@stigmer/sdk 3.14.1 → 3.15.1

package/__tests__/ensure-identity-account.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ensure-identity-account.test.d.ts.map

package/__tests__/ensure-identity-account.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-identity-account.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/ensure-identity-account.test.ts"],"names":[],"mappings":""}

package/__tests__/ensure-identity-account.test.js

@@ -0,0 +1,108 @@
+/**
+ * Pins `ensureMyIdentityAccount` (`ensure-identity-account.ts`; 20260911.11
+ * A3): the ONE first-sign-in flow every surface runs — the console's
+ * `useIdentityAccountGate` delegates to it, the CLI's `auth whoami` and
+ * `auth login` call it — so a platform builder embedding Stigmer gets the
+ * same flow as a first-class import.
+ *
+ *   1. whoAmI answers → the account, `created: false`; nothing else is
+ *      called;
+ *   2. whoAmI is NOT_FOUND → `onProvisioning` fires once (the hook's
+ *      "provisioning" state), provisionMyAccount runs, the created account
+ *      comes back with `created: true`;
+ *   3. any other whoAmI error propagates untouched (UNAUTHENTICATED,
+ *      UNAVAILABLE, a network fault) — the caller's error UX owns it;
+ *   4. a provisionMyAccount failure propagates untouched (UNAVAILABLE when
+ *      the issuer's userinfo is down is the documented arm).
+ *
+ * The doubles reject with `StigmerError`, the vocabulary the real
+ * `IdentityAccountClient` speaks (every RPC failure passes through
+ * `wrapError`), so `isNotFound` — the SDK's one classifier — is what the
+ * helper is proven against (refinement 11, slice 4).
+ */
+import { Code } from "@connectrpc/connect";
+import { create } from "@bufbuild/protobuf";
+import { IdentityAccountSchema, } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { describe, expect, it } from "vitest";
+import { ensureMyIdentityAccount, } from "../ensure-identity-account";
+import { StigmerError } from "../gen/errors";
+function clientWith(behaviour) {
+    const calls = { whoAmI: 0, provisionMyAccount: 0 };
+    const client = {
+        identityAccount: {
+            whoAmI: () => {
+                calls.whoAmI += 1;
+                return behaviour.whoAmI();
+            },
+            provisionMyAccount: () => {
+                calls.provisionMyAccount += 1;
+                return (behaviour.provisionMyAccount ??
+                    (() => Promise.reject(new Error("must not be called"))))();
+            },
+        },
+    };
+    return { client, calls };
+}
+const EXISTING = create(IdentityAccountSchema, {
+    metadata: { id: "ida_existing" },
+    spec: { idpId: "auth0|existing" },
+});
+const CREATED = create(IdentityAccountSchema, {
+    metadata: { id: "ida_created" },
+    spec: { idpId: "auth0|created" },
+});
+const NOT_FOUND = () => new StigmerError("not-found", "Identity account not found for the authenticated user", Code.NotFound);
+describe("ensureMyIdentityAccount", () => {
+    it("answers the existing account without provisioning", async () => {
+        const { client, calls } = clientWith({
+            whoAmI: () => Promise.resolve(EXISTING),
+        });
+        const result = await ensureMyIdentityAccount(client);
+        expect(result).toEqual({ account: EXISTING, created: false });
+        expect(calls).toEqual({ whoAmI: 1, provisionMyAccount: 0 });
+    });
+    it("provisions on NOT_FOUND, telling the caller once that it is provisioning", async () => {
+        const { client, calls } = clientWith({
+            whoAmI: () => Promise.reject(NOT_FOUND()),
+            provisionMyAccount: () => Promise.resolve(CREATED),
+        });
+        let provisioning = 0;
+        const result = await ensureMyIdentityAccount(client, {
+            onProvisioning: () => (provisioning += 1),
+        });
+        expect(result).toEqual({ account: CREATED, created: true });
+        expect(provisioning).toBe(1);
+        expect(calls).toEqual({ whoAmI: 1, provisionMyAccount: 1 });
+    });
+    it("does not fire onProvisioning when the account already exists", async () => {
+        const { client } = clientWith({ whoAmI: () => Promise.resolve(EXISTING) });
+        let provisioning = 0;
+        await ensureMyIdentityAccount(client, {
+            onProvisioning: () => (provisioning += 1),
+        });
+        expect(provisioning).toBe(0);
+    });
+    it("propagates any other whoAmI error untouched — only NOT_FOUND means 'provision me'", async () => {
+        const unauthenticated = new StigmerError("unauthenticated", "authentication token missing", Code.Unauthenticated);
+        const { client, calls } = clientWith({
+            whoAmI: () => Promise.reject(unauthenticated),
+        });
+        await expect(ensureMyIdentityAccount(client)).rejects.toBe(unauthenticated);
+        expect(calls.provisionMyAccount).toBe(0);
+        // A value that is not a StigmerError at all (a lane double that does
+        // not wrap, a transport fault) is also "any other error": propagated
+        // as the same object, never classified as "provision me".
+        const network = new TypeError("Load failed");
+        const offline = clientWith({ whoAmI: () => Promise.reject(network) });
+        await expect(ensureMyIdentityAccount(offline.client)).rejects.toBe(network);
+    });
+    it("propagates a provisioning failure untouched (the issuer's userinfo down is UNAVAILABLE)", async () => {
+        const unavailable = new StigmerError("unavailable", "Failed to fetch user profile from identity provider: userinfo answered 503", Code.Unavailable);
+        const { client } = clientWith({
+            whoAmI: () => Promise.reject(NOT_FOUND()),
+            provisionMyAccount: () => Promise.reject(unavailable),
+        });
+        await expect(ensureMyIdentityAccount(client)).rejects.toBe(unavailable);
+    });
+});
+//# sourceMappingURL=ensure-identity-account.test.js.map

package/__tests__/ensure-identity-account.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-identity-account.test.js","sourceRoot":"","sources":["../../src/__tests__/ensure-identity-account.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EACL,qBAAqB,GAEtB,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EACL,uBAAuB,GAExB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAO7C,SAAS,UAAU,CAAC,SAGnB;IACC,MAAM,KAAK,GAAU,EAAE,MAAM,EAAE,CAAC,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG;QACb,eAAe,EAAE;YACf,MAAM,EAAE,GAAG,EAAE;gBACX,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;gBAClB,OAAO,SAAS,CAAC,MAAM,EAAE,CAAC;YAC5B,CAAC;YACD,kBAAkB,EAAE,GAAG,EAAE;gBACvB,KAAK,CAAC,kBAAkB,IAAI,CAAC,CAAC;gBAC9B,OAAO,CACL,SAAS,CAAC,kBAAkB;oBAC5B,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,CACxD,EAAE,CAAC;YACN,CAAC;SACF;KACF,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,QAAQ,GAAG,MAAM,CAAC,qBAAqB,EAAE;IAC7C,QAAQ,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE;IAChC,IAAI,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE;CAClC,CAAC,CAAC;AACH,MAAM,OAAO,GAAG,MAAM,CAAC,qBAAqB,EAAE;IAC5C,QAAQ,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE;IAC/B,IAAI,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,IAAI,YAAY,CACd,WAAW,EACX,uDAAuD,EACvD,IAAI,CAAC,QAAQ,CACd,CAAC;AAEJ,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;YACnC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;YACnC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACzC,kBAAkB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;SACnD,CAAC,CAAC;QACH,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE;YACnD,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3E,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,MAAM,uBAAuB,CAAC,MAAM,EAAE;YACpC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,eAAe,GAAG,IAAI,YAAY,CACtC,iBAAiB,EACjB,8BAA8B,EAC9B,IAAI,CAAC,eAAe,CACrB,CAAC;QACF,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;YACnC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;SAC9C,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5E,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEzC,qEAAqE;QACrE,qEAAqE;QACrE,0DAA0D;QAC1D,MAAM,OAAO,GAAG,IAAI,SAAS,CAAC,aAAa,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtE,MAAM,MAAM,CAAC,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,WAAW,GAAG,IAAI,YAAY,CAClC,aAAa,EACb,4EAA4E,EAC5E,IAAI,CAAC,WAAW,CACjB,CAAC;QACF,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;YAC5B,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACzC,kBAAkB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;SACtD,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/__tests__/resource-availability.test.js

@@ -58,8 +58,10 @@ describe("isResourceAvailable — a tier is a minimum edition", () => {
         // platform: the operator seat a self-hosting Enterprise company owns.
         expect(isResourceAvailable(ApiResourceKind.platform, "local")).toBe(false);
         expect(isResourceAvailable(ApiResourceKind.platform, "enterprise")).toBe(true);
-        // identity_account: flips to open_source in P1's serving PR, not here.
-        expect(isResourceAvailable(ApiResourceKind.identity_account, "local")).toBe(false);
+        // identity_account: open_source since the open-source server serves the
+        // domain (20260911.11 slice 5); the tier moved in the same change as
+        // the serving code, never ahead of it.
+        expect(isResourceAvailable(ApiResourceKind.identity_account, "local")).toBe(true);
         // agent_share and channel_app: served by OSS; they never moved.
         expect(isResourceAvailable(ApiResourceKind.agent_share, "local")).toBe(true);
         expect(isResourceAvailable(ApiResourceKind.channel_app, "local")).toBe(true);

package/__tests__/resource-availability.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-availability.test.js","sourceRoot":"","sources":["../../src/__tests__/resource-availability.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,OAAO,EACL,gBAAgB,EAChB,mBAAmB,GAEpB,MAAM,0BAA0B,CAAC;AAElC,MAAM,KAAK,GAA8B,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;AAE1E,QAAQ,CAAC,sDAAsD,EAAE,GAAG,EAAE;IACpE,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtE,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE,GAAG,EAAE;QACrG,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CACrE,OAAO,CACR,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kGAAkG,EAAE,GAAG,EAAE;QAC1G,oEAAoE;QACpE,oDAAoD;QACpD,MAAM,CAAC,gBAAgB,CAAC,EAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mDAAmD,EAAE,GAAG,EAAE;IACjE,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CACnE,KAAK,CACN,CAAC;QACF,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CACxE,IAAI,CACL,CAAC;QACF,gEAAgE;QAChE,6CAA6C;QAC7C,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CACJ,mBAAmB,CAAC,eAAe,CAAC,oBAAoB,EAAE,OAAO,CAAC,CACnE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,MAAM,CACJ,mBAAmB,CAAC,eAAe,CAAC,oBAAoB,EAAE,YAAY,CAAC,CACxE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,MAAM,CACJ,mBAAmB,CAAC,eAAe,CAAC,oBAAoB,EAAE,OAAO,CAAC,CACnE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,sEAAsE;QACtE,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,sEAAsE;QACtE,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3E,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CACtE,IAAI,CACL,CAAC;QACF,uEAAuE;QACvE,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CACzE,KAAK,CACN,CAAC;QACF,gEAAgE;QAChE,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CACpE,IAAI,CACL,CAAC;QACF,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CACpE,IAAI,CACL,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,CAAC,GAAG,EAAE,CACV,mBAAmB,CAAC,eAAe,CAAC,yBAAyB,EAAE,OAAO,CAAC,CACxE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"resource-availability.test.js","sourceRoot":"","sources":["../../src/__tests__/resource-availability.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,OAAO,EACL,gBAAgB,EAChB,mBAAmB,GAEpB,MAAM,0BAA0B,CAAC;AAElC,MAAM,KAAK,GAA8B,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;AAE1E,QAAQ,CAAC,sDAAsD,EAAE,GAAG,EAAE;IACpE,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtE,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE,GAAG,EAAE;QACrG,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CACrE,OAAO,CACR,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kGAAkG,EAAE,GAAG,EAAE;QAC1G,oEAAoE;QACpE,oDAAoD;QACpD,MAAM,CAAC,gBAAgB,CAAC,EAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mDAAmD,EAAE,GAAG,EAAE;IACjE,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CACnE,KAAK,CACN,CAAC;QACF,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CACxE,IAAI,CACL,CAAC;QACF,gEAAgE;QAChE,6CAA6C;QAC7C,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CACJ,mBAAmB,CAAC,eAAe,CAAC,oBAAoB,EAAE,OAAO,CAAC,CACnE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,MAAM,CACJ,mBAAmB,CAAC,eAAe,CAAC,oBAAoB,EAAE,YAAY,CAAC,CACxE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,MAAM,CACJ,mBAAmB,CAAC,eAAe,CAAC,oBAAoB,EAAE,OAAO,CAAC,CACnE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,sEAAsE;QACtE,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,sEAAsE;QACtE,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3E,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CACtE,IAAI,CACL,CAAC;QACF,wEAAwE;QACxE,qEAAqE;QACrE,uCAAuC;QACvC,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CACzE,IAAI,CACL,CAAC;QACF,gEAAgE;QAChE,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CACpE,IAAI,CACL,CAAC;QACF,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CACpE,IAAI,CACL,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,CAAC,GAAG,EAAE,CACV,mBAAmB,CAAC,eAAe,CAAC,yBAAyB,EAAE,OAAO,CAAC,CACxE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/ensure-identity-account.d.ts

@@ -0,0 +1,72 @@
+/**
+ * The first-sign-in flow, once: make sure the authenticated caller has an
+ * identity account, creating it if this is the first time they arrive.
+ *
+ * Every edition serves `IdentityAccount` from one controller (20260911.11),
+ * and every surface that greets a signed-in person runs the same two-step
+ * flow — the console's `useIdentityAccountGate` (`@stigmer/react`), the
+ * CLI's `auth login` and `auth whoami`, and any platform builder's own
+ * gate. This module is that flow's one home, so the surfaces cannot drift
+ * on the question "what does a missing account mean?".
+ *
+ * Three facts it is built on:
+ *
+ * - `whoAmI` answers NOT_FOUND for an authenticated caller who has no
+ *   account yet (the server's byte-pinned copy: "Identity account not found
+ *   for the authenticated user"). That code, and ONLY that code, means
+ *   "provision me". UNAUTHENTICATED, UNAVAILABLE, a transport fault — each
+ *   is the caller's to handle and is rethrown as the same object.
+ * - `provisionMyAccount` is the one creator of a direct account and is
+ *   idempotent by the caller's subject: two racing first sign-ins resolve
+ *   to one row. Its failures are also rethrown untouched (the issuer's
+ *   userinfo being down is UNAVAILABLE, the documented arm).
+ * - Whether THIS call created the account is part of the answer. A first
+ *   sign-in should be visible ("your account was created"), not silent.
+ *
+ * The client parameter is structural, the `McpServerConnectLane` precedent:
+ * the full `Stigmer` client satisfies it, and a test can hand in two
+ * functions.
+ */
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+/**
+ * The slice of the identity-account client this flow needs. Errors are the
+ * SDK client's `StigmerError`s; `isNotFound` is the one classifier read.
+ */
+export interface IdentityAccountLane {
+    whoAmI(): Promise<IdentityAccount>;
+    provisionMyAccount(): Promise<IdentityAccount>;
+}
+/** Options for {@link ensureMyIdentityAccount}. */
+export interface EnsureMyIdentityAccountOptions {
+    /**
+     * Called once, before `provisionMyAccount` is issued, when `whoAmI` found
+     * no account — the moment a surface shows "Setting up your account…".
+     * Not called when the account already exists.
+     */
+    readonly onProvisioning?: () => void;
+}
+/** What {@link ensureMyIdentityAccount} learned. */
+export interface EnsuredIdentityAccount {
+    /** The caller's account, existing or just created. */
+    readonly account: IdentityAccount;
+    /** `true` when this call created the account (a first sign-in). */
+    readonly created: boolean;
+}
+/**
+ * Resolve the caller's identity account, provisioning it on a first sign-in.
+ *
+ * `whoAmI` first; on NOT_FOUND — and only NOT_FOUND — `onProvisioning` fires
+ * and `provisionMyAccount` runs. Every other error, from either RPC, is
+ * rethrown as the same object so the caller's error UX owns it.
+ *
+ * @example
+ * ```ts
+ * const { account, created } = await ensureMyIdentityAccount(stigmer, {
+ *   onProvisioning: () => console.log("Setting up your account…"),
+ * });
+ * ```
+ */
+export declare function ensureMyIdentityAccount(client: {
+    readonly identityAccount: IdentityAccountLane;
+}, options?: EnsureMyIdentityAccountOptions): Promise<EnsuredIdentityAccount>;
+//# sourceMappingURL=ensure-identity-account.d.ts.map

package/ensure-identity-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-identity-account.d.ts","sourceRoot":"","sources":["../src/ensure-identity-account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAGhG;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IACnC,kBAAkB,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;CAChD;AAED,mDAAmD;AACnD,MAAM,WAAW,8BAA8B;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;CACtC;AAED,oDAAoD;AACpD,MAAM,WAAW,sBAAsB;IACrC,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE;IAAE,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAA;CAAE,EACzD,OAAO,CAAC,EAAE,8BAA8B,GACvC,OAAO,CAAC,sBAAsB,CAAC,CAUjC"}

package/ensure-identity-account.js

@@ -0,0 +1,29 @@
+import { isNotFound } from "./errors.js";
+/**
+ * Resolve the caller's identity account, provisioning it on a first sign-in.
+ *
+ * `whoAmI` first; on NOT_FOUND — and only NOT_FOUND — `onProvisioning` fires
+ * and `provisionMyAccount` runs. Every other error, from either RPC, is
+ * rethrown as the same object so the caller's error UX owns it.
+ *
+ * @example
+ * ```ts
+ * const { account, created } = await ensureMyIdentityAccount(stigmer, {
+ *   onProvisioning: () => console.log("Setting up your account…"),
+ * });
+ * ```
+ */
+export async function ensureMyIdentityAccount(client, options) {
+    try {
+        const account = await client.identityAccount.whoAmI();
+        return { account, created: false };
+    }
+    catch (err) {
+        if (!isNotFound(err))
+            throw err;
+    }
+    options?.onProvisioning?.();
+    const account = await client.identityAccount.provisionMyAccount();
+    return { account, created: true };
+}
+//# sourceMappingURL=ensure-identity-account.js.map

package/ensure-identity-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-identity-account.js","sourceRoot":"","sources":["../src/ensure-identity-account.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA6BzC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAyD,EACzD,OAAwC;IAExC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,kBAAkB,EAAE,CAAC;IAClE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC"}

package/gen/resource-availability.js

@@ -12,7 +12,7 @@ import { ApiResourceKind, ResourceTier } from "@stigmer/protos/ai/stigmer/common
 export const KIND_TIERS = new Map([
     [ApiResourceKind.api_resource_version, ResourceTier.cloud_only],
     [ApiResourceKind.iam_policy, ResourceTier.enterprise],
-    [ApiResourceKind.identity_account, ResourceTier.cloud_only],
+    [ApiResourceKind.identity_account, ResourceTier.open_source],
     [ApiResourceKind.api_key, ResourceTier.open_source],
     [ApiResourceKind.invitation, ResourceTier.enterprise],
     [ApiResourceKind.identity_provider, ResourceTier.enterprise],

package/gen/resource-availability.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-availability.js","sourceRoot":"","sources":["../../src/gen/resource-availability.ts"],"names":[],"mappings":"AAAA,yFAAyF;AAEzF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,qFAAqF,CAAC;AAEpI;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAA+C,IAAI,GAAG,CAAC;IAC5E,CAAC,eAAe,CAAC,oBAAoB,EAAE,YAAY,CAAC,UAAU,CAAC;IAC/D,CAAC,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC;IACrD,CAAC,eAAe,CAAC,gBAAgB,EAAE,YAAY,CAAC,UAAU,CAAC;IAC3D,CAAC,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,WAAW,CAAC;IACnD,CAAC,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC;IACrD,CAAC,eAAe,CAAC,iBAAiB,EAAE,YAAY,CAAC,UAAU,CAAC;IAC5D,CAAC,eAAe,CAAC,SAAS,EAAE,YAAY,CAAC,WAAW,CAAC;IACrD,CAAC,eAAe,CAAC,eAAe,EAAE,YAAY,CAAC,UAAU,CAAC;IAC1D,CAAC,eAAe,CAAC,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC;IACxD,CAAC,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,UAAU,CAAC;IACnD,CAAC,eAAe,CAAC,KAAK,EAAE,YAAY,CAAC,WAAW,CAAC;IACjD,CAAC,eAAe,CAAC,eAAe,EAAE,YAAY,CAAC,WAAW,CAAC;IAC3D,CAAC,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,WAAW,CAAC;IACnD,CAAC,eAAe,CAAC,KAAK,EAAE,YAAY,CAAC,WAAW,CAAC;IACjD,CAAC,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC,WAAW,CAAC;IACtD,CAAC,eAAe,CAAC,cAAc,EAAE,YAAY,CAAC,WAAW,CAAC;IAC1D,CAAC,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC;IACvD,CAAC,eAAe,CAAC,aAAa,EAAE,YAAY,CAAC,WAAW,CAAC;IACzD,CAAC,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC;IACvD,CAAC,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,WAAW,CAAC;IACpD,CAAC,eAAe,CAAC,iBAAiB,EAAE,YAAY,CAAC,WAAW,CAAC;IAC7D,CAAC,eAAe,CAAC,kBAAkB,EAAE,YAAY,CAAC,WAAW,CAAC;IAC9D,CAAC,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC;IACvD,CAAC,eAAe,CAAC,iBAAiB,EAAE,YAAY,CAAC,WAAW,CAAC;IAC7D,CAAC,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,WAAW,CAAC;IACpD,CAAC,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,WAAW,CAAC;IACpD,CAAC,eAAe,CAAC,MAAM,EAAE,YAAY,CAAC,WAAW,CAAC;IAClD,CAAC,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,WAAW,CAAC;CACpD,CAAC,CAAC"}
+{"version":3,"file":"resource-availability.js","sourceRoot":"","sources":["../../src/gen/resource-availability.ts"],"names":[],"mappings":"AAAA,yFAAyF;AAEzF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,qFAAqF,CAAC;AAEpI;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAA+C,IAAI,GAAG,CAAC;IAC5E,CAAC,eAAe,CAAC,oBAAoB,EAAE,YAAY,CAAC,UAAU,CAAC;IAC/D,CAAC,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC;IACrD,CAAC,eAAe,CAAC,gBAAgB,EAAE,YAAY,CAAC,WAAW,CAAC;IAC5D,CAAC,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,WAAW,CAAC;IACnD,CAAC,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC;IACrD,CAAC,eAAe,CAAC,iBAAiB,EAAE,YAAY,CAAC,UAAU,CAAC;IAC5D,CAAC,eAAe,CAAC,SAAS,EAAE,YAAY,CAAC,WAAW,CAAC;IACrD,CAAC,eAAe,CAAC,eAAe,EAAE,YAAY,CAAC,UAAU,CAAC;IAC1D,CAAC,eAAe,CAAC,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC;IACxD,CAAC,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,UAAU,CAAC;IACnD,CAAC,eAAe,CAAC,KAAK,EAAE,YAAY,CAAC,WAAW,CAAC;IACjD,CAAC,eAAe,CAAC,eAAe,EAAE,YAAY,CAAC,WAAW,CAAC;IAC3D,CAAC,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,WAAW,CAAC;IACnD,CAAC,eAAe,CAAC,KAAK,EAAE,YAAY,CAAC,WAAW,CAAC;IACjD,CAAC,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC,WAAW,CAAC;IACtD,CAAC,eAAe,CAAC,cAAc,EAAE,YAAY,CAAC,WAAW,CAAC;IAC1D,CAAC,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC;IACvD,CAAC,eAAe,CAAC,aAAa,EAAE,YAAY,CAAC,WAAW,CAAC;IACzD,CAAC,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC;IACvD,CAAC,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,WAAW,CAAC;IACpD,CAAC,eAAe,CAAC,iBAAiB,EAAE,YAAY,CAAC,WAAW,CAAC;IAC7D,CAAC,eAAe,CAAC,kBAAkB,EAAE,YAAY,CAAC,WAAW,CAAC;IAC9D,CAAC,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC;IACvD,CAAC,eAAe,CAAC,iBAAiB,EAAE,YAAY,CAAC,WAAW,CAAC;IAC7D,CAAC,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,WAAW,CAAC;IACpD,CAAC,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,WAAW,CAAC;IACpD,CAAC,eAAe,CAAC,MAAM,EAAE,YAAY,CAAC,WAAW,CAAC;IAClD,CAAC,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,WAAW,CAAC;CACpD,CAAC,CAAC"}

package/index.d.ts

@@ -5,6 +5,7 @@ export { createGuestAuth, GuestAuth, type GuestAuthConfig, type GuestIdStorage,
 export { MAX_ALLOWED_ORIGINS, LINK_TOKEN_PARAM, validateOrigin, chatPath, buildChatUrl, appendLinkToken, buildEmbedLoaderUrl, buildEmbedSnippet, } from "./sharing.js";
 export { StigmerError, type ErrorCode, isNotFound, isUnauthenticated, isPermissionDenied, isRetryable, isUnimplemented, type ErrorCategory, isConnectError, classifyError, isRetryableError, isTransientStreamError, getUserMessage, type ErrorReason, getErrorReason, type RpcErrorMetadata, annotateRpcError, getRpcMetadata, } from "./errors.js";
 export { type DeploymentMode, deploymentModeOf, isResourceAvailable, } from "./resource-availability.js";
+export { ensureMyIdentityAccount, type EnsuredIdentityAccount, type EnsureMyIdentityAccountOptions, type IdentityAccountLane, } from "./ensure-identity-account.js";
 export { getGrantableRoles, hasGrantableRoles, isRoleGrantable, } from "./authorization-config.js";
 export { iamRoleToString, iamRoleFromString, iamRoleDisplayName, iamRoleDescription, } from "./iam-role.js";
 export { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
@@ -15,7 +16,7 @@ export { CursorAccountsClient, type UpsertCursorAccountParams, type DeleteCursor
 export { ProviderStandingClient } from "./provider-standing.js";
 export { SearchClient, type SearchParams, type SearchResponse, ApiResourceKind, } from "./search.js";
 export { GitHubClient, type GetOAuthAuthorizeUrlParams, type OAuthAuthorizeUrlResponse, type ExchangeOAuthCodeParams, type OAuthTokenResponse, } from "./github.js";
-export { PlatformClient, type ServerInfo, } from "./platform.js";
+export { PlatformClient, type ServerInfo } from "./platform.js";
 export { ManifestClient, parseManifest, serializeManifest, manifestDocumentForResource, manifestKinds, manifestHandlerForYamlKind, manifestHandlerForTypeName, metadataOf, REDACTED_SECRET_MARKER, containsRedactedSecrets, type AppliedManifest, type ManifestDocument, type ManifestKindHandler, type ParseManifestOptions, } from "./manifest/index.js";
 export { type DeleteResourceInput, type ResourceRef, type Page, type ListParams, type ListResult, type EnvSpecInput, type EnvVarInput, } from "./gen/types.js";
 export { AgentClient, buildAgentProto, toAgentUpdateInput, type AgentInput, type McpServerUsageInput, type ToolApprovalOverrideInput, type SubAgentInput, type McpAccessInput, type EnvVarDeclarationInput, } from "./gen/agent.js";
@@ -23,13 +24,13 @@ export { AgentChannelClient, toAgentChannelUpdateInput, type AgentChannelInput,
 export { AgentExecutionClient, toAgentExecutionUpdateInput, type AgentExecutionInput, type ExecutionConfigInput, type ContextManagementConfigInput, type AttachmentInput, } from "./gen/agentexecution.js";
 export { AgentInstanceClient, toAgentInstanceUpdateInput, type AgentInstanceInput, } from "./gen/agentinstance.js";
 export { AgentShareClient, toAgentShareUpdateInput, type AgentShareInput, type AgentShareMessagesInput, } from "./gen/agentshare.js";
-export { ApiKeyClient, toApiKeyUpdateInput, type ApiKeyInput } from "./gen/apikey.js";
+export { ApiKeyClient, toApiKeyUpdateInput, type ApiKeyInput, } from "./gen/apikey.js";
 export { ChannelAppClient, toChannelAppUpdateInput, type ChannelAppInput, type SlackChannelAppConfigInput, } from "./gen/channelapp.js";
 export { EnvironmentClient, toEnvironmentUpdateInput, type EnvironmentInput, } from "./gen/environment.js";
 export { ExecutionContextClient, type ExecutionContextInput, } from "./gen/executioncontext.js";
 export { IamPolicyClient, type IamPolicyInput, type ApiResourceRefInput, } from "./gen/iampolicy.js";
 export { IdentityAccountClient, toIdentityAccountUpdateInput, type IdentityAccountInput, } from "./gen/identityaccount.js";
-export { InvitationClient, type InvitationInput, } from "./gen/invitation.js";
+export { InvitationClient, type InvitationInput } from "./gen/invitation.js";
 export { IdentityProviderClient, toIdentityProviderUpdateInput, type IdentityProviderInput, } from "./gen/identityprovider.js";
 export { OAuthAppClient, toOAuthAppUpdateInput, type OAuthAppInput, } from "./gen/oauthapp.js";
 export { McpServerClient, buildMcpServerProto, toMcpServerUpdateInput, type McpServerInput, type StdioServerConfigInput, type HttpServerConfigInput, type ToolApprovalPolicyInput, } from "./gen/mcpserver.js";
@@ -37,7 +38,7 @@ export { MemoryClient, buildMemoryProto, toMemoryUpdateInput, type MemoryInput,
 export { connectAndWait, ConnectStillRunningError, CONNECT_POLL_INTERVAL_MS, CONNECT_SETTLE_BOUND_MS, type ConnectAndWaitOptions, type McpServerConnectLane, } from "./mcpserver-connect.js";
 export { OrganizationClient, toOrganizationUpdateInput, type OrganizationInput, } from "./gen/organization.js";
 export { PlatformClientClient, toPlatformClientUpdateInput, type PlatformClientInput, } from "./gen/platformclient.js";
-export { ProjectClient, toProjectUpdateInput, type ProjectInput } from "./gen/project.js";
+export { ProjectClient, toProjectUpdateInput, type ProjectInput, } from "./gen/project.js";
 export { ScheduleClient, buildScheduleProto, toScheduleUpdateInput, type ScheduleInput, type AgentInvocationInput, type RunConfigInput, } from "./gen/schedule.js";
 export { SessionClient, toSessionUpdateInput, type SessionInput, type WorkspaceEntryInput, type WorkspaceSourceInput, type GitRepoSourceInput, type LocalPathSourceInput, } from "./gen/session.js";
 export { PENDING_SUBJECT, SESSION_CONTEXT_METADATA_KEY, mergeSessionContext, resolvedSubject, } from "./session.js";

package/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAGrE,OAAO,EACL,eAAe,EACf,SAAS,EACT,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,YAAY,EACZ,KAAK,SAAS,EACd,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,KAAK,aAAa,EAClB,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,KAAK,WAAW,EAChB,cAAc,EACd,KAAK,gBAAgB,EACrB,gBAAgB,EAChB,cAAc,GACf,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,KAAK,cAAc,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAGpE,OAAO,EACL,cAAc,EACd,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,GAChC,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,mBAAmB,IAAI,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAGrF,OAAO,EACL,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAChC,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,GACnC,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,KAAK,+BAA+B,GACrC,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAGhE,OAAO,EACL,YAAY,EACZ,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,eAAe,GAChB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,YAAY,EACZ,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,cAAc,EACd,KAAK,UAAU,GAChB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,2BAA2B,EAC3B,aAAa,EACb,0BAA0B,EAC1B,0BAA0B,EAC1B,UAAU,EACV,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,IAAI,EACT,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EACL,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,sBAAsB,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,EACjC,KAAK,eAAe,GACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,KAAK,kBAAkB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,0BAA0B,GAChC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,KAAK,gBAAgB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,sBAAsB,EACtB,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,KAAK,oBAAoB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,gBAAgB,EAChB,KAAK,eAAe,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,GAC7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,qBAAqB,GAC3B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,KAAK,mBAAmB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,cAAc,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,eAAe,EACf,4BAA4B,EAC5B,mBAAmB,EACnB,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,QAAQ,EACR,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,gCAAgC,EACrC,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,GACjC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,uBAAuB,EACvB,8BAA8B,EAC9B,KAAK,sBAAsB,GAC5B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAGrE,OAAO,EACL,eAAe,EACf,SAAS,EACT,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,YAAY,EACZ,KAAK,SAAS,EACd,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,KAAK,aAAa,EAClB,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,KAAK,WAAW,EAChB,cAAc,EACd,KAAK,gBAAgB,EACrB,gBAAgB,EAChB,cAAc,GACf,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,KAAK,cAAc,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,uBAAuB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,8BAA8B,EACnC,KAAK,mBAAmB,GACzB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAGpE,OAAO,EACL,cAAc,EACd,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,GAChC,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,mBAAmB,IAAI,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAGrF,OAAO,EACL,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAChC,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,GACnC,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,KAAK,+BAA+B,GACrC,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAGhE,OAAO,EACL,YAAY,EACZ,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,eAAe,GAChB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,YAAY,EACZ,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhE,OAAO,EACL,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,2BAA2B,EAC3B,aAAa,EACb,0BAA0B,EAC1B,0BAA0B,EAC1B,UAAU,EACV,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,IAAI,EACT,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EACL,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,sBAAsB,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,EACjC,KAAK,eAAe,GACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,KAAK,kBAAkB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,KAAK,WAAW,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,0BAA0B,GAChC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,KAAK,gBAAgB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,sBAAsB,EACtB,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,KAAK,oBAAoB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,GAC7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,qBAAqB,GAC3B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,KAAK,mBAAmB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,KAAK,YAAY,GAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,cAAc,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,eAAe,EACf,4BAA4B,EAC5B,mBAAmB,EACnB,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,QAAQ,EACR,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,gCAAgC,EACrC,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,GACjC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,uBAAuB,EACvB,8BAA8B,EAC9B,KAAK,sBAAsB,GAC5B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC"}

package/index.js

@@ -11,6 +11,10 @@ export { MAX_ALLOWED_ORIGINS, LINK_TOKEN_PARAM, validateOrigin, chatPath, buildC
 export { StigmerError, isNotFound, isUnauthenticated, isPermissionDenied, isRetryable, isUnimplemented, isConnectError, classifyError, isRetryableError, isTransientStreamError, getUserMessage, getErrorReason, annotateRpcError, getRpcMetadata, } from "./errors.js";
 // Edition vocabulary and resource availability
 export { deploymentModeOf, isResourceAvailable, } from "./resource-availability.js";
+// The first-sign-in flow: resolve the caller's identity account, provisioning
+// it on a first sign-in. One home for every surface (console gate, CLI,
+// platform builders' own gates).
+export { ensureMyIdentityAccount, } from "./ensure-identity-account.js";
 // Authorization config and IAM role utilities
 export { getGrantableRoles, hasGrantableRoles, isRoleGrantable, } from "./authorization-config.js";
 export { iamRoleToString, iamRoleFromString, iamRoleDisplayName, iamRoleDescription, } from "./iam-role.js";
@@ -28,7 +32,7 @@ export { SearchClient, ApiResourceKind, } from "./search.js";
 // GitHub OAuth client
 export { GitHubClient, } from "./github.js";
 // Platform client (server info / edition detection)
-export { PlatformClient, } from "./platform.js";
+export { PlatformClient } from "./platform.js";
 // Manifest engine (kind-agnostic YAML ⇄ proto ⇄ apply)
 export { ManifestClient, parseManifest, serializeManifest, manifestDocumentForResource, manifestKinds, manifestHandlerForYamlKind, manifestHandlerForTypeName, metadataOf, REDACTED_SECRET_MARKER, containsRedactedSecrets, } from "./manifest/index.js";
 // Re-export all resource client classes and input types. The
@@ -40,13 +44,13 @@ export { AgentChannelClient, toAgentChannelUpdateInput, } from "./gen/agentchann
 export { AgentExecutionClient, toAgentExecutionUpdateInput, } from "./gen/agentexecution.js";
 export { AgentInstanceClient, toAgentInstanceUpdateInput, } from "./gen/agentinstance.js";
 export { AgentShareClient, toAgentShareUpdateInput, } from "./gen/agentshare.js";
-export { ApiKeyClient, toApiKeyUpdateInput } from "./gen/apikey.js";
+export { ApiKeyClient, toApiKeyUpdateInput, } from "./gen/apikey.js";
 export { ChannelAppClient, toChannelAppUpdateInput, } from "./gen/channelapp.js";
 export { EnvironmentClient, toEnvironmentUpdateInput, } from "./gen/environment.js";
 export { ExecutionContextClient, } from "./gen/executioncontext.js";
 export { IamPolicyClient, } from "./gen/iampolicy.js";
 export { IdentityAccountClient, toIdentityAccountUpdateInput, } from "./gen/identityaccount.js";
-export { InvitationClient, } from "./gen/invitation.js";
+export { InvitationClient } from "./gen/invitation.js";
 export { IdentityProviderClient, toIdentityProviderUpdateInput, } from "./gen/identityprovider.js";
 export { OAuthAppClient, toOAuthAppUpdateInput, } from "./gen/oauthapp.js";
 export { McpServerClient, buildMcpServerProto, toMcpServerUpdateInput, } from "./gen/mcpserver.js";
@@ -54,7 +58,7 @@ export { MemoryClient, buildMemoryProto, toMemoryUpdateInput, } from "./gen/memo
 export { connectAndWait, ConnectStillRunningError, CONNECT_POLL_INTERVAL_MS, CONNECT_SETTLE_BOUND_MS, } from "./mcpserver-connect.js";
 export { OrganizationClient, toOrganizationUpdateInput, } from "./gen/organization.js";
 export { PlatformClientClient, toPlatformClientUpdateInput, } from "./gen/platformclient.js";
-export { ProjectClient, toProjectUpdateInput } from "./gen/project.js";
+export { ProjectClient, toProjectUpdateInput, } from "./gen/project.js";
 export { ScheduleClient, buildScheduleProto, toScheduleUpdateInput, } from "./gen/schedule.js";
 export { SessionClient, toSessionUpdateInput, } from "./gen/session.js";
 // Session utilities (hand-written)

package/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAE9B,mBAAmB;AACnB,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,iBAAiB;AACjB,OAAO,EAGL,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAK7B,4EAA4E;AAC5E,OAAO,EACL,eAAe,EACf,SAAS,GAGV,MAAM,iBAAiB,CAAC;AAEzB,8DAA8D;AAC9D,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAEtB,iBAAiB;AACjB,OAAO,EACL,YAAY,EAEZ,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,eAAe,EAEf,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EAEd,cAAc,EAEd,gBAAgB,EAChB,cAAc,GACf,MAAM,aAAa,CAAC;AAErB,+CAA+C;AAC/C,OAAO,EAEL,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AAEpC,8CAA8C;AAC9C,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAEpE,oCAAoC;AACpC,OAAO,EACL,cAAc,GAGf,MAAM,eAAe,CAAC;AAGvB,iBAAiB;AACjB,OAAO,EACL,aAAa,GAQd,MAAM,cAAc,CAAC;AAEtB,mDAAmD;AACnD,OAAO,EACL,oBAAoB,GAMrB,MAAM,sBAAsB,CAAC;AAE9B,gEAAgE;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,gBAAgB;AAChB,OAAO,EACL,YAAY,EAGZ,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,sBAAsB;AACtB,OAAO,EACL,YAAY,GAKb,MAAM,aAAa,CAAC;AAErB,oDAAoD;AACpD,OAAO,EACL,cAAc,GAEf,MAAM,eAAe,CAAC;AAEvB,uDAAuD;AACvD,OAAO,EACL,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,2BAA2B,EAC3B,aAAa,EACb,0BAA0B,EAC1B,0BAA0B,EAC1B,UAAU,EACV,sBAAsB,EACtB,uBAAuB,GAKxB,MAAM,qBAAqB,CAAC;AAa7B,6DAA6D;AAC7D,wEAAwE;AACxE,yEAAyE;AACzE,sDAAsD;AACtD,OAAO,EACL,WAAW,EACX,eAAe,EACf,kBAAkB,GAOnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,yBAAyB,GAG1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,2BAA2B,GAK5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,GAE3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,GAGxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAoB,MAAM,iBAAiB,CAAC;AACtF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,GAGxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,iBAAiB,EACjB,wBAAwB,GAEzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,sBAAsB,GAEvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,4BAA4B,GAE7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,gBAAgB,GAEjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,6BAA6B,GAE9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,cAAc,EACd,qBAAqB,GAEtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,GAKvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,GAGpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,GAGxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,yBAAyB,GAE1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,2BAA2B,GAE5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAqB,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,qBAAqB,GAItB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,aAAa,EACb,oBAAoB,GAMrB,MAAM,kBAAkB,CAAC;AAE1B,mCAAmC;AACnC,OAAO,EACL,eAAe,EACf,4BAA4B,EAC5B,mBAAmB,EACnB,eAAe,GAChB,MAAM,cAAc,CAAC;AAEtB,uFAAuF;AACvF,OAAO,EACL,QAAQ,EACR,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,GAIpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,gBAAgB,GAQjB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAmB,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EACL,cAAc,EACd,qBAAqB,GAMtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,uBAAuB,EACvB,8BAA8B,GAE/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,GAE9B,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAE9B,mBAAmB;AACnB,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,iBAAiB;AACjB,OAAO,EAGL,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAK7B,4EAA4E;AAC5E,OAAO,EACL,eAAe,EACf,SAAS,GAGV,MAAM,iBAAiB,CAAC;AAEzB,8DAA8D;AAC9D,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAEtB,iBAAiB;AACjB,OAAO,EACL,YAAY,EAEZ,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,eAAe,EAEf,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EAEd,cAAc,EAEd,gBAAgB,EAChB,cAAc,GACf,MAAM,aAAa,CAAC;AAErB,+CAA+C;AAC/C,OAAO,EAEL,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AAEpC,8EAA8E;AAC9E,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EACL,uBAAuB,GAIxB,MAAM,8BAA8B,CAAC;AAEtC,8CAA8C;AAC9C,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAEpE,oCAAoC;AACpC,OAAO,EACL,cAAc,GAGf,MAAM,eAAe,CAAC;AAGvB,iBAAiB;AACjB,OAAO,EACL,aAAa,GAQd,MAAM,cAAc,CAAC;AAEtB,mDAAmD;AACnD,OAAO,EACL,oBAAoB,GAMrB,MAAM,sBAAsB,CAAC;AAE9B,gEAAgE;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,gBAAgB;AAChB,OAAO,EACL,YAAY,EAGZ,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,sBAAsB;AACtB,OAAO,EACL,YAAY,GAKb,MAAM,aAAa,CAAC;AAErB,oDAAoD;AACpD,OAAO,EAAE,cAAc,EAAmB,MAAM,eAAe,CAAC;AAEhE,uDAAuD;AACvD,OAAO,EACL,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,2BAA2B,EAC3B,aAAa,EACb,0BAA0B,EAC1B,0BAA0B,EAC1B,UAAU,EACV,sBAAsB,EACtB,uBAAuB,GAKxB,MAAM,qBAAqB,CAAC;AAa7B,6DAA6D;AAC7D,wEAAwE;AACxE,yEAAyE;AACzE,sDAAsD;AACtD,OAAO,EACL,WAAW,EACX,eAAe,EACf,kBAAkB,GAOnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,yBAAyB,GAG1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,2BAA2B,GAK5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,GAE3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,GAGxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,mBAAmB,GAEpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,GAGxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,iBAAiB,EACjB,wBAAwB,GAEzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,sBAAsB,GAEvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,4BAA4B,GAE7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAwB,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EACL,sBAAsB,EACtB,6BAA6B,GAE9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,cAAc,EACd,qBAAqB,GAEtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,GAKvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,GAGpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,GAGxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,yBAAyB,GAE1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,2BAA2B,GAE5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,aAAa,EACb,oBAAoB,GAErB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,qBAAqB,GAItB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,aAAa,EACb,oBAAoB,GAMrB,MAAM,kBAAkB,CAAC;AAE1B,mCAAmC;AACnC,OAAO,EACL,eAAe,EACf,4BAA4B,EAC5B,mBAAmB,EACnB,eAAe,GAChB,MAAM,cAAc,CAAC;AAEtB,uFAAuF;AACvF,OAAO,EACL,QAAQ,EACR,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,GAIpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,gBAAgB,GAQjB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAmB,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EACL,cAAc,EACd,qBAAqB,GAMtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,uBAAuB,EACvB,8BAA8B,GAE/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,GAE9B,MAAM,2BAA2B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/sdk",
-  "version": "3.14.1",
+  "version": "3.15.1",
   "description": "Stigmer TypeScript SDK — typed API client for all Stigmer platform resources",
   "license": "Apache-2.0",
   "type": "module",
@@ -45,6 +45,6 @@
   "peerDependencies": {
     "@bufbuild/protobuf": "^2.0.0",
     "@connectrpc/connect-node": "^2.0.0",
-    "@stigmer/protos": "3.14.1"
+    "@stigmer/protos": "3.15.1"
   }
 }

package/src/__tests__/ensure-identity-account.test.ts

@@ -0,0 +1,146 @@
+/**
+ * Pins `ensureMyIdentityAccount` (`ensure-identity-account.ts`; 20260911.11
+ * A3): the ONE first-sign-in flow every surface runs — the console's
+ * `useIdentityAccountGate` delegates to it, the CLI's `auth whoami` and
+ * `auth login` call it — so a platform builder embedding Stigmer gets the
+ * same flow as a first-class import.
+ *
+ *   1. whoAmI answers → the account, `created: false`; nothing else is
+ *      called;
+ *   2. whoAmI is NOT_FOUND → `onProvisioning` fires once (the hook's
+ *      "provisioning" state), provisionMyAccount runs, the created account
+ *      comes back with `created: true`;
+ *   3. any other whoAmI error propagates untouched (UNAUTHENTICATED,
+ *      UNAVAILABLE, a network fault) — the caller's error UX owns it;
+ *   4. a provisionMyAccount failure propagates untouched (UNAVAILABLE when
+ *      the issuer's userinfo is down is the documented arm).
+ *
+ * The doubles reject with `StigmerError`, the vocabulary the real
+ * `IdentityAccountClient` speaks (every RPC failure passes through
+ * `wrapError`), so `isNotFound` — the SDK's one classifier — is what the
+ * helper is proven against (refinement 11, slice 4).
+ */
+import { Code } from "@connectrpc/connect";
+import { create } from "@bufbuild/protobuf";
+import {
+  IdentityAccountSchema,
+  type IdentityAccount,
+} from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { describe, expect, it } from "vitest";
+
+import {
+  ensureMyIdentityAccount,
+  type IdentityAccountLane,
+} from "../ensure-identity-account";
+import { StigmerError } from "../gen/errors";
+
+interface Calls {
+  whoAmI: number;
+  provisionMyAccount: number;
+}
+
+function clientWith(behaviour: {
+  whoAmI: () => Promise<IdentityAccount>;
+  provisionMyAccount?: () => Promise<IdentityAccount>;
+}): { client: { identityAccount: IdentityAccountLane }; calls: Calls } {
+  const calls: Calls = { whoAmI: 0, provisionMyAccount: 0 };
+  const client = {
+    identityAccount: {
+      whoAmI: () => {
+        calls.whoAmI += 1;
+        return behaviour.whoAmI();
+      },
+      provisionMyAccount: () => {
+        calls.provisionMyAccount += 1;
+        return (
+          behaviour.provisionMyAccount ??
+          (() => Promise.reject(new Error("must not be called")))
+        )();
+      },
+    },
+  };
+  return { client, calls };
+}
+
+const EXISTING = create(IdentityAccountSchema, {
+  metadata: { id: "ida_existing" },
+  spec: { idpId: "auth0|existing" },
+});
+const CREATED = create(IdentityAccountSchema, {
+  metadata: { id: "ida_created" },
+  spec: { idpId: "auth0|created" },
+});
+
+const NOT_FOUND = () =>
+  new StigmerError(
+    "not-found",
+    "Identity account not found for the authenticated user",
+    Code.NotFound,
+  );
+
+describe("ensureMyIdentityAccount", () => {
+  it("answers the existing account without provisioning", async () => {
+    const { client, calls } = clientWith({
+      whoAmI: () => Promise.resolve(EXISTING),
+    });
+    const result = await ensureMyIdentityAccount(client);
+    expect(result).toEqual({ account: EXISTING, created: false });
+    expect(calls).toEqual({ whoAmI: 1, provisionMyAccount: 0 });
+  });
+
+  it("provisions on NOT_FOUND, telling the caller once that it is provisioning", async () => {
+    const { client, calls } = clientWith({
+      whoAmI: () => Promise.reject(NOT_FOUND()),
+      provisionMyAccount: () => Promise.resolve(CREATED),
+    });
+    let provisioning = 0;
+    const result = await ensureMyIdentityAccount(client, {
+      onProvisioning: () => (provisioning += 1),
+    });
+    expect(result).toEqual({ account: CREATED, created: true });
+    expect(provisioning).toBe(1);
+    expect(calls).toEqual({ whoAmI: 1, provisionMyAccount: 1 });
+  });
+
+  it("does not fire onProvisioning when the account already exists", async () => {
+    const { client } = clientWith({ whoAmI: () => Promise.resolve(EXISTING) });
+    let provisioning = 0;
+    await ensureMyIdentityAccount(client, {
+      onProvisioning: () => (provisioning += 1),
+    });
+    expect(provisioning).toBe(0);
+  });
+
+  it("propagates any other whoAmI error untouched — only NOT_FOUND means 'provision me'", async () => {
+    const unauthenticated = new StigmerError(
+      "unauthenticated",
+      "authentication token missing",
+      Code.Unauthenticated,
+    );
+    const { client, calls } = clientWith({
+      whoAmI: () => Promise.reject(unauthenticated),
+    });
+    await expect(ensureMyIdentityAccount(client)).rejects.toBe(unauthenticated);
+    expect(calls.provisionMyAccount).toBe(0);
+
+    // A value that is not a StigmerError at all (a lane double that does
+    // not wrap, a transport fault) is also "any other error": propagated
+    // as the same object, never classified as "provision me".
+    const network = new TypeError("Load failed");
+    const offline = clientWith({ whoAmI: () => Promise.reject(network) });
+    await expect(ensureMyIdentityAccount(offline.client)).rejects.toBe(network);
+  });
+
+  it("propagates a provisioning failure untouched (the issuer's userinfo down is UNAVAILABLE)", async () => {
+    const unavailable = new StigmerError(
+      "unavailable",
+      "Failed to fetch user profile from identity provider: userinfo answered 503",
+      Code.Unavailable,
+    );
+    const { client } = clientWith({
+      whoAmI: () => Promise.reject(NOT_FOUND()),
+      provisionMyAccount: () => Promise.reject(unavailable),
+    });
+    await expect(ensureMyIdentityAccount(client)).rejects.toBe(unavailable);
+  });
+});

package/src/__tests__/resource-availability.test.ts

@@ -85,9 +85,11 @@ describe("isResourceAvailable — a tier is a minimum edition", () => {
     expect(isResourceAvailable(ApiResourceKind.platform, "enterprise")).toBe(
       true,
     );
-    // identity_account: flips to open_source in P1's serving PR, not here.
+    // identity_account: open_source since the open-source server serves the
+    // domain (20260911.11 slice 5); the tier moved in the same change as
+    // the serving code, never ahead of it.
     expect(isResourceAvailable(ApiResourceKind.identity_account, "local")).toBe(
-      false,
+      true,
     );
     // agent_share and channel_app: served by OSS; they never moved.
     expect(isResourceAvailable(ApiResourceKind.agent_share, "local")).toBe(

package/src/ensure-identity-account.ts

@@ -0,0 +1,87 @@
+/**
+ * The first-sign-in flow, once: make sure the authenticated caller has an
+ * identity account, creating it if this is the first time they arrive.
+ *
+ * Every edition serves `IdentityAccount` from one controller (20260911.11),
+ * and every surface that greets a signed-in person runs the same two-step
+ * flow — the console's `useIdentityAccountGate` (`@stigmer/react`), the
+ * CLI's `auth login` and `auth whoami`, and any platform builder's own
+ * gate. This module is that flow's one home, so the surfaces cannot drift
+ * on the question "what does a missing account mean?".
+ *
+ * Three facts it is built on:
+ *
+ * - `whoAmI` answers NOT_FOUND for an authenticated caller who has no
+ *   account yet (the server's byte-pinned copy: "Identity account not found
+ *   for the authenticated user"). That code, and ONLY that code, means
+ *   "provision me". UNAUTHENTICATED, UNAVAILABLE, a transport fault — each
+ *   is the caller's to handle and is rethrown as the same object.
+ * - `provisionMyAccount` is the one creator of a direct account and is
+ *   idempotent by the caller's subject: two racing first sign-ins resolve
+ *   to one row. Its failures are also rethrown untouched (the issuer's
+ *   userinfo being down is UNAVAILABLE, the documented arm).
+ * - Whether THIS call created the account is part of the answer. A first
+ *   sign-in should be visible ("your account was created"), not silent.
+ *
+ * The client parameter is structural, the `McpServerConnectLane` precedent:
+ * the full `Stigmer` client satisfies it, and a test can hand in two
+ * functions.
+ */
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { isNotFound } from "./errors.js";
+
+/**
+ * The slice of the identity-account client this flow needs. Errors are the
+ * SDK client's `StigmerError`s; `isNotFound` is the one classifier read.
+ */
+export interface IdentityAccountLane {
+  whoAmI(): Promise<IdentityAccount>;
+  provisionMyAccount(): Promise<IdentityAccount>;
+}
+
+/** Options for {@link ensureMyIdentityAccount}. */
+export interface EnsureMyIdentityAccountOptions {
+  /**
+   * Called once, before `provisionMyAccount` is issued, when `whoAmI` found
+   * no account — the moment a surface shows "Setting up your account…".
+   * Not called when the account already exists.
+   */
+  readonly onProvisioning?: () => void;
+}
+
+/** What {@link ensureMyIdentityAccount} learned. */
+export interface EnsuredIdentityAccount {
+  /** The caller's account, existing or just created. */
+  readonly account: IdentityAccount;
+  /** `true` when this call created the account (a first sign-in). */
+  readonly created: boolean;
+}
+
+/**
+ * Resolve the caller's identity account, provisioning it on a first sign-in.
+ *
+ * `whoAmI` first; on NOT_FOUND — and only NOT_FOUND — `onProvisioning` fires
+ * and `provisionMyAccount` runs. Every other error, from either RPC, is
+ * rethrown as the same object so the caller's error UX owns it.
+ *
+ * @example
+ * ```ts
+ * const { account, created } = await ensureMyIdentityAccount(stigmer, {
+ *   onProvisioning: () => console.log("Setting up your account…"),
+ * });
+ * ```
+ */
+export async function ensureMyIdentityAccount(
+  client: { readonly identityAccount: IdentityAccountLane },
+  options?: EnsureMyIdentityAccountOptions,
+): Promise<EnsuredIdentityAccount> {
+  try {
+    const account = await client.identityAccount.whoAmI();
+    return { account, created: false };
+  } catch (err: unknown) {
+    if (!isNotFound(err)) throw err;
+  }
+  options?.onProvisioning?.();
+  const account = await client.identityAccount.provisionMyAccount();
+  return { account, created: true };
+}

package/src/gen/resource-availability.ts

@@ -14,7 +14,7 @@ import { ApiResourceKind, ResourceTier } from "@stigmer/protos/ai/stigmer/common
 export const KIND_TIERS: ReadonlyMap<ApiResourceKind, ResourceTier> = new Map([
   [ApiResourceKind.api_resource_version, ResourceTier.cloud_only],
   [ApiResourceKind.iam_policy, ResourceTier.enterprise],
-  [ApiResourceKind.identity_account, ResourceTier.cloud_only],
+  [ApiResourceKind.identity_account, ResourceTier.open_source],
   [ApiResourceKind.api_key, ResourceTier.open_source],
   [ApiResourceKind.invitation, ResourceTier.enterprise],
   [ApiResourceKind.identity_provider, ResourceTier.enterprise],

package/src/index.ts

@@ -62,6 +62,16 @@ export {
   isResourceAvailable,
 } from "./resource-availability.js";
 
+// The first-sign-in flow: resolve the caller's identity account, provisioning
+// it on a first sign-in. One home for every surface (console gate, CLI,
+// platform builders' own gates).
+export {
+  ensureMyIdentityAccount,
+  type EnsuredIdentityAccount,
+  type EnsureMyIdentityAccountOptions,
+  type IdentityAccountLane,
+} from "./ensure-identity-account.js";
+
 // Authorization config and IAM role utilities
 export {
   getGrantableRoles,
@@ -127,10 +137,7 @@ export {
 } from "./github.js";
 
 // Platform client (server info / edition detection)
-export {
-  PlatformClient,
-  type ServerInfo,
-} from "./platform.js";
+export { PlatformClient, type ServerInfo } from "./platform.js";
 
 // Manifest engine (kind-agnostic YAML ⇄ proto ⇄ apply)
 export {
@@ -201,7 +208,11 @@ export {
   type AgentShareInput,
   type AgentShareMessagesInput,
 } from "./gen/agentshare.js";
-export { ApiKeyClient, toApiKeyUpdateInput, type ApiKeyInput } from "./gen/apikey.js";
+export {
+  ApiKeyClient,
+  toApiKeyUpdateInput,
+  type ApiKeyInput,
+} from "./gen/apikey.js";
 export {
   ChannelAppClient,
   toChannelAppUpdateInput,
@@ -227,10 +238,7 @@ export {
   toIdentityAccountUpdateInput,
   type IdentityAccountInput,
 } from "./gen/identityaccount.js";
-export {
-  InvitationClient,
-  type InvitationInput,
-} from "./gen/invitation.js";
+export { InvitationClient, type InvitationInput } from "./gen/invitation.js";
 export {
   IdentityProviderClient,
   toIdentityProviderUpdateInput,
@@ -275,7 +283,11 @@ export {
   toPlatformClientUpdateInput,
   type PlatformClientInput,
 } from "./gen/platformclient.js";
-export { ProjectClient, toProjectUpdateInput, type ProjectInput } from "./gen/project.js";
+export {
+  ProjectClient,
+  toProjectUpdateInput,
+  type ProjectInput,
+} from "./gen/project.js";
 export {
   ScheduleClient,
   buildScheduleProto,