@stigmer/server 3.14.0 → 3.15.0

package/dist/domain/apikey/verifier.js

@@ -23,16 +23,28 @@
  * seam wants. Expiry is "expires_at set and past"; never_expires is
  * deliberately not read — Java parity (never-expiring keys leave
  * expires_at unset).
+ *
+ * The stamp is then resolved the way the OIDC lane resolves `sub`
+ * (20260911.11, T01_1_review.md A6; domain/identityaccount/resolve.ts):
+ * a key minted before its owner was provisioned carries the raw subject
+ * and answers the owner's ACCOUNT id once one exists, so no write over a
+ * legacy key mints a raw-subject stamp again; a stamp that is already an
+ * account id is kept — one primary-key read either way, no cache. Only
+ * identityId changes on a hit: email/displayName stay the stamp's, the
+ * actor the key recorded at minting. The credential checks run first, so
+ * a revoked or expired key never reaches the account store.
  */
 import { Code, ConnectError } from "@connectrpc/connect";
 import { timestampDate } from "@bufbuild/protobuf/wkt";
+import { identityIdForSubject } from "../identityaccount/resolve.js";
 import { hashApiKey, isApiKeyToken } from "./keymaterial.js";
 import { findApiKeyByHash } from "./lookup.js";
 /** Java classifyAuthError's fallback arm — the unknown/revoked-key copy. */
 export const INVALID_TOKEN_MESSAGE = "invalid token";
 /** Java classifyAuthError's "expired" arm. */
 export const TOKEN_EXPIRED_MESSAGE = "token has expired";
-export function newApiKeyIdentityVerifier(store) {
+export function newApiKeyIdentityVerifier(deps) {
+    const { store, accounts } = deps;
     return {
         name: "apikey",
         async verify(token) {
@@ -55,7 +67,7 @@ export function newApiKeyIdentityVerifier(store) {
                 throw new ConnectError(INVALID_TOKEN_MESSAGE, Code.Unauthenticated);
             }
             return {
-                identityId: owner.id,
+                identityId: await identityIdForSubject(accounts, owner.id),
                 callerClass: "user",
                 issuer: "",
                 rawToken: token,

package/dist/domain/apikey/verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../src/domain/apikey/verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAOvD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAErD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAEzD,MAAM,UAAU,yBAAyB,CAAC,KAAY;IACpD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;YACtC,IAAI,SAAS,KAAK,SAAS,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;gBACtE,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;YACtD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC3C,oEAAoE;gBACpE,mEAAmE;gBACnE,+DAA+D;gBAC/D,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,KAAK,CAAC,EAAE;gBACpB,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,KAAK;gBACf,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../src/domain/apikey/verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAOvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAErD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AASzD,MAAM,UAAU,yBAAyB,CACvC,IAAwB;IAExB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACjC,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;YACtC,IAAI,SAAS,KAAK,SAAS,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;gBACtE,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;YACtD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC3C,oEAAoE;gBACpE,mEAAmE;gBACnE,+DAA+D;gBAC/D,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,MAAM,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC1D,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,KAAK;gBACf,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/identityaccount/constants.d.ts

@@ -0,0 +1,66 @@
+import type { CallerIdentity } from "../../extensions/identity.js";
+/** The kind's id prefix (kind_meta `identity_account.id_prefix`). */
+export declare const ACCOUNT_ID_PREFIX = "ida";
+/**
+ * The derived account id of a direct account with subject `idpId`. Pure,
+ * total over non-empty input; an empty subject has no principal and so
+ * no address — refused, never hashed.
+ */
+export declare function accountIdFor(idpId: string): string;
+/**
+ * The subject namespace of the trusted-local posture. An OIDC subject is
+ * `<connection>|<id>` by Auth0 convention; `local|` claims the same shape
+ * for the one principal no issuer vouches for, so the derived ids of a
+ * local operator and an OIDC user can never collide by construction.
+ */
+export declare const LOCAL_IDP_ID_PREFIX = "local|";
+/** `local|<identityId>` — the trusted-local operator's subject. */
+export declare function localIdpIdFor(identityId: string): string;
+/**
+ * The issuer subject a caller stands for:
+ *   - a caller with no issuer and no token is the trusted-local operator
+ *     (`local|<identityId>`; identityId is the operator's email or
+ *     "system" — pipeline/interceptors/auth.ts trustedLocalIdentity);
+ *   - a token-bearing caller is its JWT `sub`, read from the raw token
+ *     the verifier already proved; `""` when the token carries no
+ *     readable subject (an opaque credential under an issuer), which
+ *     the provisionMyAccount handler maps to the UNAUTHENTICATED arm.
+ */
+export declare function idpIdOf(caller: CallerIdentity): string;
+/**
+ * Auth0's client-credentials subject shape (`<client_id>@clients`) — the
+ * cloud's IsMachineAccountVerifier rule, the one input to
+ * `is_machine_account`.
+ */
+export declare const MACHINE_ACCOUNT_SUFFIX = "@clients";
+export declare function isMachineSubject(idpId: string): boolean;
+/** whoAmI for a caller with no account (NOT_FOUND). */
+export declare const ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE = "Identity account not found for the authenticated user";
+/** provisionMyAccount for a caller whose credential names no subject (UNAUTHENTICATED). */
+export declare const NO_IDP_ID_MESSAGE = "Cannot provision account: no IDP ID in authentication context";
+/** provisionMyAccount when the issuer's userinfo cannot be read (UNAVAILABLE); the cause follows. */
+export declare const USERINFO_UNAVAILABLE_PREFIX = "Failed to fetch user profile from identity provider: ";
+/** get / getByEmail / getByIdpId / getActorInfo / update / delete on a missing account (NOT_FOUND). */
+export declare function accountNotFoundMessage(handle: string): string;
+/**
+ * The cloud#393 gate's refusal (PERMISSION_DENIED): the create RPC admits
+ * the platform's own pipelines only — machine-class callers and
+ * server-composed (in-process) requests (T01_1_review.md A7).
+ */
+export declare const CREATE_IS_INTERNAL_MESSAGE = "this RPC is internal to the platform";
+/**
+ * The reason a composition with no IdentityFederation unit refuses the four
+ * federation RPCs (UNIMPLEMENTED). The sentence a person can act on; the
+ * method-naming prefix is the organization directory's absent-method shape
+ * so clients matching on "is not implemented" keep working.
+ */
+export declare const FEDERATION_UNIMPLEMENTED_REASON = "federated identity accounts are served by the Enterprise and Cloud editions";
+export declare function federationUnimplementedMessage(method: string): string;
+/**
+ * update with a changed spec.idp_id (FAILED_PRECONDITION; the schedule
+ * domain's immutability shape, T01_1_review.md A1). The subject IS the
+ * identity; a client that sends a different one has a bug it should hear
+ * about, never a silent preserve.
+ */
+export declare function idpIdImmutableMessage(existingIdpId: string): string;
+//# sourceMappingURL=constants.d.ts.map

package/dist/domain/identityaccount/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/constants.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAQvC;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAgBlD;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;;;;GASG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAKtD;AAsBD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,aAAa,CAAC;AAEjD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEvD;AAMD,uDAAuD;AACvD,eAAO,MAAM,oCAAoC,0DACQ,CAAC;AAE1D,2FAA2F;AAC3F,eAAO,MAAM,iBAAiB,kEACmC,CAAC;AAElE,qGAAqG;AACrG,eAAO,MAAM,2BAA2B,0DACiB,CAAC;AAE1D,uGAAuG;AACvG,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,yCACC,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,gFACmC,CAAC;AAEhF,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAEnE"}

package/dist/domain/identityaccount/constants.js

@@ -0,0 +1,153 @@
+/**
+ * Identity-account domain constants (20260911.11, T01_1_review.md A1, A2,
+ * A7): the derived account id, the one function that turns a caller into
+ * an issuer subject, and the byte-pinned wire copy.
+ *
+ * The derived id (A1). A direct account's id is a pure function of its
+ * subject: `ida_` + the top 130 bits of sha256(idp_id) as 26 lowercase
+ * Crockford-base32 characters. The shape is indistinguishable from a
+ * minted `{prefix}_{ulid}`, so nothing downstream learns a second id
+ * grammar, and the PRIMARY KEY becomes the one home of "one account per
+ * subject": the generic store has no secondary uniqueness and its save is
+ * an upsert (`store/sqlite/store.ts`), so a lookup-then-insert on a scan
+ * could never close the first-login race. Two replicas deriving the same
+ * id converge by primary key with no migration and no second copy of any
+ * field. The hash is one-way, so an issuer subject never leaks into the
+ * `created_by.id` stamps that ride on every resource. The golden vectors in
+ * __tests__/constants.test.ts are wire-adjacent contract: a change here
+ * re-addresses every direct account open source ever created.
+ *
+ * `idpIdOf` (A2) is the ONE place a CallerIdentity becomes a subject. An
+ * issuer-vouched token is read for its `sub` (already verified at
+ * position 1, so this is a read of trusted state, never a verification);
+ * a caller with no issuer and no token is the trusted-local operator,
+ * whose subject is `local|<identityId>`. It deliberately knows nothing
+ * about API keys: every verifier resolves its stamp to the account when
+ * one exists (A6), so a credential's shape is the verifier's business.
+ *
+ * The copy moved from the cloud's iam/account/handlers.ts as-is: the CLI,
+ * console and SDK show these sentences verbatim, so they are contract.
+ */
+import { createHash } from "node:crypto";
+/** The kind's id prefix (kind_meta `identity_account.id_prefix`). */
+export const ACCOUNT_ID_PREFIX = "ida";
+/** Crockford base32, lowercased — the alphabet every minted ULID id uses. */
+const CROCKFORD_ALPHABET = "0123456789abcdefghjkmnpqrstvwxyz";
+const DERIVED_ID_CHARS = 26;
+const DERIVED_ID_BITS = BigInt(DERIVED_ID_CHARS * 5);
+const SHA256_BITS = 256n;
+/**
+ * The derived account id of a direct account with subject `idpId`. Pure,
+ * total over non-empty input; an empty subject has no principal and so
+ * no address — refused, never hashed.
+ */
+export function accountIdFor(idpId) {
+    if (idpId === "") {
+        throw new Error("idp_id must not be empty");
+    }
+    const digest = createHash("sha256").update(idpId, "utf8").digest();
+    let bits = 0n;
+    for (const byte of digest) {
+        bits = (bits << 8n) | BigInt(byte);
+    }
+    let top = bits >> (SHA256_BITS - DERIVED_ID_BITS);
+    let encoded = "";
+    for (let i = 0; i < DERIVED_ID_CHARS; i++) {
+        encoded = CROCKFORD_ALPHABET[Number(top & 31n)] + encoded;
+        top >>= 5n;
+    }
+    return `${ACCOUNT_ID_PREFIX}_${encoded}`;
+}
+/**
+ * The subject namespace of the trusted-local posture. An OIDC subject is
+ * `<connection>|<id>` by Auth0 convention; `local|` claims the same shape
+ * for the one principal no issuer vouches for, so the derived ids of a
+ * local operator and an OIDC user can never collide by construction.
+ */
+export const LOCAL_IDP_ID_PREFIX = "local|";
+/** `local|<identityId>` — the trusted-local operator's subject. */
+export function localIdpIdFor(identityId) {
+    return `${LOCAL_IDP_ID_PREFIX}${identityId}`;
+}
+/**
+ * The issuer subject a caller stands for:
+ *   - a caller with no issuer and no token is the trusted-local operator
+ *     (`local|<identityId>`; identityId is the operator's email or
+ *     "system" — pipeline/interceptors/auth.ts trustedLocalIdentity);
+ *   - a token-bearing caller is its JWT `sub`, read from the raw token
+ *     the verifier already proved; `""` when the token carries no
+ *     readable subject (an opaque credential under an issuer), which
+ *     the provisionMyAccount handler maps to the UNAUTHENTICATED arm.
+ */
+export function idpIdOf(caller) {
+    if (caller.issuer === "" && caller.rawToken === "") {
+        return localIdpIdFor(caller.identityId);
+    }
+    return jwtSubjectOf(caller.rawToken);
+}
+/**
+ * The cloud's jwtSubjectOf verbatim: the payload segment decoded, `sub`
+ * when it is a string. Not a verification — the chain's position 1 did
+ * that; this only reads a claim from trusted state.
+ */
+function jwtSubjectOf(rawToken) {
+    const segments = rawToken.split(".");
+    if (segments.length !== 3) {
+        return "";
+    }
+    try {
+        const payload = JSON.parse(Buffer.from(segments[1] ?? "", "base64url").toString("utf8"));
+        return typeof payload.sub === "string" ? payload.sub : "";
+    }
+    catch {
+        return "";
+    }
+}
+/**
+ * Auth0's client-credentials subject shape (`<client_id>@clients`) — the
+ * cloud's IsMachineAccountVerifier rule, the one input to
+ * `is_machine_account`.
+ */
+export const MACHINE_ACCOUNT_SUFFIX = "@clients";
+export function isMachineSubject(idpId) {
+    return idpId.endsWith(MACHINE_ACCOUNT_SUFFIX);
+}
+// ---------------------------------------------------------------------------
+// Byte-pinned copy (the cloud handlers' sentences, moved as-is).
+// ---------------------------------------------------------------------------
+/** whoAmI for a caller with no account (NOT_FOUND). */
+export const ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE = "Identity account not found for the authenticated user";
+/** provisionMyAccount for a caller whose credential names no subject (UNAUTHENTICATED). */
+export const NO_IDP_ID_MESSAGE = "Cannot provision account: no IDP ID in authentication context";
+/** provisionMyAccount when the issuer's userinfo cannot be read (UNAVAILABLE); the cause follows. */
+export const USERINFO_UNAVAILABLE_PREFIX = "Failed to fetch user profile from identity provider: ";
+/** get / getByEmail / getByIdpId / getActorInfo / update / delete on a missing account (NOT_FOUND). */
+export function accountNotFoundMessage(handle) {
+    return `Identity account not found: ${handle}`;
+}
+/**
+ * The cloud#393 gate's refusal (PERMISSION_DENIED): the create RPC admits
+ * the platform's own pipelines only — machine-class callers and
+ * server-composed (in-process) requests (T01_1_review.md A7).
+ */
+export const CREATE_IS_INTERNAL_MESSAGE = "this RPC is internal to the platform";
+/**
+ * The reason a composition with no IdentityFederation unit refuses the four
+ * federation RPCs (UNIMPLEMENTED). The sentence a person can act on; the
+ * method-naming prefix is the organization directory's absent-method shape
+ * so clients matching on "is not implemented" keep working.
+ */
+export const FEDERATION_UNIMPLEMENTED_REASON = "federated identity accounts are served by the Enterprise and Cloud editions";
+export function federationUnimplementedMessage(method) {
+    return `${method} is not implemented: ${FEDERATION_UNIMPLEMENTED_REASON}`;
+}
+/**
+ * update with a changed spec.idp_id (FAILED_PRECONDITION; the schedule
+ * domain's immutability shape, T01_1_review.md A1). The subject IS the
+ * identity; a client that sends a different one has a bug it should hear
+ * about, never a silent preserve.
+ */
+export function idpIdImmutableMessage(existingIdpId) {
+    return `spec.idp_id is immutable (account subject is '${existingIdpId}') — create a new account for a different subject`;
+}
+//# sourceMappingURL=constants.js.map

package/dist/domain/identityaccount/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEvC,6EAA6E;AAC7E,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;AAC9D,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,eAAe,GAAG,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC;AACrD,MAAM,WAAW,GAAG,IAAI,CAAC;AAEzB;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnE,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,WAAW,GAAG,eAAe,CAAC,CAAC;IAClD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,gBAAgB,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC;QAC1D,GAAG,KAAK,EAAE,CAAC;IACb,CAAC;IACD,OAAO,GAAG,iBAAiB,IAAI,OAAO,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAE5C,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,OAAO,GAAG,mBAAmB,GAAG,UAAU,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,OAAO,CAAC,MAAsB;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACnD,OAAO,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACxC,CAAC;QACvB,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAEjD,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;AAChD,CAAC;AAED,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,uDAAuD;AACvD,MAAM,CAAC,MAAM,oCAAoC,GAC/C,uDAAuD,CAAC;AAE1D,2FAA2F;AAC3F,MAAM,CAAC,MAAM,iBAAiB,GAC5B,+DAA+D,CAAC;AAElE,qGAAqG;AACrG,MAAM,CAAC,MAAM,2BAA2B,GACtC,uDAAuD,CAAC;AAE1D,uGAAuG;AACvG,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,OAAO,+BAA+B,MAAM,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,sCAAsC,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAC1C,6EAA6E,CAAC;AAEhF,MAAM,UAAU,8BAA8B,CAAC,MAAc;IAC3D,OAAO,GAAG,MAAM,wBAAwB,+BAA+B,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,aAAqB;IACzD,OAAO,iDAAiD,aAAa,mDAAmD,CAAC;AAC3H,CAAC"}

package/dist/domain/identityaccount/controller.d.ts

@@ -0,0 +1,34 @@
+import type { ConnectRouter } from "@connectrpc/connect";
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { Logger } from "../../boot/logger.js";
+import type { Authorizer } from "../../extensions/authorizer.js";
+import type { ResolvedGateSteps } from "../../extensions/gate-slots.js";
+import type { IdentityFederation } from "../../extensions/identity-federation.js";
+import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
+import type { CreateAccount, DirectAccountProvisioner } from "./provisioning.js";
+import type { IdentityAccountStore } from "./store.js";
+/** What the create path needs — the subset every caller of it composes. */
+export interface CreateAccountPathDeps {
+    readonly accounts: IdentityAccountStore;
+    readonly logger: Logger;
+    /** The composed authorization seam — the Authorize step at position 1 of every chain calls it (DD-007 §3). */
+    readonly authorizer: Authorizer;
+    /** The composed tuple-lifecycle driver — undefined = the shared steps no-op. */
+    readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
+}
+export interface IdentityAccountControllerDeps extends CreateAccountPathDeps {
+    readonly provisioner: DirectAccountProvisioner;
+    /** The composed federation capability — undefined = the four RPCs refuse UNIMPLEMENTED. */
+    readonly federation: IdentityFederation | undefined;
+    /** The composed slot registrations — this domain's provision slot (Q-IA-9, A10). */
+    readonly gateSteps: ResolvedGateSteps;
+}
+/** Registers both identityaccount services on the router (routes stage). */
+export declare function registerIdentityAccountServices(router: ConnectRouter, deps: IdentityAccountControllerDeps): void;
+/**
+ * The create path as its in-process callers see it (provisioning.ts
+ * `CreateAccount`): the input becomes the resource envelope the chain
+ * expects, tagged with the kind this controller serves.
+ */
+export declare function newCreateAccountPath(deps: CreateAccountPathDeps, kind: ApiResourceKind): CreateAccount;
+//# sourceMappingURL=controller.d.ts.map

package/dist/domain/identityaccount/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/controller.ts"],"names":[],"mappings":"AAgDA,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAKzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAc3H,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAExE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AA8BjG,OAAO,KAAK,EACV,aAAa,EAEb,wBAAwB,EACzB,MAAM,mBAAmB,CAAC;AAiB3B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8GAA8G;IAC9G,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,gFAAgF;IAChF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;CAC7E;AAED,MAAM,WAAW,6BAA8B,SAAQ,qBAAqB;IAC1E,QAAQ,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAC/C,2FAA2F;IAC3F,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACpD,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;CACvC;AAED,4EAA4E;AAC5E,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,6BAA6B,GAClC,IAAI,CAkDN;AA0DD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,qBAAqB,EAC3B,IAAI,EAAE,eAAe,GACpB,aAAa,CAaf"}