@noodleseed/one 0.83.0 → 0.84.0

package/node_modules/@noodle-borg/service/dist/platform-account-reset-fingerprint.js

@@ -0,0 +1,46 @@
+import { createHash } from 'node:crypto';
+import { PlatformAccountResetTargetSetSchema, } from './platform-account-reset.js';
+/**
+ * Account-reset evidence uses sorted object keys and sorted arrays so database/query order cannot change a
+ * preview checksum. Callers include an explicit schema version and label at every independent fingerprint.
+ */
+export function sha256Canonical(value) {
+    return createHash('sha256')
+        .update(JSON.stringify(canonicalize(value)))
+        .digest('hex');
+}
+export function canonicalJson(value) {
+    return JSON.stringify(canonicalize(value));
+}
+export function platformAccountResetApprovedTargetSetFingerprint(targetSet) {
+    const approved = PlatformAccountResetTargetSetSchema.parse(targetSet);
+    return sha256Canonical({
+        schemaVersion: 1,
+        label: 'platform_account_reset_approved_target_set',
+        principalIds: [...approved.principalIds].sort(compareText),
+    });
+}
+function canonicalize(value) {
+    if (value === null ||
+        typeof value === 'boolean' ||
+        typeof value === 'string' ||
+        (typeof value === 'number' && Number.isFinite(value))) {
+        return value;
+    }
+    if (Array.isArray(value)) {
+        return value
+            .map(canonicalize)
+            .sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));
+    }
+    if (typeof value === 'object') {
+        const entries = Object.entries(value)
+            .filter(([, entry]) => entry !== undefined)
+            .sort(([left], [right]) => left.localeCompare(right));
+        return Object.fromEntries(entries.map(([key, entry]) => [key, canonicalize(entry)]));
+    }
+    throw new TypeError('account-reset fingerprint input is not canonical JSON');
+}
+function compareText(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+//# sourceMappingURL=platform-account-reset-fingerprint.js.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-fingerprint.js","sourceRoot":"","sources":["../src/platform-account-reset-fingerprint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAEL,mCAAmC,GACpC,MAAM,6BAA6B,CAAC;AAUrC;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;SAC3C,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,gDAAgD,CAC9D,SAAwC;IAExC,MAAM,QAAQ,GAAG,mCAAmC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACtE,OAAO,eAAe,CAAC;QACrB,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,4CAA4C;QACnD,YAAY,EAAE,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;KAC3D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,SAAS;QAC1B,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EACrD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK;aACT,GAAG,CAAC,YAAY,CAAC;aACjB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aAClC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;aAC1C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,uDAAuD,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-account-reset-operation-postgres.d.ts

@@ -0,0 +1,77 @@
+import { type PlatformAccountResetExecuteRequest, type PlatformAccountResetResult } from './platform-account-reset.js';
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+export type PlatformAccountResetConnection = PlatformIdentityQueryable & {
+    release?: (error?: Error) => void;
+};
+export type PlatformAccountResetPool = PlatformIdentityQueryable & {
+    connect?: () => Promise<PlatformAccountResetConnection>;
+};
+export interface PlatformAccountResetActionEvidence {
+    readonly actorFingerprint: string;
+    readonly idempotencyKeyHash: string;
+    readonly requestFingerprint: string;
+    readonly reasonFingerprint: string;
+}
+export interface PlatformAccountResetRegistryPlan {
+    readonly action: 'quarantine' | 'rollback';
+    readonly apps: readonly {
+        readonly org: string;
+        readonly app: string;
+    }[];
+    readonly archivedAt: string;
+}
+export interface PlatformAccountResetMutationOutcome {
+    readonly result: PlatformAccountResetResult;
+    readonly registry: PlatformAccountResetRegistryPlan;
+}
+export interface PlatformAccountResetOperationRow {
+    readonly lifecycle: string;
+    readonly release_sha: string;
+    readonly rollout_generation: string;
+    readonly workos_realm: string;
+    readonly source_epoch: string;
+    readonly preview_checksum: string;
+    readonly target_set_fingerprint: string;
+    readonly approved_target_set_fingerprint: string | null;
+    readonly request_fingerprint: string;
+    readonly safe_result: unknown;
+    readonly preview_expires_at: Date | string;
+    readonly quarantined_at: Date | string | null;
+    readonly finalize_after: Date | string | null;
+    readonly quarantine_idempotency_key_hash: string | null;
+    readonly quarantine_request_fingerprint: string | null;
+    readonly quarantine_reason_fingerprint: string | null;
+    readonly quarantine_actor_fingerprint: string | null;
+    readonly quarantine_safe_result: unknown;
+    readonly rollback_idempotency_key_hash: string | null;
+    readonly rollback_request_fingerprint: string | null;
+    readonly rollback_reason_fingerprint: string | null;
+    readonly rollback_actor_fingerprint: string | null;
+    readonly rollback_safe_result: unknown;
+}
+export interface PlatformAccountResetFrozenResources {
+    readonly apps: readonly {
+        readonly org: string;
+        readonly app: string;
+    }[];
+    readonly deploymentIds: readonly string[];
+    readonly resourceCount: number;
+}
+export declare function platformAccountResetActionEvidence(request: PlatformAccountResetExecuteRequest, actorFingerprint: string): PlatformAccountResetActionEvidence;
+export declare function lockPlatformAccountResetOperation(connection: PlatformIdentityQueryable, operationId: string): Promise<PlatformAccountResetOperationRow>;
+export declare function assertPlatformAccountResetApprovedTargetSet(operation: PlatformAccountResetOperationRow, approvedTargetSetFingerprint: string): void;
+export declare function loadPlatformAccountResetTargets(connection: PlatformIdentityQueryable, operationId: string, lifecycle: 'previewed' | 'quarantined'): Promise<readonly string[]>;
+export declare function loadPlatformAccountResetFrozenResources(connection: PlatformIdentityQueryable, operationId: string): Promise<PlatformAccountResetFrozenResources>;
+export declare function parsePlatformAccountResetSafeResult(value: unknown): PlatformAccountResetResult;
+export declare function assertPlatformAccountResetRequestMatches(operation: PlatformAccountResetOperationRow, request: PlatformAccountResetExecuteRequest, options: {
+    readonly releaseSha: string;
+    readonly workosRealm: string;
+}): void;
+export declare function assertPlatformAccountResetActionReplay(evidence: PlatformAccountResetActionEvidence, stored: {
+    readonly idempotencyKeyHash: string | null;
+    readonly requestFingerprint: string | null;
+    readonly reasonFingerprint: string | null;
+    readonly actorFingerprint: string | null;
+    readonly safeResult: unknown;
+}): PlatformAccountResetResult;
+//# sourceMappingURL=platform-account-reset-operation-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-operation-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-operation-postgres.d.ts","sourceRoot":"","sources":["../src/platform-account-reset-operation-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,kCAAkC,EACvC,KAAK,0BAA0B,EAEhC,MAAM,6BAA6B,CAAC;AAGrC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,MAAM,MAAM,8BAA8B,GAAG,yBAAyB,GAAG;IACvE,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC;CACnC,CAAC;AACF,MAAM,MAAM,wBAAwB,GAAG,yBAAyB,GAAG;IACjE,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,8BAA8B,CAAC,CAAC;CACzD,CAAC;AAEF,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,UAAU,CAAC;IAC3C,QAAQ,CAAC,IAAI,EAAE,SAAS;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACzE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;CACrD;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,+BAA+B,EAAE,MAAM,GAAG,IAAI,CAAC;IACxD,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,IAAI,GAAG,MAAM,CAAC;IAC3C,QAAQ,CAAC,cAAc,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9C,QAAQ,CAAC,cAAc,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9C,QAAQ,CAAC,+BAA+B,EAAE,MAAM,GAAG,IAAI,CAAC;IACxD,QAAQ,CAAC,8BAA8B,EAAE,MAAM,GAAG,IAAI,CAAC;IACvD,QAAQ,CAAC,6BAA6B,EAAE,MAAM,GAAG,IAAI,CAAC;IACtD,QAAQ,CAAC,4BAA4B,EAAE,MAAM,GAAG,IAAI,CAAC;IACrD,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,6BAA6B,EAAE,MAAM,GAAG,IAAI,CAAC;IACtD,QAAQ,CAAC,4BAA4B,EAAE,MAAM,GAAG,IAAI,CAAC;IACrD,QAAQ,CAAC,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAC;IACpD,QAAQ,CAAC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IACnD,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;CACxC;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,IAAI,EAAE,SAAS;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACzE,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,kCAAkC,EAC3C,gBAAgB,EAAE,MAAM,GACvB,kCAAkC,CA4BpC;AAED,wBAAsB,iCAAiC,CACrD,UAAU,EAAE,yBAAyB,EACrC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gCAAgC,CAAC,CAuB3C;AAED,wBAAgB,2CAA2C,CACzD,SAAS,EAAE,gCAAgC,EAC3C,4BAA4B,EAAE,MAAM,GACnC,IAAI,CAGN;AAED,wBAAsB,+BAA+B,CACnD,UAAU,EAAE,yBAAyB,EACrC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,WAAW,GAAG,aAAa,GACrC,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAW5B;AAED,wBAAsB,uCAAuC,CAC3D,UAAU,EAAE,yBAAyB,EACrC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,mCAAmC,CAAC,CAqD9C;AAED,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,OAAO,GAAG,0BAA0B,CAI9F;AAED,wBAAgB,wCAAwC,CACtD,SAAS,EAAE,gCAAgC,EAC3C,OAAO,EAAE,kCAAkC,EAC3C,OAAO,EAAE;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACrE,IAAI,CASN;AAED,wBAAgB,sCAAsC,CACpD,QAAQ,EAAE,kCAAkC,EAC5C,MAAM,EAAE;IACN,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B,GACA,0BAA0B,CAS5B"}

package/node_modules/@noodle-borg/service/dist/platform-account-reset-operation-postgres.js

@@ -0,0 +1,144 @@
+import { PlatformAccountResetResultSchema, } from './platform-account-reset.js';
+import { sha256Canonical } from './platform-account-reset-fingerprint.js';
+import { PlatformAccountResetPreviewError } from './platform-account-reset-preview-result.js';
+export function platformAccountResetActionEvidence(request, actorFingerprint) {
+    const idempotencyKeyHash = sha256Canonical({
+        schemaVersion: 1,
+        label: `platform_account_reset_idempotency:${request.action}`,
+        actorFingerprint,
+        idempotencyKey: request.idempotencyKey,
+    });
+    return {
+        actorFingerprint,
+        idempotencyKeyHash,
+        reasonFingerprint: sha256Canonical({
+            schemaVersion: 1,
+            label: `platform_account_reset_reason:${request.action}`,
+            reason: request.reason,
+        }),
+        requestFingerprint: sha256Canonical({
+            schemaVersion: 1,
+            label: `platform_account_reset_request:${request.action}`,
+            operationId: request.operationId,
+            expectedGeneration: request.expectedGeneration,
+            releaseSha: request.releaseSha,
+            previewChecksum: request.previewChecksum,
+            actorFingerprint,
+            idempotencyKeyHash,
+            reason: request.reason,
+            confirmed: request.confirmed,
+        }),
+    };
+}
+export async function lockPlatformAccountResetOperation(connection, operationId) {
+    await connection.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [
+        `platform-account-reset:${operationId}`,
+    ]);
+    const operation = await connection.query(`SELECT lifecycle, release_sha, rollout_generation::text, workos_realm,
+            source_epoch::text, preview_checksum, target_set_fingerprint,
+            approved_target_set_fingerprint, request_fingerprint, safe_result,
+            preview_expires_at, quarantined_at,
+            finalize_after, quarantine_idempotency_key_hash,
+            quarantine_request_fingerprint, quarantine_reason_fingerprint,
+            quarantine_actor_fingerprint, quarantine_safe_result,
+            rollback_idempotency_key_hash,
+            rollback_request_fingerprint, rollback_reason_fingerprint,
+            rollback_actor_fingerprint, rollback_safe_result
+       FROM platform_account_reset_operations
+      WHERE operation_id = $1
+      FOR UPDATE`, [operationId]);
+    const row = operation.rows[0];
+    if (row === undefined)
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+    return row;
+}
+export function assertPlatformAccountResetApprovedTargetSet(operation, approvedTargetSetFingerprint) {
+    if (operation.approved_target_set_fingerprint !== approvedTargetSetFingerprint)
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+}
+export async function loadPlatformAccountResetTargets(connection, operationId, lifecycle) {
+    const result = await connection.query(`SELECT principal_id
+       FROM platform_account_reset_targets
+      WHERE operation_id = $1 AND lifecycle = $2
+      ORDER BY principal_id
+      FOR UPDATE`, [operationId, lifecycle]);
+    if (result.rows.length !== 3)
+        throw new PlatformAccountResetPreviewError('target_count_invalid');
+    return result.rows.map((row) => row.principal_id);
+}
+export async function loadPlatformAccountResetFrozenResources(connection, operationId) {
+    const result = await connection.query(`SELECT provider, resource_kind, provider_locator, locator_fingerprint
+       FROM platform_account_reset_cleanup_ledger
+      WHERE operation_id = $1
+      ORDER BY provider, resource_kind, locator_fingerprint
+      FOR SHARE`, [operationId]);
+    const apps = new Map();
+    const deploymentIds = new Set();
+    for (const row of result.rows) {
+        let locator;
+        try {
+            locator = JSON.parse(row.provider_locator);
+        }
+        catch {
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+        }
+        if (!isRecord(locator))
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+        const actual = sha256Canonical({
+            schemaVersion: 1,
+            label: `platform_account_reset_locator:${row.provider}:${row.resource_kind}`,
+            locator,
+        });
+        if (actual !== row.locator_fingerprint)
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+        if (row.provider !== 'postgres')
+            continue;
+        if (row.resource_kind === 'application') {
+            const org = locator.org;
+            const app = locator.app;
+            if (typeof org !== 'string' || typeof app !== 'string')
+                throw new PlatformAccountResetPreviewError('operation_conflict');
+            apps.set(`${org}\u0000${app}`, { org, app });
+        }
+        if (row.resource_kind === 'deployment') {
+            const deploymentId = locator.deploymentId;
+            if (typeof deploymentId !== 'string' || typeof locator.archived !== 'boolean')
+                throw new PlatformAccountResetPreviewError('operation_conflict');
+            if (!locator.archived)
+                deploymentIds.add(deploymentId);
+        }
+    }
+    return {
+        apps: [...apps.values()].sort((left, right) => `${left.org}/${left.app}`.localeCompare(`${right.org}/${right.app}`)),
+        deploymentIds: [...deploymentIds].sort(),
+        resourceCount: result.rows.length,
+    };
+}
+export function parsePlatformAccountResetSafeResult(value) {
+    const parsed = PlatformAccountResetResultSchema.safeParse(value);
+    if (!parsed.success)
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+    return parsed.data;
+}
+export function assertPlatformAccountResetRequestMatches(operation, request, options) {
+    if (request.releaseSha !== options.releaseSha || operation.release_sha !== request.releaseSha)
+        throw new PlatformAccountResetPreviewError('release_mismatch');
+    if (Number(operation.rollout_generation) !== request.expectedGeneration)
+        throw new PlatformAccountResetPreviewError('generation_mismatch');
+    if (operation.preview_checksum !== request.previewChecksum)
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+    if (operation.workos_realm !== options.workosRealm)
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+}
+export function assertPlatformAccountResetActionReplay(evidence, stored) {
+    if (stored.actorFingerprint !== evidence.actorFingerprint ||
+        stored.idempotencyKeyHash !== evidence.idempotencyKeyHash ||
+        stored.requestFingerprint !== evidence.requestFingerprint ||
+        stored.reasonFingerprint !== evidence.reasonFingerprint)
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+    return parsePlatformAccountResetSafeResult(stored.safeResult);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=platform-account-reset-operation-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-operation-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-operation-postgres.js","sourceRoot":"","sources":["../src/platform-account-reset-operation-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,gCAAgC,GACjC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AA4D9F,MAAM,UAAU,kCAAkC,CAChD,OAA2C,EAC3C,gBAAwB;IAExB,MAAM,kBAAkB,GAAG,eAAe,CAAC;QACzC,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,sCAAsC,OAAO,CAAC,MAAM,EAAE;QAC7D,gBAAgB;QAChB,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;IACH,OAAO;QACL,gBAAgB;QAChB,kBAAkB;QAClB,iBAAiB,EAAE,eAAe,CAAC;YACjC,aAAa,EAAE,CAAC;YAChB,KAAK,EAAE,iCAAiC,OAAO,CAAC,MAAM,EAAE;YACxD,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;QACF,kBAAkB,EAAE,eAAe,CAAC;YAClC,aAAa,EAAE,CAAC;YAChB,KAAK,EAAE,kCAAkC,OAAO,CAAC,MAAM,EAAE;YACzD,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,gBAAgB;YAChB,kBAAkB;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,UAAqC,EACrC,WAAmB;IAEnB,MAAM,UAAU,CAAC,KAAK,CAAC,uDAAuD,EAAE;QAC9E,0BAA0B,WAAW,EAAE;KACxC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,KAAK,CACtC;;;;;;;;;;;;iBAYa,EACb,CAAC,WAAW,CAAC,CACd,CAAC;IACF,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IACxF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,SAA2C,EAC3C,4BAAoC;IAEpC,IAAI,SAAS,CAAC,+BAA+B,KAAK,4BAA4B;QAC5E,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,UAAqC,EACrC,WAAmB,EACnB,SAAsC;IAEtC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CACnC;;;;iBAIa,EACb,CAAC,WAAW,EAAE,SAAS,CAAC,CACzB,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,gCAAgC,CAAC,sBAAsB,CAAC,CAAC;IACjG,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,UAAqC,EACrC,WAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAMnC;;;;gBAIY,EACZ,CAAC,WAAW,CAAC,CACd,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAA0D,CAAC;IAC/E,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;QACzF,MAAM,MAAM,GAAG,eAAe,CAAC;YAC7B,aAAa,EAAE,CAAC;YAChB,KAAK,EAAE,kCAAkC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,aAAa,EAAE;YAC5E,OAAO;SACR,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,GAAG,CAAC,mBAAmB;YACpC,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;QACnE,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU;YAAE,SAAS;QAC1C,IAAI,GAAG,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ;gBACpD,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;YACnE,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,SAAS,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,GAAG,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;YACvC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;YAC1C,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,SAAS;gBAC3E,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;YACnE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC5C,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,CACrE;QACD,aAAa,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,EAAE;QACxC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,KAAc;IAChE,MAAM,MAAM,GAAG,gCAAgC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IACtF,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,SAA2C,EAC3C,OAA2C,EAC3C,OAAsE;IAEtE,IAAI,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC,WAAW,KAAK,OAAO,CAAC,UAAU;QAC3F,MAAM,IAAI,gCAAgC,CAAC,kBAAkB,CAAC,CAAC;IACjE,IAAI,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,OAAO,CAAC,kBAAkB;QACrE,MAAM,IAAI,gCAAgC,CAAC,qBAAqB,CAAC,CAAC;IACpE,IAAI,SAAS,CAAC,gBAAgB,KAAK,OAAO,CAAC,eAAe;QACxD,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IACnE,IAAI,SAAS,CAAC,YAAY,KAAK,OAAO,CAAC,WAAW;QAChD,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,QAA4C,EAC5C,MAMC;IAED,IACE,MAAM,CAAC,gBAAgB,KAAK,QAAQ,CAAC,gBAAgB;QACrD,MAAM,CAAC,kBAAkB,KAAK,QAAQ,CAAC,kBAAkB;QACzD,MAAM,CAAC,kBAAkB,KAAK,QAAQ,CAAC,kBAAkB;QACzD,MAAM,CAAC,iBAAiB,KAAK,QAAQ,CAAC,iBAAiB;QAEvD,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IACnE,OAAO,mCAAmC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-account-reset-operator.d.ts

@@ -0,0 +1,29 @@
+import { type PlatformAccountResetExecuteRequest, type PlatformAccountResetOperatorPreviewRequest, type PlatformAccountResetPreviewRequest, type PlatformAccountResetResult, type PlatformAccountResetRollbackPreviewRequest, type PlatformAccountResetStatusRequest } from './platform-account-reset.js';
+import type { PlatformAccountResetMutationOutcome, PlatformAccountResetRegistryPlan } from './platform-account-reset-operation-postgres.js';
+import type { PlatformAccountResetOperatorPort } from './platform-account-reset-ports.js';
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+interface PlatformAccountResetOperatorOptions {
+    readonly preview: {
+        preview(input: PlatformAccountResetPreviewRequest): Promise<PlatformAccountResetResult>;
+    };
+    readonly rollbackPreview: {
+        preview(input: PlatformAccountResetRollbackPreviewRequest): Promise<PlatformAccountResetResult>;
+    };
+    readonly quarantine: {
+        apply(input: PlatformAccountResetExecuteRequest): Promise<PlatformAccountResetMutationOutcome>;
+    };
+    readonly rollback: {
+        apply(input: PlatformAccountResetExecuteRequest): Promise<PlatformAccountResetMutationOutcome>;
+    };
+    readonly statusStore: PlatformIdentityQueryable;
+    readonly reconcileRegistry?: (input: PlatformAccountResetRegistryPlan) => void | Promise<void>;
+}
+export declare class PlatformAccountResetOperator implements PlatformAccountResetOperatorPort {
+    #private;
+    constructor(options: PlatformAccountResetOperatorOptions);
+    preview(rawInput: PlatformAccountResetOperatorPreviewRequest): Promise<PlatformAccountResetResult>;
+    execute(rawInput: PlatformAccountResetExecuteRequest): Promise<PlatformAccountResetResult>;
+    status(rawInput: PlatformAccountResetStatusRequest): Promise<PlatformAccountResetResult | undefined>;
+}
+export {};
+//# sourceMappingURL=platform-account-reset-operator.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-operator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-operator.d.ts","sourceRoot":"","sources":["../src/platform-account-reset-operator.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,kCAAkC,EAEvC,KAAK,0CAA0C,EAE/C,KAAK,kCAAkC,EACvC,KAAK,0BAA0B,EAE/B,KAAK,0CAA0C,EAC/C,KAAK,iCAAiC,EAEvC,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EACV,mCAAmC,EACnC,gCAAgC,EACjC,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAC;AAE1F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,OAAO,EAAE;QAChB,OAAO,CAAC,KAAK,EAAE,kCAAkC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;KACzF,CAAC;IACF,QAAQ,CAAC,eAAe,EAAE;QACxB,OAAO,CAAC,KAAK,EAAE,0CAA0C,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;KACjG,CAAC;IACF,QAAQ,CAAC,UAAU,EAAE;QACnB,KAAK,CAAC,KAAK,EAAE,kCAAkC,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAAC;KAChG,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE;QACjB,KAAK,CAAC,KAAK,EAAE,kCAAkC,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAAC;KAChG,CAAC;IACF,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC;IAChD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,gCAAgC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChG;AAUD,qBAAa,4BAA6B,YAAW,gCAAgC;;gBAGvE,OAAO,EAAE,mCAAmC;IAIxD,OAAO,CACL,QAAQ,EAAE,0CAA0C,GACnD,OAAO,CAAC,0BAA0B,CAAC;IAMhC,OAAO,CAAC,QAAQ,EAAE,kCAAkC,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAU1F,MAAM,CACV,QAAQ,EAAE,iCAAiC,GAC1C,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC;CA8BnD"}

package/node_modules/@noodle-borg/service/dist/platform-account-reset-operator.js

@@ -0,0 +1,59 @@
+import { PlatformAccountResetExecuteRequestSchema, PlatformAccountResetOperatorPreviewRequestSchema, PlatformAccountResetResultSchema, PlatformAccountResetStatusRequestSchema, } from './platform-account-reset.js';
+import { PlatformAccountResetPreviewError } from './platform-account-reset-preview-result.js';
+export class PlatformAccountResetOperator {
+    #options;
+    constructor(options) {
+        this.#options = options;
+    }
+    preview(rawInput) {
+        const input = PlatformAccountResetOperatorPreviewRequestSchema.parse(rawInput);
+        if ('operation' in input)
+            return this.#options.rollbackPreview.preview(input);
+        return this.#options.preview.preview(input);
+    }
+    async execute(rawInput) {
+        const input = PlatformAccountResetExecuteRequestSchema.parse(rawInput);
+        let outcome;
+        if (input.action === 'quarantine')
+            outcome = await this.#options.quarantine.apply(input);
+        else if (input.action === 'rollback')
+            outcome = await this.#options.rollback.apply(input);
+        else
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+        await this.#options.reconcileRegistry?.(outcome.registry);
+        return outcome.result;
+    }
+    async status(rawInput) {
+        const input = PlatformAccountResetStatusRequestSchema.parse(rawInput);
+        const status = await this.#options.statusStore.query(`SELECT operation.lifecycle, operation.safe_result,
+              operation.quarantine_safe_result, operation.rollback_safe_result,
+              count(*) FILTER (
+                WHERE cleanup.state IN ('pending', 'leased', 'failed')
+              )::int AS cleanup_pending_count
+         FROM platform_account_reset_operations operation
+         LEFT JOIN platform_account_reset_cleanup_ledger cleanup
+           ON cleanup.operation_id = operation.operation_id
+        WHERE operation.operation_id = $1
+        GROUP BY operation.operation_id`, [input.operationId]);
+        const row = status.rows[0];
+        if (row === undefined)
+            return undefined;
+        const value = row.rollback_safe_result ?? row.quarantine_safe_result ?? row.safe_result;
+        const result = PlatformAccountResetResultSchema.safeParse(value);
+        if (!result.success)
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+        return {
+            ...result.data,
+            lifecycle: row.lifecycle,
+            counts: {
+                ...result.data.counts,
+                suspendedPrincipalCount: isSuspendedLifecycle(row.lifecycle) ? 3 : 0,
+                cleanupPendingCount: row.cleanup_pending_count,
+            },
+        };
+    }
+}
+function isSuspendedLifecycle(lifecycle) {
+    return ['quarantined', 'finalizing', 'finalization_blocked'].includes(lifecycle);
+}
+//# sourceMappingURL=platform-account-reset-operator.js.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-operator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-operator.js","sourceRoot":"","sources":["../src/platform-account-reset-operator.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wCAAwC,EAExC,gDAAgD,EAGhD,gCAAgC,EAGhC,uCAAuC,GACxC,MAAM,6BAA6B,CAAC;AAMrC,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AA4B9F,MAAM,OAAO,4BAA4B;IAC9B,QAAQ,CAAsC;IAEvD,YAAY,OAA4C;QACtD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC1B,CAAC;IAED,OAAO,CACL,QAAoD;QAEpD,MAAM,KAAK,GAAG,gDAAgD,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/E,IAAI,WAAW,IAAI,KAAK;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAA4C;QACxD,MAAM,KAAK,GAAG,wCAAwC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,OAA4C,CAAC;QACjD,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY;YAAE,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;aACpF,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;;YACrF,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;QACtE,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1D,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,MAAM,CACV,QAA2C;QAE3C,MAAM,KAAK,GAAG,uCAAuC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAClD;;;;;;;;;wCASkC,EAClC,CAAC,KAAK,CAAC,WAAW,CAAC,CACpB,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC,sBAAsB,IAAI,GAAG,CAAC,WAAW,CAAC;QACxF,MAAM,MAAM,GAAG,gCAAgC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;QACtF,OAAO;YACL,GAAG,MAAM,CAAC,IAAI;YACd,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,MAAM,EAAE;gBACN,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM;gBACrB,uBAAuB,EAAE,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpE,mBAAmB,EAAE,GAAG,CAAC,qBAAqB;aAC/C;SACF,CAAC;IACJ,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,SAAkD;IAC9E,OAAO,CAAC,aAAa,EAAE,YAAY,EAAE,sBAAsB,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACnF,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-account-reset-ownership-helpers.d.ts

@@ -0,0 +1,11 @@
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+export declare function platformAccountResetAppKey(row: {
+    readonly org_slug: string;
+    readonly app_slug?: string;
+    readonly slug?: string;
+}): string;
+export declare function groupPlatformAccountResetRows<T>(values: readonly T[], key: (value: T) => string): Map<string, T[]>;
+export declare function incrementPlatformAccountResetCount<T>(counts: Map<T, number>, key: T): void;
+export declare function comparePlatformAccountResetText(left: string, right: string): number;
+export declare function queryPlatformAccountResetRows<T>(pool: PlatformIdentityQueryable, sql: string, values?: readonly unknown[]): Promise<readonly T[]>;
+//# sourceMappingURL=platform-account-reset-ownership-helpers.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-ownership-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-ownership-helpers.d.ts","sourceRoot":"","sources":["../src/platform-account-reset-ownership-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,wBAAgB,0BAA0B,CAAC,GAAG,EAAE;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,MAAM,CAET;AAED,wBAAgB,6BAA6B,CAAC,CAAC,EAC7C,MAAM,EAAE,SAAS,CAAC,EAAE,EACpB,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,GACxB,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAQlB;AAED,wBAAgB,kCAAkC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,CAE1F;AAED,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnF;AAED,wBAAsB,6BAA6B,CAAC,CAAC,EACnD,IAAI,EAAE,yBAAyB,EAC/B,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAC1B,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAEvB"}

package/node_modules/@noodle-borg/service/dist/platform-account-reset-ownership-helpers.js

@@ -0,0 +1,22 @@
+export function platformAccountResetAppKey(row) {
+    return `${row.org_slug}\0${row.app_slug ?? row.slug ?? ''}`;
+}
+export function groupPlatformAccountResetRows(values, key) {
+    const grouped = new Map();
+    for (const value of values) {
+        const bucket = grouped.get(key(value)) ?? [];
+        bucket.push(value);
+        grouped.set(key(value), bucket);
+    }
+    return grouped;
+}
+export function incrementPlatformAccountResetCount(counts, key) {
+    counts.set(key, (counts.get(key) ?? 0) + 1);
+}
+export function comparePlatformAccountResetText(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+export async function queryPlatformAccountResetRows(pool, sql, values) {
+    return (await pool.query(sql, values)).rows;
+}
+//# sourceMappingURL=platform-account-reset-ownership-helpers.js.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-ownership-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-ownership-helpers.js","sourceRoot":"","sources":["../src/platform-account-reset-ownership-helpers.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,0BAA0B,CAAC,GAI1C;IACC,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,MAAoB,EACpB,GAAyB;IAEzB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAe,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAI,MAAsB,EAAE,GAAM;IAClF,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,IAAY,EAAE,KAAa;IACzE,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,IAA+B,EAC/B,GAAW,EACX,MAA2B;IAE3B,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAI,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-account-reset-ownership-postgres.d.ts

@@ -0,0 +1,41 @@
+import type { PlatformAccountResetBlockerCode } from './platform-account-reset.js';
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+export type ResetDisposition = 'personal_org' | 'sole_owned_org' | 'target_owner_only_app' | 'preserved_shared_org' | 'preserved_org_members_app' | 'blocker';
+export interface PlatformAccountResetCleanupResource {
+    readonly provider: 'postgres' | 'object_storage' | 'github' | 'stripe' | 'workos';
+    readonly resourceKind: string;
+    readonly locator: Readonly<Record<string, unknown>>;
+    readonly locatorFingerprint: string;
+}
+export interface PlatformAccountResetOwnershipSnapshot {
+    readonly counts: {
+        readonly personalOrganizationCount: number;
+        readonly soleOwnedOrganizationCount: number;
+        readonly ownerOnlyAppCount: number;
+        readonly preservedSharedOrganizationCount: number;
+        readonly membershipCount: number;
+        readonly billingAccountCount: number;
+        readonly credentialCount: number;
+        readonly providerObjectCount: number;
+    };
+    readonly blockers: readonly {
+        readonly code: Extract<PlatformAccountResetBlockerCode, 'ownership_ambiguous' | 'shared_org_owner_required'>;
+        readonly count: number;
+    }[];
+    readonly cleanupResources: readonly PlatformAccountResetCleanupResource[];
+    readonly ownershipFingerprint: string;
+    readonly cleanupSetFingerprint: string;
+    readonly fingerprint: string;
+}
+/**
+ * Classifies only explicit relational ownership. Email fields are deliberately absent from every ownership
+ * predicate; the preview layer handles contact hints separately as restrictive evidence.
+ */
+export declare function loadPlatformAccountResetOwnershipSnapshot(pool: PlatformIdentityQueryable, input: {
+    readonly targetPrincipalIds: readonly string[];
+    readonly quarantine?: {
+        readonly operationId: string;
+        readonly cleanupResources: readonly PlatformAccountResetCleanupResource[];
+    };
+}): Promise<PlatformAccountResetOwnershipSnapshot>;
+//# sourceMappingURL=platform-account-reset-ownership-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-ownership-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-ownership-postgres.d.ts","sourceRoot":"","sources":["../src/platform-account-reset-ownership-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAkBnF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,MAAM,MAAM,gBAAgB,GACxB,cAAc,GACd,gBAAgB,GAChB,uBAAuB,GACvB,sBAAsB,GACtB,2BAA2B,GAC3B,SAAS,CAAC;AAEd,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,QAAQ,EAAE,UAAU,GAAG,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAClF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;QAC3C,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;QAC5C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,gCAAgC,EAAE,MAAM,CAAC;QAClD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;KACtC,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CACpB,+BAA+B,EAC/B,qBAAqB,GAAG,2BAA2B,CACpD,CAAC;QACF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,EAAE,CAAC;IACJ,QAAQ,CAAC,gBAAgB,EAAE,SAAS,mCAAmC,EAAE,CAAC;IAC1E,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAyDD;;;GAGG;AACH,wBAAsB,yCAAyC,CAC7D,IAAI,EAAE,yBAAyB,EAC/B,KAAK,EAAE;IACL,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,gBAAgB,EAAE,SAAS,mCAAmC,EAAE,CAAC;KAC3E,CAAC;CACH,GACA,OAAO,CAAC,qCAAqC,CAAC,CAmYhD"}