@stigmer/server 3.14.0 → 3.15.0

package/dist/domain/identityaccount/controller.js

@@ -0,0 +1,342 @@
+/**
+ * IdentityAccount controller (20260911.11) — the identity-account domain
+ * served ONCE by @stigmer/server in every edition (the editions program's
+ * tier truth: `identity_account` is open-source tier). The behavioural
+ * reference is the cloud's iam/account/handlers.ts, whose twelve direct
+ * handlers retire against this module; the byte-pinned copy moved with it
+ * (constants.ts). The cloud keeps only what differs per edition — its row
+ * store as `drivers.identityAccountStore`, the federated arms as
+ * `drivers.identityFederation`, the personal organization as a gate on
+ * `identity-account-provision:post-persist`.
+ *
+ * Persistence is the IdentityAccountStore PORT, never the generic Store
+ * (steps.ts explains); the storage-free shared steps are reused as they
+ * are, so every chain reads onto the inventory unchanged.
+ *
+ * The ONE create path (`newCreateAccountPath`): the create RPC, the
+ * provisioner and the trusted-local operator ensure all run the same
+ * chain — DeriveAccountId, CheckDuplicate by subject, BuildNewState,
+ * AssignBackendFields, Persist through the port, CreateAuthorizationTuples
+ * (the lifecycle driver's SELF arm gives the account its self-owner grant
+ * in the cloud) — so no account exists that skipped a step. The create
+ * RPC is the cloud#393 gate in front of that path (T01_1_review.md A7):
+ * machine / internal / in-process callers only, in every edition. The
+ * gate is the RPC's admission rule and deliberately NOT a step in the
+ * path, because the provisioner runs the path as the idp-shaped wire user
+ * (the account is created by the subject it is for) and the operator
+ * ensure runs it as the trusted-local user.
+ *
+ * Direct handlers (no pipeline): whoAmI (the cloud's two primary-key
+ * reads through idpIdOf; NOT_FOUND for the unprovisioned), getByEmail and
+ * getByIdpId (lookup FIRST, then authorizeDirect on the FOUND id — the
+ * cloud's order; the annotation's `field_path = "value"` would otherwise
+ * hand the Authorizer an email as a resource id), getActorInfo, and
+ * provisionMyAccount (the provisioner, then the composed post-persist
+ * gates; UNAUTHENTICATED with the cloud's copy for a credential naming no
+ * subject; UNAVAILABLE with the cloud's copy when userinfo fails).
+ *
+ * The four federation RPCs refuse UNIMPLEMENTED with the edition reason
+ * when no unit composes the capability (never INTERNAL; the organization
+ * directory's absent-method shape); present, the controller owns the
+ * shared precondition (authorize on the org, ref-with-slug, org match,
+ * IdP exists) and dispatches to the arm with the resolved ref.
+ *
+ * Proven by __tests__/identityaccount.test.ts (the composed trusted-local
+ * server), boot/__tests__/auth-enabled-composition.test.ts (the OIDC
+ * posture end to end) and identityaccount.conformance.test.ts.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { create } from "@bufbuild/protobuf";
+import { ApiResourceAuditActorSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/status_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountCommandController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/command_pb";
+import { IdentityAccountQueryController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/query_pb";
+import { stepsForSlot } from "../../extensions/gate-slots.js";
+import { internalError, invalidArgumentError } from "../../pipeline/errors.js";
+import { apiResourceKindKey } from "../../pipeline/interceptors/apiresource.js";
+import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
+import { newPipeline } from "../../pipeline/pipeline.js";
+import { RequestContext } from "../../pipeline/request-context.js";
+import { newCleanupIamPoliciesStep, newCreateAuthorizationTuplesStep, } from "../../pipeline/steps/authorization-tuples.js";
+import { authorizeDirect, newAuthorizeStep, } from "../../pipeline/steps/authorize.js";
+import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
+import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
+import { newExtractResourceIdStep } from "../../pipeline/steps/delete.js";
+import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
+import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
+import { TARGET_RESOURCE_KEY } from "../../pipeline/steps/load-target.js";
+import { newResolveSlugStep } from "../../pipeline/steps/slug.js";
+import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
+import { ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE, CREATE_IS_INTERNAL_MESSAGE, NO_IDP_ID_MESSAGE, USERINFO_UNAVAILABLE_PREFIX, federationUnimplementedMessage, idpIdOf, } from "./constants.js";
+import { UserInfoFetchError } from "./provisioning.js";
+import { accountNotFoundError, newAssignBackendFieldsStep, newCheckDuplicateStep, newDefaultAccountNameStep, newDeleteAccountStep, newDeriveAccountIdStep, newGuardImmutableSubjectStep, newLoadExistingAccountForDeleteStep, newLoadExistingAccountStep, newLoadTargetAccountStep, newPersistNewAccountStep, newPersistUpdatedAccountStep, newPreserveBackendFieldsStep, } from "./steps.js";
+/** Registers both identityaccount services on the router (routes stage). */
+export function registerIdentityAccountServices(router, deps) {
+    router.service(IdentityAccountCommandController, {
+        create: (account, ctx) => createRpc(deps, account, ctx),
+        update: (account, ctx) => update(deps, account, ctx),
+        delete: (id, ctx) => deleteAccount(deps, id, ctx),
+        createFederatedAccount: (input, ctx) => federated(deps, ctx, IdentityAccountCommandController.method.createFederatedAccount, input, (federation, ref, caller) => federation.createFederatedAccount(input, ref, caller)),
+        updateFederatedAccount: (input, ctx) => federated(deps, ctx, IdentityAccountCommandController.method.updateFederatedAccount, input, (federation, ref, caller) => federation.updateFederatedAccount(input, ref, caller)),
+        deprovisionFederatedAccount: (input, ctx) => federated(deps, ctx, IdentityAccountCommandController.method.deprovisionFederatedAccount, input, (federation, ref, caller) => federation.deprovisionFederatedAccount(input, ref, caller)),
+        provisionMyAccount: (empty, ctx) => provisionMyAccount(deps, empty, ctx),
+    });
+    router.service(IdentityAccountQueryController, {
+        get: (id, ctx) => get(deps, id, ctx),
+        whoAmI: (empty, ctx) => whoAmI(deps, empty, ctx),
+        getByEmail: (email, ctx) => getByEmail(deps, email, ctx),
+        getByIdpId: (idpId, ctx) => getByIdpId(deps, idpId, ctx),
+        getByExternalSub: (lookup, ctx) => federated(deps, ctx, IdentityAccountQueryController.method.getByExternalSub, lookup, (federation, ref, caller) => federation.getByExternalSub(lookup, ref, caller)),
+        getActorInfo: (id, ctx) => getActorInfo(deps, id, ctx),
+    });
+}
+function kindOf(ctx) {
+    return ctx.values.get(apiResourceKindKey);
+}
+// ---------------------------------------------------------------------------
+// The one create path
+// ---------------------------------------------------------------------------
+/**
+ * Runs the create chain AS `caller` and answers the persisted account.
+ * `kind` is the service's kind tag for wire calls; the path callers with
+ * no HandlerContext (the provisioner, the operator ensure) pass the kind
+ * the controller serves.
+ */
+async function runCreateChain(deps, account, caller, kind) {
+    const reqCtx = new RequestContext(IdentityAccountSchema, account, caller, kind);
+    await newPipeline("identityaccount-create", deps.logger)
+        .addStep(newAuthorizeStep(IdentityAccountCommandController.method.create, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newDefaultAccountNameStep())
+        .addStep(newResolveSlugStep())
+        .addStep(newDeriveAccountIdStep())
+        .addStep(newCheckDuplicateStep(deps.accounts))
+        .addStep(newBuildNewStateStep())
+        .addStep(newGuardReservedLabelsStep(deps.authorizer))
+        .addStep(newAssignBackendFieldsStep())
+        .addStep(newPersistNewAccountStep(deps.accounts))
+        .addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle, deps.logger))
+        .build()
+        .execute(reqCtx);
+    return reqCtx.newState;
+}
+/**
+ * The create path as its in-process callers see it (provisioning.ts
+ * `CreateAccount`): the input becomes the resource envelope the chain
+ * expects, tagged with the kind this controller serves.
+ */
+export function newCreateAccountPath(deps, kind) {
+    return (input, caller) => runCreateChain(deps, create(IdentityAccountSchema, {
+        apiVersion: "iam.stigmer.ai/v1",
+        kind: "IdentityAccount",
+        metadata: { name: input.name },
+        spec: input.spec,
+    }), caller, kind);
+}
+/**
+ * The create RPC: the cloud#393 gate, then the path AS the caller. FGA
+ * cannot gate this RPC (the account being created IS the principal — the
+ * bootstrap problem), so the gate is caller class: the platform's own
+ * pipelines only.
+ */
+function createRpc(deps, account, ctx) {
+    const caller = callerIdentityOf(ctx);
+    guardInternalRpc(caller);
+    return runCreateChain(deps, account, caller, kindOf(ctx));
+}
+function guardInternalRpc(caller) {
+    if (caller.callerClass === "machine" ||
+        caller.callerClass === "internal" ||
+        caller.origin === "in-process") {
+        return;
+    }
+    throw new ConnectError(CREATE_IS_INTERNAL_MESSAGE, Code.PermissionDenied);
+}
+// ---------------------------------------------------------------------------
+// Update / Delete
+// ---------------------------------------------------------------------------
+/**
+ * Update: full-envelope replace with the cloud's writable surface (A9) —
+ * BuildUpdateState preserves id/slug/org/visibility, GuardImmutableSubject
+ * refuses a changed subject, AssignBackendFields preserves the rest of
+ * what the backend owns from the existing row.
+ */
+async function update(deps, account, ctx) {
+    const reqCtx = new RequestContext(IdentityAccountSchema, account, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("identityaccount-update", deps.logger)
+        .addStep(newAuthorizeStep(IdentityAccountCommandController.method.update, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadExistingAccountStep(deps.accounts))
+        .addStep(newGuardImmutableSubjectStep())
+        .addStep(newBuildUpdateStateStep())
+        .addStep(newPreserveBackendFieldsStep())
+        .addStep(newPersistUpdatedAccountStep(deps.accounts))
+        .build()
+        .execute(reqCtx);
+    return reqCtx.newState;
+}
+/** Delete — answers the pre-delete account (the canonical delete chain over the port). */
+async function deleteAccount(deps, id, ctx) {
+    const reqCtx = new RequestContext(IdentityAccountCommandController.method.delete.input, id, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("identityaccount-delete", deps.logger)
+        .addStep(newAuthorizeStep(IdentityAccountCommandController.method.delete, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newExtractResourceIdStep())
+        .addStep(newLoadExistingAccountForDeleteStep(deps.accounts))
+        .addStep(newDeleteAccountStep(deps.accounts))
+        .addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle, deps.logger))
+        .build()
+        .execute(reqCtx);
+    const deleted = reqCtx.get(EXISTING_RESOURCE_KEY);
+    if (deleted === undefined) {
+        throw internalError(new Error("delete pipeline completed without a loaded resource"), "deleted identity account not found in context");
+    }
+    return deleted;
+}
+// ---------------------------------------------------------------------------
+// Reads
+// ---------------------------------------------------------------------------
+/** Get — LoadTarget by id through the port; the domain's NOT_FOUND copy. */
+async function get(deps, id, ctx) {
+    return loadTarget(deps, IdentityAccountQueryController.method.get, id, ctx);
+}
+/** getActorInfo — the contract-shaped actor: id, avatar, "First Last", email. */
+async function getActorInfo(deps, id, ctx) {
+    const account = await loadTarget(deps, IdentityAccountQueryController.method.getActorInfo, id, ctx);
+    const firstName = account.spec?.firstName ?? "";
+    const lastName = account.spec?.lastName ?? "";
+    return create(ApiResourceAuditActorSchema, {
+        id: account.metadata?.id ?? "",
+        avatar: account.spec?.pictureUrl ?? "",
+        displayName: `${firstName} ${lastName}`.trim(),
+        email: account.spec?.email ?? "",
+    });
+}
+async function loadTarget(deps, method, id, ctx) {
+    const reqCtx = new RequestContext(method.input, id, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline(`identityaccount-${method.localName}`, deps.logger)
+        .addStep(newAuthorizeStep(method, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadTargetAccountStep(deps.accounts))
+        .build()
+        .execute(reqCtx);
+    return reqCtx.get(TARGET_RESOURCE_KEY);
+}
+/**
+ * whoAmI — the cloud's lookup verbatim: by the resolved identity, then by
+ * the derived id of the caller's subject for a caller whose identity is
+ * still idp-shaped (an unprovisioned OIDC subject), then NOT_FOUND with
+ * the cloud's copy. Two primary-key reads at most; no scan.
+ */
+async function whoAmI(deps, _empty, ctx) {
+    const caller = callerIdentityOf(ctx);
+    let account = await read(() => deps.accounts.findById(caller.identityId), "failed to load identity account");
+    if (account === undefined) {
+        account = await read(() => deps.accounts.findDirectByIdpId(idpIdOf(caller)), "failed to load identity account");
+    }
+    if (account === undefined) {
+        throw new ConnectError(ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE, Code.NotFound);
+    }
+    return account;
+}
+/** getByEmail — direct accounts only; lookup first, authorize on the FOUND id. */
+async function getByEmail(deps, email, ctx) {
+    return lookupThenAuthorize(deps, IdentityAccountQueryController.method.getByEmail, email, ctx, () => deps.accounts.findDirectByEmail(email.value), email.value);
+}
+/** getByIdpId — any provisioning mode; lookup first, authorize on the FOUND id. */
+async function getByIdpId(deps, idpId, ctx) {
+    return lookupThenAuthorize(deps, IdentityAccountQueryController.method.getByIdpId, idpId, ctx, () => deps.accounts.findByIdpId(idpId.value), idpId.value);
+}
+async function lookupThenAuthorize(deps, method, input, ctx, lookup, handle) {
+    const account = await read(lookup, "failed to look up identity account");
+    if (account === undefined) {
+        throw accountNotFoundError(handle);
+    }
+    await authorizeDirect(method, deps.authorizer, callerIdentityOf(ctx), input, {
+        resourceId: account.metadata?.id ?? "",
+    });
+    return account;
+}
+// ---------------------------------------------------------------------------
+// Provisioning
+// ---------------------------------------------------------------------------
+/**
+ * provisionMyAccount — the subject from the caller's credential, the
+ * provisioner's flow, then the composed post-persist gates (the cloud's
+ * personal organization) with the caller RE-STAMPED as the account: the
+ * position-1 identity was idp-shaped because no row existed when the
+ * verifier ran, and a gate that attributes ownership must name the
+ * account, never a principal no later request carries. The gates run on
+ * EVERY call, the idempotent early return included — the cloud's step
+ * backfills accounts that predate personal organizations there, which is
+ * why Q-IA-9 chose a slot over onResourceCreated. Non-transactional in
+ * the `org-create:post-persist` sense: a gate failure fails the request,
+ * the row survives, the next call heals it.
+ */
+async function provisionMyAccount(deps, _empty, ctx) {
+    const caller = callerIdentityOf(ctx);
+    const idpId = idpIdOf(caller);
+    if (idpId === "") {
+        throw new ConnectError(NO_IDP_ID_MESSAGE, Code.Unauthenticated);
+    }
+    let account;
+    try {
+        account = await deps.provisioner.provisionDirectAccount(idpId, caller);
+    }
+    catch (error) {
+        if (error instanceof UserInfoFetchError) {
+            throw new ConnectError(`${USERINFO_UNAVAILABLE_PREFIX}${error.message}`, Code.Unavailable);
+        }
+        throw error;
+    }
+    // The ratified provision slot (Q-IA-9; the gate-slots.ts header carries
+    // its semantics). Empty in OSS — no pipeline is built for zero steps.
+    const gates = stepsForSlot(deps.gateSteps, "identity-account-provision:post-persist");
+    if (gates.length > 0) {
+        const asAccount = {
+            ...caller,
+            identityId: account.metadata?.id ?? "",
+        };
+        const reqCtx = new RequestContext(IdentityAccountSchema, account, asAccount, kindOf(ctx));
+        const pipeline = newPipeline("identityaccount-provision-post-persist", deps.logger);
+        for (const step of gates) {
+            pipeline.addStep(step);
+        }
+        await pipeline.build().execute(reqCtx);
+    }
+    return account;
+}
+async function federated(deps, ctx, method, input, arm) {
+    const federation = deps.federation;
+    if (federation === undefined) {
+        throw new ConnectError(federationUnimplementedMessage(`${method.parent.typeName}.${method.localName}`), Code.Unimplemented);
+    }
+    const caller = callerIdentityOf(ctx);
+    const org = input.org;
+    const ref = input.identityProviderRef;
+    if (ref === undefined || ref.slug === "") {
+        throw invalidArgumentError("identity_provider_ref with a valid slug is required");
+    }
+    if (ref.org !== "" && ref.org !== org) {
+        throw invalidArgumentError(`identity_provider_ref.org '${ref.org}' does not match input org '${org}'`);
+    }
+    // The annotation's target is the org (`field_path = "org"`); resolved
+    // from the input exactly as the pipeline step would.
+    await authorizeDirect(method, deps.authorizer, caller, input);
+    const refOrg = ref.org !== "" ? ref.org : org;
+    if (!(await federation.providerExists(refOrg, ref.slug))) {
+        throw new ConnectError(`IdentityProvider '${refOrg}/${ref.slug}' not found`, Code.NotFound);
+    }
+    ref.org = refOrg;
+    return arm(federation, ref, caller);
+}
+/** A direct handler's store read: a fault is INTERNAL with a static message, never "not found". */
+async function read(operation, message) {
+    try {
+        return await operation();
+    }
+    catch (error) {
+        throw internalError(error, message);
+    }
+}
+//# sourceMappingURL=controller.js.map

package/dist/domain/identityaccount/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAK5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,0DAA0D,CAAC;AAGvG,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AACjG,OAAO,EAAE,gCAAgC,EAAE,MAAM,8DAA8D,CAAC;AAMhH,OAAO,EAAE,8BAA8B,EAAE,MAAM,4DAA4D,CAAC;AAI5G,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAK9D,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,eAAe,EACf,gBAAgB,GACjB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EACL,oCAAoC,EACpC,0BAA0B,EAC1B,iBAAiB,EACjB,2BAA2B,EAC3B,8BAA8B,EAC9B,OAAO,GACR,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,sBAAsB,EACtB,4BAA4B,EAC5B,mCAAmC,EACnC,0BAA0B,EAC1B,wBAAwB,EACxB,wBAAwB,EACxB,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,YAAY,CAAC;AAqBpB,4EAA4E;AAC5E,MAAM,UAAU,+BAA+B,CAC7C,MAAqB,EACrB,IAAmC;IAEnC,MAAM,CAAC,OAAO,CAAC,gCAAgC,EAAE;QAC/C,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;QACvD,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;QACpD,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACjD,sBAAsB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACrC,SAAS,CACP,IAAI,EACJ,GAAG,EACH,gCAAgC,CAAC,MAAM,CAAC,sBAAsB,EAC9D,KAAK,EACL,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC1B,UAAU,CAAC,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CACxD;QACH,sBAAsB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACrC,SAAS,CACP,IAAI,EACJ,GAAG,EACH,gCAAgC,CAAC,MAAM,CAAC,sBAAsB,EAC9D,KAAK,EACL,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC1B,UAAU,CAAC,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CACxD;QACH,2BAA2B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC1C,SAAS,CACP,IAAI,EACJ,GAAG,EACH,gCAAgC,CAAC,MAAM,CAAC,2BAA2B,EACnE,KAAK,EACL,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC1B,UAAU,CAAC,2BAA2B,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAC7D;QACH,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzE,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,8BAA8B,EAAE;QAC7C,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAChD,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACxD,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACxD,gBAAgB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAChC,SAAS,CACP,IAAI,EACJ,GAAG,EACH,8BAA8B,CAAC,MAAM,CAAC,gBAAgB,EACtD,MAAM,EACN,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC1B,UAAU,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CACnD;QACH,YAAY,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;KACvD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAC3B,IAA2B,EAC3B,OAAwB,EACxB,MAAsB,EACtB,IAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,qBAAqB,EACrB,OAAO,EACP,MAAM,EACN,IAAI,CACL,CAAC;IACF,MAAM,WAAW,CACf,wBAAwB,EACxB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,gCAAgC,CAAC,MAAM,CAAC,MAAM,EAC9C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,sBAAsB,EAAE,CAAC;SACjC,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAC7C,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,CAAC;SACrC,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAChD,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAA2B,EAC3B,IAAqB;IAErB,OAAO,CAAC,KAAyB,EAAE,MAAsB,EAAE,EAAE,CAC3D,cAAc,CACZ,IAAI,EACJ,MAAM,CAAC,qBAAqB,EAAE;QAC5B,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,EACF,MAAM,EACN,IAAI,CACL,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAChB,IAAmC,EACnC,OAAwB,EACxB,GAAmB;IAEnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAsB;IAC9C,IACE,MAAM,CAAC,WAAW,KAAK,SAAS;QAChC,MAAM,CAAC,WAAW,KAAK,UAAU;QACjC,MAAM,CAAC,MAAM,KAAK,YAAY,EAC9B,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,YAAY,CAAC,0BAA0B,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAC5E,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;GAKG;AACH,KAAK,UAAU,MAAM,CACnB,IAAmC,EACnC,OAAwB,EACxB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,qBAAqB,EACrB,OAAO,EACP,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,wBAAwB,EACxB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,gCAAgC,CAAC,MAAM,CAAC,MAAM,EAC9C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAClD,OAAO,CAAC,4BAA4B,EAAE,CAAC;SACvC,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,4BAA4B,EAAE,CAAC;SACvC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SACpD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,aAAa,CAC1B,IAAmC,EACnC,EAAqB,EACrB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,gCAAgC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EACpD,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,wBAAwB,EAAE,IAAI,CAAC,MAAM,CAAC;SACrC,OAAO,CACN,gBAAgB,CACd,gCAAgC,CAAC,MAAM,CAAC,MAAM,EAC9C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,EAAE,CAAC;SACnC,OAAO,CAAC,mCAAmC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAC3D,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAC5C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,qDAAqD,CAAC,EAChE,+CAA+C,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,OAA0B,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,4EAA4E;AAC5E,KAAK,UAAU,GAAG,CAChB,IAAmC,EACnC,EAAqB,EACrB,GAAmB;IAEnB,OAAO,UAAU,CAAC,IAAI,EAAE,8BAA8B,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,YAAY,CACzB,IAAmC,EACnC,EAAqB,EACrB,GAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,UAAU,CAC9B,IAAI,EACJ,8BAA8B,CAAC,MAAM,CAAC,YAAY,EAClD,EAAE,EACF,GAAG,CACJ,CAAC;IACF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;IAC9C,OAAO,MAAM,CAAC,2BAA2B,EAAE;QACzC,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;QAC9B,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE;QACtC,WAAW,EAAE,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC,IAAI,EAAE;QAC9C,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;KACjC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,IAAmC,EACnC,MAAkB,EAClB,EAAqB,EACrB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,MAAM,CAAC,KAAK,EACZ,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,mBAAmB,MAAM,CAAC,SAAS,EAAE,EACrC,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAChD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAoB,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,MAAM,CACnB,IAAmC,EACnC,MAAa,EACb,GAAmB;IAEnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,GAAG,MAAM,IAAI,CACtB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAC/C,iCAAiC,CAClC,CAAC;IACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,GAAG,MAAM,IAAI,CAClB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EACtD,iCAAiC,CAClC,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,YAAY,CAAC,oCAAoC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,UAAU,CACvB,IAAmC,EACnC,KAA2B,EAC3B,GAAmB;IAEnB,OAAO,mBAAmB,CACxB,IAAI,EACJ,8BAA8B,CAAC,MAAM,CAAC,UAAU,EAChD,KAAK,EACL,GAAG,EACH,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,EAClD,KAAK,CAAC,KAAK,CACZ,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,KAAK,UAAU,UAAU,CACvB,IAAmC,EACnC,KAAY,EACZ,GAAmB;IAEnB,OAAO,mBAAmB,CACxB,IAAI,EACJ,8BAA8B,CAAC,MAAM,CAAC,UAAU,EAChD,KAAK,EACL,GAAG,EACH,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAC5C,KAAK,CAAC,KAAK,CACZ,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,IAAmC,EACnC,MAAkB,EAClB,KAAmC,EACnC,GAAmB,EACnB,MAAkD,EAClD,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC;IACzE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE;QAC3E,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;KACvC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,kBAAkB,CAC/B,IAAmC,EACnC,MAAa,EACb,GAAmB;IAEnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;YACxC,MAAM,IAAI,YAAY,CACpB,GAAG,2BAA2B,GAAG,KAAK,CAAC,OAAO,EAAE,EAChD,IAAI,CAAC,WAAW,CACjB,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,KAAK,GAAG,YAAY,CACxB,IAAI,CAAC,SAAS,EACd,yCAAyC,CAC1C,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,SAAS,GAAmB;YAChC,GAAG,MAAM;YACT,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;SACvC,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,qBAAqB,EACrB,OAAO,EACP,SAAS,EACT,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;QACF,MAAM,QAAQ,GAAG,WAAW,CAC1B,wCAAwC,EACxC,IAAI,CAAC,MAAM,CACZ,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAiBD,KAAK,UAAU,SAAS,CACtB,IAAmC,EACnC,GAAmB,EACnB,MAAkB,EAClB,KAAY,EACZ,GAI6B;IAE7B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACnC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,8BAA8B,CAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAChD,EACD,IAAI,CAAC,aAAa,CACnB,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,mBAAmB,CAAC;IACtC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,oBAAoB,CACxB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACtC,MAAM,oBAAoB,CACxB,8BAA8B,GAAG,CAAC,GAAG,+BAA+B,GAAG,GAAG,CAC3E,CAAC;IACJ,CAAC;IACD,sEAAsE;IACtE,qDAAqD;IACrD,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC9C,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,YAAY,CACpB,qBAAqB,MAAM,IAAI,GAAG,CAAC,IAAI,aAAa,EACpD,IAAI,CAAC,QAAQ,CACd,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC;IACjB,OAAO,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,mGAAmG;AACnG,KAAK,UAAU,IAAI,CACjB,SAA2B,EAC3B,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}

package/dist/domain/identityaccount/operator.d.ts

@@ -0,0 +1,14 @@
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import type { CreateAccount } from "./provisioning.js";
+import type { IdentityAccountStore } from "./store.js";
+/** The operator as boot/config.ts loads it; empty email = the "system" placeholder. */
+export interface OperatorIdentity {
+    readonly email: string;
+    readonly displayName: string;
+}
+export interface OperatorAccountDeps {
+    readonly accounts: IdentityAccountStore;
+    readonly createAccount: CreateAccount;
+}
+export declare function ensureOperatorAccount(deps: OperatorAccountDeps, operator: OperatorIdentity): Promise<IdentityAccount>;
+//# sourceMappingURL=operator.d.ts.map

package/dist/domain/identityaccount/operator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/operator.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAKhG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,uFAAuF;AACvF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;CACvC;AAKD,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,mBAAmB,EACzB,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,eAAe,CAAC,CAiC1B"}

package/dist/domain/identityaccount/operator.js

@@ -0,0 +1,67 @@
+/**
+ * The trusted-local operator account (20260911.11, T01_1_review.md A2,
+ * A5): under the posture with no authentication, the server knows its one
+ * principal from config, so the server states the fact at boot instead of
+ * asking three clients to provision it (the console's gate is off on the
+ * laptop and the desktop has none).
+ *
+ * `ensureOperatorAccount` is create-if-absent under the derived id of
+ * `local|<operator email, or "system">`, through the domain's ONE create
+ * path AS the trusted-local identity, so the row is stamped, derived and
+ * tuple-lifecycled exactly like every other account. Create-if-absent
+ * means a later boot never touches the row: preferences set through
+ * `update` survive a reboot, and a changed display name is edited like
+ * any profile, never re-synced from config. A changed operator email is a
+ * different subject and therefore a different account — the platform
+ * already treats the email as the identity (boot/config.ts
+ * loadOperatorIdentity). Two replicas ensuring at once converge by
+ * primary key: a lost race reads the winner back.
+ *
+ * The operator arrives from the SAME seam the interceptor stamps the
+ * caller from (pipeline/interceptors/auth.ts operatorIdentitySnapshot,
+ * read by the composition root), and the account is created AS the
+ * identity that seam yields for it (trustedLocalIdentityFor — the one
+ * construction of that principal), never from config directly: one
+ * source, so the row, its audit stamp and the per-request caller cannot
+ * disagree (A5).
+ *
+ * Whether this runs at all — only when no authentication posture is on —
+ * is the composition root's decision (boot/compose.ts); the cloud and an
+ * OIDC self-host never create one.
+ */
+import { create } from "@bufbuild/protobuf";
+import { IdentityAccountSpecSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/spec_pb";
+import { trustedLocalIdentityFor } from "../../pipeline/interceptors/auth.js";
+import { accountIdFor, localIdpIdFor } from "./constants.js";
+import { resolveCreateRace } from "./provisioning.js";
+import { assignDirectBackendFields } from "./steps.js";
+/** The unconfigured laptop's operator: what the interceptor stamps as identityId. */
+const SYSTEM_OPERATOR = "system";
+export async function ensureOperatorAccount(deps, operator) {
+    // The caller the interceptor would stamp for this operator; its
+    // identityId (the email, or "system") is the subject's local principal.
+    const caller = trustedLocalIdentityFor(operator);
+    const idpId = localIdpIdFor(caller.identityId);
+    const existing = await deps.accounts.findById(accountIdFor(idpId));
+    if (existing !== undefined) {
+        return existing;
+    }
+    const name = operator.displayName !== ""
+        ? operator.displayName
+        : operator.email !== ""
+            ? operator.email
+            : SYSTEM_OPERATOR;
+    try {
+        return await deps.createAccount({
+            name,
+            spec: assignDirectBackendFields(create(IdentityAccountSpecSchema, {
+                idpId,
+                email: operator.email,
+            })),
+        }, caller);
+    }
+    catch (error) {
+        return resolveCreateRace(error, () => deps.accounts.findById(accountIdFor(idpId)));
+    }
+}
+//# sourceMappingURL=operator.js.map

package/dist/domain/identityaccount/operator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/operator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AAEtG,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAcvD,qFAAqF;AACrF,MAAM,eAAe,GAAG,QAAQ,CAAC;AAEjC,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAyB,EACzB,QAA0B;IAE1B,gEAAgE;IAChE,wEAAwE;IACxE,MAAM,MAAM,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACnE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GACR,QAAQ,CAAC,WAAW,KAAK,EAAE;QACzB,CAAC,CAAC,QAAQ,CAAC,WAAW;QACtB,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE;YACrB,CAAC,CAAC,QAAQ,CAAC,KAAK;YAChB,CAAC,CAAC,eAAe,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,aAAa,CAC7B;YACE,IAAI;YACJ,IAAI,EAAE,yBAAyB,CAC7B,MAAM,CAAC,yBAAyB,EAAE;gBAChC,KAAK;gBACL,KAAK,EAAE,QAAQ,CAAC,KAAK;aACtB,CAAC,CACH;SACF,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,CACnC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAC5C,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/domain/identityaccount/provisioning.d.ts

@@ -0,0 +1,52 @@
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import type { IdentityAccountSpec } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/spec_pb";
+import type { CallerIdentity } from "../../extensions/identity.js";
+import type { IdentityAccountStore } from "./store.js";
+/** The profile an identity provider's userinfo endpoint states. */
+export interface UserProfile {
+    readonly email: string;
+    readonly firstName: string;
+    readonly lastName: string;
+    readonly pictureUrl: string;
+}
+/** The userinfo port: `issuer` is the one that vouched for `accessToken`. */
+export interface UserInfoClient {
+    /** Throws on any failure to obtain a profile (the handler maps UNAVAILABLE). */
+    fetchUserProfile(issuer: string, accessToken: string): Promise<UserProfile>;
+}
+/** Thrown when the profile cannot be fetched; the handler answers UNAVAILABLE. */
+export declare class UserInfoFetchError extends Error {
+    constructor(cause: unknown);
+}
+/** What a caller of the create path supplies: the rest is the chain's. */
+export interface CreateAccountInput {
+    /** `metadata.name`; the chain defaults an empty one. */
+    readonly name: string;
+    readonly spec: IdentityAccountSpec;
+}
+/**
+ * The domain's one create path, as its callers see it: runs the create
+ * chain AS `caller` and answers the persisted account. Built by the
+ * controller (newCreateAccountPath); the provisioner and the operator
+ * ensure call it, nothing else builds an account.
+ */
+export type CreateAccount = (input: CreateAccountInput, caller: CallerIdentity) => Promise<IdentityAccount>;
+export interface DirectAccountProvisionerDeps {
+    readonly accounts: IdentityAccountStore;
+    readonly createAccount: CreateAccount;
+    readonly userInfo: UserInfoClient;
+}
+export interface DirectAccountProvisioner {
+    /** provisionMyAccount's domain flow; `idpId` is the caller's verified subject. */
+    provisionDirectAccount(idpId: string, caller: CallerIdentity): Promise<IdentityAccount>;
+}
+export declare function newDirectAccountProvisioner(deps: DirectAccountProvisionerDeps): DirectAccountProvisioner;
+/**
+ * The concurrent-create resolution every lane uses: on a failed create,
+ * read the winner back by the lane's natural key; a winner is the answer,
+ * whatever the failure's shape (the chain's ALREADY_EXISTS, a driver's
+ * DuplicateAccountError, a transport fault after the row landed). No
+ * winner means the failure was real — it propagates untouched.
+ */
+export declare function resolveCreateRace(error: unknown, findWinner: () => Promise<IdentityAccount | undefined>): Promise<IdentityAccount>;
+//# sourceMappingURL=provisioning.d.ts.map

package/dist/domain/identityaccount/provisioning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioning.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/provisioning.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2DAA2D,CAAC;AAGrG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,mEAAmE;AACnE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,gFAAgF;IAChF,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC7E;AAED,kFAAkF;AAClF,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,KAAK,EAAE,OAAO;CAI3B;AAED,0EAA0E;AAC1E,MAAM,WAAW,kBAAkB;IACjC,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;CACpC;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,KAAK,EAAE,kBAAkB,EACzB,MAAM,EAAE,cAAc,KACnB,OAAO,CAAC,eAAe,CAAC,CAAC;AAE9B,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;CACnC;AAED,MAAM,WAAW,wBAAwB;IACvC,kFAAkF;IAClF,sBAAsB,CACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,eAAe,CAAC,CAAC;CAC7B;AAED,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,4BAA4B,GACjC,wBAAwB,CA+B1B;AAkCD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,OAAO,EACd,UAAU,EAAE,MAAM,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,GACrD,OAAO,CAAC,eAAe,CAAC,CAM1B"}

package/dist/domain/identityaccount/provisioning.js

@@ -0,0 +1,114 @@
+/**
+ * Direct-account self-provisioning (20260911.11, Q-IA-2; the cloud's
+ * iam/account/provisioning.ts steps 1 to 3 as OSS core): the console, the
+ * CLI and the React hook call provisionMyAccount when whoAmI answers
+ * NOT_FOUND on a first sign-in, and the caller's OWN authenticated request
+ * drives provisioning synchronously — no webhook, no external trigger.
+ *
+ * The flow:
+ *   1. Idempotent early return when the subject already has an account
+ *      (a primary-key read of the derived id; no userinfo call).
+ *   2. The profile. A token-bearing caller's comes from the userinfo
+ *      endpoint of the issuer that vouched for the token, fetched with the
+ *      caller's own access token — the token goes only where it came from
+ *      (T01_1_review.md A8). One path for every issuer: `given_name` and
+ *      `family_name` as the IdP states them, where splitting a `name`
+ *      claim would be guesswork. A caller with no issuer (the trusted-local
+ *      operator) never dials out: its profile is what the CallerIdentity
+ *      carries.
+ *   3. Create through the ONE create path the domain owns — the same chain
+ *      the create RPC runs, so the tuple lifecycle fires for both — AS the
+ *      caller: the account is created by the subject it is for, and its
+ *      audit stamp says so. A lost first-login race resolves the winner by
+ *      subject whatever the failure's shape (the cloud's idempotency arm):
+ *      the primary key guarantees one row, so a failed create with a row
+ *      underneath it is a win, not an error.
+ *
+ * Step 4 of the cloud's flow (the personal organization) is not core: it
+ * fires on the `identity-account-provision:post-persist` slot in the
+ * composition (A10), wired by the controller.
+ *
+ * This module holds the domain flow over two PORTS — the store and the
+ * userinfo client — and no network code; identity/oidc-userinfo.ts is the
+ * OIDC implementation the composition root wires in.
+ */
+import { create } from "@bufbuild/protobuf";
+import { IdentityAccountSpecSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/spec_pb";
+import { assignDirectBackendFields } from "./steps.js";
+/** Thrown when the profile cannot be fetched; the handler answers UNAVAILABLE. */
+export class UserInfoFetchError extends Error {
+    constructor(cause) {
+        super(cause instanceof Error ? cause.message : String(cause), { cause });
+        this.name = "UserInfoFetchError";
+    }
+}
+export function newDirectAccountProvisioner(deps) {
+    return {
+        async provisionDirectAccount(idpId, caller) {
+            const existing = await deps.accounts.findDirectByIdpId(idpId);
+            if (existing !== undefined) {
+                return existing;
+            }
+            const profile = await profileOf(deps.userInfo, caller);
+            const input = {
+                name: displayNameOf(caller, profile),
+                spec: assignDirectBackendFields(create(IdentityAccountSpecSchema, {
+                    idpId,
+                    email: profile.email,
+                    firstName: profile.firstName,
+                    lastName: profile.lastName,
+                    pictureUrl: profile.pictureUrl,
+                })),
+            };
+            try {
+                return await deps.createAccount(input, caller);
+            }
+            catch (error) {
+                return resolveCreateRace(error, () => deps.accounts.findDirectByIdpId(idpId));
+            }
+        },
+    };
+}
+/** Userinfo for a token-bearing caller; the identity's own claims otherwise. */
+async function profileOf(userInfo, caller) {
+    if (caller.issuer === "") {
+        return {
+            email: caller.email ?? "",
+            firstName: "",
+            lastName: "",
+            pictureUrl: "",
+        };
+    }
+    try {
+        return await userInfo.fetchUserProfile(caller.issuer, caller.rawToken);
+    }
+    catch (error) {
+        throw new UserInfoFetchError(error);
+    }
+}
+/**
+ * The cloud names a provisioned account by its email; the trusted-local
+ * operator, who has no userinfo, by the display name the identity
+ * carries. An empty result is the chain's to default (DefaultAccountName).
+ */
+function displayNameOf(caller, profile) {
+    if (caller.issuer === "") {
+        return caller.displayName ?? profile.email;
+    }
+    return profile.email;
+}
+/**
+ * The concurrent-create resolution every lane uses: on a failed create,
+ * read the winner back by the lane's natural key; a winner is the answer,
+ * whatever the failure's shape (the chain's ALREADY_EXISTS, a driver's
+ * DuplicateAccountError, a transport fault after the row landed). No
+ * winner means the failure was real — it propagates untouched.
+ */
+export async function resolveCreateRace(error, findWinner) {
+    const winner = await findWinner();
+    if (winner === undefined) {
+        throw error;
+    }
+    return winner;
+}
+//# sourceMappingURL=provisioning.js.map

package/dist/domain/identityaccount/provisioning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioning.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/provisioning.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAI5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AAGtG,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAiBvD,kFAAkF;AAClF,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,KAAc;QACxB,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAkCD,MAAM,UAAU,2BAA2B,CACzC,IAAkC;IAElC,OAAO;QACL,KAAK,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM;YACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC9D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvD,MAAM,KAAK,GAAuB;gBAChC,IAAI,EAAE,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC;gBACpC,IAAI,EAAE,yBAAyB,CAC7B,MAAM,CAAC,yBAAyB,EAAE;oBAChC,KAAK;oBACL,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC,CACH;aACF,CAAC;YAEF,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,CACnC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CACvC,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,SAAS,CACtB,QAAwB,EACxB,MAAsB;IAEtB,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACzB,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACzB,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,EAAE;SACf,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,MAAsB,EAAE,OAAoB;IACjE,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,KAAK,CAAC;IAC7C,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC;AACvB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAc,EACd,UAAsD;IAEtD,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}