@owlmeans/server-auth-identity 0.1.18-rc.28 → 0.1.18-rc.29

package/README.md

@@ -10,7 +10,7 @@ whose grants decide access (use `@owlmeans/server-oidc-rp`'s guard and gate, or
 ## Installation
 
 ```bash
-bun add @owlmeans/server-auth-identity@^0.1.18-rc.28
+bun add @owlmeans/server-auth-identity@^0.1.18-rc.29
 ```
 
 ## Concepts
@@ -28,6 +28,8 @@ bun add @owlmeans/server-auth-identity@^0.1.18-rc.28
   profile details and returns an `AuthPayload`.
 - **Entity resolver** — the `EntityResolverService` registered under `ENTITY_RESOLVER`. Registering
   it tells the server boundary that this deployment has organizations.
+- **Identity events** — `identityEvents(ctx)` returns the `IdentityEventsService`; its
+  `onEntityCreated` listeners run once per newly registered organization entity.
 
 ## Usage
 
@@ -145,6 +147,23 @@ payload ??= await linking.linkProfile(details, { username: 'person@example.org'
 // payload: { type, role, userId, profileId, entitySlug, scopes }
 ```
 
+### Provision when an organization is created
+
+```ts
+import { identityEvents } from '@owlmeans/server-auth-identity'
+
+// in makeContext, after appendAuthIdentityResources
+identityEvents(context)?.onEntityCreated(async (event, ctx) => {
+  await ctx.service<PlanService>(PLAN_SERVICE).grantStarterPlan(event.entityId)
+})
+```
+
+The event carries `entityId`, `entitySlug`, `iamKey`, `accountId`, `profileId`, `username`, the
+login `type` and `service`, and `createdAt`. It fires only when `linkProfile` registers a new
+identity (including `force: true`) — never when a second sign-in method links to an identity that
+exists. Listeners run in order and are awaited; one that throws is logged and never fails the
+sign-in, so anything a listener provisions needs its own backfill.
+
 ### Rename an organization and mint a durable name
 
 ```ts
@@ -168,13 +187,15 @@ const namespace = await resolver.mintName(entityId, 'namespace', entity => `my-a
 
 | Symbol | Kind | Purpose |
 |---|---|---|
-| `appendAuthIdentityResources(context, dbAlias?)` | function | Register the four resources, the linking service and the entity resolver |
+| `appendAuthIdentityResources(context, dbAlias?)` | function | Register the four resources, the linking service, the entity resolver and (unless one is registered) the identity-events service |
 | `makeOrgEntityResource(dbAlias?)` | function | Mongo resource for `OrgEntity` |
 | `makeIdentityAccountResource(dbAlias?)` | function | Mongo resource for `IdentityAccount` |
 | `makeIdentityProfileResource(dbAlias?)` | function | Mongo resource for `IdentityProfile` |
 | `makeIdentityCredentialsResource(dbAlias?)` | function | Mongo resource for `IdentityCredentials` |
 | `makeIdentityLinkingService()` | function | The `IdentityLinkingService` implementation |
 | `makeEntityResolverService(alias = ENTITY_RESOLVER)` | function | The `EntityResolverService` implementation, cached 30 s per resolved name |
+| `makeIdentityEventsService(alias = AUTH_IDENTITY_EVENTS)` | function | The `IdentityEventsService` implementation (lazy) |
+| `identityEvents(ctx, alias?)` | function | The registered events service, or `null` |
 
 ### Constants
 
@@ -182,6 +203,7 @@ const namespace = await resolver.mintName(entityId, 'namespace', entity => `my-a
 |---|---|---|
 | `AUTH_IDENTITY_ORG_ENTITY`, `AUTH_IDENTITY_ACCOUNT`, `AUTH_IDENTITY_PROFILE`, `AUTH_IDENTITY_CREDENTIALS` | const | Resource aliases (`'auth-identity:…'`), lookup keys only |
 | `AUTH_IDENTITY_LINKING` | const | `'auth-identity:linking'` — linking service alias |
+| `AUTH_IDENTITY_EVENTS` | const | `'auth-identity:events'` — identity-events service alias |
 | `AUTH_IDENTITY_DB_ALIAS` | const | `'auth-identity'` — suggested db config alias |
 | `AUTH_IDENTITY_ORG_ENTITY_COLLECTION`, `AUTH_IDENTITY_ACCOUNT_COLLECTION`, `AUTH_IDENTITY_PROFILE_COLLECTION`, `AUTH_IDENTITY_CREDENTIALS_COLLECTION` | const | Colon-free Mongo collection base names |
 | `MAX_ENTITY_SLUG_ATTEMPTS` | const | `8` — word slugs tried before minting gives up |
@@ -197,6 +219,8 @@ const namespace = await resolver.mintName(entityId, 'namespace', entity => `my-a
 | `IdentityCredentials` | type | `AuthCredentials` + `profileId` |
 | `IdentityLinkingService` | type | `getLinkedProfile`, `linkProfile`, `linkCredentials`, `unlinkCredentials`, `getOwnerProfiles`, `getOwnerCredentials` |
 | `AccountMeta` | type | `{ username, force? }` |
+| `IdentityEventsService` | type | `onEntityCreated(callback)`, `propagateEntityCreated(event)` |
+| `EntityCreatedEvent`, `EntityCreatedCallback` | type | The entity-created payload; `(event, ctx) => Promise<void>` |
 | `OrgEntityResource`, `IdentityAccountResource`, `IdentityProfileResource`, `IdentityCredentialsResource` | type | Typed `MongoResource` aliases |
 | `IdentityConfig`, `IdentityContext` | type | Server config and context shapes |
 | `GoogleUserInfo` | type | Google userinfo claims |
@@ -224,6 +248,8 @@ const namespace = await resolver.mintName(entityId, 'namespace', entity => `my-a
   is needed.
 - `linkProfile(details, { username, force: true })` always registers a new identity — use it only
   when a separate identity is intended.
+- Provisioning in an `onEntityCreated` listener is best-effort: a throwing listener is logged and the
+  sign-in succeeds, so reconcile what it provisions periodically.
 - The resolver caches for 30 seconds, so a rename reaches other replicas within that window; the old
   slug keeps resolving meanwhile.
 - `rename` rejects a malformed slug and any slug an entity has ever answered to; `mintSlug` throws
@@ -247,7 +273,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.27
+npx @owlmeans/agent-skills@^0.1.18-rc.28
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-auth-identity",
-  "version": "0.1.18-rc.28",
-  "generatedAt": "2026-09-15T13:19:14.330Z",
+  "version": "0.1.18-rc.29",
+  "generatedAt": "2026-09-16T17:32:31.932Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-auth-identity/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: server-auth-identity
-description: How to use @owlmeans/server-auth-identity — the Mongo-backed local identity store behind provider logins. Registers the organization-entity registry plus account, profile and credentials resources, the IdentityLinkingService that maps an external provider account onto one local identity, and the EntityResolverService that turns the slug on a token into a stable entity id. Auto-invoked when importing appendAuthIdentityResources, an identity resource alias, IdentityLinkingService or the entity resolver.
+description: How to use @owlmeans/server-auth-identity — the Mongo-backed local identity store behind provider logins. Registers the organization-entity registry plus account, profile and credentials resources, the IdentityLinkingService that maps an external provider account onto one local identity, the EntityResolverService that turns the slug on a token into a stable entity id, and the identity-events seam that announces a newly created organization entity. Auto-invoked when importing appendAuthIdentityResources, an identity resource alias, IdentityLinkingService, the entity resolver or identityEvents.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-auth-identity
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-auth-identity": "^0.1.18-rc.28"` in `dependencies`
+**Install:** `"@owlmeans/server-auth-identity": "^0.1.18-rc.29"` in `dependencies`
 
 The local identity store a deployment owns when it does not delegate identity to an external IAM.
 It answers two questions: *who is this person here* (account / profile / credentials) and *which
@@ -18,18 +18,21 @@ organization entity is this* (the org-entity registry and its resolver).
 
 | Export | Description |
 |--------|-------------|
-| `appendAuthIdentityResources(context, dbAlias?)` | Register the four resources, the linking service and the entity resolver in one call |
+| `appendAuthIdentityResources(context, dbAlias?)` | Register the four resources, the linking service, the entity resolver and — unless one is already registered — the identity-events service |
 | `makeOrgEntityResource(dbAlias?)` | Mongo resource for `OrgEntity` — the organization-entity registry |
 | `makeIdentityAccountResource(dbAlias?)` | Mongo resource for `IdentityAccount` (one per person) |
 | `makeIdentityProfileResource(dbAlias?)` | Mongo resource for `IdentityProfile` (one person inside one organization entity, with a role) |
 | `makeIdentityCredentialsResource(dbAlias?)` | Mongo resource for `IdentityCredentials` (one provider link per profile) |
 | `makeIdentityLinkingService()` | The `IdentityLinkingService` implementation |
 | `makeEntityResolverService(alias?)` | The `EntityResolverService` implementation, cached for 30 s per resolved value |
+| `makeIdentityEventsService(alias?)` | The lazy `IdentityEventsService` implementation |
+| `identityEvents(ctx, alias?)` | The registered events service, or `null` |
 | `AUTH_IDENTITY_ORG_ENTITY` | Resource alias `'auth-identity:org-entity'` |
 | `AUTH_IDENTITY_ACCOUNT` | Resource alias `'auth-identity:account'` |
 | `AUTH_IDENTITY_PROFILE` | Resource alias `'auth-identity:profile'` |
 | `AUTH_IDENTITY_CREDENTIALS` | Resource alias `'auth-identity:credentials'` |
 | `AUTH_IDENTITY_LINKING` | Service alias `'auth-identity:linking'` |
+| `AUTH_IDENTITY_EVENTS` | Service alias `'auth-identity:events'` |
 | `AUTH_IDENTITY_DB_ALIAS` | `'auth-identity'` — the suggested db-config alias whose `resourcePrefix` scopes the prefix to identity collections only |
 | `AUTH_IDENTITY_ORG_ENTITY_COLLECTION`, `AUTH_IDENTITY_ACCOUNT_COLLECTION`, `AUTH_IDENTITY_PROFILE_COLLECTION`, `AUTH_IDENTITY_CREDENTIALS_COLLECTION` | Colon-free Mongo collection base names (`org-entity`, `account`, `profile`, `credentials`) |
 | `MAX_ENTITY_SLUG_ATTEMPTS` | How many word slugs to try before giving up minting a free one |
@@ -49,6 +52,9 @@ collection names are the colon-free `*_COLLECTION` values, optionally prefixed b
 | `IdentityCredentials` | `AuthCredentials` + `profileId` |
 | `IdentityLinkingService` | `getLinkedProfile`, `linkProfile`, `linkCredentials`, `getOwnerProfiles`, `getOwnerCredentials` |
 | `AccountMeta` | `{ username, force? }` — the second argument to `linkProfile` |
+| `IdentityEventsService` | `onEntityCreated(callback)`, `propagateEntityCreated(event)` |
+| `EntityCreatedEvent` | `entityId`, `entitySlug`, `iamKey`, `accountId`, `profileId`, `username`, `type`, `service`, `createdAt` |
+| `EntityCreatedCallback` | `(event, ctx) => Promise<void>` |
 | `OrgEntityResource`, `IdentityAccountResource`, `IdentityProfileResource`, `IdentityCredentialsResource` | Typed `MongoResource` aliases |
 | `IdentityConfig`, `IdentityContext` | Server config/context shapes |
 | `GoogleUserInfo` | The Google userinfo claim set |
@@ -154,6 +160,32 @@ profile carrying one is a platform login and a profile carrying none is somebody
 `linkProfile(details, { username, force: true })` skips the lookup and registers a fresh identity
 regardless. Use it only where a genuinely separate identity is intended.
 
+## Identity events
+
+`linkProfile` is the only place an organization entity is minted, so it is where one is announced:
+
+```typescript
+import { identityEvents } from '@owlmeans/server-auth-identity'
+
+// while wiring the context, after appendAuthIdentityResources — the service is lazy
+identityEvents(context)?.onEntityCreated(async (event, ctx) => {
+  await provisionStarterPlan(ctx, event.entityId)
+})
+```
+
+- **It fires at the end of the REGISTRATION branch only** — after the entity, account, profile and
+  credential rows exist, and on `force: true` too. A second sign-in method that links to a known
+  identity creates no entity and fires nothing. Provisioning keyed on "reached `linkProfile`"
+  would double-fund that person; key it on this event.
+- **Listeners run in registration order and are awaited**, so the sign-in completes after them.
+  Keep them short: one row, one enqueue.
+- **A throwing listener is logged and never fails the sign-in**, and the next listener still runs.
+  The person is registered either way, so whatever a listener provisions needs a periodic
+  reconciliation to backfill the misses.
+- **`identityEvents(ctx)` answers `null` where the service is not registered** — write `?.` and a
+  deployment without the seam pays nothing.
+- Key what a listener writes on `event.entityId`, never on `entitySlug`: the slug can be renamed.
+
 ## Key derivation conventions
 
 - **Account `credential`** — a unique 16-character Base58 slug, the account's own stable key.

package/build/consts.d.ts

@@ -3,6 +3,7 @@ export declare const AUTH_IDENTITY_PROFILE = "auth-identity:profile";
 export declare const AUTH_IDENTITY_CREDENTIALS = "auth-identity:credentials";
 export declare const AUTH_IDENTITY_LINKING = "auth-identity:linking";
 export declare const AUTH_IDENTITY_ORG_ENTITY = "auth-identity:org-entity";
+export declare const AUTH_IDENTITY_EVENTS = "auth-identity:events";
 export declare const AUTH_IDENTITY_ACCOUNT_COLLECTION = "account";
 export declare const AUTH_IDENTITY_PROFILE_COLLECTION = "profile";
 export declare const AUTH_IDENTITY_CREDENTIALS_COLLECTION = "credentials";

package/build/consts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAC5D,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAC5D,eAAO,MAAM,yBAAyB,8BAA8B,CAAA;AACpE,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAC5D,eAAO,MAAM,wBAAwB,6BAA6B,CAAA;AAMlE,eAAO,MAAM,gCAAgC,YAAY,CAAA;AACzD,eAAO,MAAM,gCAAgC,YAAY,CAAA;AACzD,eAAO,MAAM,oCAAoC,gBAAgB,CAAA;AACjE,eAAO,MAAM,mCAAmC,eAAe,CAAA;AAI/D,eAAO,MAAM,sBAAsB,kBAAkB,CAAA;AAIrD,eAAO,MAAM,wBAAwB,IAAI,CAAA;AAGzC,eAAO,MAAM,oBAAoB,YAAY,CAAA;AAC7C,eAAO,MAAM,sBAAsB,MAAM,CAAA"}
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAC5D,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAC5D,eAAO,MAAM,yBAAyB,8BAA8B,CAAA;AACpE,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAC5D,eAAO,MAAM,wBAAwB,6BAA6B,CAAA;AAElE,eAAO,MAAM,oBAAoB,yBAAyB,CAAA;AAM1D,eAAO,MAAM,gCAAgC,YAAY,CAAA;AACzD,eAAO,MAAM,gCAAgC,YAAY,CAAA;AACzD,eAAO,MAAM,oCAAoC,gBAAgB,CAAA;AACjE,eAAO,MAAM,mCAAmC,eAAe,CAAA;AAI/D,eAAO,MAAM,sBAAsB,kBAAkB,CAAA;AAIrD,eAAO,MAAM,wBAAwB,IAAI,CAAA;AAGzC,eAAO,MAAM,oBAAoB,YAAY,CAAA;AAC7C,eAAO,MAAM,sBAAsB,MAAM,CAAA"}

package/build/consts.js

@@ -7,6 +7,8 @@ export const AUTH_IDENTITY_PROFILE = 'auth-identity:profile';
 export const AUTH_IDENTITY_CREDENTIALS = 'auth-identity:credentials';
 export const AUTH_IDENTITY_LINKING = 'auth-identity:linking';
 export const AUTH_IDENTITY_ORG_ENTITY = 'auth-identity:org-entity';
+// Service alias of the identity-events seam (`identityEvents(ctx)`).
+export const AUTH_IDENTITY_EVENTS = 'auth-identity:events';
 // Colon-free Mongo collection base names. The final collection name is
 // `${resourcePrefix}${collection}` — e.g. with the project prefix 'viam-' this yields
 // 'viam-account'. Register the identity resources against a db config that carries the

package/build/consts.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,wFAAwF;AACxF,sFAAsF;AACtF,sFAAsF;AACtF,uFAAuF;AACvF,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAC5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAC5D,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAA;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAC5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAA;AAElE,uEAAuE;AACvE,sFAAsF;AACtF,uFAAuF;AACvF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CAAA;AACzD,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CAAA;AACzD,MAAM,CAAC,MAAM,oCAAoC,GAAG,aAAa,CAAA;AACjE,MAAM,CAAC,MAAM,mCAAmC,GAAG,YAAY,CAAA;AAE/D,mFAAmF;AACnF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,CAAA;AAErD,iGAAiG;AACjG,uEAAuE;AACvE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAEzC,4CAA4C;AAC5C,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAA;AAC7C,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAA"}
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,wFAAwF;AACxF,sFAAsF;AACtF,sFAAsF;AACtF,uFAAuF;AACvF,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAC5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAC5D,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAA;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAC5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAA;AAClE,qEAAqE;AACrE,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAA;AAE1D,uEAAuE;AACvE,sFAAsF;AACtF,uFAAuF;AACvF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CAAA;AACzD,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CAAA;AACzD,MAAM,CAAC,MAAM,oCAAoC,GAAG,aAAa,CAAA;AACjE,MAAM,CAAC,MAAM,mCAAmC,GAAG,YAAY,CAAA;AAE/D,mFAAmF;AACnF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,CAAA;AAErD,iGAAiG;AACjG,uEAAuE;AACvE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAEzC,4CAA4C;AAC5C,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAA;AAC7C,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAA"}

package/build/events.d.ts

@@ -0,0 +1,9 @@
+import type { BasicContext } from '@owlmeans/context';
+import type { IdentityEventsService } from './types.js';
+export declare const makeIdentityEventsService: (alias?: string) => IdentityEventsService;
+/**
+ * The identity-events service, or `null` where the context has none registered — so a caller
+ * writes `identityEvents(ctx)?.onEntityCreated(...)` and a deployment without the seam pays nothing.
+ */
+export declare const identityEvents: (ctx: BasicContext<any>, alias?: string) => IdentityEventsService | null;
+//# sourceMappingURL=events.d.ts.map

package/build/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAGrD,OAAO,KAAK,EAA0C,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAE/F,eAAO,MAAM,yBAAyB,WAC7B,MAAM,KACZ,qBAsBF,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,cAAc,QACpB,YAAY,CAAC,GAAG,CAAC,UAAS,MAAM,KACpC,qBAAqB,GAAG,IAC+C,CAAA"}

package/build/events.js

@@ -0,0 +1,29 @@
+import { createLazyService } from '@owlmeans/context';
+import { AUTH_IDENTITY_EVENTS } from './consts.js';
+export const makeIdentityEventsService = (alias = AUTH_IDENTITY_EVENTS) => {
+    const created = [];
+    const service = createLazyService(alias, {
+        onEntityCreated: callback => {
+            created.push(callback);
+        },
+        propagateEntityCreated: async (event) => {
+            for (const callback of created) {
+                try {
+                    await callback(event, service.assertCtx());
+                }
+                catch (error) {
+                    // The entity, the account and the profile already exist; failing here would turn a
+                    // listener's problem into a sign-in that never completes for a person who is registered.
+                    console.error(`${alias}: entity-created listener failed for ${event.entityId}`, error);
+                }
+            }
+        },
+    });
+    return service;
+};
+/**
+ * The identity-events service, or `null` where the context has none registered — so a caller
+ * writes `identityEvents(ctx)?.onEntityCreated(...)` and a deployment without the seam pays nothing.
+ */
+export const identityEvents = (ctx, alias = AUTH_IDENTITY_EVENTS) => ctx.hasService(alias) ? ctx.service(alias) : null;
+//# sourceMappingURL=events.js.map

package/build/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAGlD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,KAAK,GAAW,oBAAoB,EACb,EAAE;IACzB,MAAM,OAAO,GAA4B,EAAE,CAAA;IAE3C,MAAM,OAAO,GAA0B,iBAAiB,CAAwB,KAAK,EAAE;QACrF,eAAe,EAAE,QAAQ,CAAC,EAAE;YAC1B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACxB,CAAC;QAED,sBAAsB,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACpC,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAA2C,CAAC,CAAA;gBACrF,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,mFAAmF;oBACnF,yFAAyF;oBACzF,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,wCAAwC,KAAK,CAAC,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAA;gBACxF,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,GAAsB,EAAE,KAAK,GAAW,oBAAoB,EAC9B,EAAE,CAChC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAwB,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA"}

package/build/helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAKrD,eAAO,MAAM,2BAA2B,YAC7B,YAAY,CAAC,GAAG,CAAC,YAChB,MAAM,KACf,IAUF,CAAA"}
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAOrD,eAAO,MAAM,2BAA2B,YAC7B,YAAY,CAAC,GAAG,CAAC,YAChB,MAAM,KACf,IAcF,CAAA"}

package/build/helper.js

@@ -1,6 +1,8 @@
 import { makeIdentityAccountResource, makeIdentityProfileResource, makeIdentityCredentialsResource, makeOrgEntityResource } from './resource.js';
 import { makeIdentityLinkingService } from './service.js';
 import { makeEntityResolverService } from './resolver.js';
+import { makeIdentityEventsService } from './events.js';
+import { AUTH_IDENTITY_EVENTS } from './consts.js';
 export const appendAuthIdentityResources = (context, dbAlias) => {
     context.registerResource(makeIdentityAccountResource(dbAlias));
     context.registerResource(makeIdentityProfileResource(dbAlias));
@@ -11,5 +13,9 @@ export const appendAuthIdentityResources = (context, dbAlias) => {
     // organizations: without it `request.entity` stays undefined and every consumer falls back to
     // treating the token's slug as the only entity value there is.
     context.registerService(makeEntityResolverService());
+    // Behind `hasService`, so an application that registered its own events service first keeps it.
+    if (!context.hasService(AUTH_IDENTITY_EVENTS)) {
+        context.registerService(makeIdentityEventsService());
+    }
 };
 //# sourceMappingURL=helper.js.map

package/build/helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,+BAA+B,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAChJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAA;AAEzD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,OAA0B,EAC1B,OAAgB,EACV,EAAE;IACR,OAAO,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9D,OAAO,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9D,OAAO,CAAC,gBAAgB,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC,CAAA;IAClE,OAAO,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAA;IACxD,OAAO,CAAC,eAAe,CAAC,0BAA0B,EAAE,CAAC,CAAA;IACrD,sFAAsF;IACtF,8FAA8F;IAC9F,+DAA+D;IAC/D,OAAO,CAAC,eAAe,CAAC,yBAAyB,EAAE,CAAC,CAAA;AACtD,CAAC,CAAA"}
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,+BAA+B,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAChJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAA;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAElD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,OAA0B,EAC1B,OAAgB,EACV,EAAE;IACR,OAAO,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9D,OAAO,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9D,OAAO,CAAC,gBAAgB,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC,CAAA;IAClE,OAAO,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAA;IACxD,OAAO,CAAC,eAAe,CAAC,0BAA0B,EAAE,CAAC,CAAA;IACrD,sFAAsF;IACtF,8FAA8F;IAC9F,+DAA+D;IAC/D,OAAO,CAAC,eAAe,CAAC,yBAAyB,EAAE,CAAC,CAAA;IACpD,gGAAgG;IAChG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC9C,OAAO,CAAC,eAAe,CAAC,yBAAyB,EAAE,CAAC,CAAA;IACtD,CAAC;AACH,CAAC,CAAA"}

package/build/index.d.ts

@@ -5,4 +5,5 @@ export * from './service.js';
 export * from './resolver.js';
 export * from './helper.js';
 export * from './iam.js';
+export * from './events.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,mBAAmB,YAAY,CAAA;AAC/B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,mBAAmB,YAAY,CAAA;AAC/B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA;AACxB,cAAc,aAAa,CAAA"}

package/build/index.js

@@ -4,4 +4,5 @@ export * from './service.js';
 export * from './resolver.js';
 export * from './helper.js';
 export * from './iam.js';
+export * from './events.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAE3B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAE3B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA;AACxB,cAAc,aAAa,CAAA"}

package/build/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAA8F,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAmBpJ,eAAO,MAAM,0BAA0B,QAAO,sBA8Q7C,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAA8F,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAoBpJ,eAAO,MAAM,0BAA0B,QAAO,sBA6R7C,CAAA"}

package/build/service.js

@@ -3,6 +3,7 @@ import { ALL_SCOPES, AuthRole } from '@owlmeans/auth';
 import { createIdOfLength, IdStyle } from '@owlmeans/basic-ids';
 import { ENTITY_RESOLVER } from '@owlmeans/auth-common';
 import { AUTH_IDENTITY_ACCOUNT, AUTH_IDENTITY_PROFILE, AUTH_IDENTITY_CREDENTIALS, AUTH_IDENTITY_LINKING, AUTH_IDENTITY_ORG_ENTITY, LOGIN_SERVICE_PREFIX, EXTERNAL_KEY_DELIMITER } from './consts.js';
+import { identityEvents } from './events.js';
 const MAX_SLUG_RETRIES = 5;
 // Stable external login key: "{type}:{service}:{providerSub}"
 const externalKey = (details) => [details.type, details.service, details.userId].join(EXTERNAL_KEY_DELIMITER);
@@ -172,6 +173,20 @@ export const makeIdentityLinkingService = () => {
                 profileId,
                 credential: svc,
             });
+            // Only this branch creates an organization — the linking branch above adds a credential to
+            // one that exists — so this is the one place an entity is announced, once it is complete.
+            // Listeners are awaited and never throw (the service logs them).
+            await identityEvents(ctx)?.propagateEntityCreated({
+                entityId,
+                entitySlug: entity.slug,
+                iamKey: entity.iamKey,
+                accountId,
+                profileId: profile.profileId,
+                username: meta.username,
+                type: details.type,
+                service: details.service,
+                createdAt: entity.createdAt,
+            });
             return {
                 type: details.type,
                 role: profile.role,

package/build/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAGpD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAErD,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAM/D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAIpM,MAAM,gBAAgB,GAAG,CAAC,CAAA;AAE1B,8DAA8D;AAC9D,MAAM,WAAW,GAAG,CAAC,OAA+B,EAAU,EAAE,CAC9D,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;AAE9E,yFAAyF;AACzF,MAAM,YAAY,GAAG,CAAC,OAA+B,EAAU,EAAE,CAC/D,CAAC,oBAAoB,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;AAEpF,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAA2B,EAAE;IACrE;;;;;;OAMG;IACH,MAAM,MAAM,GAAG,KAAK,EAAE,QAAiB,EAA+B,EAAE;QACtE,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO,SAAS,CAAA;QACzD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;QAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAEvF,OAAO,MAAM,EAAE,IAAI,CAAA;IACrB,CAAC,CAAA;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,oBAAoB,GAAG,KAAK,EAAE,QAAgB,EAAmC,EAAE;QACvF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC5B,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,IAAI,CAAA;QAE5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;QAClC,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;QACpF,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;QAEpF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAA+B,CAAC,CAAA;QAC7F,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAA+B,CAAC,CAAA;YAC3G,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CACvC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,oBAAoB,GAAG,sBAAsB,EAAE,CAAC,KAAK,IAAI,CAC5F,CAAA;YACD,IAAI,QAAQ,IAAI,IAAI;gBAAE,OAAO,QAAQ,CAAA;QACvC,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,MAAM,OAAO,GAA2B,gBAAgB,CAAyB,qBAAqB,EAAE;QACtG,gBAAgB,EAAE,KAAK,EAAE,OAA+B,EAA+B,EAAE;YACvF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;YAE1F,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC;gBACpC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;gBAC5B,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC;aAClC,CAAC,CAAA;YACF,IAAI,IAAI,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAA;YAE7B,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;YACzE,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAA;YAEhC,OAAO;gBACL,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS;gBAC3C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAA;QACH,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,OAA+B,EAAE,IAAiB,EAAwB,EAAE;YAC9F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;YAC1F,MAAM,cAAc,GAAG,GAAG,CAAC,QAAQ,CAAoB,wBAAwB,CAAC,CAAA;YAChF,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAA;YAEpE,wFAAwF;YACxF,4FAA4F;YAC5F,sDAAsD;YACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACpF,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,aAAa,CAAC,MAAM,CAAC;oBACzB,SAAS,EAAE,EAAE;oBACb,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;oBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC;iBAClC,CAAC,CAAA;gBAEF,OAAO;oBACL,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS;oBACvC,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,UAAU,EAAE,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;oBACxC,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAA;YACH,CAAC;YAED,yFAAyF;YACzF,6FAA6F;YAC7F,sFAAsF;YACtF,MAAM,MAAM,GAAc,MAAM,cAAc,CAAC,MAAM,CAAC;gBACpD,IAAI,EAAE,MAAM,QAAQ,CAAC,QAAQ,EAAE;gBAC/B,WAAW,EAAE,EAAE;gBACf,wFAAwF;gBACxF,2EAA2E;gBAC3E,MAAM,EAAE,gBAAgB,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC;gBAC5C,KAAK,EAAE,EAAE;gBACT,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC,CAAA;YACF,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAG,CAAA;YAE3B,IAAI,SAAS,GAAkB,IAAI,CAAA;YACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,gBAAgB,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;gBACvD,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC;wBAC3C,UAAU;wBACV,IAAI,EAAE,IAAI,CAAC,QAAQ;wBACnB,QAAQ;qBACT,CAAC,CAAA;oBACF,SAAS,GAAG,OAAO,CAAC,EAAE,CAAA;oBACtB,MAAK;gBACP,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,IAAI,GAAG,EAAE,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC;wBAAE,SAAQ;oBACxE,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAED,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;YAC/E,CAAC;YAED,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;YACxE,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;YAEjC,IAAI,OAAO,CAAA;YACX,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC;oBACrC,SAAS;oBACT,MAAM,EAAE,SAAS;oBACjB,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,IAAI,EAAE,IAAI,CAAC,QAAQ;oBACnB,QAAQ;oBACR,MAAM,EAAE,CAAC,UAAU,CAAC;iBACrB,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,IAAI,GAAG,EAAE,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/D,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;gBACpD,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAED,MAAM,aAAa,CAAC,MAAM,CAAC;gBACzB,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;gBAC5B,SAAS;gBACT,UAAU,EAAE,GAAG;aAChB,CAAC,CAAA;YAEF,OAAO;gBACL,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS;gBAC3C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAA;QACH,CAAC;QAED,eAAe,EAAE,KAAK,EAAE,OAA+B,EAAwB,EAAE;YAC/E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;YACtD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YAC/D,CAAC;YAED,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;gBAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;gBAClC,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;gBAC1F,MAAM,aAAa,CAAC,MAAM,CAAC;oBACzB,SAAS,EAAE,EAAE;oBACb,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;oBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC;iBAClC,CAAC,CAAA;YACJ,CAAC;YAED,OAAO,MAAM,CAAA;QACf,CAAC;QAED,iBAAiB,EAAE,KAAK,EAAE,OAA+B,EAAiB,EAAE;YAC1E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;YAC1F,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC;gBACpC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;gBAC5B,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC;aAClC,CAAC,CAAA;YACF,IAAI,IAAI,EAAE,EAAE,IAAI,IAAI;gBAAE,OAAM;YAC5B,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACrC,CAAC;QAED,gBAAgB,EAAE,KAAK,EAAE,QAAgB,EAAsB,EAAE;YAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;YAEpE,OAAO,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAC,CAAC,EAAC,EAAE,CAAC,CAAC;gBAChD,EAAE,EAAE,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,UAAU,EAAE,MAAM,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACpC,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC,CAAC,CAAA;QACN,CAAC;QAED,mBAAmB,EAAE,KAAK,EAAE,MAAc,EAAE,QAAiB,EAAE,IAAa,EAAwC,EAAE;YACpH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;YAE1F,MAAM,aAAa,GAA8B,EAAE,MAAM,EAAE,CAAA;YAC3D,IAAI,QAAQ,IAAI,IAAI;gBAAE,aAAa,CAAC,QAAQ,GAAG,QAAQ,CAAA;YACvD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;YACrE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAA;YAE3C,MAAM,WAAW,GAAkC;gBACjD,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;aACnD,CAAA;YACD,IAAI,IAAI,IAAI,IAAI;gBAAE,WAAW,CAAC,IAAI,GAAG,IAAI,CAAA;YACzC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YAClD,IAAI,IAAI,IAAI,IAAI;gBAAE,OAAO,SAAS,CAAA;YAElC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAA;YAEjF,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS;gBAC3C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAGpD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAErD,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAM/D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpM,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAI5C,MAAM,gBAAgB,GAAG,CAAC,CAAA;AAE1B,8DAA8D;AAC9D,MAAM,WAAW,GAAG,CAAC,OAA+B,EAAU,EAAE,CAC9D,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;AAE9E,yFAAyF;AACzF,MAAM,YAAY,GAAG,CAAC,OAA+B,EAAU,EAAE,CAC/D,CAAC,oBAAoB,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;AAEpF,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAA2B,EAAE;IACrE;;;;;;OAMG;IACH,MAAM,MAAM,GAAG,KAAK,EAAE,QAAiB,EAA+B,EAAE;QACtE,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO,SAAS,CAAA;QACzD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;QAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAEvF,OAAO,MAAM,EAAE,IAAI,CAAA;IACrB,CAAC,CAAA;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,oBAAoB,GAAG,KAAK,EAAE,QAAgB,EAAmC,EAAE;QACvF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC5B,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,IAAI,CAAA;QAE5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;QAClC,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;QACpF,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;QAEpF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAA+B,CAAC,CAAA;QAC7F,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAA+B,CAAC,CAAA;YAC3G,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CACvC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,oBAAoB,GAAG,sBAAsB,EAAE,CAAC,KAAK,IAAI,CAC5F,CAAA;YACD,IAAI,QAAQ,IAAI,IAAI;gBAAE,OAAO,QAAQ,CAAA;QACvC,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,MAAM,OAAO,GAA2B,gBAAgB,CAAyB,qBAAqB,EAAE;QACtG,gBAAgB,EAAE,KAAK,EAAE,OAA+B,EAA+B,EAAE;YACvF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;YAE1F,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC;gBACpC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;gBAC5B,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC;aAClC,CAAC,CAAA;YACF,IAAI,IAAI,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAA;YAE7B,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;YACzE,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAA;YAEhC,OAAO;gBACL,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS;gBAC3C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAA;QACH,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,OAA+B,EAAE,IAAiB,EAAwB,EAAE;YAC9F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;YAC1F,MAAM,cAAc,GAAG,GAAG,CAAC,QAAQ,CAAoB,wBAAwB,CAAC,CAAA;YAChF,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAA;YAEpE,wFAAwF;YACxF,4FAA4F;YAC5F,sDAAsD;YACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACpF,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,aAAa,CAAC,MAAM,CAAC;oBACzB,SAAS,EAAE,EAAE;oBACb,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;oBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC;iBAClC,CAAC,CAAA;gBAEF,OAAO;oBACL,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS;oBACvC,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,UAAU,EAAE,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;oBACxC,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAA;YACH,CAAC;YAED,yFAAyF;YACzF,6FAA6F;YAC7F,sFAAsF;YACtF,MAAM,MAAM,GAAc,MAAM,cAAc,CAAC,MAAM,CAAC;gBACpD,IAAI,EAAE,MAAM,QAAQ,CAAC,QAAQ,EAAE;gBAC/B,WAAW,EAAE,EAAE;gBACf,wFAAwF;gBACxF,2EAA2E;gBAC3E,MAAM,EAAE,gBAAgB,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC;gBAC5C,KAAK,EAAE,EAAE;gBACT,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC,CAAA;YACF,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAG,CAAA;YAE3B,IAAI,SAAS,GAAkB,IAAI,CAAA;YACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,gBAAgB,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;gBACvD,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC;wBAC3C,UAAU;wBACV,IAAI,EAAE,IAAI,CAAC,QAAQ;wBACnB,QAAQ;qBACT,CAAC,CAAA;oBACF,SAAS,GAAG,OAAO,CAAC,EAAE,CAAA;oBACtB,MAAK;gBACP,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,IAAI,GAAG,EAAE,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC;wBAAE,SAAQ;oBACxE,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAED,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;YAC/E,CAAC;YAED,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;YACxE,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;YAEjC,IAAI,OAAO,CAAA;YACX,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC;oBACrC,SAAS;oBACT,MAAM,EAAE,SAAS;oBACjB,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,IAAI,EAAE,IAAI,CAAC,QAAQ;oBACnB,QAAQ;oBACR,MAAM,EAAE,CAAC,UAAU,CAAC;iBACrB,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,IAAI,GAAG,EAAE,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/D,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;gBACpD,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAED,MAAM,aAAa,CAAC,MAAM,CAAC;gBACzB,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;gBAC5B,SAAS;gBACT,UAAU,EAAE,GAAG;aAChB,CAAC,CAAA;YAEF,2FAA2F;YAC3F,0FAA0F;YAC1F,iEAAiE;YACjE,MAAM,cAAc,CAAC,GAAG,CAAC,EAAE,sBAAsB,CAAC;gBAChD,QAAQ;gBACR,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS;gBACT,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CAAA;YAEF,OAAO;gBACL,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS;gBAC3C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAA;QACH,CAAC;QAED,eAAe,EAAE,KAAK,EAAE,OAA+B,EAAwB,EAAE;YAC/E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;YACtD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YAC/D,CAAC;YAED,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;gBAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;gBAClC,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;gBAC1F,MAAM,aAAa,CAAC,MAAM,CAAC;oBACzB,SAAS,EAAE,EAAE;oBACb,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;oBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC;iBAClC,CAAC,CAAA;YACJ,CAAC;YAED,OAAO,MAAM,CAAA;QACf,CAAC;QAED,iBAAiB,EAAE,KAAK,EAAE,OAA+B,EAAiB,EAAE;YAC1E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;YAC1F,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC;gBACpC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;gBAC5B,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC;aAClC,CAAC,CAAA;YACF,IAAI,IAAI,EAAE,EAAE,IAAI,IAAI;gBAAE,OAAM;YAC5B,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACrC,CAAC;QAED,gBAAgB,EAAE,KAAK,EAAE,QAAgB,EAAsB,EAAE;YAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;YAEpE,OAAO,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAC,CAAC,EAAC,EAAE,CAAC,CAAC;gBAChD,EAAE,EAAE,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,UAAU,EAAE,MAAM,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACpC,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC,CAAC,CAAA;QACN,CAAC;QAED,mBAAmB,EAAE,KAAK,EAAE,MAAc,EAAE,QAAiB,EAAE,IAAa,EAAwC,EAAE;YACpH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;YAE1F,MAAM,aAAa,GAA8B,EAAE,MAAM,EAAE,CAAA;YAC3D,IAAI,QAAQ,IAAI,IAAI;gBAAE,aAAa,CAAC,QAAQ,GAAG,QAAQ,CAAA;YACvD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;YACrE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAA;YAE3C,MAAM,WAAW,GAAkC;gBACjD,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;aACnD,CAAA;YACD,IAAI,IAAI,IAAI,IAAI;gBAAE,WAAW,CAAC,IAAI,GAAG,IAAI,CAAA;YACzC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YAClD,IAAI,IAAI,IAAI,IAAI;gBAAE,OAAO,SAAS,CAAA;YAElC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAA;YAEjF,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS;gBAC3C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/types.d.ts

@@ -1,6 +1,6 @@
 import type { ResourceRecord } from '@owlmeans/resource';
 import type { MongoResource } from '@owlmeans/mongo-resource';
-import type { InitializedService } from '@owlmeans/context';
+import type { InitializedService, LazyService } from '@owlmeans/context';
 import type { ServerConfig, ServerContext } from '@owlmeans/server-context';
 import type { AuthCredentials, AuthPayload, AuthRole, Profile } from '@owlmeans/auth';
 import type { ProviderProfileDetails } from '@owlmeans/oidc';
@@ -101,4 +101,40 @@ export interface GoogleUserInfo {
     family_name?: string;
     picture?: string;
 }
+/**
+ * An organization entity was just registered, together with the account and profile of the person
+ * whose first sign-in created it. `entityId` is the stable id every per-organization record keys
+ * on; `entitySlug` is its name at this moment and may be renamed later.
+ */
+export interface EntityCreatedEvent {
+    entityId: string;
+    entitySlug: string;
+    iamKey: string;
+    accountId: string;
+    profileId: string;
+    username: string;
+    /** The login's `AuthenticationType`. */
+    type: string;
+    /** The provider service alias the login came through. */
+    service: string;
+    createdAt: Date;
+}
+export interface EntityCreatedCallback {
+    (event: EntityCreatedEvent, ctx: IdentityContext): Promise<void>;
+}
+/**
+ * Lifecycle notifications from the identity store — the seam an application hangs provisioning on
+ * (a starting plan, a default workspace) without wrapping the linking service.
+ *
+ * Lazy, so a listener can be registered while the context is still being wired.
+ */
+export interface IdentityEventsService extends LazyService {
+    /** Called for every entity registered from now on, in registration order. */
+    onEntityCreated: (callback: EntityCreatedCallback) => void;
+    /**
+     * Run every listener, one after another, each awaited. A listener that throws is logged and the
+     * rest still run: a listener's failure never fails the sign-in that created the entity.
+     */
+    propagateEntityCreated: (event: EntityCreatedEvent) => Promise<void>;
+}
 //# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AACrF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAE5D;;;;;GAKG;AACH,MAAM,WAAW,eAAgB,SAAQ,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,cAAc;IAClF,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAgB,SAAQ,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,cAAc;IAClF,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,QAAQ,CAAA;IACd,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAoB,SAAQ,eAAe,EAAE,cAAc;IAC1E,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,SAAU,SAAQ,cAAc;IAC/C,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,CAAC,EAAE,IAAI,CAAA;CACjB;AAED,MAAM,MAAM,iBAAiB,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;AAExD,MAAM,MAAM,uBAAuB,GAAG,aAAa,CAAC,eAAe,CAAC,CAAA;AACpE,MAAM,MAAM,uBAAuB,GAAG,aAAa,CAAC,eAAe,CAAC,CAAA;AACpE,MAAM,MAAM,2BAA2B,GAAG,aAAa,CAAC,mBAAmB,CAAC,CAAA;AAE5E;;;GAGG;AACH,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;IAChE,gBAAgB,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;IAClF,WAAW,EAAE,CAAC,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;IACzF,eAAe,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;IAC1E;;;;;;;;;OASG;IACH,iBAAiB,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrE,gBAAgB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;IAC1D,mBAAmB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAA;CAChH;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,cAAe,SAAQ,YAAY;CACnD;AAED,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC;CACnG;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AACrF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAE5D;;;;;GAKG;AACH,MAAM,WAAW,eAAgB,SAAQ,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,cAAc;IAClF,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAgB,SAAQ,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,cAAc;IAClF,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,QAAQ,CAAA;IACd,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAoB,SAAQ,eAAe,EAAE,cAAc;IAC1E,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,SAAU,SAAQ,cAAc;IAC/C,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,CAAC,EAAE,IAAI,CAAA;CACjB;AAED,MAAM,MAAM,iBAAiB,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;AAExD,MAAM,MAAM,uBAAuB,GAAG,aAAa,CAAC,eAAe,CAAC,CAAA;AACpE,MAAM,MAAM,uBAAuB,GAAG,aAAa,CAAC,eAAe,CAAC,CAAA;AACpE,MAAM,MAAM,2BAA2B,GAAG,aAAa,CAAC,mBAAmB,CAAC,CAAA;AAE5E;;;GAGG;AACH,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;IAChE,gBAAgB,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;IAClF,WAAW,EAAE,CAAC,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;IACzF,eAAe,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;IAC1E;;;;;;;;;OASG;IACH,iBAAiB,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrE,gBAAgB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;IAC1D,mBAAmB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAA;CAChH;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,cAAe,SAAQ,YAAY;CACnD;AAED,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC;CACnG;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAA;IACZ,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,CAAC,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACjE;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAsB,SAAQ,WAAW;IACxD,6EAA6E;IAC7E,eAAe,EAAE,CAAC,QAAQ,EAAE,qBAAqB,KAAK,IAAI,CAAA;IAC1D;;;OAGG;IACH,sBAAsB,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACrE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-auth-identity",
-  "version": "0.1.18-rc.28",
+  "version": "0.1.18-rc.29",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -22,14 +22,14 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.26",
-    "@owlmeans/auth-common": "^0.1.18-rc.28",
-    "@owlmeans/basic-ids": "^0.1.18-rc.25",
-    "@owlmeans/context": "^0.1.18-rc.24",
-    "@owlmeans/mongo-resource": "^0.1.18-rc.27",
-    "@owlmeans/oidc": "^0.1.18-rc.36",
-    "@owlmeans/resource": "^0.1.18-rc.26",
-    "@owlmeans/server-context": "^0.1.18-rc.27"
+    "@owlmeans/auth": "^0.1.18-rc.27",
+    "@owlmeans/auth-common": "^0.1.18-rc.29",
+    "@owlmeans/basic-ids": "^0.1.18-rc.26",
+    "@owlmeans/context": "^0.1.18-rc.25",
+    "@owlmeans/mongo-resource": "^0.1.18-rc.28",
+    "@owlmeans/oidc": "^0.1.18-rc.37",
+    "@owlmeans/resource": "^0.1.18-rc.27",
+    "@owlmeans/server-context": "^0.1.18-rc.28"
   },
   "peerDependencies": {
     "mongodb": "*"

package/src/consts.ts

@@ -8,6 +8,8 @@ export const AUTH_IDENTITY_PROFILE = 'auth-identity:profile'
 export const AUTH_IDENTITY_CREDENTIALS = 'auth-identity:credentials'
 export const AUTH_IDENTITY_LINKING = 'auth-identity:linking'
 export const AUTH_IDENTITY_ORG_ENTITY = 'auth-identity:org-entity'
+// Service alias of the identity-events seam (`identityEvents(ctx)`).
+export const AUTH_IDENTITY_EVENTS = 'auth-identity:events'
 
 // Colon-free Mongo collection base names. The final collection name is
 // `${resourcePrefix}${collection}` — e.g. with the project prefix 'viam-' this yields

package/src/events.ts

@@ -0,0 +1,39 @@
+import type { BasicContext } from '@owlmeans/context'
+import { createLazyService } from '@owlmeans/context'
+import { AUTH_IDENTITY_EVENTS } from './consts.js'
+import type { EntityCreatedCallback, IdentityContext, IdentityEventsService } from './types.js'
+
+export const makeIdentityEventsService = (
+  alias: string = AUTH_IDENTITY_EVENTS
+): IdentityEventsService => {
+  const created: EntityCreatedCallback[] = []
+
+  const service: IdentityEventsService = createLazyService<IdentityEventsService>(alias, {
+    onEntityCreated: callback => {
+      created.push(callback)
+    },
+
+    propagateEntityCreated: async event => {
+      for (const callback of created) {
+        try {
+          await callback(event, service.assertCtx<IdentityContext['cfg'], IdentityContext>())
+        } catch (error) {
+          // The entity, the account and the profile already exist; failing here would turn a
+          // listener's problem into a sign-in that never completes for a person who is registered.
+          console.error(`${alias}: entity-created listener failed for ${event.entityId}`, error)
+        }
+      }
+    },
+  })
+
+  return service
+}
+
+/**
+ * The identity-events service, or `null` where the context has none registered — so a caller
+ * writes `identityEvents(ctx)?.onEntityCreated(...)` and a deployment without the seam pays nothing.
+ */
+export const identityEvents = (
+  ctx: BasicContext<any>, alias: string = AUTH_IDENTITY_EVENTS
+): IdentityEventsService | null =>
+  ctx.hasService(alias) ? ctx.service<IdentityEventsService>(alias) : null

package/src/helper.ts

@@ -2,6 +2,8 @@ import type { BasicContext } from '@owlmeans/context'
 import { makeIdentityAccountResource, makeIdentityProfileResource, makeIdentityCredentialsResource, makeOrgEntityResource } from './resource.js'
 import { makeIdentityLinkingService } from './service.js'
 import { makeEntityResolverService } from './resolver.js'
+import { makeIdentityEventsService } from './events.js'
+import { AUTH_IDENTITY_EVENTS } from './consts.js'
 
 export const appendAuthIdentityResources = (
   context: BasicContext<any>,
@@ -16,4 +18,8 @@ export const appendAuthIdentityResources = (
   // organizations: without it `request.entity` stays undefined and every consumer falls back to
   // treating the token's slug as the only entity value there is.
   context.registerService(makeEntityResolverService())
+  // Behind `hasService`, so an application that registered its own events service first keeps it.
+  if (!context.hasService(AUTH_IDENTITY_EVENTS)) {
+    context.registerService(makeIdentityEventsService())
+  }
 }

package/src/index.ts

@@ -5,3 +5,4 @@ export * from './service.js'
 export * from './resolver.js'
 export * from './helper.js'
 export * from './iam.js'
+export * from './events.js'

package/src/service.ts

@@ -11,6 +11,7 @@ import type { OrgEntity, OrgEntityResource } from './types.js'
 import type { EntityResolverService } from '@owlmeans/auth-common'
 import { ENTITY_RESOLVER } from '@owlmeans/auth-common'
 import { AUTH_IDENTITY_ACCOUNT, AUTH_IDENTITY_PROFILE, AUTH_IDENTITY_CREDENTIALS, AUTH_IDENTITY_LINKING, AUTH_IDENTITY_ORG_ENTITY, LOGIN_SERVICE_PREFIX, EXTERNAL_KEY_DELIMITER } from './consts.js'
+import { identityEvents } from './events.js'
 
 type Context = ServerContext<ServerConfig>
 
@@ -200,6 +201,21 @@ export const makeIdentityLinkingService = (): IdentityLinkingService => {
         credential: svc,
       })
 
+      // Only this branch creates an organization — the linking branch above adds a credential to
+      // one that exists — so this is the one place an entity is announced, once it is complete.
+      // Listeners are awaited and never throw (the service logs them).
+      await identityEvents(ctx)?.propagateEntityCreated({
+        entityId,
+        entitySlug: entity.slug,
+        iamKey: entity.iamKey,
+        accountId,
+        profileId: profile.profileId,
+        username: meta.username,
+        type: details.type,
+        service: details.service,
+        createdAt: entity.createdAt,
+      })
+
       return {
         type: details.type,
         role: profile.role,

package/src/types.ts

@@ -1,6 +1,6 @@
 import type { ResourceRecord } from '@owlmeans/resource'
 import type { MongoResource } from '@owlmeans/mongo-resource'
-import type { InitializedService } from '@owlmeans/context'
+import type { InitializedService, LazyService } from '@owlmeans/context'
 import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
 import type { AuthCredentials, AuthPayload, AuthRole, Profile } from '@owlmeans/auth'
 import type { ProviderProfileDetails } from '@owlmeans/oidc'
@@ -113,3 +113,41 @@ export interface GoogleUserInfo {
   picture?: string
 }
 
+/**
+ * An organization entity was just registered, together with the account and profile of the person
+ * whose first sign-in created it. `entityId` is the stable id every per-organization record keys
+ * on; `entitySlug` is its name at this moment and may be renamed later.
+ */
+export interface EntityCreatedEvent {
+  entityId: string
+  entitySlug: string
+  iamKey: string
+  accountId: string
+  profileId: string
+  username: string
+  /** The login's `AuthenticationType`. */
+  type: string
+  /** The provider service alias the login came through. */
+  service: string
+  createdAt: Date
+}
+
+export interface EntityCreatedCallback {
+  (event: EntityCreatedEvent, ctx: IdentityContext): Promise<void>
+}
+
+/**
+ * Lifecycle notifications from the identity store — the seam an application hangs provisioning on
+ * (a starting plan, a default workspace) without wrapping the linking service.
+ *
+ * Lazy, so a listener can be registered while the context is still being wired.
+ */
+export interface IdentityEventsService extends LazyService {
+  /** Called for every entity registered from now on, in registration order. */
+  onEntityCreated: (callback: EntityCreatedCallback) => void
+  /**
+   * Run every listener, one after another, each awaited. A listener that throws is logged and the
+   * rest still run: a listener's failure never fails the sign-in that created the entity.
+   */
+  propagateEntityCreated: (event: EntityCreatedEvent) => Promise<void>
+}

package/tests/context.ts

@@ -0,0 +1,98 @@
+import { ENTITY_RESOLVER } from '@owlmeans/auth-common'
+import type { BasicContext } from '@owlmeans/context'
+import { makeIdentityLinkingService } from '../src/service.js'
+import { makeIdentityEventsService } from '../src/events.js'
+import {
+  AUTH_IDENTITY_ACCOUNT, AUTH_IDENTITY_CREDENTIALS, AUTH_IDENTITY_EVENTS, AUTH_IDENTITY_ORG_ENTITY,
+  AUTH_IDENTITY_PROFILE,
+} from '../src/consts.js'
+import type { IdentityEventsService } from '../src/types.js'
+
+/**
+ * The rows are stubbed rather than mocked — the linking service's whole behaviour is which record
+ * it reads before it writes, so a stub that records writes is the subject, not a stand-in for it.
+ */
+export const stubResource = <T extends { id?: string }>(alias: string, seed: T[] = []) => {
+  const items: T[] = [...seed]
+  let next = seed.length + 1
+
+  const matches = (record: any, where: any): boolean =>
+    where == null || Object.entries(where).every(([key, value]) => record[key] === value)
+
+  return {
+    alias,
+    items,
+    list: async (where?: unknown) => ({ items: items.filter(item => matches(item, where)) }),
+    load: async (where?: unknown) => items.find(item => matches(item, where)) ?? null,
+    get: async (where?: unknown) => {
+      const found = items.find(item => matches(item, where))
+      if (found == null) throw new Error(`${alias}: not found`)
+      return found
+    },
+    create: async (record: T) => {
+      const stored = { ...record, id: record.id ?? `${alias}-${next++}` } as T
+      items.push(stored)
+      return stored
+    },
+    delete: async (id: string) => {
+      const at = items.findIndex(item => item.id === id)
+      if (at < 0) return null
+      return items.splice(at, 1)[0]
+    },
+    registerContext: () => undefined,
+  }
+}
+
+export interface CtxSeed {
+  accounts?: any[]
+  profiles?: any[]
+  credentials?: any[]
+  /** Register the identity-events service, as `appendAuthIdentityResources` does. */
+  events?: boolean
+}
+
+export const makeCtx = (seed: CtxSeed = {}) => {
+  const resources: Record<string, any> = {
+    [AUTH_IDENTITY_ACCOUNT]: stubResource('account', seed.accounts),
+    [AUTH_IDENTITY_PROFILE]: stubResource('profile', seed.profiles),
+    [AUTH_IDENTITY_CREDENTIALS]: stubResource('credential', seed.credentials),
+    [AUTH_IDENTITY_ORG_ENTITY]: stubResource('entity'),
+  }
+  const services: Record<string, unknown> = {}
+  let minted = 0
+
+  const ctx = {
+    resources,
+    resource: (alias: string) => resources[alias],
+    hasService: (alias: string) => alias === ENTITY_RESOLVER || alias in services,
+    service: (alias: string) => {
+      if (alias in services) return services[alias]
+      if (alias !== ENTITY_RESOLVER) throw new Error(`unexpected service ${alias}`)
+      return {
+        mintSlug: async () => `slug-${++minted}`,
+        byId: async (id: string) => ({ id, slug: `slug-of-${id}` }),
+      }
+    },
+  }
+
+  if (seed.events === true) {
+    const events = makeIdentityEventsService()
+    events.registerContext(ctx as unknown as BasicContext<any>)
+    services[AUTH_IDENTITY_EVENTS] = events
+  }
+
+  return ctx
+}
+
+export const eventsOf = (ctx: ReturnType<typeof makeCtx>): IdentityEventsService =>
+  ctx.service(AUTH_IDENTITY_EVENTS) as IdentityEventsService
+
+export const details = (type: string, sub: string) => ({
+  type, service: type, clientId: type, userId: sub, username: 'person@example.org',
+})
+
+export const linkingFor = (ctx: unknown) => {
+  const service = makeIdentityLinkingService()
+  service.registerContext(ctx as never)
+  return service
+}

package/tests/events.spec.ts

@@ -0,0 +1,81 @@
+import { describe, expect, test } from 'bun:test'
+import { AuthenticationType } from '@owlmeans/auth'
+import type { EntityCreatedEvent } from '../src/types.js'
+import { identityEvents } from '../src/events.js'
+import { AUTH_IDENTITY_ACCOUNT, AUTH_IDENTITY_ORG_ENTITY } from '../src/consts.js'
+import { details, eventsOf, linkingFor, makeCtx } from './context.js'
+
+/**
+ * The organization entity is announced exactly when one is created — on a registration, never on
+ * a second sign-in method that links to an identity the platform already has. An application
+ * provisions on it (a starting plan, say), so a missed or doubled event is a missed or doubled
+ * provisioning, and a listener's failure must not become a login failure.
+ */
+describe('identity events', () => {
+  test('a registration announces the entity it created, once', async () => {
+    const ctx = makeCtx({ events: true })
+    const received: EntityCreatedEvent[] = []
+    eventsOf(ctx).onEntityCreated(async event => { received.push(event) })
+
+    const payload = await linkingFor(ctx).linkProfile(
+      details('google-oauth', 'google-sub') as never, { username: 'person@example.org' }
+    )
+
+    const [entity] = ctx.resources[AUTH_IDENTITY_ORG_ENTITY].items
+    expect(received).toHaveLength(1)
+    expect(received[0]).toMatchObject({
+      entityId: entity.id,
+      entitySlug: entity.slug,
+      iamKey: entity.iamKey,
+      profileId: payload.profileId,
+      username: 'person@example.org',
+      type: 'google-oauth',
+      service: 'google-oauth',
+    })
+    expect(received[0].accountId).toBe(ctx.resources[AUTH_IDENTITY_ACCOUNT].items[0].id)
+    expect(received[0].createdAt).toBeInstanceOf(Date)
+  })
+
+  test('a second sign-in method links and announces nothing', async () => {
+    const ctx = makeCtx({ events: true })
+    const received: EntityCreatedEvent[] = []
+    eventsOf(ctx).onEntityCreated(async event => { received.push(event) })
+    const linking = linkingFor(ctx)
+
+    await linking.linkProfile(details('google-oauth', 'google-sub') as never, { username: 'person@example.org' })
+    await linking.linkProfile(
+      details(AuthenticationType.Supervisor, 'person@example.org') as never, { username: 'person@example.org' }
+    )
+    expect(received).toHaveLength(1)
+
+    await linking.linkProfile(
+      details('google-oauth', 'other-sub') as never, { username: 'person@example.org', force: true }
+    )
+    expect(received).toHaveLength(2)
+    expect(received[1].entityId).not.toBe(received[0].entityId)
+  })
+
+  test('a throwing listener neither fails the sign-in nor silences the next one', async () => {
+    const ctx = makeCtx({ events: true })
+    const reached: string[] = []
+    eventsOf(ctx).onEntityCreated(async () => { throw new Error('provisioning is down') })
+    eventsOf(ctx).onEntityCreated(async event => { reached.push(event.entityId) })
+
+    const payload = await linkingFor(ctx).linkProfile(
+      details('google-oauth', 'google-sub') as never, { username: 'person@example.org' }
+    )
+
+    expect(payload.profileId).toStartWith('google-oauth:')
+    expect(reached).toHaveLength(1)
+  })
+
+  test('without the service registered there is nothing to announce to', async () => {
+    const ctx = makeCtx()
+
+    expect(identityEvents(ctx as never)).toBeNull()
+    const payload = await linkingFor(ctx).linkProfile(
+      details('google-oauth', 'google-sub') as never, { username: 'person@example.org' }
+    )
+    expect(payload.profileId).toStartWith('google-oauth:')
+  })
+})

package/tests/linking.spec.ts

@@ -1,12 +1,11 @@
 import { describe, expect, test } from 'bun:test'
 import { AuthRole } from '@owlmeans/auth'
 import { AuthenticationType } from '@owlmeans/auth'
-import { makeIdentityLinkingService } from '../src/service.js'
 import {
   AUTH_IDENTITY_ACCOUNT, AUTH_IDENTITY_CREDENTIALS, AUTH_IDENTITY_ORG_ENTITY,
   AUTH_IDENTITY_PROFILE,
 } from '../src/consts.js'
-import { ENTITY_RESOLVER } from '@owlmeans/auth-common'
+import { details, linkingFor, makeCtx } from './context.js'
 
 /**
  * One human, one email, one platform profile — whichever way they sign in.
@@ -15,75 +14,7 @@ import { ENTITY_RESOLVER } from '@owlmeans/auth-common'
  * and registration is per METHOD. The same address signing in by Google and then by key ended up
  * in two entities that could not see each other's projects: `requireEntity` matched neither, and
  * ownership (`project.createdBy`) named a profile the other identity did not have.
- *
- * The rows are stubbed rather than mocked — the service's whole behaviour here is which record it
- * reads before it writes, so a stub that records writes is the subject, not a stand-in for it.
  */
-const stubResource = <T extends { id?: string }>(alias: string, seed: T[] = []) => {
-  const items: T[] = [...seed]
-  let next = seed.length + 1
-
-  const matches = (record: any, where: any): boolean =>
-    where == null || Object.entries(where).every(([key, value]) => record[key] === value)
-
-  return {
-    alias,
-    items,
-    list: async (where?: unknown) => ({ items: items.filter(item => matches(item, where)) }),
-    load: async (where?: unknown) => items.find(item => matches(item, where)) ?? null,
-    get: async (where?: unknown) => {
-      const found = items.find(item => matches(item, where))
-      if (found == null) throw new Error(`${alias}: not found`)
-      return found
-    },
-    create: async (record: T) => {
-      const stored = { ...record, id: record.id ?? `${alias}-${next++}` } as T
-      items.push(stored)
-      return stored
-    },
-    delete: async (id: string) => {
-      const at = items.findIndex(item => item.id === id)
-      if (at < 0) return null
-      return items.splice(at, 1)[0]
-    },
-    registerContext: () => undefined,
-  }
-}
-
-const makeCtx = (seed: {
-  accounts?: any[], profiles?: any[], credentials?: any[]
-} = {}) => {
-  const resources: Record<string, any> = {
-    [AUTH_IDENTITY_ACCOUNT]: stubResource('account', seed.accounts),
-    [AUTH_IDENTITY_PROFILE]: stubResource('profile', seed.profiles),
-    [AUTH_IDENTITY_CREDENTIALS]: stubResource('credential', seed.credentials),
-    [AUTH_IDENTITY_ORG_ENTITY]: stubResource('entity'),
-  }
-  let minted = 0
-
-  return {
-    resources,
-    resource: (alias: string) => resources[alias],
-    service: (alias: string) => {
-      if (alias !== ENTITY_RESOLVER) throw new Error(`unexpected service ${alias}`)
-      return {
-        mintSlug: async () => `slug-${++minted}`,
-        byId: async (id: string) => ({ id, slug: `slug-of-${id}` }),
-      }
-    },
-  }
-}
-
-const details = (type: string, sub: string) => ({
-  type, service: type, clientId: type, userId: sub, username: 'person@example.org',
-})
-
-const linkingFor = (ctx: unknown) => {
-  const service = makeIdentityLinkingService()
-  service.registerContext(ctx as never)
-  return service
-}
-
 describe('linkProfile', () => {
   test('a first sign-in registers an organization, an account and a profile', async () => {
     const ctx = makeCtx()

package/tsconfig.json

@@ -1,5 +1,5 @@
 {
-  "extends": ["@owlmeans/dep-config/tsconfig.base.json", "@owlmeans/dep-config/tsconfig.server.json"],
+  "extends": ["@owlmeans/dep-config/tsconfig.base.json", "@owlmeans/dep-config/tsconfig.node.json"],
   "compilerOptions": {
     "rootDir": "./src",
     "outDir": "./build/"