@noodleseed/one 0.83.0 → 0.84.1

package/node_modules/@noodle-borg/service/dist/platform-account-reset-quarantine-postgres.d.ts

@@ -0,0 +1,46 @@
+import { type PlatformAccountResetExecuteRequest, type PlatformAccountResetResult } from './platform-account-reset.js';
+import { type PlatformAccountResetMutationOutcome, type PlatformAccountResetPool } from './platform-account-reset-operation-postgres.js';
+import type { PlatformAccountResetPreparedPreviewValidation } from './platform-account-reset-preview-postgres.js';
+import { type PlatformAccountResetPreviewResult } from './platform-account-reset-preview-result.js';
+import { assertPlatformAuthInventorySourceFence } from './platform-auth-inventory-source-fence-postgres.js';
+import type { PlatformAuthInventorySourceManifest } from './platform-auth-inventory-sources.js';
+export type PlatformAccountResetQuarantineBoundary = 'canonical_validated' | 'operation_transitioned' | 'reservations_inserted' | 'principals_suspended' | 'authorization_codes_revoked' | 'consent_revoked' | 'device_authorizations_revoked' | 'developer_grants_revoked' | 'deployments_archived' | 'cleanup_ledger_stamped' | 'targets_transitioned' | 'event_appended';
+interface QuarantineOptions {
+    readonly preview: {
+        prepareUsable(input: {
+            readonly operationId: string;
+            readonly releaseSha: string;
+            readonly expectedGeneration: number;
+            readonly previewChecksum: string;
+        }, deadline?: number): Promise<PlatformAccountResetPreparedPreviewValidation>;
+        assertPrepared(connection: Parameters<typeof assertPlatformAuthInventorySourceFence>[0], input: {
+            readonly operationId: string;
+            readonly releaseSha: string;
+            readonly expectedGeneration: number;
+            readonly previewChecksum: string;
+        }, prepared: PlatformAccountResetPreparedPreviewValidation): Promise<PlatformAccountResetPreviewResult>;
+        assertUsable(input: {
+            readonly operationId: string;
+            readonly releaseSha: string;
+            readonly expectedGeneration: number;
+            readonly previewChecksum: string;
+        }): Promise<PlatformAccountResetPreviewResult>;
+    };
+    readonly sourceAvailability: PlatformAuthInventorySourceManifest;
+    readonly releaseSha: string;
+    readonly workosRealm: string;
+    readonly approvedTargetSetFingerprint: string;
+    readonly actorFingerprint: string;
+    readonly googleRealm?: string;
+    readonly now?: () => Date;
+    readonly localCaptureTimeoutMs?: number;
+    readonly fault?: (boundary: PlatformAccountResetQuarantineBoundary) => void | Promise<void>;
+}
+export declare class PostgresPlatformAccountResetQuarantineStore {
+    #private;
+    constructor(pool: PlatformAccountResetPool, options: QuarantineOptions);
+    quarantine(rawRequest: PlatformAccountResetExecuteRequest): Promise<PlatformAccountResetResult>;
+    apply(rawRequest: PlatformAccountResetExecuteRequest): Promise<PlatformAccountResetMutationOutcome>;
+}
+export {};
+//# sourceMappingURL=platform-account-reset-quarantine-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-quarantine-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-quarantine-postgres.d.ts","sourceRoot":"","sources":["../src/platform-account-reset-quarantine-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,kCAAkC,EAEvC,KAAK,0BAA0B,EAChC,MAAM,6BAA6B,CAAC;AAMrC,OAAO,EAOL,KAAK,mCAAmC,EACxC,KAAK,wBAAwB,EAG9B,MAAM,gDAAgD,CAAC;AAExD,OAAO,KAAK,EAAE,6CAA6C,EAAE,MAAM,8CAA8C,CAAC;AAClH,OAAO,EAEL,KAAK,iCAAiC,EACvC,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EACL,sCAAsC,EAKvC,MAAM,oDAAoD,CAAC;AAC5D,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAEhG,MAAM,MAAM,sCAAsC,GAC9C,qBAAqB,GACrB,wBAAwB,GACxB,uBAAuB,GACvB,sBAAsB,GACtB,6BAA6B,GAC7B,iBAAiB,GACjB,+BAA+B,GAC/B,0BAA0B,GAC1B,sBAAsB,GACtB,wBAAwB,GACxB,sBAAsB,GACtB,gBAAgB,CAAC;AAErB,UAAU,iBAAiB;IACzB,QAAQ,CAAC,OAAO,EAAE;QAChB,aAAa,CACX,KAAK,EAAE;YACL,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;YAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;YAC5B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;YACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;SAClC,EACD,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,6CAA6C,CAAC,CAAC;QAC1D,cAAc,CACZ,UAAU,EAAE,UAAU,CAAC,OAAO,sCAAsC,CAAC,CAAC,CAAC,CAAC,EACxE,KAAK,EAAE;YACL,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;YAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;YAC5B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;YACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;SAClC,EACD,QAAQ,EAAE,6CAA6C,GACtD,OAAO,CAAC,iCAAiC,CAAC,CAAC;QAC9C,YAAY,CAAC,KAAK,EAAE;YAClB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;YAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;YAC5B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;YACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;SAClC,GAAG,OAAO,CAAC,iCAAiC,CAAC,CAAC;KAChD,CAAC;IACF,QAAQ,CAAC,kBAAkB,EAAE,mCAAmC,CAAC;IACjE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,sCAAsC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7F;AAKD,qBAAa,2CAA2C;;gBAI1C,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,iBAAiB;IAShE,UAAU,CACd,UAAU,EAAE,kCAAkC,GAC7C,OAAO,CAAC,0BAA0B,CAAC;IAIhC,KAAK,CACT,UAAU,EAAE,kCAAkC,GAC7C,OAAO,CAAC,mCAAmC,CAAC;CA6WhD"}

package/node_modules/@noodle-borg/service/dist/platform-account-reset-quarantine-postgres.js

@@ -0,0 +1,283 @@
+import { PlatformAccountResetExecuteRequestSchema, } from './platform-account-reset.js';
+import { remainingPlatformAccountResetDispatchMilliseconds, runPlatformAccountResetWithDispatchLock, } from './platform-account-reset-dispatch-lock-postgres.js';
+import { canonicalJson, sha256Canonical } from './platform-account-reset-fingerprint.js';
+import { assertPlatformAccountResetActionReplay, assertPlatformAccountResetApprovedTargetSet, assertPlatformAccountResetRequestMatches, loadPlatformAccountResetFrozenResources, loadPlatformAccountResetTargets, lockPlatformAccountResetOperation, parsePlatformAccountResetSafeResult, platformAccountResetActionEvidence, } from './platform-account-reset-operation-postgres.js';
+import { loadPlatformAccountResetContactEvidence } from './platform-account-reset-preview-evidence-postgres.js';
+import { PlatformAccountResetPreviewError, } from './platform-account-reset-preview-result.js';
+import { PostgresPlatformAuthLegacyInventorySources } from './platform-auth-inventory-legacy-sources-postgres.js';
+import { assertPlatformAuthInventorySourceFence, lockPlatformAuthInventorySourceFenceTargets, PLATFORM_ACCOUNT_RESET_EXECUTION_TABLES, readPlatformAuthInventorySourceEpoch, runPlatformAuthInventorySourceFenceTransaction, } from './platform-auth-inventory-source-fence-postgres.js';
+const DEFAULT_LOCAL_CAPTURE_TIMEOUT_MS = 5_000;
+const MAX_LOCAL_CAPTURE_TIMEOUT_MS = 60_000;
+export class PostgresPlatformAccountResetQuarantineStore {
+    #pool;
+    #options;
+    constructor(pool, options) {
+        this.#pool = pool;
+        this.#options = {
+            ...options,
+            googleRealm: options.googleRealm ?? 'accounts.google.com',
+            now: options.now ?? (() => new Date()),
+        };
+    }
+    async quarantine(rawRequest) {
+        return (await this.apply(rawRequest)).result;
+    }
+    async apply(rawRequest) {
+        const request = PlatformAccountResetExecuteRequestSchema.parse(rawRequest);
+        if (request.action !== 'quarantine')
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+        return runPlatformAccountResetWithDispatchLock(this.#pool, {
+            operationId: request.operationId,
+            timeoutMs: this.#localCaptureTimeout(),
+            task: (context) => this.#applyLocked(request, context.replayLifecycle, context.deadline),
+        });
+    }
+    async #applyLocked(request, replayLifecycle, deadline) {
+        const evidence = platformAccountResetActionEvidence(request, this.#options.actorFingerprint);
+        const previewEvidence = {
+            operationId: request.operationId,
+            releaseSha: request.releaseSha,
+            expectedGeneration: request.expectedGeneration,
+            previewChecksum: request.previewChecksum,
+        };
+        const prepared = replayLifecycle === 'quarantined'
+            ? undefined
+            : await this.#options.preview.prepareUsable(previewEvidence, deadline);
+        return runPlatformAuthInventorySourceFenceTransaction(this.#pool, async (connection) => {
+            await this.#assertSourceFence(connection);
+            const operation = await lockPlatformAccountResetOperation(connection, request.operationId);
+            assertPlatformAccountResetApprovedTargetSet(operation, this.#options.approvedTargetSetFingerprint);
+            const resources = await loadPlatformAccountResetFrozenResources(connection, request.operationId);
+            if (operation.lifecycle === 'quarantined') {
+                const result = assertPlatformAccountResetActionReplay(evidence, {
+                    idempotencyKeyHash: operation.quarantine_idempotency_key_hash,
+                    requestFingerprint: operation.quarantine_request_fingerprint,
+                    reasonFingerprint: operation.quarantine_reason_fingerprint,
+                    actorFingerprint: operation.quarantine_actor_fingerprint,
+                    safeResult: operation.quarantine_safe_result,
+                });
+                return {
+                    result,
+                    registry: this.#registryPlan(resources.apps, operation.quarantined_at),
+                };
+            }
+            const validated = prepared === undefined
+                ? undefined
+                : await this.#options.preview.assertPrepared(connection, previewEvidence, prepared);
+            if (operation.lifecycle !== 'previewed' || validated === undefined)
+                throw new PlatformAccountResetPreviewError('operation_conflict');
+            assertPlatformAccountResetRequestMatches(operation, request, this.#options);
+            this.#assertStoredPreview(operation.safe_result, validated);
+            const targets = await loadPlatformAccountResetTargets(connection, request.operationId, 'previewed');
+            await lockPlatformAuthInventorySourceFenceTargets(connection, targets);
+            await this.#assertCurrentCoordination(connection, operation.source_epoch, request);
+            const contacts = await loadPlatformAccountResetContactEvidence(connection, targets, this.#options.sourceAvailability);
+            if (contacts.normalizedContacts.size !== 3 ||
+                contacts.missingCount !== 0 ||
+                contacts.ambiguousCount !== 0)
+                throw new PlatformAccountResetPreviewError('operation_conflict');
+            await this.#assertSuspensionTrigger(connection);
+            const result = this.#quarantineResult(parsePlatformAccountResetSafeResult(operation.safe_result), resources.resourceCount);
+            await this.#fault('canonical_validated');
+            const operationTransitioned = await connection.query(`WITH authority AS MATERIALIZED (
+             SELECT clock_timestamp() AS quarantined_at
+           )
+           UPDATE platform_account_reset_operations operation
+              SET lifecycle = 'quarantined',
+                  quarantined_at = authority.quarantined_at,
+                  finalize_after = authority.quarantined_at + interval '24 hours',
+                  quarantine_idempotency_key_hash = $2,
+                  quarantine_request_fingerprint = $3,
+                  quarantine_reason_fingerprint = $4,
+                  quarantine_actor_fingerprint = $5,
+                  quarantine_safe_result = $6::jsonb,
+                  updated_at = authority.quarantined_at
+             FROM authority
+            WHERE operation.operation_id = $1 AND operation.lifecycle = 'previewed'
+              AND operation.preview_expires_at > authority.quarantined_at
+          RETURNING operation.quarantined_at::text AS quarantined_at,
+                    operation.finalize_after::text AS finalize_after`, [
+                request.operationId,
+                evidence.idempotencyKeyHash,
+                evidence.requestFingerprint,
+                evidence.reasonFingerprint,
+                evidence.actorFingerprint,
+                JSON.stringify(result),
+            ]);
+            if (operationTransitioned.rows.length !== 1)
+                throw new PlatformAccountResetPreviewError('operation_conflict');
+            const quarantinedAtValue = operationTransitioned.rows[0]?.quarantined_at;
+            const finalizeAfterValue = operationTransitioned.rows[0]?.finalize_after;
+            const quarantinedAt = validTimestamp(quarantinedAtValue);
+            validTimestamp(finalizeAfterValue);
+            await this.#fault('operation_transitioned');
+            for (const target of targets) {
+                const normalizedEmail = contacts.normalizedContacts.get(target);
+                if (normalizedEmail === undefined)
+                    throw new PlatformAccountResetPreviewError('operation_conflict');
+                await connection.query(`INSERT INTO platform_account_reset_email_reservations
+             (operation_id, realm, normalized_email, principal_id, expires_at, created_at)
+           VALUES ($1, $2, $3, $4, $5, $6)`, [
+                    request.operationId,
+                    this.#options.workosRealm,
+                    normalizedEmail,
+                    target,
+                    finalizeAfterValue,
+                    quarantinedAtValue,
+                ]);
+            }
+            await this.#fault('reservations_inserted');
+            const suspended = await connection.query(`UPDATE platform_principals
+            SET status = 'suspended', suspended_at = $2
+          WHERE principal_id = ANY($1::text[]) AND status = 'active'
+          RETURNING principal_id`, [targets, quarantinedAtValue]);
+            if (suspended.rows.length !== 3)
+                throw new PlatformAccountResetPreviewError('principal_not_active');
+            await this.#fault('principals_suspended');
+            await connection.query(`DELETE FROM oauth_authorization_codes
+          WHERE owner_subject = ANY($1::text[])
+            AND identity_kind IS DISTINCT FROM 'customer'`, [targets]);
+            await this.#fault('authorization_codes_revoked');
+            await connection.query(`DELETE FROM oauth_consent_grant_provenance
+            WHERE owner_subject = ANY($1::text[]) AND identity_kind = 'platform'`, [targets]);
+            await connection.query(`DELETE FROM oauth_consent_grants
+            WHERE owner_subject = ANY($1::text[]) AND identity_kind = 'platform'`, [targets]);
+            await this.#fault('consent_revoked');
+            await connection.query(`DELETE FROM oauth_device_authorizations
+          WHERE owner_subject = ANY($1::text[])
+            AND identity_kind IS DISTINCT FROM 'customer'`, [targets]);
+            await this.#fault('device_authorizations_revoked');
+            await connection.query(`UPDATE developer_access_grants
+            SET revoked_at = $2, updated_at = $2
+          WHERE subject = ANY($1::text[]) AND revoked_at IS NULL`, [targets, quarantinedAtValue]);
+            await this.#fault('developer_grants_revoked');
+            const archived = await connection.query(`UPDATE deploy_records
+            SET archived_at = $2
+          WHERE deployment_id = ANY($1::text[]) AND archived_at IS NULL
+          RETURNING deployment_id`, [resources.deploymentIds, quarantinedAtValue]);
+            if (archived.rows.length !== resources.deploymentIds.length)
+                throw new PlatformAccountResetPreviewError('operation_conflict');
+            await this.#fault('deployments_archived');
+            const archivedIds = archived.rows.map((row) => row.deployment_id);
+            const stamped = await connection.query(`UPDATE platform_account_reset_cleanup_ledger
+            SET quarantine_archive_at = $3, updated_at = $3
+          WHERE operation_id = $1 AND provider = 'postgres'
+            AND resource_kind = 'deployment'
+            AND provider_locator::jsonb->>'deploymentId' = ANY($2::text[])
+            AND quarantine_archive_at IS NULL
+          RETURNING ledger_id`, [request.operationId, archivedIds, quarantinedAtValue]);
+            if (stamped.rows.length !== archivedIds.length)
+                throw new PlatformAccountResetPreviewError('operation_conflict');
+            await this.#fault('cleanup_ledger_stamped');
+            const targetsTransitioned = await connection.query(`UPDATE platform_account_reset_targets
+            SET lifecycle = 'quarantined', updated_at = $2
+          WHERE operation_id = $1 AND lifecycle = 'previewed'
+          RETURNING principal_id`, [request.operationId, quarantinedAtValue]);
+            if (targetsTransitioned.rows.length !== 3)
+                throw new PlatformAccountResetPreviewError('operation_conflict');
+            await this.#fault('targets_transitioned');
+            await connection.query(`INSERT INTO platform_account_reset_events
+           (operation_id, event_type, target_set_fingerprint, event_fingerprint,
+            target_count, resource_count, blocker_count, created_at)
+         VALUES ($1, 'quarantined', $2, $3, 3, $4, 0, $5)`, [
+                request.operationId,
+                result.targetSetFingerprint,
+                sha256Canonical({
+                    schemaVersion: 1,
+                    label: 'platform_account_reset_event:quarantined',
+                    operationId: request.operationId,
+                    requestFingerprint: evidence.requestFingerprint,
+                    result,
+                }),
+                resources.resourceCount,
+                quarantinedAtValue,
+            ]);
+            await this.#fault('event_appended');
+            return {
+                result,
+                registry: {
+                    action: 'quarantine',
+                    apps: resources.apps,
+                    archivedAt: quarantinedAt.toISOString(),
+                },
+            };
+        }, this.#transactionOptions(deadline));
+    }
+    async #assertSourceFence(connection) {
+        await new PostgresPlatformAuthLegacyInventorySources({
+            googleRealm: this.#options.googleRealm,
+            sourceAvailability: this.#options.sourceAvailability,
+            excludedSubjects: [],
+        }).assertManifest(connection);
+        await assertPlatformAuthInventorySourceFence(connection, this.#options.sourceAvailability);
+    }
+    async #assertCurrentCoordination(connection, storedSourceEpoch, request) {
+        if (Number(await readPlatformAuthInventorySourceEpoch(connection)) !== Number(storedSourceEpoch))
+            throw new PlatformAccountResetPreviewError('source_epoch_mismatch');
+        const rollout = await connection.query(`SELECT generation::text, lifecycle, workos_percentage
+         FROM platform_auth_rollout_state WHERE singleton = true FOR SHARE`);
+        const state = rollout.rows[0];
+        if (state === undefined || Number(state.generation) !== request.expectedGeneration)
+            throw new PlatformAccountResetPreviewError('generation_mismatch');
+        if (state.lifecycle !== 'google' || state.workos_percentage !== 0)
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+    }
+    async #assertSuspensionTrigger(connection) {
+        const installed = await connection.query(`SELECT 1 FROM pg_trigger
+        WHERE tgrelid = to_regclass('platform_principals')
+          AND tgname = 'platform_principal_suspension_revokes_refresh_tokens_trigger'
+          AND NOT tgisinternal AND tgenabled <> 'D'`);
+        if (installed.rows[0] === undefined)
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+    }
+    #assertStoredPreview(value, validated) {
+        const stored = parsePlatformAccountResetSafeResult(value);
+        const { workosRealmFingerprint: _realm, previewExpiresAt: _expiry, ...safe } = validated;
+        if (canonicalJson(stored) !== canonicalJson(safe))
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+    }
+    #quarantineResult(preview, resourceCount) {
+        return {
+            ...preview,
+            lifecycle: 'quarantined',
+            counts: {
+                ...preview.counts,
+                suspendedPrincipalCount: 3,
+                cleanupPendingCount: resourceCount,
+            },
+        };
+    }
+    #registryPlan(apps, quarantinedAt) {
+        const at = quarantinedAt === null ? new Date(Number.NaN) : new Date(quarantinedAt);
+        if (!Number.isFinite(at.getTime()))
+            throw new PlatformAccountResetPreviewError('operation_conflict');
+        return { action: 'quarantine', apps, archivedAt: at.toISOString() };
+    }
+    async #fault(boundary) {
+        await this.#options.fault?.(boundary);
+    }
+    #transactionOptions(deadline) {
+        const timeout = deadline === undefined
+            ? this.#localCaptureTimeout()
+            : remainingPlatformAccountResetDispatchMilliseconds(deadline, this.#localCaptureTimeout());
+        return {
+            lockTables: PLATFORM_ACCOUNT_RESET_EXECUTION_TABLES,
+            lockTimeoutMs: timeout,
+            statementTimeoutMs: timeout,
+        };
+    }
+    #localCaptureTimeout() {
+        return Math.min(this.#options.localCaptureTimeoutMs !== undefined &&
+            Number.isSafeInteger(this.#options.localCaptureTimeoutMs) &&
+            this.#options.localCaptureTimeoutMs > 0
+            ? this.#options.localCaptureTimeoutMs
+            : DEFAULT_LOCAL_CAPTURE_TIMEOUT_MS, MAX_LOCAL_CAPTURE_TIMEOUT_MS);
+    }
+}
+function validTimestamp(value) {
+    const timestamp = value === undefined ? new Date(Number.NaN) : new Date(value);
+    if (!Number.isFinite(timestamp.getTime()))
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+    return timestamp;
+}
+//# sourceMappingURL=platform-account-reset-quarantine-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-quarantine-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-quarantine-postgres.js","sourceRoot":"","sources":["../src/platform-account-reset-quarantine-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wCAAwC,GAEzC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,iDAAiD,EACjD,uCAAuC,GACxC,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AACzF,OAAO,EACL,sCAAsC,EACtC,2CAA2C,EAC3C,wCAAwC,EACxC,uCAAuC,EACvC,+BAA+B,EAC/B,iCAAiC,EAGjC,mCAAmC,EACnC,kCAAkC,GACnC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,uCAAuC,EAAE,MAAM,uDAAuD,CAAC;AAEhH,OAAO,EACL,gCAAgC,GAEjC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,0CAA0C,EAAE,MAAM,sDAAsD,CAAC;AAClH,OAAO,EACL,sCAAsC,EACtC,2CAA2C,EAC3C,uCAAuC,EACvC,oCAAoC,EACpC,8CAA8C,GAC/C,MAAM,oDAAoD,CAAC;AAwD5D,MAAM,gCAAgC,GAAG,KAAK,CAAC;AAC/C,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAE5C,MAAM,OAAO,2CAA2C;IAC7C,KAAK,CAA2B;IAChC,QAAQ,CAAiF;IAElG,YAAY,IAA8B,EAAE,OAA0B;QACpE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG;YACd,GAAG,OAAO;YACV,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,qBAAqB;YACzD,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;SACvC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CACd,UAA8C;QAE9C,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,KAAK,CACT,UAA8C;QAE9C,MAAM,OAAO,GAAG,wCAAwC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY;YACjC,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;QACnE,OAAO,uCAAuC,CAAC,IAAI,CAAC,KAAK,EAAE;YACzD,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,IAAI,CAAC,oBAAoB,EAAE;YACtC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC;SACzF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,OAA2C,EAC3C,eAAmC,EACnC,QAAgB;QAEhB,MAAM,QAAQ,GAAG,kCAAkC,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC7F,MAAM,eAAe,GAAG;YACtB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,eAAe,EAAE,OAAO,CAAC,eAAe;SACzC,CAAC;QACF,MAAM,QAAQ,GACZ,eAAe,KAAK,aAAa;YAC/B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAC3E,OAAO,8CAA8C,CACnD,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,UAAU,EAAE,EAAE;YACnB,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,MAAM,iCAAiC,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YAC3F,2CAA2C,CACzC,SAAS,EACT,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAC3C,CAAC;YACF,MAAM,SAAS,GAAG,MAAM,uCAAuC,CAC7D,UAAU,EACV,OAAO,CAAC,WAAW,CACpB,CAAC;YACF,IAAI,SAAS,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;gBAC1C,MAAM,MAAM,GAAG,sCAAsC,CAAC,QAAQ,EAAE;oBAC9D,kBAAkB,EAAE,SAAS,CAAC,+BAA+B;oBAC7D,kBAAkB,EAAE,SAAS,CAAC,8BAA8B;oBAC5D,iBAAiB,EAAE,SAAS,CAAC,6BAA6B;oBAC1D,gBAAgB,EAAE,SAAS,CAAC,4BAA4B;oBACxD,UAAU,EAAE,SAAS,CAAC,sBAAsB;iBAC7C,CAAC,CAAC;gBACH,OAAO;oBACL,MAAM;oBACN,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,CAAC;iBACvE,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GACb,QAAQ,KAAK,SAAS;gBACpB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;YACxF,IAAI,SAAS,CAAC,SAAS,KAAK,WAAW,IAAI,SAAS,KAAK,SAAS;gBAChE,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;YACnE,wCAAwC,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5E,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,MAAM,+BAA+B,CACnD,UAAU,EACV,OAAO,CAAC,WAAW,EACnB,WAAW,CACZ,CAAC;YACF,MAAM,2CAA2C,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACvE,MAAM,IAAI,CAAC,0BAA0B,CAAC,UAAU,EAAE,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACnF,MAAM,QAAQ,GAAG,MAAM,uCAAuC,CAC5D,UAAU,EACV,OAAO,EACP,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CACjC,CAAC;YACF,IACE,QAAQ,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC;gBACtC,QAAQ,CAAC,YAAY,KAAK,CAAC;gBAC3B,QAAQ,CAAC,cAAc,KAAK,CAAC;gBAE7B,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;YACnE,MAAM,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC;YAEhD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CACnC,mCAAmC,CAAC,SAAS,CAAC,WAAW,CAAC,EAC1D,SAAS,CAAC,aAAa,CACxB,CAAC;YACF,MAAM,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YACzC,MAAM,qBAAqB,GAAG,MAAM,UAAU,CAAC,KAAK,CAIlD;;;;;;;;;;;;;;;;;qEAiB2D,EAC3D;gBACE,OAAO,CAAC,WAAW;gBACnB,QAAQ,CAAC,kBAAkB;gBAC3B,QAAQ,CAAC,kBAAkB;gBAC3B,QAAQ,CAAC,iBAAiB;gBAC1B,QAAQ,CAAC,gBAAgB;gBACzB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;aACvB,CACF,CAAC;YACF,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBACzC,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;YACnE,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC;YACzE,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC;YACzE,MAAM,aAAa,GAAG,cAAc,CAAC,kBAAkB,CAAC,CAAC;YACzD,cAAc,CAAC,kBAAkB,CAAC,CAAC;YACnC,MAAM,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;YAE5C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,eAAe,GAAG,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAChE,IAAI,eAAe,KAAK,SAAS;oBAC/B,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;gBACnE,MAAM,UAAU,CAAC,KAAK,CACpB;;2CAE+B,EAC/B;oBACE,OAAO,CAAC,WAAW;oBACnB,IAAI,CAAC,QAAQ,CAAC,WAAW;oBACzB,eAAe;oBACf,MAAM;oBACN,kBAAkB;oBAClB,kBAAkB;iBACnB,CACF,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAE3C,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,KAAK,CACtC;;;iCAGuB,EACvB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAC9B,CAAC;YACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAC7B,MAAM,IAAI,gCAAgC,CAAC,sBAAsB,CAAC,CAAC;YACrE,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAE1C,MAAM,UAAU,CAAC,KAAK,CACpB;;0DAEgD,EAChD,CAAC,OAAO,CAAC,CACV,CAAC;YACF,MAAM,IAAI,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC;YACjD,MAAM,UAAU,CAAC,KAAK,CACpB;iFACuE,EACvE,CAAC,OAAO,CAAC,CACV,CAAC;YACF,MAAM,UAAU,CAAC,KAAK,CACpB;iFACuE,EACvE,CAAC,OAAO,CAAC,CACV,CAAC;YACF,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACrC,MAAM,UAAU,CAAC,KAAK,CACpB;;0DAEgD,EAChD,CAAC,OAAO,CAAC,CACV,CAAC;YACF,MAAM,IAAI,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC;YACnD,MAAM,UAAU,CAAC,KAAK,CACpB;;iEAEuD,EACvD,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAC9B,CAAC;YACF,MAAM,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;YAE9C,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CACrC;;;kCAGwB,EACxB,CAAC,SAAS,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAC9C,CAAC;YACF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,aAAa,CAAC,MAAM;gBACzD,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;YACnE,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAC1C,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CACpC;;;;;;8BAMoB,EACpB,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,kBAAkB,CAAC,CACvD,CAAC;YACF,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;gBAC5C,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;YACnE,MAAM,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;YAE5C,MAAM,mBAAmB,GAAG,MAAM,UAAU,CAAC,KAAK,CAChD;;;iCAGuB,EACvB,CAAC,OAAO,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAC1C,CAAC;YACF,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBACvC,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;YACnE,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAE1C,MAAM,UAAU,CAAC,KAAK,CACpB;;;0DAGgD,EAChD;gBACE,OAAO,CAAC,WAAW;gBACnB,MAAM,CAAC,oBAAoB;gBAC3B,eAAe,CAAC;oBACd,aAAa,EAAE,CAAC;oBAChB,KAAK,EAAE,0CAA0C;oBACjD,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;oBAC/C,MAAM;iBACP,CAAC;gBACF,SAAS,CAAC,aAAa;gBACvB,kBAAkB;aACnB,CACF,CAAC;YACF,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACpC,OAAO;gBACL,MAAM;gBACN,QAAQ,EAAE;oBACR,MAAM,EAAE,YAAY;oBACpB,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,UAAU,EAAE,aAAa,CAAC,WAAW,EAAE;iBACxC;aACF,CAAC;QACJ,CAAC,EACD,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CACnC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,UAAwE;QAExE,MAAM,IAAI,0CAA0C,CAAC;YACnD,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;YACtC,kBAAkB,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB;YACpD,gBAAgB,EAAE,EAAE;SACrB,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,sCAAsC,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAC7F,CAAC;IAED,KAAK,CAAC,0BAA0B,CAC9B,UAAsE,EACtE,iBAAyB,EACzB,OAA2C;QAE3C,IACE,MAAM,CAAC,MAAM,oCAAoC,CAAC,UAAU,CAAC,CAAC,KAAK,MAAM,CAAC,iBAAiB,CAAC;YAE5F,MAAM,IAAI,gCAAgC,CAAC,uBAAuB,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAKpC;2EACqE,CACtE,CAAC;QACF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,kBAAkB;YAChF,MAAM,IAAI,gCAAgC,CAAC,qBAAqB,CAAC,CAAC;QACpE,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC;YAC/D,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC5B,UAAsE;QAEtE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,KAAK,CACtC;;;oDAG8C,CAC/C,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;YACjC,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IACrE,CAAC;IAED,oBAAoB,CAAC,KAAc,EAAE,SAA4C;QAC/E,MAAM,MAAM,GAAG,mCAAmC,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,SAAS,CAAC;QACzF,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,aAAa,CAAC,IAAI,CAAC;YAC/C,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IACrE,CAAC;IAED,iBAAiB,CACf,OAAmC,EACnC,aAAqB;QAErB,OAAO;YACL,GAAG,OAAO;YACV,SAAS,EAAE,aAAa;YACxB,MAAM,EAAE;gBACN,GAAG,OAAO,CAAC,MAAM;gBACjB,uBAAuB,EAAE,CAAC;gBAC1B,mBAAmB,EAAE,aAAa;aACnC;SACF,CAAC;IACJ,CAAC;IAED,aAAa,CACX,IAA+D,EAC/D,aAAmC;QAEnC,MAAM,EAAE,GAAG,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;QACnE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgD;QAC3D,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,mBAAmB,CAAC,QAAiB;QACnC,MAAM,OAAO,GACX,QAAQ,KAAK,SAAS;YACpB,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE;YAC7B,CAAC,CAAC,iDAAiD,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAC/F,OAAO;YACL,UAAU,EAAE,uCAAuC;YACnD,aAAa,EAAE,OAAO;YACtB,kBAAkB,EAAE,OAAO;SAC5B,CAAC;IACJ,CAAC;IAED,oBAAoB;QAClB,OAAO,IAAI,CAAC,GAAG,CACb,IAAI,CAAC,QAAQ,CAAC,qBAAqB,KAAK,SAAS;YAC/C,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YACzD,IAAI,CAAC,QAAQ,CAAC,qBAAqB,GAAG,CAAC;YACvC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB;YACrC,CAAC,CAAC,gCAAgC,EACpC,4BAA4B,CAC7B,CAAC;IACJ,CAAC;CACF;AAED,SAAS,cAAc,CAAC,KAAgC;IACtD,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IACnE,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-account-reset-rollback-eligibility-postgres.d.ts

@@ -0,0 +1,13 @@
+import type { PlatformAccountResetResult } from './platform-account-reset.js';
+import { type PlatformAccountResetCleanupResource } from './platform-account-reset-ownership-postgres.js';
+import type { PlatformAuthInventorySourceManifest } from './platform-auth-inventory-sources.js';
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+export declare function assertPlatformAccountResetRollbackEligibility(connection: PlatformIdentityQueryable, input: {
+    readonly operationId: string;
+    readonly targets: readonly string[];
+    readonly frozenContacts: ReadonlyMap<string, string>;
+    readonly frozenCleanupResources: readonly PlatformAccountResetCleanupResource[];
+    readonly sourceAvailability: PlatformAuthInventorySourceManifest;
+    readonly baseResult: PlatformAccountResetResult;
+}): Promise<string>;
+//# sourceMappingURL=platform-account-reset-rollback-eligibility-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-rollback-eligibility-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-rollback-eligibility-postgres.d.ts","sourceRoot":"","sources":["../src/platform-account-reset-rollback-eligibility-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAE9E,OAAO,EAEL,KAAK,mCAAmC,EACzC,MAAM,gDAAgD,CAAC;AAMxD,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAChG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAcjF,wBAAsB,6CAA6C,CACjE,UAAU,EAAE,yBAAyB,EACrC,KAAK,EAAE;IACL,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrD,QAAQ,CAAC,sBAAsB,EAAE,SAAS,mCAAmC,EAAE,CAAC;IAChF,QAAQ,CAAC,kBAAkB,EAAE,mCAAmC,CAAC;IACjE,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;CACjD,GACA,OAAO,CAAC,MAAM,CAAC,CA0FjB"}

package/node_modules/@noodle-borg/service/dist/platform-account-reset-rollback-eligibility-postgres.js

@@ -0,0 +1,81 @@
+import { canonicalJson, sha256Canonical } from './platform-account-reset-fingerprint.js';
+import { loadPlatformAccountResetOwnershipSnapshot, } from './platform-account-reset-ownership-postgres.js';
+import { loadPlatformAccountResetContactEvidence, loadPlatformAccountResetCustomerEvidence, } from './platform-account-reset-preview-evidence-postgres.js';
+import { PlatformAccountResetPreviewError } from './platform-account-reset-preview-result.js';
+export async function assertPlatformAccountResetRollbackEligibility(connection, input) {
+    const verified = await connection.query(`SELECT 1 FROM platform_verified_emails
+      WHERE principal_id = ANY($1::text[])
+      LIMIT 1`, [input.targets]);
+    if (verified.rows[0] !== undefined)
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+    const customerEvidence = await loadPlatformAccountResetCustomerEvidence(connection, input.targets);
+    if (customerEvidence.length !== 0)
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+    const contactEvidence = await loadPlatformAccountResetContactEvidence(connection, input.targets, input.sourceAvailability);
+    if (contactEvidence.missingCount !== 0 ||
+        contactEvidence.ambiguousCount !== 0 ||
+        canonicalJson(orderedEntries(contactEvidence.normalizedContacts)) !==
+            canonicalJson(orderedEntries(input.frozenContacts)))
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+    const personal = await connection.query(`SELECT binding.principal_subject, binding.org_slug,
+            binding.billing_identity_issuer, binding.billing_subject,
+            binding.billing_account_id,
+            defaults.billing_account_id AS default_billing_account_id,
+            home.billing_account_id AS home_billing_account_id,
+            home.home_owner_identity_issuer, home.home_owner_subject
+       FROM personal_workspace_bindings binding
+       LEFT JOIN billing_account_defaults defaults
+         ON defaults.identity_issuer = binding.billing_identity_issuer
+        AND defaults.subject = binding.billing_subject
+       LEFT JOIN org_billing_home_accounts home ON home.org_slug = binding.org_slug
+      WHERE binding.principal_subject = ANY($1::text[])
+      ORDER BY binding.principal_subject, binding.org_slug`, [input.targets]);
+    if (personal.rows.length !== input.targets.length ||
+        personal.rows.some((row) => row.billing_identity_issuer !== 'https://accounts.google.com' ||
+            row.billing_subject !== row.principal_subject ||
+            row.billing_account_id !== row.default_billing_account_id ||
+            row.billing_account_id !== row.home_billing_account_id ||
+            row.home_owner_identity_issuer !== 'https://accounts.google.com' ||
+            row.home_owner_subject !== row.principal_subject))
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+    const ownership = await loadPlatformAccountResetOwnershipSnapshot(connection, {
+        targetPrincipalIds: input.targets,
+        quarantine: {
+            operationId: input.operationId,
+            cleanupResources: input.frozenCleanupResources,
+        },
+    });
+    if (ownership.blockers.length !== 0)
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+    const frozenLocalResources = input.frozenCleanupResources
+        .filter((resource) => resource.provider !== 'workos')
+        .sort((left, right) => canonicalJson(left).localeCompare(canonicalJson(right)));
+    if (canonicalJson(ownership.cleanupResources) !== canonicalJson(frozenLocalResources) ||
+        !sameCounts(ownership.counts, ownership.cleanupResources.length, input.baseResult.counts))
+        throw new PlatformAccountResetPreviewError('operation_conflict');
+    return sha256Canonical({
+        schemaVersion: 1,
+        label: 'platform_account_reset_rollback_eligibility',
+        targets: input.targets,
+        frozenContacts: orderedEntries(input.frozenContacts),
+        contactEvidence: [...contactEvidence.evidenceByTarget].sort(([left], [right]) => left.localeCompare(right)),
+        personal: personal.rows,
+        ownershipFingerprint: ownership.ownershipFingerprint,
+        cleanupSetFingerprint: ownership.cleanupSetFingerprint,
+    });
+}
+function sameCounts(actual, actualCleanupResourceCount, expected) {
+    return (actual.personalOrganizationCount === expected.personalOrganizationCount &&
+        actual.soleOwnedOrganizationCount === expected.soleOwnedOrganizationCount &&
+        actual.ownerOnlyAppCount === expected.ownerOnlyAppCount &&
+        actual.preservedSharedOrganizationCount === expected.preservedSharedOrganizationCount &&
+        actual.membershipCount === expected.membershipCount &&
+        actual.billingAccountCount === expected.billingAccountCount &&
+        actual.credentialCount === expected.credentialCount &&
+        actual.providerObjectCount + expected.cleanupPendingCount - actualCleanupResourceCount ===
+            expected.providerObjectCount);
+}
+function orderedEntries(values) {
+    return [...values].sort(([left], [right]) => left.localeCompare(right));
+}
+//# sourceMappingURL=platform-account-reset-rollback-eligibility-postgres.js.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-rollback-eligibility-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-rollback-eligibility-postgres.js","sourceRoot":"","sources":["../src/platform-account-reset-rollback-eligibility-postgres.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AACzF,OAAO,EACL,yCAAyC,GAE1C,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAgB9F,MAAM,CAAC,KAAK,UAAU,6CAA6C,CACjE,UAAqC,EACrC,KAOC;IAED,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CACrC;;cAEU,EACV,CAAC,KAAK,CAAC,OAAO,CAAC,CAChB,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;QAChC,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IAEnE,MAAM,gBAAgB,GAAG,MAAM,wCAAwC,CACrE,UAAU,EACV,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAC/B,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IAEnE,MAAM,eAAe,GAAG,MAAM,uCAAuC,CACnE,UAAU,EACV,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,IACE,eAAe,CAAC,YAAY,KAAK,CAAC;QAClC,eAAe,CAAC,cAAc,KAAK,CAAC;QACpC,aAAa,CAAC,cAAc,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC;YAC/D,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAErD,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IAEnE,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CACrC;;;;;;;;;;;;2DAYuD,EACvD,CAAC,KAAK,CAAC,OAAO,CAAC,CAChB,CAAC;IACF,IACE,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM;QAC7C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAChB,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,uBAAuB,KAAK,6BAA6B;YAC7D,GAAG,CAAC,eAAe,KAAK,GAAG,CAAC,iBAAiB;YAC7C,GAAG,CAAC,kBAAkB,KAAK,GAAG,CAAC,0BAA0B;YACzD,GAAG,CAAC,kBAAkB,KAAK,GAAG,CAAC,uBAAuB;YACtD,GAAG,CAAC,0BAA0B,KAAK,6BAA6B;YAChE,GAAG,CAAC,kBAAkB,KAAK,GAAG,CAAC,iBAAiB,CACnD;QAED,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IAEnE,MAAM,SAAS,GAAG,MAAM,yCAAyC,CAAC,UAAU,EAAE;QAC5E,kBAAkB,EAAE,KAAK,CAAC,OAAO;QACjC,UAAU,EAAE;YACV,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,gBAAgB,EAAE,KAAK,CAAC,sBAAsB;SAC/C;KACF,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QACjC,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IACnE,MAAM,oBAAoB,GAAG,KAAK,CAAC,sBAAsB;SACtD,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC;SACpD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClF,IACE,aAAa,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,aAAa,CAAC,oBAAoB,CAAC;QACjF,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAEzF,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;IAEnE,OAAO,eAAe,CAAC;QACrB,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,6CAA6C;QACpD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC;QACpD,eAAe,EAAE,CAAC,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAC9E,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAC1B;QACD,QAAQ,EAAE,QAAQ,CAAC,IAAI;QACvB,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;QACpD,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;KACvD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CACjB,MAAuF,EACvF,0BAAkC,EAClC,QAA8C;IAE9C,OAAO,CACL,MAAM,CAAC,yBAAyB,KAAK,QAAQ,CAAC,yBAAyB;QACvE,MAAM,CAAC,0BAA0B,KAAK,QAAQ,CAAC,0BAA0B;QACzE,MAAM,CAAC,iBAAiB,KAAK,QAAQ,CAAC,iBAAiB;QACvD,MAAM,CAAC,gCAAgC,KAAK,QAAQ,CAAC,gCAAgC;QACrF,MAAM,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;QACnD,MAAM,CAAC,mBAAmB,KAAK,QAAQ,CAAC,mBAAmB;QAC3D,MAAM,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;QACnD,MAAM,CAAC,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,GAAG,0BAA0B;YACpF,QAAQ,CAAC,mBAAmB,CAC/B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,MAAmC;IAEnC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1E,CAAC"}

package/node_modules/@noodle-borg/service/dist/platform-account-reset-rollback-local-postgres.d.ts

@@ -0,0 +1,30 @@
+import { type PlatformAccountResetResult } from './platform-account-reset.js';
+import type { PlatformAuthInventorySourceManifest } from './platform-auth-inventory-sources.js';
+import type { PlatformIdentityQueryable } from './platform-identity-postgres.js';
+export interface PlatformAccountResetCanonicalCleanupResource {
+    readonly provider: 'postgres' | 'object_storage' | 'github' | 'stripe' | 'workos';
+    readonly resourceKind: string;
+    readonly locator: Readonly<Record<string, unknown>>;
+    readonly locatorFingerprint: string;
+}
+export interface PlatformAccountResetRollbackLocalInspection {
+    readonly operationId: string;
+    readonly sourceEpoch: number;
+    readonly rolloutGeneration: number;
+    readonly releaseSha: string;
+    readonly targetSetFingerprint: string;
+    readonly targets: readonly string[];
+    readonly contacts: ReadonlyMap<string, string>;
+    readonly workosResources: readonly PlatformAccountResetCanonicalCleanupResource[];
+    readonly baseResult: PlatformAccountResetResult;
+    readonly evidenceFingerprint: string;
+}
+interface RollbackLocalOptions {
+    readonly googleRealm: string;
+    readonly workosRealm: string;
+    readonly releaseSha: string;
+    readonly sourceAvailability: PlatformAuthInventorySourceManifest;
+}
+export declare function inspectPlatformAccountResetRollbackLocalEvidence(connection: PlatformIdentityQueryable, operationId: string, options: RollbackLocalOptions): Promise<PlatformAccountResetRollbackLocalInspection>;
+export {};
+//# sourceMappingURL=platform-account-reset-rollback-local-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/platform-account-reset-rollback-local-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-account-reset-rollback-local-postgres.d.ts","sourceRoot":"","sources":["../src/platform-account-reset-rollback-local-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,0BAA0B,EAEhC,MAAM,6BAA6B,CAAC;AAQrC,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAChG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AA8BjF,MAAM,WAAW,4CAA4C;IAC3D,QAAQ,CAAC,QAAQ,EAAE,UAAU,GAAG,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAClF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,2CAA2C;IAC1D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,eAAe,EAAE,SAAS,4CAA4C,EAAE,CAAC;IAClF,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;IAChD,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAED,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,EAAE,mCAAmC,CAAC;CAClE;AAED,wBAAsB,gDAAgD,CACpE,UAAU,EAAE,yBAAyB,EACrC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,2CAA2C,CAAC,CAuPtD"}