@noodleseed/one 0.83.0 → 0.84.0

package/node_modules/@noodle-borg/service/dist/platform-account-reset-rollback-preview-postgres.d.ts

@@ -0,0 +1,55 @@
+import { type PlatformAccountResetResult, type PlatformAccountResetRollbackPreviewRequest } from './platform-account-reset.js';
+import { type PlatformAccountResetWorkosEvidence } from './platform-account-reset-preview-evidence-postgres.js';
+import { type PlatformAccountResetRollbackLocalInspection } from './platform-account-reset-rollback-local-postgres.js';
+import type { PlatformAuthInventorySourceManifest } from './platform-auth-inventory-sources.js';
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+import type { PlatformAccountResetDirectory } from './workos-directory.js';
+type RollbackPreviewConnection = PlatformIdentityQueryable & {
+    release?: (error?: Error) => void;
+};
+type RollbackPreviewPool = PlatformIdentityQueryable & {
+    connect?: () => Promise<RollbackPreviewConnection>;
+};
+export interface PlatformAccountResetRollbackPreviewEvidence {
+    readonly operationId: string;
+    readonly releaseSha: string;
+    readonly expectedGeneration: number;
+    readonly previewChecksum: string;
+}
+interface RollbackPreviewOptions {
+    readonly directory: PlatformAccountResetDirectory;
+    readonly sourceAvailability: PlatformAuthInventorySourceManifest;
+    readonly googleRealm: string;
+    readonly workosRealm: string;
+    readonly releaseSha: string;
+    readonly now?: () => Date;
+    readonly providerTimeoutMs?: number;
+    readonly localCaptureTimeoutMs?: number;
+    readonly previewTtlMs?: number;
+}
+interface StoredRollbackPreview {
+    readonly previewChecksum: string;
+    readonly sourceEpoch: number;
+    readonly releaseSha: string;
+    readonly rolloutGeneration: number;
+    readonly sourceManifestFingerprint: string;
+    readonly evidenceFingerprint: string;
+    readonly safeResult: PlatformAccountResetResult;
+    readonly previewExpiresAt: string;
+    readonly fingerprint: string;
+}
+export interface PlatformAccountResetPreparedRollbackValidation {
+    readonly local: PlatformAccountResetRollbackLocalInspection;
+    readonly remote: PlatformAccountResetWorkosEvidence;
+    readonly stored: StoredRollbackPreview;
+}
+/** Fresh rollback evidence. Provider reads are bounded and never run while database locks are held. */
+export declare class PostgresPlatformAccountResetRollbackPreviewStore {
+    #private;
+    constructor(pool: RollbackPreviewPool, options: RollbackPreviewOptions);
+    preview(rawRequest: PlatformAccountResetRollbackPreviewRequest): Promise<PlatformAccountResetResult>;
+    prepareUsable(evidence: PlatformAccountResetRollbackPreviewEvidence, deadline?: number): Promise<PlatformAccountResetPreparedRollbackValidation>;
+    assertPrepared(connection: PlatformIdentityQueryable, evidence: PlatformAccountResetRollbackPreviewEvidence, prepared: PlatformAccountResetPreparedRollbackValidation): Promise<PlatformAccountResetResult>;
+}
+export {};
+//# sourceMappingURL=platform-account-reset-rollback-preview-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-rollback-preview-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-rollback-preview-postgres.d.ts","sourceRoot":"","sources":["../src/platform-account-reset-rollback-preview-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,0BAA0B,EAE/B,KAAK,0CAA0C,EAEhD,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAEL,KAAK,kCAAkC,EACxC,MAAM,uDAAuD,CAAC;AAE/D,OAAO,EAGL,KAAK,2CAA2C,EACjD,MAAM,qDAAqD,CAAC;AAO7D,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAChG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAE3E,KAAK,yBAAyB,GAAG,yBAAyB,GAAG;IAAE,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,IAAI,CAAA;CAAE,CAAC;AACnG,KAAK,mBAAmB,GAAG,yBAAyB,GAAG;IACrD,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACpD,CAAC;AAEF,MAAM,WAAW,2CAA2C;IAC1D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,UAAU,sBAAsB;IAC9B,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;IAClD,QAAQ,CAAC,kBAAkB,EAAE,mCAAmC,CAAC;IACjE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;IAChD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAQD,MAAM,WAAW,8CAA8C;IAC7D,QAAQ,CAAC,KAAK,EAAE,2CAA2C,CAAC;IAC5D,QAAQ,CAAC,MAAM,EAAE,kCAAkC,CAAC;IACpD,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;CACxC;AAMD,uGAAuG;AACvG,qBAAa,gDAAgD;;gBAQ/C,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,sBAAsB;IAahE,OAAO,CACX,UAAU,EAAE,0CAA0C,GACrD,OAAO,CAAC,0BAA0B,CAAC;IAuEhC,aAAa,CACjB,QAAQ,EAAE,2CAA2C,EACrD,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,8CAA8C,CAAC;IA2BpD,cAAc,CAClB,UAAU,EAAE,yBAAyB,EACrC,QAAQ,EAAE,2CAA2C,EACrD,QAAQ,EAAE,8CAA8C,GACvD,OAAO,CAAC,0BAA0B,CAAC;CAoNvC"}

package/node_modules/@noodle-borg/service/dist/platform-account-reset-rollback-preview-postgres.js

@@ -0,0 +1,262 @@
+import { PlatformAccountResetResultSchema, PlatformAccountResetRollbackPreviewRequestSchema, } from './platform-account-reset.js';
+import { remainingPlatformAccountResetDispatchMilliseconds } from './platform-account-reset-dispatch-lock-postgres.js';
+import { canonicalJson, sha256Canonical } from './platform-account-reset-fingerprint.js';
+import { loadPlatformAccountResetWorkosEvidence, } from './platform-account-reset-preview-evidence-postgres.js';
+import { PlatformAccountResetPreviewError } from './platform-account-reset-preview-result.js';
+import { inspectPlatformAccountResetRollbackLocalEvidence, } from './platform-account-reset-rollback-local-postgres.js';
+import { PostgresPlatformAuthLegacyInventorySources } from './platform-auth-inventory-legacy-sources-postgres.js';
+import { assertPlatformAuthInventorySourceFence, PLATFORM_ACCOUNT_RESET_EXECUTION_TABLES, runPlatformAuthInventorySourceFenceTransaction, } from './platform-auth-inventory-source-fence-postgres.js';
+const DEFAULT_PROVIDER_TIMEOUT_MS = 5_000;
+const DEFAULT_LOCAL_CAPTURE_TIMEOUT_MS = 5_000;
+const DEFAULT_PREVIEW_TTL_MS = 5 * 60 * 1000;
+/** Fresh rollback evidence. Provider reads are bounded and never run while database locks are held. */
+export class PostgresPlatformAccountResetRollbackPreviewStore {
+    #pool;
+    #options;
+    constructor(pool, options) {
+        this.#pool = pool;
+        this.#options = {
+            ...options,
+            providerTimeoutMs: validPositive(options.providerTimeoutMs, DEFAULT_PROVIDER_TIMEOUT_MS),
+            localCaptureTimeoutMs: validPositive(options.localCaptureTimeoutMs, DEFAULT_LOCAL_CAPTURE_TIMEOUT_MS),
+            previewTtlMs: validPositive(options.previewTtlMs, DEFAULT_PREVIEW_TTL_MS),
+        };
+    }
+    async preview(rawRequest) {
+        const request = PlatformAccountResetRollbackPreviewRequestSchema.parse(rawRequest);
+        const first = await this.#captureLocal(request.operationId);
+        const remote = await this.#readRemote(first.local);
+        return runPlatformAuthInventorySourceFenceTransaction(this.#pool, async (connection) => {
+            await this.#assertSourceFence(connection);
+            const second = await this.#inspectLocal(connection, request.operationId);
+            this.#assertSameLocal(first.local, second);
+            const combinedFingerprint = this.#assertRemoteMatches(second, remote);
+            const previewChecksum = sha256Canonical({
+                schemaVersion: 1,
+                label: 'platform_account_reset_rollback_preview',
+                operationId: request.operationId,
+                releaseSha: second.releaseSha,
+                rolloutGeneration: second.rolloutGeneration,
+                sourceEpoch: second.sourceEpoch,
+                targetSetFingerprint: second.targetSetFingerprint,
+                sourceManifestFingerprint: this.#sourceManifestFingerprint(),
+                evidenceFingerprint: combinedFingerprint,
+                createdAt: first.createdAt,
+                previewExpiresAt: first.previewExpiresAt,
+            });
+            const safeResult = {
+                ...second.baseResult,
+                lifecycle: 'quarantined',
+                sourceEpoch: second.sourceEpoch,
+                previewChecksum,
+                requestFingerprint: sha256Canonical(request),
+                blockers: [],
+            };
+            const inserted = await connection.query(`WITH authority AS MATERIALIZED (
+             SELECT clock_timestamp() AS checked_at
+           )
+           INSERT INTO platform_account_reset_rollback_previews
+             (operation_id, preview_checksum, source_epoch, release_sha,
+              rollout_generation, source_manifest_fingerprint, evidence_fingerprint,
+              safe_result, preview_expires_at, created_at)
+           SELECT $1, $2, $3, $4, $5, $6, $7, $8::jsonb, $9::timestamptz, $10::timestamptz
+             FROM authority
+            WHERE authority.checked_at < $9::timestamptz
+              AND EXISTS (
+                SELECT 1 FROM platform_account_reset_operations operation
+                 WHERE operation.operation_id = $1
+                   AND operation.lifecycle = 'quarantined'
+                   AND operation.finalize_after > authority.checked_at
+              )
+          RETURNING operation_id`, [
+                request.operationId,
+                previewChecksum,
+                second.sourceEpoch,
+                second.releaseSha,
+                second.rolloutGeneration,
+                this.#sourceManifestFingerprint(),
+                combinedFingerprint,
+                JSON.stringify(safeResult),
+                first.previewExpiresAt,
+                first.createdAt,
+            ]);
+            if (inserted.rows.length !== 1)
+                throw new PlatformAccountResetPreviewError('operation_conflict');
+            return safeResult;
+        }, this.#transactionOptions());
+    }
+    async prepareUsable(evidence, deadline) {
+        const captured = await runPlatformAuthInventorySourceFenceTransaction(this.#pool, async (connection) => {
+            await this.#assertSourceFence(connection);
+            const stored = await this.#loadStored(connection, evidence);
+            const local = await this.#inspectLocal(connection, evidence.operationId);
+            if (stored.sourceEpoch !== local.sourceEpoch)
+                throw new PlatformAccountResetPreviewError('source_epoch_mismatch');
+            return { local, stored };
+        }, this.#transactionOptions(deadline));
+        const remote = await this.#readRemote(captured.local, deadline);
+        const confirmed = await runPlatformAuthInventorySourceFenceTransaction(this.#pool, async (connection) => {
+            await this.#assertSourceFence(connection);
+            return this.#loadStored(connection, evidence);
+        }, this.#transactionOptions(deadline));
+        if (confirmed.fingerprint !== captured.stored.fingerprint)
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+        return { ...captured, remote };
+    }
+    async assertPrepared(connection, evidence, prepared) {
+        await this.#assertSourceFence(connection);
+        const stored = await this.#loadStored(connection, evidence);
+        if (stored.fingerprint !== prepared.stored.fingerprint)
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+        const local = await this.#inspectLocal(connection, evidence.operationId);
+        this.#assertSameLocal(prepared.local, local);
+        const combinedFingerprint = this.#assertRemoteMatches(local, prepared.remote);
+        if (combinedFingerprint !== stored.evidenceFingerprint)
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+        const expected = {
+            ...local.baseResult,
+            lifecycle: 'quarantined',
+            sourceEpoch: local.sourceEpoch,
+            previewChecksum: stored.previewChecksum,
+            requestFingerprint: stored.safeResult.requestFingerprint,
+            blockers: [],
+        };
+        if (canonicalJson(expected) !== canonicalJson(stored.safeResult))
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+        return stored.safeResult;
+    }
+    async #captureLocal(operationId) {
+        return runPlatformAuthInventorySourceFenceTransaction(this.#pool, async (connection) => {
+            await this.#assertSourceFence(connection);
+            const authority = await connection.query(`WITH authority AS MATERIALIZED (
+             SELECT clock_timestamp() AS created_at
+           )
+           SELECT authority.created_at::text AS created_at,
+                  (authority.created_at + $1::bigint * interval '1 millisecond')::text
+                    AS preview_expires_at
+             FROM authority`, [this.#options.previewTtlMs]);
+            const timestamp = authority.rows[0];
+            if (timestamp === undefined)
+                throw new PlatformAccountResetPreviewError('operation_conflict');
+            const local = await this.#inspectLocal(connection, operationId);
+            return {
+                local,
+                createdAt: timestamp.created_at,
+                previewExpiresAt: timestamp.preview_expires_at,
+            };
+        }, this.#transactionOptions());
+    }
+    async #inspectLocal(connection, operationId) {
+        return inspectPlatformAccountResetRollbackLocalEvidence(connection, operationId, {
+            googleRealm: this.#options.googleRealm,
+            workosRealm: this.#options.workosRealm,
+            releaseSha: this.#options.releaseSha,
+            sourceAvailability: this.#options.sourceAvailability,
+        });
+    }
+    async #readRemote(local, dispatchDeadline) {
+        const providerTimeoutMs = dispatchDeadline === undefined
+            ? this.#options.providerTimeoutMs
+            : remainingPlatformAccountResetDispatchMilliseconds(dispatchDeadline, this.#options.providerTimeoutMs);
+        const controller = new AbortController();
+        const deadline = new Date(Date.now() + providerTimeoutMs);
+        const timeout = setTimeout(() => controller.abort(new DOMException('account reset provider deadline exceeded', 'AbortError')), providerTimeoutMs);
+        try {
+            return await loadPlatformAccountResetWorkosEvidence(local.contacts, this.#options.directory, this.#options.workosRealm, { signal: controller.signal, deadline });
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    #assertRemoteMatches(local, remote) {
+        if (remote.providerUnavailableCount !== 0)
+            throw new PlatformAccountResetPreviewError('provider_cleanup_pending');
+        if (remote.conflictCount !== 0)
+            throw new PlatformAccountResetPreviewError('workos_user_conflict');
+        const expected = [...local.workosResources].sort(compareResource);
+        const actual = [...remote.resources].sort(compareResource);
+        if (canonicalJson(expected) !== canonicalJson(actual))
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+        return sha256Canonical({
+            schemaVersion: 1,
+            label: 'platform_account_reset_rollback_evidence',
+            localEvidenceFingerprint: local.evidenceFingerprint,
+            workosResources: actual,
+        });
+    }
+    async #loadStored(connection, evidence) {
+        const result = await connection.query(`SELECT preview_checksum, source_epoch::text, release_sha,
+              rollout_generation::text, source_manifest_fingerprint,
+              evidence_fingerprint, safe_result,
+              preview_expires_at::text AS preview_expires_at,
+              created_at::text AS created_at
+         FROM platform_account_reset_rollback_previews
+        WHERE operation_id = $1 AND preview_checksum = $2
+          AND preview_expires_at > clock_timestamp()
+          AND preview_expires_at =
+              created_at + $3::bigint * interval '1 millisecond'
+        FOR SHARE`, [evidence.operationId, evidence.previewChecksum, this.#options.previewTtlMs]);
+        const row = result.rows[0];
+        if (row === undefined)
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+        if (row.release_sha !== evidence.releaseSha || row.release_sha !== this.#options.releaseSha)
+            throw new PlatformAccountResetPreviewError('release_mismatch');
+        if (Number(row.rollout_generation) !== evidence.expectedGeneration)
+            throw new PlatformAccountResetPreviewError('generation_mismatch');
+        if (row.source_manifest_fingerprint !== this.#sourceManifestFingerprint())
+            throw new PlatformAccountResetPreviewError('source_epoch_mismatch');
+        const safeResult = PlatformAccountResetResultSchema.safeParse(row.safe_result);
+        if (!safeResult.success)
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+        return {
+            previewChecksum: row.preview_checksum,
+            sourceEpoch: Number(row.source_epoch),
+            releaseSha: row.release_sha,
+            rolloutGeneration: Number(row.rollout_generation),
+            sourceManifestFingerprint: row.source_manifest_fingerprint,
+            evidenceFingerprint: row.evidence_fingerprint,
+            safeResult: safeResult.data,
+            previewExpiresAt: row.preview_expires_at,
+            fingerprint: sha256Canonical({
+                ...row,
+                safe_result: safeResult.data,
+            }),
+        };
+    }
+    async #assertSourceFence(connection) {
+        await new PostgresPlatformAuthLegacyInventorySources({
+            googleRealm: this.#options.googleRealm,
+            sourceAvailability: this.#options.sourceAvailability,
+            excludedSubjects: [],
+        }).assertManifest(connection);
+        await assertPlatformAuthInventorySourceFence(connection, this.#options.sourceAvailability);
+    }
+    #assertSameLocal(first, second) {
+        if (first.evidenceFingerprint !== second.evidenceFingerprint)
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+    }
+    #sourceManifestFingerprint() {
+        return sha256Canonical({
+            schemaVersion: 1,
+            label: 'platform_auth_inventory_source_manifest',
+            manifest: this.#options.sourceAvailability,
+        });
+    }
+    #transactionOptions(deadline) {
+        const timeout = deadline === undefined
+            ? this.#options.localCaptureTimeoutMs
+            : remainingPlatformAccountResetDispatchMilliseconds(deadline, this.#options.localCaptureTimeoutMs);
+        return {
+            lockTables: PLATFORM_ACCOUNT_RESET_EXECUTION_TABLES,
+            lockTimeoutMs: timeout,
+            statementTimeoutMs: timeout,
+        };
+    }
+}
+function compareResource(left, right) {
+    return canonicalJson(left).localeCompare(canonicalJson(right));
+}
+function validPositive(value, fallback) {
+    return value !== undefined && Number.isSafeInteger(value) && value > 0 ? value : fallback;
+}
+//# sourceMappingURL=platform-account-reset-rollback-preview-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-rollback-preview-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-rollback-preview-postgres.js","sourceRoot":"","sources":["../src/platform-account-reset-rollback-preview-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,gCAAgC,EAEhC,gDAAgD,GACjD,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,iDAAiD,EAAE,MAAM,oDAAoD,CAAC;AACvH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AACzF,OAAO,EACL,sCAAsC,GAEvC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAC9F,OAAO,EACL,gDAAgD,GAGjD,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,0CAA0C,EAAE,MAAM,sDAAsD,CAAC;AAClH,OAAO,EACL,sCAAsC,EACtC,uCAAuC,EACvC,8CAA8C,GAC/C,MAAM,oDAAoD,CAAC;AAqD5D,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAC1C,MAAM,gCAAgC,GAAG,KAAK,CAAC;AAC/C,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C,uGAAuG;AACvG,MAAM,OAAO,gDAAgD;IAClD,KAAK,CAAsB;IAC3B,QAAQ,CAIf;IAEF,YAAY,IAAyB,EAAE,OAA+B;QACpE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG;YACd,GAAG,OAAO;YACV,iBAAiB,EAAE,aAAa,CAAC,OAAO,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;YACxF,qBAAqB,EAAE,aAAa,CAClC,OAAO,CAAC,qBAAqB,EAC7B,gCAAgC,CACjC;YACD,YAAY,EAAE,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE,sBAAsB,CAAC;SAC1E,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CACX,UAAsD;QAEtD,MAAM,OAAO,GAAG,gDAAgD,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACnF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,OAAO,8CAA8C,CACnD,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,UAAU,EAAE,EAAE;YACnB,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YACzE,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3C,MAAM,mBAAmB,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACtE,MAAM,eAAe,GAAG,eAAe,CAAC;gBACtC,aAAa,EAAE,CAAC;gBAChB,KAAK,EAAE,yCAAyC;gBAChD,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;gBACjD,yBAAyB,EAAE,IAAI,CAAC,0BAA0B,EAAE;gBAC5D,mBAAmB,EAAE,mBAAmB;gBACxC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;aACzC,CAAC,CAAC;YACH,MAAM,UAAU,GAA+B;gBAC7C,GAAG,MAAM,CAAC,UAAU;gBACpB,SAAS,EAAE,aAAa;gBACxB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,eAAe;gBACf,kBAAkB,EAAE,eAAe,CAAC,OAAO,CAAC;gBAC5C,QAAQ,EAAE,EAAE;aACb,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CACrC;;;;;;;;;;;;;;;;iCAgBuB,EACvB;gBACE,OAAO,CAAC,WAAW;gBACnB,eAAe;gBACf,MAAM,CAAC,WAAW;gBAClB,MAAM,CAAC,UAAU;gBACjB,MAAM,CAAC,iBAAiB;gBACxB,IAAI,CAAC,0BAA0B,EAAE;gBACjC,mBAAmB;gBACnB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;gBAC1B,KAAK,CAAC,gBAAgB;gBACtB,KAAK,CAAC,SAAS;aAChB,CACF,CAAC;YACF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAC5B,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;YACnE,OAAO,UAAU,CAAC;QACpB,CAAC,EACD,IAAI,CAAC,mBAAmB,EAAE,CAC3B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,QAAqD,EACrD,QAAiB;QAEjB,MAAM,QAAQ,GAAG,MAAM,8CAA8C,CACnE,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,UAAU,EAAE,EAAE;YACnB,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;YACzE,IAAI,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;gBAC1C,MAAM,IAAI,gCAAgC,CAAC,uBAAuB,CAAC,CAAC;YACtE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC3B,CAAC,EACD,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CACnC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,8CAA8C,CACpE,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,UAAU,EAAE,EAAE;YACnB,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC,EACD,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CACnC,CAAC;QACF,IAAI,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC,MAAM,CAAC,WAAW;YACvD,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;QACnE,OAAO,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,UAAqC,EACrC,QAAqD,EACrD,QAAwD;QAExD,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,MAAM,CAAC,WAAW;YACpD,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,mBAAmB,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9E,IAAI,mBAAmB,KAAK,MAAM,CAAC,mBAAmB;YACpD,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG;YACf,GAAG,KAAK,CAAC,UAAU;YACnB,SAAS,EAAE,aAAsB;YACjC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,kBAAkB,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB;YACxD,QAAQ,EAAE,EAAE;SACb,CAAC;QACF,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC;YAC9D,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;QACnE,OAAO,MAAM,CAAC,UAAU,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,WAAmB;QACrC,OAAO,8CAA8C,CACnD,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,UAAU,EAAE,EAAE;YACnB,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,KAAK,CAItC;;;;;;4BAMkB,EAClB,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAC7B,CAAC;YACF,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpC,IAAI,SAAS,KAAK,SAAS;gBACzB,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;YACnE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YAChE,OAAO;gBACL,KAAK;gBACL,SAAS,EAAE,SAAS,CAAC,UAAU;gBAC/B,gBAAgB,EAAE,SAAS,CAAC,kBAAkB;aAC/C,CAAC;QACJ,CAAC,EACD,IAAI,CAAC,mBAAmB,EAAE,CAC3B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,UAAqC,EACrC,WAAmB;QAEnB,OAAO,gDAAgD,CAAC,UAAU,EAAE,WAAW,EAAE;YAC/E,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;YACtC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;YACtC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU;YACpC,kBAAkB,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB;SACrD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CACf,KAAkD,EAClD,gBAAyB;QAEzB,MAAM,iBAAiB,GACrB,gBAAgB,KAAK,SAAS;YAC5B,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB;YACjC,CAAC,CAAC,iDAAiD,CAC/C,gBAAgB,EAChB,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAChC,CAAC;QACR,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,UAAU,CACxB,GAAG,EAAE,CACH,UAAU,CAAC,KAAK,CACd,IAAI,YAAY,CAAC,0CAA0C,EAAE,YAAY,CAAC,CAC3E,EACH,iBAAiB,CAClB,CAAC;QACF,IAAI,CAAC;YACH,OAAO,MAAM,sCAAsC,CACjD,KAAK,CAAC,QAAQ,EACd,IAAI,CAAC,QAAQ,CAAC,SAAS,EACvB,IAAI,CAAC,QAAQ,CAAC,WAAW,EACzB,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,CACxC,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,oBAAoB,CAClB,KAAkD,EAClD,MAA0C;QAE1C,IAAI,MAAM,CAAC,wBAAwB,KAAK,CAAC;YACvC,MAAM,IAAI,gCAAgC,CAAC,0BAA0B,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC;YAC5B,MAAM,IAAI,gCAAgC,CAAC,sBAAsB,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC3D,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC;YACnD,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;QACnE,OAAO,eAAe,CAAC;YACrB,aAAa,EAAE,CAAC;YAChB,KAAK,EAAE,0CAA0C;YACjD,wBAAwB,EAAE,KAAK,CAAC,mBAAmB;YACnD,eAAe,EAAE,MAAM;SACxB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CACf,UAAqC,EACrC,QAAqD;QAErD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAWnC;;;;;;;;;;kBAUY,EACZ,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAC7E,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS;YAAE,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;QACxF,IAAI,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,QAAQ,CAAC,UAAU;YACzF,MAAM,IAAI,gCAAgC,CAAC,kBAAkB,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,QAAQ,CAAC,kBAAkB;YAChE,MAAM,IAAI,gCAAgC,CAAC,qBAAqB,CAAC,CAAC;QACpE,IAAI,GAAG,CAAC,2BAA2B,KAAK,IAAI,CAAC,0BAA0B,EAAE;YACvE,MAAM,IAAI,gCAAgC,CAAC,uBAAuB,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,gCAAgC,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/E,IAAI,CAAC,UAAU,CAAC,OAAO;YAAE,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;QAC1F,OAAO;YACL,eAAe,EAAE,GAAG,CAAC,gBAAgB;YACrC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;YACrC,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,iBAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC;YACjD,yBAAyB,EAAE,GAAG,CAAC,2BAA2B;YAC1D,mBAAmB,EAAE,GAAG,CAAC,oBAAoB;YAC7C,UAAU,EAAE,UAAU,CAAC,IAAI;YAC3B,gBAAgB,EAAE,GAAG,CAAC,kBAAkB;YACxC,WAAW,EAAE,eAAe,CAAC;gBAC3B,GAAG,GAAG;gBACN,WAAW,EAAE,UAAU,CAAC,IAAI;aAC7B,CAAC;SACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,UAAqC;QAC5D,MAAM,IAAI,0CAA0C,CAAC;YACnD,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;YACtC,kBAAkB,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB;YACpD,gBAAgB,EAAE,EAAE;SACrB,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,sCAAsC,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAC7F,CAAC;IAED,gBAAgB,CACd,KAAkD,EAClD,MAAmD;QAEnD,IAAI,KAAK,CAAC,mBAAmB,KAAK,MAAM,CAAC,mBAAmB;YAC1D,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IACrE,CAAC;IAED,0BAA0B;QACxB,OAAO,eAAe,CAAC;YACrB,aAAa,EAAE,CAAC;YAChB,KAAK,EAAE,yCAAyC;YAChD,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,mBAAmB,CAAC,QAAiB;QACnC,MAAM,OAAO,GACX,QAAQ,KAAK,SAAS;YACpB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB;YACrC,CAAC,CAAC,iDAAiD,CAC/C,QAAQ,EACR,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CACpC,CAAC;QACR,OAAO;YACL,UAAU,EAAE,uCAAuC;YACnD,aAAa,EAAE,OAAO;YACtB,kBAAkB,EAAE,OAAO;SAC5B,CAAC;IACJ,CAAC;CACF;AAED,SAAS,eAAe,CACtB,IAAkD,EAClD,KAAmD;IAEnD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB,EAAE,QAAgB;IAChE,OAAO,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC5F,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-account-reset-schema-postgres.d.ts

@@ -0,0 +1,7 @@
+import type { PlatformIdentityQueryable } from './platform-identity-schema-postgres.js';
+/**
+ * Additive, service-only persistence for the exact-three account reset. Sensitive reservation and locator
+ * fields never appear in the append-only event table or the public result contract.
+ */
+export declare function ensurePlatformAccountResetSchema(pool: PlatformIdentityQueryable): Promise<void>;
+//# sourceMappingURL=platform-account-reset-schema-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-schema-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-schema-postgres.d.ts","sourceRoot":"","sources":["../src/platform-account-reset-schema-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AAExF;;;GAGG;AACH,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAmbf"}