANY($1::text[])
+             OR candidate.source_subject = ANY($1::text[]))
+        AND import_run.state IN ('running', 'completed')
+     LIMIT 1`, [targets, targetFingerprints]);
+    if (evidence.rows[0] !== undefined)
+        throw new PlatformAccountResetPreviewError('workos_import_present');
+}
+async function assertCredentialsRevoked(connection, targets) {
+    const active = await connection.query(`SELECT (
+       (SELECT count(*) FROM oauth_refresh_tokens
+         WHERE owner_subject = ANY($1::text[]) AND identity_kind IS DISTINCT FROM 'customer')
+       + (SELECT count(*) FROM oauth_authorization_codes
+         WHERE owner_subject = ANY($1::text[]) AND identity_kind IS DISTINCT FROM 'customer')
+       + (SELECT count(*) FROM oauth_consent_grant_provenance
+         WHERE owner_subject = ANY($1::text[]) AND identity_kind = 'platform')
+       + (SELECT count(*) FROM oauth_consent_grants
+         WHERE owner_subject = ANY($1::text[]) AND identity_kind = 'platform')
+       + (SELECT count(*) FROM oauth_device_authorizations
+         WHERE owner_subject = ANY($1::text[]) AND identity_kind IS DISTINCT FROM 'customer')
+       + (SELECT count(*) FROM developer_access_grants
+         WHERE subject = ANY($1::text[]) AND revoked_at IS NULL)
+     )::int AS count`, [targets]);
+    if (active.rows[0]?.count !== 0)
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+}
+function parseLocator(row) {
+    let locator;
+    try {
+        locator = JSON.parse(row.provider_locator);
+    }
+    catch {
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+    }
+    if (!isRecord(locator) ||
+        !['postgres', 'object_storage', 'github', 'stripe', 'workos'].includes(row.provider) ||
+        sha256Canonical({
+            schemaVersion: 1,
+            label: `platform_account_reset_locator:${row.provider}:${row.resource_kind}`,
+            locator,
+        }) !== row.locator_fingerprint)
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+    return locator;
+}
+function validDate(value) {
+    const date = value === null ? new Date(Number.NaN) : new Date(value);
+    if (!Number.isFinite(date.getTime()))
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+    return date;
+}
+function optionalDate(value) {
+    return value === null ? null : validDate(value).toISOString();
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=platform-account-reset-rollback-local-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-rollback-local-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-rollback-local-postgres.js","sourceRoot":"","sources":["../src/platform-account-reset-rollback-local-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,gCAAgC,GACjC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAC9F,OAAO,EAAE,6CAA6C,EAAE,MAAM,2DAA2D,CAAC;AAC1H,OAAO,EACL,2CAA2C,EAC3C,oCAAoC,GACrC,MAAM,oDAAoD,CAAC;AA2D5D,MAAM,CAAC,KAAK,UAAU,gDAAgD,CACpE,UAAqC,EACrC,WAAmB,EACnB,OAA6B;IAE7B,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,KAAK,CAC5C;;;;;;;;gBAQY,EACZ,CAAC,WAAW,CAAC,CACd,CAAC;IACF,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,SAAS,KAAK,SAAS;QAAE,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IAC9F,IAAI,SAAS,CAAC,WAAW,KAAK,OAAO,CAAC,UAAU;QAC9C,MAAM,IAAI,gCAAgC,CAAC,kBAAkB,CAAC,CAAC;IACjE,IAAI,SAAS,CAAC,YAAY,KAAK,OAAO,CAAC,WAAW;QAChD,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,SAAS,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,SAAS,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAE1D,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,KAAK,CAK1C;;8DAE0D,EAC1D,CAAC,WAAW,CAAC,CACd,CAAC;IACF,IACE,aAAa,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAC/B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,aAAa,CAAC;QAEjE,MAAM,IAAI,gCAAgC,CAAC,sBAAsB,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAClE,MAAM,2CAA2C,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACvE,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,oCAAoC,CAAC,UAAU,CAAC,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAKpC;yEACqE,CACtE,CAAC;IACF,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,IACE,YAAY,KAAK,SAAS;QAC1B,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC;QAExE,MAAM,IAAI,gCAAgC,CAAC,qBAAqB,CAAC,CAAC;IACpE,IAAI,YAAY,CAAC,SAAS,KAAK,QAAQ,IAAI,YAAY,CAAC,iBAAiB,KAAK,CAAC;QAC7E,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IAEnE,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,KAAK,CAQzC;;8DAE0D,EAC1D,CAAC,WAAW,CAAC,CACd,CAAC;IACF,IACE,YAAY,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAC9B,YAAY,CAAC,IAAI,CAAC,IAAI,CACpB,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,KAAK,KAAK,OAAO,CAAC,WAAW;YACjC,GAAG,CAAC,WAAW,KAAK,IAAI;YACxB,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,KAAK,aAAa,CAAC,OAAO,EAAE;YAC/D,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,KAAK,aAAa,CAAC,OAAO,EAAE,CAClE;QAED,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC,CACzE,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxE,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IAEnE,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,KAAK,CAOvC;;2EAEuE,EACvE,CAAC,OAAO,CAAC,CACV,CAAC;IACF,IACE,UAAU,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAC5B,UAAU,CAAC,IAAI,CAAC,IAAI,CAClB,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,MAAM,KAAK,WAAW;YAC1B,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,KAAK,aAAa,CAAC,OAAO,EAAE;YACjE,GAAG,CAAC,uBAAuB,KAAK,6BAA6B;YAC7D,GAAG,CAAC,eAAe,KAAK,GAAG,CAAC,YAAY,CAC3C;QAED,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,KAAK,CAOlC;;;oEAGgE,EAChE,CAAC,OAAO,CAAC,CACV,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAC9B,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,YAAY,KAAK,MAAM;YAC3B,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,GAAG,CAAC,KAAK,KAAK,OAAO,CAAC,WAAW;YACjC,GAAG,CAAC,WAAW,KAAK,IAAI;YACxB,GAAG,CAAC,WAAW,KAAK,MAAM,CAC7B,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YACrB,MAAM,IAAI,gCAAgC,CAAC,6BAA6B,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,2BAA2B,CAAC,UAAU,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAC3E,MAAM,wBAAwB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAEpD,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,KAAK,CACzC;;;;;sEAKkE,EAClE,CAAC,WAAW,CAAC,CACd,CAAC;IACF,MAAM,SAAS,GAAmD,EAAE,CAAC;IACrE,MAAM,mBAAmB,GAAa,EAAE,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAClC,SAAS,CAAC,IAAI,CAAC;YACb,QAAQ,EAAE,GAAG,CAAC,QAAoE;YAClF,YAAY,EAAE,GAAG,CAAC,aAAa;YAC/B,OAAO;YACP,kBAAkB,EAAE,GAAG,CAAC,mBAAmB;SAC5C,CAAC,CAAC;QACH,IACE,GAAG,CAAC,QAAQ,KAAK,UAAU;YAC3B,GAAG,CAAC,aAAa,KAAK,YAAY;YAClC,OAAO,CAAC,QAAQ,KAAK,KAAK,EAC1B,CAAC;YACD,IACE,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ;gBACxC,SAAS,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,OAAO,EAAE,KAAK,aAAa,CAAC,OAAO,EAAE;gBAE1E,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;YACnE,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,KAAK,CAIxC;6EACyE,EACzE,CAAC,mBAAmB,CAAC,CACtB,CAAC;IACF,IACE,WAAW,CAAC,IAAI,CAAC,MAAM,KAAK,mBAAmB,CAAC,MAAM;QACtD,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,KAAK,aAAa,CAAC,OAAO,EAAE,CAAC;QAEhG,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,gCAAgC,CAAC,SAAS,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IAChG,IAAI,CAAC,UAAU,CAAC,OAAO;QAAE,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IAC1F,MAAM,sBAAsB,GAAG,MAAM,6CAA6C,CAAC,UAAU,EAAE;QAC7F,WAAW;QACX,OAAO;QACP,cAAc,EAAE,QAAQ;QACxB,sBAAsB,EAAE,SAAS;QACjC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,UAAU,EAAE,UAAU,CAAC,IAAI;KAC5B,CAAC,CAAC;IACH,MAAM,aAAa,GAAG;QACpB,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,gDAAgD;QACvD,SAAS,EAAE;YACT,UAAU,EAAE,SAAS,CAAC,WAAW;YACjC,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC;YACvD,oBAAoB,EAAE,SAAS,CAAC,sBAAsB;YACtD,aAAa,EAAE,aAAa,CAAC,WAAW,EAAE;YAC1C,aAAa,EAAE,aAAa,CAAC,WAAW,EAAE;YAC1C,4BAA4B,EAAE,SAAS,CAAC,+BAA+B;YACvE,4BAA4B,EAAE,SAAS,CAAC,8BAA8B;YACtE,2BAA2B,EAAE,SAAS,CAAC,6BAA6B;SACrE;QACD,WAAW;QACX,sBAAsB;QACtB,UAAU,EAAE,aAAa,CAAC,IAAI;QAC9B,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC5C,GAAG,GAAG;YACN,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;YACnD,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;YACnD,WAAW,EAAE,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;SAC3C,CAAC,CAAC;QACH,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxC,GAAG,GAAG;YACN,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC;SAC7C,CAAC,CAAC;QACH,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9B,GAAG,GAAG;YACN,WAAW,EAAE,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;SAC3C,CAAC,CAAC;QACH,aAAa,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC7C,GAAG,GAAG;YACN,gBAAgB,EAAE,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC;YACpD,QAAQ,EAAE,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;YACpC,qBAAqB,EAAE,YAAY,CAAC,GAAG,CAAC,qBAAqB,CAAC;SAC/D,CAAC,CAAC;QACH,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC1C,GAAG,GAAG;YACN,WAAW,EAAE,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;SAC3C,CAAC,CAAC;KACJ,CAAC;IACF,OAAO;QACL,WAAW;QACX,WAAW;QACX,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC;QACvD,UAAU,EAAE,SAAS,CAAC,WAAW;QACjC,oBAAoB,EAAE,SAAS,CAAC,sBAAsB;QACtD,OAAO;QACP,QAAQ;QACR,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC/E,UAAU,EAAE,UAAU,CAAC,IAAI;QAC3B,mBAAmB,EAAE,eAAe,CAAC,aAAa,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,UAAqC,EACrC,OAA0B,EAC1B,kBAAqC;IAErC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CACrC;;;;;;;;;;;;;;;;;;;;;aAqBS,EACT,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAC9B,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;QAChC,MAAM,IAAI,gCAAgC,CAAC,uBAAuB,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,UAAqC,EACrC,OAA0B;IAE1B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CACnC;;;;;;;;;;;;;qBAaiB,EACjB,CAAC,OAAO,CAAC,CACV,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC;QAAE,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,YAAY,CAAC,GAAc;IAClC,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IACnE,CAAC;IACD,IACE,CAAC,QAAQ,CAAC,OAAO,CAAC;QAClB,CAAC,CAAC,UAAU,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QACpF,eAAe,CAAC;YACd,aAAa,EAAE,CAAC;YAChB,KAAK,EAAE,kCAAkC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,aAAa,EAAE;YAC5E,OAAO;SACR,CAAC,KAAK,GAAG,CAAC,mBAAmB;QAE9B,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IACnE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,SAAS,CAAC,KAA2B;IAC5C,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,KAA2B;IAC/C,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-account-reset-rollback-postgres.d.ts

@@ -0,0 +1,29 @@
+import { type PlatformAccountResetExecuteRequest, type PlatformAccountResetResult } from './platform-account-reset.js';
+import { type PlatformAccountResetMutationOutcome, type PlatformAccountResetPool } from './platform-account-reset-operation-postgres.js';
+import type { PlatformAccountResetPreparedRollbackValidation, PlatformAccountResetRollbackPreviewEvidence } from './platform-account-reset-rollback-preview-postgres.js';
+import type { PlatformAuthInventorySourceManifest } from './platform-auth-inventory-sources.js';
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+export type PlatformAccountResetRollbackBoundary = 'canonical_validated' | 'operation_transitioned' | 'reservations_removed' | 'principals_reactivated' | 'deployments_restored' | 'cleanup_cancelled' | 'targets_transitioned' | 'event_appended';
+interface RollbackOptions {
+    readonly preview: {
+        prepareUsable(input: PlatformAccountResetRollbackPreviewEvidence, deadline?: number): Promise<PlatformAccountResetPreparedRollbackValidation>;
+        assertPrepared(connection: PlatformIdentityQueryable, input: PlatformAccountResetRollbackPreviewEvidence, prepared: PlatformAccountResetPreparedRollbackValidation): Promise<PlatformAccountResetResult>;
+    };
+    readonly releaseSha: string;
+    readonly workosRealm: string;
+    readonly approvedTargetSetFingerprint: string;
+    readonly actorFingerprint: string;
+    readonly googleRealm?: string;
+    readonly sourceAvailability: PlatformAuthInventorySourceManifest;
+    readonly now?: () => Date;
+    readonly localCaptureTimeoutMs?: number;
+    readonly fault?: (boundary: PlatformAccountResetRollbackBoundary) => void | Promise<void>;
+}
+export declare class PostgresPlatformAccountResetRollbackStore {
+    #private;
+    constructor(pool: PlatformAccountResetPool, options: RollbackOptions);
+    rollback(rawRequest: PlatformAccountResetExecuteRequest): Promise<PlatformAccountResetResult>;
+    apply(rawRequest: PlatformAccountResetExecuteRequest): Promise<PlatformAccountResetMutationOutcome>;
+}
+export {};
+//# sourceMappingURL=platform-account-reset-rollback-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-rollback-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-rollback-postgres.d.ts","sourceRoot":"","sources":["../src/platform-account-reset-rollback-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,kCAAkC,EAEvC,KAAK,0BAA0B,EAChC,MAAM,6BAA6B,CAAC;AAMrC,OAAO,EAML,KAAK,mCAAmC,EACxC,KAAK,wBAAwB,EAE9B,MAAM,gDAAgD,CAAC;AAExD,OAAO,KAAK,EACV,8CAA8C,EAC9C,2CAA2C,EAC5C,MAAM,uDAAuD,CAAC;AAQ/D,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAChG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,MAAM,MAAM,oCAAoC,GAC5C,qBAAqB,GACrB,wBAAwB,GACxB,sBAAsB,GACtB,wBAAwB,GACxB,sBAAsB,GACtB,mBAAmB,GACnB,sBAAsB,GACtB,gBAAgB,CAAC;AAErB,UAAU,eAAe;IACvB,QAAQ,CAAC,OAAO,EAAE;QAChB,aAAa,CACX,KAAK,EAAE,2CAA2C,EAClD,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,8CAA8C,CAAC,CAAC;QAC3D,cAAc,CACZ,UAAU,EAAE,yBAAyB,EACrC,KAAK,EAAE,2CAA2C,EAClD,QAAQ,EAAE,8CAA8C,GACvD,OAAO,CAAC,0BAA0B,CAAC,CAAC;KACxC,CAAC;IACF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,mCAAmC,CAAC;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,oCAAoC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3F;AAKD,qBAAa,yCAAyC;;gBAIxC,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,eAAe;IAQ9D,QAAQ,CACZ,UAAU,EAAE,kCAAkC,GAC7C,OAAO,CAAC,0BAA0B,CAAC;IAIhC,KAAK,CACT,UAAU,EAAE,kCAAkC,GAC7C,OAAO,CAAC,mCAAmC,CAAC;CAiXhD"}

package/node_modules/@noodle-borg/service/dist/platform-account-reset-rollback-postgres.js

@@ -0,0 +1,281 @@
+import { PlatformAccountResetExecuteRequestSchema, } from './platform-account-reset.js';
+import { remainingPlatformAccountResetDispatchMilliseconds, runPlatformAccountResetWithDispatchLock, } from './platform-account-reset-dispatch-lock-postgres.js';
+import { sha256Canonical } from './platform-account-reset-fingerprint.js';
+import { assertPlatformAccountResetActionReplay, assertPlatformAccountResetApprovedTargetSet, loadPlatformAccountResetFrozenResources, loadPlatformAccountResetTargets, lockPlatformAccountResetOperation, platformAccountResetActionEvidence, } from './platform-account-reset-operation-postgres.js';
+import { PlatformAccountResetPreviewError } from './platform-account-reset-preview-result.js';
+import { PostgresPlatformAuthLegacyInventorySources } from './platform-auth-inventory-legacy-sources-postgres.js';
+import { assertPlatformAuthInventorySourceFence, lockPlatformAuthInventorySourceFenceTargets, PLATFORM_ACCOUNT_RESET_EXECUTION_TABLES, runPlatformAuthInventorySourceFenceTransaction, } from './platform-auth-inventory-source-fence-postgres.js';
+const DEFAULT_LOCAL_CAPTURE_TIMEOUT_MS = 5_000;
+const MAX_LOCAL_CAPTURE_TIMEOUT_MS = 60_000;
+export class PostgresPlatformAccountResetRollbackStore {
+    #pool;
+    #options;
+    constructor(pool, options) {
+        this.#pool = pool;
+        this.#options = {
+            ...options,
+            googleRealm: options.googleRealm ?? 'accounts.google.com',
+        };
+    }
+    async rollback(rawRequest) {
+        return (await this.apply(rawRequest)).result;
+    }
+    async apply(rawRequest) {
+        const request = PlatformAccountResetExecuteRequestSchema.parse(rawRequest);
+        if (request.action !== 'rollback')
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+        return runPlatformAccountResetWithDispatchLock(this.#pool, {
+            operationId: request.operationId,
+            timeoutMs: this.#localCaptureTimeout(),
+            task: (context) => this.#applyLocked(request, context.replayLifecycle, context.deadline),
+        });
+    }
+    async #applyLocked(request, replayLifecycle, deadline) {
+        const evidence = platformAccountResetActionEvidence(request, this.#options.actorFingerprint);
+        const previewEvidence = {
+            operationId: request.operationId,
+            releaseSha: request.releaseSha,
+            expectedGeneration: request.expectedGeneration,
+            previewChecksum: request.previewChecksum,
+        };
+        const prepared = replayLifecycle === 'rolled_back'
+            ? undefined
+            : await this.#options.preview.prepareUsable(previewEvidence, deadline);
+        return runPlatformAuthInventorySourceFenceTransaction(this.#pool, async (connection) => {
+            await this.#assertSourceFence(connection);
+            const operation = await lockPlatformAccountResetOperation(connection, request.operationId);
+            assertPlatformAccountResetApprovedTargetSet(operation, this.#options.approvedTargetSetFingerprint);
+            const resources = await loadPlatformAccountResetFrozenResources(connection, request.operationId);
+            if (operation.lifecycle === 'rolled_back') {
+                const result = assertPlatformAccountResetActionReplay(evidence, {
+                    idempotencyKeyHash: operation.rollback_idempotency_key_hash,
+                    requestFingerprint: operation.rollback_request_fingerprint,
+                    reasonFingerprint: operation.rollback_reason_fingerprint,
+                    actorFingerprint: operation.rollback_actor_fingerprint,
+                    safeResult: operation.rollback_safe_result,
+                });
+                return {
+                    result,
+                    registry: this.#registryPlan(resources.apps, operation.quarantined_at),
+                };
+            }
+            if (operation.lifecycle !== 'quarantined' || prepared === undefined)
+                throw new PlatformAccountResetPreviewError('operation_conflict');
+            const validated = await this.#options.preview.assertPrepared(connection, previewEvidence, prepared);
+            if (request.releaseSha !== this.#options.releaseSha ||
+                operation.release_sha !== request.releaseSha ||
+                operation.workos_realm !== this.#options.workosRealm ||
+                Number(operation.rollout_generation) !== request.expectedGeneration ||
+                validated.previewChecksum !== request.previewChecksum)
+                throw new PlatformAccountResetPreviewError('operation_conflict');
+            const targets = await loadPlatformAccountResetTargets(connection, request.operationId, 'quarantined');
+            await lockPlatformAuthInventorySourceFenceTargets(connection, targets);
+            await this.#assertRollbackCoordination(connection, targets, request, operation.quarantined_at);
+            await this.#assertFrozenQuarantineState(connection, request.operationId, targets);
+            const result = this.#rollbackResult(validated);
+            await this.#fault('canonical_validated');
+            const operationTransitioned = await connection.query(`WITH authority AS MATERIALIZED (
+             SELECT clock_timestamp() AS rolled_back_at
+           )
+           UPDATE platform_account_reset_operations operation
+              SET lifecycle = 'rolled_back',
+                  rollback_idempotency_key_hash = $2,
+                  rollback_request_fingerprint = $3,
+                  rollback_reason_fingerprint = $4,
+                  rollback_actor_fingerprint = $5,
+                  rollback_safe_result = $6::jsonb,
+                  updated_at = authority.rolled_back_at
+             FROM authority
+            WHERE operation.operation_id = $1 AND operation.lifecycle = 'quarantined'
+              AND operation.finalize_after > authority.rolled_back_at
+              AND EXISTS (
+                SELECT 1 FROM platform_account_reset_rollback_previews preview
+                 WHERE preview.operation_id = $1
+                   AND preview.preview_checksum = $7
+                   AND preview.preview_expires_at > authority.rolled_back_at
+              )
+          RETURNING operation.updated_at::text AS rolled_back_at`, [
+                request.operationId,
+                evidence.idempotencyKeyHash,
+                evidence.requestFingerprint,
+                evidence.reasonFingerprint,
+                evidence.actorFingerprint,
+                JSON.stringify(result),
+                request.previewChecksum,
+            ]);
+            if (operationTransitioned.rows.length !== 1)
+                throw new PlatformAccountResetPreviewError('operation_conflict');
+            const rolledBackAt = operationTransitioned.rows[0]?.rolled_back_at;
+            if (rolledBackAt === undefined)
+                throw new PlatformAccountResetPreviewError('operation_conflict');
+            await this.#fault('operation_transitioned');
+            const removed = await connection.query(`DELETE FROM platform_account_reset_email_reservations
+          WHERE operation_id = $1 AND realm = $2
+          RETURNING principal_id`, [request.operationId, this.#options.workosRealm]);
+            if (removed.rows.length !== 3)
+                throw new PlatformAccountResetPreviewError('operation_conflict');
+            await this.#fault('reservations_removed');
+            const reactivated = await connection.query(`UPDATE platform_principals
+            SET status = 'active', suspended_at = NULL
+          WHERE principal_id = ANY($1::text[]) AND status = 'suspended'
+            AND suspended_at = (
+              SELECT quarantined_at FROM platform_account_reset_operations
+               WHERE operation_id = $2
+            )
+          RETURNING principal_id`, [targets, request.operationId]);
+            if (reactivated.rows.length !== 3)
+                throw new PlatformAccountResetPreviewError('operation_conflict');
+            await this.#fault('principals_reactivated');
+            const restored = await connection.query(`UPDATE deploy_records deployment
+            SET archived_at = NULL
+           FROM platform_account_reset_cleanup_ledger ledger
+          WHERE ledger.operation_id = $1 AND ledger.provider = 'postgres'
+            AND ledger.resource_kind = 'deployment'
+            AND ledger.quarantine_archive_at IS NOT NULL
+            AND deployment.deployment_id =
+                ledger.provider_locator::jsonb->>'deploymentId'
+            AND deployment.archived_at = ledger.quarantine_archive_at
+          RETURNING deployment.deployment_id`, [request.operationId]);
+            if (restored.rows.length !== resources.deploymentIds.length)
+                throw new PlatformAccountResetPreviewError('operation_conflict');
+            await this.#fault('deployments_restored');
+            await connection.query(`UPDATE platform_account_reset_cleanup_ledger
+            SET state = 'blocked', lease_token_hash = NULL, lease_expires_at = NULL,
+                retry_at = NULL, outcome_code = 'rolled_back', updated_at = $2
+          WHERE operation_id = $1`, [request.operationId, rolledBackAt]);
+            await this.#fault('cleanup_cancelled');
+            const targetsTransitioned = await connection.query(`UPDATE platform_account_reset_targets
+            SET lifecycle = 'rolled_back', updated_at = $2
+          WHERE operation_id = $1 AND lifecycle = 'quarantined'
+          RETURNING principal_id`, [request.operationId, rolledBackAt]);
+            if (targetsTransitioned.rows.length !== 3)
+                throw new PlatformAccountResetPreviewError('operation_conflict');
+            await this.#fault('targets_transitioned');
+            await connection.query(`INSERT INTO platform_account_reset_events
+           (operation_id, event_type, target_set_fingerprint, event_fingerprint,
+            target_count, resource_count, blocker_count, created_at)
+         VALUES ($1, 'rolled_back', $2, $3, 3, $4, 0, $5)`, [
+                request.operationId,
+                result.targetSetFingerprint,
+                sha256Canonical({
+                    schemaVersion: 1,
+                    label: 'platform_account_reset_event:rolled_back',
+                    operationId: request.operationId,
+                    requestFingerprint: evidence.requestFingerprint,
+                    result,
+                }),
+                resources.resourceCount,
+                rolledBackAt,
+            ]);
+            await this.#fault('event_appended');
+            return {
+                result,
+                registry: this.#registryPlan(resources.apps, operation.quarantined_at),
+            };
+        }, this.#transactionOptions(deadline));
+    }
+    async #assertRollbackCoordination(connection, targets, request, quarantinedAtValue) {
+        const targetFingerprints = targets.map((target) => sha256Canonical(target));
+        const rollout = await connection.query(`SELECT generation::text, lifecycle, workos_percentage
+         FROM platform_auth_rollout_state WHERE singleton = true FOR SHARE`);
+        const state = rollout.rows[0];
+        if (state === undefined || Number(state.generation) !== request.expectedGeneration)
+            throw new PlatformAccountResetPreviewError('generation_mismatch');
+        if (state.lifecycle !== 'google' || state.workos_percentage !== 0)
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+        const quarantinedAt = quarantinedAtValue === null ? new Date(Number.NaN) : new Date(quarantinedAtValue);
+        if (!Number.isFinite(quarantinedAt.getTime()))
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+        const lineage = await connection.query(`SELECT 1
+         FROM platform_auth_inventory_candidates candidate
+         JOIN identity_migration_runs inventory
+           ON inventory.id = candidate.migration_run_id
+         JOIN identity_migration_runs import_run
+           ON import_run.inventory_run_id = inventory.id
+          AND import_run.kind = 'import'
+        WHERE (candidate.principal_id = ANY($1::text[])
+               OR candidate.source_subject = ANY($1::text[]))
+          AND import_run.state IN ('running', 'completed')
+          AND COALESCE(import_run.started_at, import_run.created_at) > $2
+        LIMIT 1`, [targets, quarantinedAt]);
+        const imported = await connection.query(`SELECT 1 FROM workos_import_ledger
+        WHERE principal_id = ANY($1::text[]) AND created_at > $2
+          AND state IN ('pending', 'reconcile_required', 'linked')
+        LIMIT 1`, [targets, quarantinedAt]);
+        const attempted = await connection.query(`SELECT 1 FROM workos_import_attempt_evidence
+        WHERE (principal_id = ANY($1::text[])
+               OR principal_fingerprint = ANY($3::text[]))
+          AND created_at > $2
+          AND outcome_code IN ('pending', 'reconcile_required', 'linked')
+        LIMIT 1`, [targets, quarantinedAt, targetFingerprints]);
+        const linked = await connection.query(`SELECT 1 FROM platform_identity_links
+        WHERE principal_id = ANY($1::text[]) AND provider = 'workos'
+          AND created_at > $2 AND disabled_at IS NULL
+        LIMIT 1`, [targets, quarantinedAt]);
+        if (lineage.rows[0] !== undefined ||
+            imported.rows[0] !== undefined ||
+            attempted.rows[0] !== undefined ||
+            linked.rows[0] !== undefined)
+            throw new PlatformAccountResetPreviewError('workos_import_present');
+    }
+    async #assertFrozenQuarantineState(connection, operationId, targets) {
+        const state = await connection.query(`SELECT
+         (SELECT count(*)::int
+            FROM platform_account_reset_email_reservations
+           WHERE operation_id = $1 AND realm = $2 AND released_at IS NULL) AS reservations,
+         (SELECT count(*)::int FROM platform_principals
+           WHERE principal_id = ANY($3::text[]) AND status = 'suspended'
+             AND suspended_at = (
+               SELECT quarantined_at FROM platform_account_reset_operations
+                WHERE operation_id = $1
+             )) AS suspended`, [operationId, this.#options.workosRealm, targets]);
+        if (state.rows[0]?.reservations !== 3 || state.rows[0]?.suspended !== 3)
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+    }
+    #rollbackResult(quarantined) {
+        return {
+            ...quarantined,
+            lifecycle: 'rolled_back',
+            counts: {
+                ...quarantined.counts,
+                suspendedPrincipalCount: 0,
+                cleanupPendingCount: 0,
+            },
+        };
+    }
+    #registryPlan(apps, quarantinedAtValue) {
+        const quarantinedAt = quarantinedAtValue === null ? new Date(Number.NaN) : new Date(quarantinedAtValue);
+        if (!Number.isFinite(quarantinedAt.getTime()))
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+        return { action: 'rollback', apps, archivedAt: quarantinedAt.toISOString() };
+    }
+    async #fault(boundary) {
+        await this.#options.fault?.(boundary);
+    }
+    async #assertSourceFence(connection) {
+        await new PostgresPlatformAuthLegacyInventorySources({
+            googleRealm: this.#options.googleRealm,
+            sourceAvailability: this.#options.sourceAvailability,
+            excludedSubjects: [],
+        }).assertManifest(connection);
+        await assertPlatformAuthInventorySourceFence(connection, this.#options.sourceAvailability);
+    }
+    #transactionOptions(deadline) {
+        const timeout = deadline === undefined
+            ? this.#localCaptureTimeout()
+            : remainingPlatformAccountResetDispatchMilliseconds(deadline, this.#localCaptureTimeout());
+        return {
+            lockTables: PLATFORM_ACCOUNT_RESET_EXECUTION_TABLES,
+            lockTimeoutMs: timeout,
+            statementTimeoutMs: timeout,
+        };
+    }
+    #localCaptureTimeout() {
+        return Math.min(this.#options.localCaptureTimeoutMs !== undefined &&
+            Number.isSafeInteger(this.#options.localCaptureTimeoutMs) &&
+            this.#options.localCaptureTimeoutMs > 0
+            ? this.#options.localCaptureTimeoutMs
+            : DEFAULT_LOCAL_CAPTURE_TIMEOUT_MS, MAX_LOCAL_CAPTURE_TIMEOUT_MS);
+    }
+}
+//# sourceMappingURL=platform-account-reset-rollback-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-rollback-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-rollback-postgres.js","sourceRoot":"","sources":["../src/platform-account-reset-rollback-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wCAAwC,GAEzC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,iDAAiD,EACjD,uCAAuC,GACxC,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EACL,sCAAsC,EACtC,2CAA2C,EAC3C,uCAAuC,EACvC,+BAA+B,EAC/B,iCAAiC,EAGjC,kCAAkC,GACnC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAK9F,OAAO,EAAE,0CAA0C,EAAE,MAAM,sDAAsD,CAAC;AAClH,OAAO,EACL,sCAAsC,EACtC,2CAA2C,EAC3C,uCAAuC,EACvC,8CAA8C,GAC/C,MAAM,oDAAoD,CAAC;AAqC5D,MAAM,gCAAgC,GAAG,KAAK,CAAC;AAC/C,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAE5C,MAAM,OAAO,yCAAyC;IAC3C,KAAK,CAA2B;IAChC,QAAQ,CAAqD;IAEtE,YAAY,IAA8B,EAAE,OAAwB;QAClE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG;YACd,GAAG,OAAO;YACV,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,qBAAqB;SAC1D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,UAA8C;QAE9C,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,KAAK,CACT,UAA8C;QAE9C,MAAM,OAAO,GAAG,wCAAwC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;YAC/B,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;QACnE,OAAO,uCAAuC,CAAC,IAAI,CAAC,KAAK,EAAE;YACzD,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,IAAI,CAAC,oBAAoB,EAAE;YACtC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC;SACzF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,OAA2C,EAC3C,eAAmC,EACnC,QAAgB;QAEhB,MAAM,QAAQ,GAAG,kCAAkC,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC7F,MAAM,eAAe,GAAgD;YACnE,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,eAAe,EAAE,OAAO,CAAC,eAAe;SACzC,CAAC;QACF,MAAM,QAAQ,GACZ,eAAe,KAAK,aAAa;YAC/B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAC3E,OAAO,8CAA8C,CACnD,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,UAAU,EAAE,EAAE;YACnB,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,MAAM,iCAAiC,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YAC3F,2CAA2C,CACzC,SAAS,EACT,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAC3C,CAAC;YACF,MAAM,SAAS,GAAG,MAAM,uCAAuC,CAC7D,UAAU,EACV,OAAO,CAAC,WAAW,CACpB,CAAC;YACF,IAAI,SAAS,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;gBAC1C,MAAM,MAAM,GAAG,sCAAsC,CAAC,QAAQ,EAAE;oBAC9D,kBAAkB,EAAE,SAAS,CAAC,6BAA6B;oBAC3D,kBAAkB,EAAE,SAAS,CAAC,4BAA4B;oBAC1D,iBAAiB,EAAE,SAAS,CAAC,2BAA2B;oBACxD,gBAAgB,EAAE,SAAS,CAAC,0BAA0B;oBACtD,UAAU,EAAE,SAAS,CAAC,oBAAoB;iBAC3C,CAAC,CAAC;gBACH,OAAO;oBACL,MAAM;oBACN,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,CAAC;iBACvE,CAAC;YACJ,CAAC;YACD,IAAI,SAAS,CAAC,SAAS,KAAK,aAAa,IAAI,QAAQ,KAAK,SAAS;gBACjE,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;YACnE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAC1D,UAAU,EACV,eAAe,EACf,QAAQ,CACT,CAAC;YACF,IACE,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,QAAQ,CAAC,UAAU;gBAC/C,SAAS,CAAC,WAAW,KAAK,OAAO,CAAC,UAAU;gBAC5C,SAAS,CAAC,YAAY,KAAK,IAAI,CAAC,QAAQ,CAAC,WAAW;gBACpD,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,OAAO,CAAC,kBAAkB;gBACnE,SAAS,CAAC,eAAe,KAAK,OAAO,CAAC,eAAe;gBAErD,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;YACnE,MAAM,OAAO,GAAG,MAAM,+BAA+B,CACnD,UAAU,EACV,OAAO,CAAC,WAAW,EACnB,aAAa,CACd,CAAC;YACF,MAAM,2CAA2C,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACvE,MAAM,IAAI,CAAC,2BAA2B,CACpC,UAAU,EACV,OAAO,EACP,OAAO,EACP,SAAS,CAAC,cAAc,CACzB,CAAC;YACF,MAAM,IAAI,CAAC,4BAA4B,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAClF,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YAC/C,MAAM,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YACzC,MAAM,qBAAqB,GAAG,MAAM,UAAU,CAAC,KAAK,CAGlD;;;;;;;;;;;;;;;;;;;;iEAoBuD,EACvD;gBACE,OAAO,CAAC,WAAW;gBACnB,QAAQ,CAAC,kBAAkB;gBAC3B,QAAQ,CAAC,kBAAkB;gBAC3B,QAAQ,CAAC,iBAAiB;gBAC1B,QAAQ,CAAC,gBAAgB;gBACzB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;gBACtB,OAAO,CAAC,eAAe;aACxB,CACF,CAAC;YACF,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBACzC,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;YACnE,MAAM,YAAY,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC;YACnE,IAAI,YAAY,KAAK,SAAS;gBAC5B,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;YACnE,MAAM,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;YAE5C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CACpC;;iCAEuB,EACvB,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CACjD,CAAC;YACF,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAC3B,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;YACnE,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAE1C,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,KAAK,CACxC;;;;;;;iCAOuB,EACvB,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAC/B,CAAC;YACF,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAC/B,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;YACnE,MAAM,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;YAE5C,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CACrC;;;;;;;;;6CASmC,EACnC,CAAC,OAAO,CAAC,WAAW,CAAC,CACtB,CAAC;YACF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,aAAa,CAAC,MAAM;gBACzD,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;YACnE,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAE1C,MAAM,UAAU,CAAC,KAAK,CACpB;;;kCAGwB,EACxB,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CACpC,CAAC;YACF,MAAM,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAEvC,MAAM,mBAAmB,GAAG,MAAM,UAAU,CAAC,KAAK,CAChD;;;iCAGuB,EACvB,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CACpC,CAAC;YACF,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBACvC,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;YACnE,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAE1C,MAAM,UAAU,CAAC,KAAK,CACpB;;;0DAGgD,EAChD;gBACE,OAAO,CAAC,WAAW;gBACnB,MAAM,CAAC,oBAAoB;gBAC3B,eAAe,CAAC;oBACd,aAAa,EAAE,CAAC;oBAChB,KAAK,EAAE,0CAA0C;oBACjD,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;oBAC/C,MAAM;iBACP,CAAC;gBACF,SAAS,CAAC,aAAa;gBACvB,YAAY;aACb,CACF,CAAC;YACF,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACpC,OAAO;gBACL,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,CAAC;aACvE,CAAC;QACJ,CAAC,EACD,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CACnC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,2BAA2B,CAC/B,UAAqC,EACrC,OAA0B,EAC1B,OAA2C,EAC3C,kBAAwC;QAExC,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAKpC;2EACqE,CACtE,CAAC;QACF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,kBAAkB;YAChF,MAAM,IAAI,gCAAgC,CAAC,qBAAqB,CAAC,CAAC;QACpE,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC;YAC/D,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;QACnE,MAAM,aAAa,GACjB,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3C,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CACpC;;;;;;;;;;;gBAWU,EACV,CAAC,OAAO,EAAE,aAAa,CAAC,CACzB,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CACrC;;;gBAGU,EACV,CAAC,OAAO,EAAE,aAAa,CAAC,CACzB,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,KAAK,CACtC;;;;;gBAKU,EACV,CAAC,OAAO,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAC7C,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CACnC;;;gBAGU,EACV,CAAC,OAAO,EAAE,aAAa,CAAC,CACzB,CAAC;QACF,IACE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;YAC7B,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;YAC9B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;YAC/B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;YAE5B,MAAM,IAAI,gCAAgC,CAAC,uBAAuB,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,4BAA4B,CAChC,UAAqC,EACrC,WAAmB,EACnB,OAA0B;QAE1B,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,KAAK,CAIlC;;;;;;;;;6BASuB,EACvB,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAClD,CAAC;QACF,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,KAAK,CAAC;YACrE,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IACrE,CAAC;IAED,eAAe,CAAC,WAAuC;QACrD,OAAO;YACL,GAAG,WAAW;YACd,SAAS,EAAE,aAAa;YACxB,MAAM,EAAE;gBACN,GAAG,WAAW,CAAC,MAAM;gBACrB,uBAAuB,EAAE,CAAC;gBAC1B,mBAAmB,EAAE,CAAC;aACvB;SACF,CAAC;IACJ,CAAC;IAED,aAAa,CACX,IAA+D,EAC/D,kBAAwC;QAExC,MAAM,aAAa,GACjB,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3C,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;QACnE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAA8C;QACzD,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,UAAqC;QAC5D,MAAM,IAAI,0CAA0C,CAAC;YACnD,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;YACtC,kBAAkB,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB;YACpD,gBAAgB,EAAE,EAAE;SACrB,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,sCAAsC,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAC7F,CAAC;IAED,mBAAmB,CAAC,QAAiB;QACnC,MAAM,OAAO,GACX,QAAQ,KAAK,SAAS;YACpB,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE;YAC7B,CAAC,CAAC,iDAAiD,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAC/F,OAAO;YACL,UAAU,EAAE,uCAAuC;YACnD,aAAa,EAAE,OAAO;YACtB,kBAAkB,EAAE,OAAO;SAC5B,CAAC;IACJ,CAAC;IAED,oBAAoB;QAClB,OAAO,IAAI,CAAC,GAAG,CACb,IAAI,CAAC,QAAQ,CAAC,qBAAqB,KAAK,SAAS;YAC/C,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YACzD,IAAI,CAAC,QAAQ,CAAC,qBAAqB,GAAG,CAAC;YACvC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB;YACrC,CAAC,CAAC,gCAAgC,EACpC,4BAA4B,CAC7B,CAAC;IACJ,CAAC;CACF"}