@stigmer/server 3.14.0 → 3.15.0

package/dist/domain/identityaccount/resolve.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Subject → identity resolution (20260911.11; T01_0_plan.md Q-IA-2,
+ * T01_1_review.md A1 and A6): the ONE statement of "what identityId does
+ * this subject get stamped with", called by every verifier after its own
+ * credential checks pass — the OIDC lane with the token's `sub`, the
+ * API-key lane with the key's creator stamp.
+ *
+ * The rule is the cloud's direct-login posture (iam/direct/verifier.ts):
+ * one primary-key read of the DIRECT account for the subject; a hit
+ * stamps the account id, so the Authorizer, the audit actor and the
+ * tuple lifecycle see one principal shape for every provisioned user; a
+ * miss returns the subject unchanged, so an unprovisioned caller is
+ * admitted idp-shaped and exactly two RPCs mean anything to them —
+ * whoAmI (NOT_FOUND) and provisionMyAccount. No cache between the two
+ * (Q5's liveness posture): a row that appears is seen by the very next
+ * request, a row that is deleted stops resolving on the next.
+ *
+ * It lives in the domain, not in either verifier, because it is the
+ * domain's knowledge that a subject and an account are two names for one
+ * principal; a verifier only knows which string it was handed. Stated
+ * once, both lanes cannot drift, and a stamp that is already an account
+ * id needs no special case: no account carries an `ida_` as its subject,
+ * so the read is a miss and the stamp is kept.
+ *
+ * Faults: a store failure propagates as the error it is — the chassis
+ * maps a non-ConnectError to INTERNAL (pipeline/interceptors/auth.ts),
+ * so an outage never reads as a bad credential. A hit whose row carries
+ * no id is the one deliberate divergence from the cloud's inline
+ * `metadata?.id ?? ""`: a `""` principal is the silent-junk failure the
+ * oss#405 doctrine forbids, so it is a loud fault naming the subject.
+ */
+import type { IdentityAccountStore } from "./store.js";
+/** The one read a verifier needs from the domain: the direct account for a subject. */
+export type AccountsBySubject = Pick<IdentityAccountStore, "findDirectByIdpId">;
+export declare function identityIdForSubject(accounts: AccountsBySubject, subject: string): Promise<string>;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/domain/identityaccount/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,uFAAuF;AACvF,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;AAEhF,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CAYjB"}

package/dist/domain/identityaccount/resolve.js

@@ -0,0 +1,12 @@
+export async function identityIdForSubject(accounts, subject) {
+    const account = await accounts.findDirectByIdpId(subject);
+    if (account === undefined) {
+        return subject;
+    }
+    const id = account.metadata?.id ?? "";
+    if (id === "") {
+        throw new Error(`identity account for subject '${subject}' carries no id — refusing to stamp an empty principal`);
+    }
+    return id;
+}
+//# sourceMappingURL=resolve.js.map

package/dist/domain/identityaccount/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/resolve.ts"],"names":[],"mappings":"AAoCA,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAA2B,EAC3B,OAAe;IAEf,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,iCAAiC,OAAO,wDAAwD,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/domain/identityaccount/resource-store.d.ts

@@ -0,0 +1,4 @@
+import type { Store } from "../../store/interface.js";
+import type { IdentityAccountStore } from "./store.js";
+export declare function newResourceIdentityAccountStore(store: Store): IdentityAccountStore;
+//# sourceMappingURL=resource-store.d.ts.map

package/dist/domain/identityaccount/resource-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-store.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/resource-store.ts"],"names":[],"mappings":"AA6CA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAGtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAIvD,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,KAAK,GACX,oBAAoB,CAyFtB"}

package/dist/domain/identityaccount/resource-store.js

@@ -0,0 +1,131 @@
+/**
+ * The open-source IdentityAccountStore: the port (store.ts) over the
+ * generic Store, rows of the `resources` table by kind (20260911.11,
+ * T01_1_review.md A1). The composition root installs it when no
+ * extension registers `drivers.identityAccountStore`.
+ *
+ * Every subject lookup is a PRIMARY-KEY read of the derived id
+ * (constants.ts accountIdFor): open source has no legacy random ids, so
+ * "the account with subject S" IS "the row with id accountIdFor(S)". That
+ * is what makes the OIDC lane's per-request resolve, whoAmI and the
+ * provisioning idempotency check O(1) reads with no secondary index and
+ * no scan, and it is why `save` refuses a direct account whose id is not
+ * its derived id — a stray row would be unreachable by subject forever.
+ * `findDirectByEmail` is the one lookup that scans (Store.findByField, a
+ * decode-and-scan of the kind's rows, T01_1_review.md finding 2): an
+ * administrative RPC, never a per-request path.
+ *
+ * `save` and `update` are both read-then-write because the generic
+ * Store's saveResource is an upsert with neither a create-only nor an
+ * update-only form. `save` refuses when the read finds a row (the port:
+ * a held id is DuplicateAccountError, never a silent overwrite); `update`
+ * returns when the read finds none (the port, A12: replace, never
+ * create — a driver whose UPDATE matches no row writes nothing, and this
+ * adapter must not differ). The residual window between the read and
+ * the write admits a same-content overwrite of the first writer's audit
+ * stamp, or a row recreated under a concurrent delete, by milliseconds —
+ * the posture every chain on the platform has today (CheckDuplicate then
+ * upsert); conditional store writes are a platform-wide follow-up, not
+ * this adapter's to invent. The primary key still guarantees ONE row per
+ * subject, which is the invariant that matters.
+ *
+ * Store faults follow the ratified mapping (domain/apikey/lookup.ts): a
+ * typed ResourceNotFoundError reads as `undefined`; anything else
+ * propagates — an outage must never read as "no account".
+ *
+ * The port's contract is proven by store-contract.ts, run over this
+ * adapter on both drivers in __tests__/resource-store.test.ts, which
+ * also pins the two invariants above that are this adapter's own.
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
+import { ResourceNotFoundError } from "../../store/interface.js";
+import { accountIdFor } from "./constants.js";
+import { DuplicateAccountError } from "./store.js";
+const KIND = ApiResourceKind.identity_account;
+export function newResourceIdentityAccountStore(store) {
+    async function readById(id) {
+        try {
+            return await store.getResource(KIND, id, IdentityAccountSchema);
+        }
+        catch (error) {
+            if (error instanceof ResourceNotFoundError) {
+                return undefined;
+            }
+            throw error;
+        }
+    }
+    /** The row for a subject — undefined for the empty subject, which no account carries. */
+    async function readBySubject(idpId) {
+        if (idpId === "") {
+            return undefined;
+        }
+        return readById(accountIdFor(idpId));
+    }
+    return {
+        async save(account) {
+            const id = account.metadata?.id ?? "";
+            const idpId = account.spec?.idpId ?? "";
+            if (isDirect(account) && id !== accountIdFor(idpId)) {
+                throw new Error("direct account id must be derived from its idp_id");
+            }
+            if ((await readById(id)) !== undefined) {
+                throw new DuplicateAccountError(`identity account '${id}' already exists`);
+            }
+            await store.saveResource(KIND, id, IdentityAccountSchema, account);
+        },
+        async update(account) {
+            const id = account.metadata?.id ?? "";
+            if ((await readById(id)) === undefined) {
+                return;
+            }
+            await store.saveResource(KIND, id, IdentityAccountSchema, account);
+        },
+        async deleteById(id) {
+            await store.deleteResource(KIND, id);
+        },
+        findById: readById,
+        findByIdpId: readBySubject,
+        async findDirectByIdpId(idpId) {
+            const account = await readBySubject(idpId);
+            return account !== undefined && isDirect(account) ? account : undefined;
+        },
+        async findDirectByEmail(email) {
+            let account;
+            try {
+                account = await store.findByField(KIND, "spec.email", email, IdentityAccountSchema);
+            }
+            catch (error) {
+                if (error instanceof ResourceNotFoundError) {
+                    return undefined;
+                }
+                throw error;
+            }
+            return isDirect(account) ? account : undefined;
+        },
+        async findByIds(ids) {
+            const found = [];
+            // One row per distinct id, at its first position (the port, A12):
+            // a Set iterates in insertion order, so the dedupe keeps the order.
+            for (const id of new Set(ids)) {
+                const account = await readById(id);
+                if (account !== undefined) {
+                    found.push(account);
+                }
+            }
+            return found;
+        },
+    };
+}
+/**
+ * Non-federated: the platform's own subject. A federated account carries
+ * its identity_provider_ref; open source never writes one (its create
+ * path assigns `direct`), so this is the port's contract stated, not a
+ * branch the OSS store expects to take.
+ */
+function isDirect(account) {
+    return (account.spec?.identityProviderRef === undefined &&
+        account.spec?.provisioningMode !== IdentityAccountProvisioningMode.federated);
+}
+//# sourceMappingURL=resource-store.js.map

package/dist/domain/identityaccount/resource-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-store.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/resource-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AACjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAE5G,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAGnD,MAAM,IAAI,GAAG,eAAe,CAAC,gBAAgB,CAAC;AAE9C,MAAM,UAAU,+BAA+B,CAC7C,KAAY;IAEZ,KAAK,UAAU,QAAQ,CAAC,EAAU;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,yFAAyF;IACzF,KAAK,UAAU,aAAa,CAC1B,KAAa;QAEb,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,OAAO;YAChB,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACxC,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,qBAAqB,CAC7B,qBAAqB,EAAE,kBAAkB,CAC1C,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,qBAAqB,EAAE,OAAO,CAAC,CAAC;QACrE,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,OAAO;YACT,CAAC;YACD,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,qBAAqB,EAAE,OAAO,CAAC,CAAC;QACrE,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE;YACjB,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC;QAED,QAAQ,EAAE,QAAQ;QAElB,WAAW,EAAE,aAAa;QAE1B,KAAK,CAAC,iBAAiB,CAAC,KAAK;YAC3B,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;YAC3C,OAAO,OAAO,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,KAAK;YAC3B,IAAI,OAAwB,CAAC;YAC7B,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAC/B,IAAI,EACJ,YAAY,EACZ,KAAK,EACL,qBAAqB,CACtB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACjD,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,GAAG;YACjB,MAAM,KAAK,GAAsB,EAAE,CAAC;YACpC,kEAAkE;YAClE,oEAAoE;YACpE,KAAK,MAAM,EAAE,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC1B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,OAAwB;IACxC,OAAO,CACL,OAAO,CAAC,IAAI,EAAE,mBAAmB,KAAK,SAAS;QAC/C,OAAO,CAAC,IAAI,EAAE,gBAAgB,KAAK,+BAA+B,CAAC,SAAS,CAC7E,CAAC;AACJ,CAAC"}

package/dist/domain/identityaccount/steps.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Identity-account domain steps (20260911.11; T01_1_review.md A1, A9).
+ *
+ * This is the first OSS domain whose persistence is a PORT
+ * (IdentityAccountStore) rather than the generic Store, so the cloud can
+ * serve the same controller over its own table. The shared steps that
+ * touch storage (CheckDuplicate, LoadExisting, LoadTarget, Persist, the
+ * delete pair) are typed over `Store`; this module brings the domain's
+ * own under the SAME names, so a chain reads onto the inventory unchanged
+ * (the organization domain's "own step, same name" precedent), and reuses
+ * every storage-free shared step as it is. The shared context keys are
+ * reused too, so BuildUpdateState finds EXISTING_RESOURCE_KEY exactly
+ * where it expects it.
+ *
+ * The domain's own rules:
+ *   - DefaultAccountName: `metadata.name` falls back to the email, then
+ *     the subject. ResolveSlug refuses an empty name and the field is not
+ *     proto-required, and a machine subject whose IdP releases no email
+ *     must still provision.
+ *   - DeriveAccountId (A1): `metadata.id = accountIdFor(spec.idp_id)`,
+ *     replacing whatever the caller sent (the organization's CopySlugToId
+ *     precedent, `metadata.proto`'s documented exception). Runs BEFORE
+ *     BuildNewState, which mints only when the id is empty.
+ *   - CheckDuplicate: by SUBJECT, a primary-key read of the derived id —
+ *     two accounts may share an email; the account's uniqueness is its
+ *     subject, never its slug (the guideline's "domains with different
+ *     uniqueness rules bring their own step under the same name").
+ *   - AssignBackendFields: `is_machine_account` from the `@clients`
+ *     suffix and `provisioning_mode direct` on create (the spec's
+ *     "assigned by backend" fields); on update, every backend-assigned
+ *     field and the email are preserved from the existing row (A9: the
+ *     cloud's writable surface — first/last name, picture, preferences —
+ *     and nothing else; the `preserveImmutableFields` shape).
+ *   - GuardImmutableSubject (A1): a changed `spec.idp_id` is refused
+ *     FAILED_PRECONDITION (the schedule domain's shape), never silently
+ *     preserved — the subject IS the identity, and a client that sends a
+ *     different one has a bug it should hear about.
+ *
+ * NOT_FOUND copy is the domain's (`Identity account not found: <id>`, the
+ * cloud's byte-pinned sentence); the shared `notFoundError` would render
+ * the kind_meta name `IdentityAccount`.
+ */
+import { ConnectError } from "@connectrpc/connect";
+import type { DescMessage } from "@bufbuild/protobuf";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import type { IdentityAccountSpec } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/spec_pb";
+import type { PipelineStep } from "../../pipeline/pipeline.js";
+import type { IdentityAccountStore } from "./store.js";
+type AccountStep = PipelineStep<typeof IdentityAccountSchema>;
+/** `Identity account not found: <handle>` as a NOT_FOUND ConnectError. */
+export declare function accountNotFoundError(handle: string): ConnectError;
+export declare function newDefaultAccountNameStep(): AccountStep;
+export declare function newDeriveAccountIdStep(): AccountStep;
+/** Rejects a create whose SUBJECT already has an account (a primary-key read). */
+export declare function newCheckDuplicateStep(accounts: IdentityAccountStore): AccountStep;
+/**
+ * The backend-assigned fields of a DIRECT account, applied in place: the
+ * machine flag from the subject's shape, `provisioning_mode direct`, no
+ * provider ref (a direct account is the platform's own subject). The ONE
+ * writer of these fields; the provisioner builds its spec through it too.
+ */
+export declare function assignDirectBackendFields(spec: IdentityAccountSpec): IdentityAccountSpec;
+export declare function newAssignBackendFieldsStep(): AccountStep;
+/** Saves the new account through the port; a held subject is ALREADY_EXISTS. */
+export declare function newPersistNewAccountStep(accounts: IdentityAccountStore): AccountStep;
+/** Loads the existing account by id into EXISTING_RESOURCE_KEY; the domain's NOT_FOUND copy. */
+export declare function newLoadExistingAccountStep(accounts: IdentityAccountStore): AccountStep;
+export declare function newGuardImmutableSubjectStep(): AccountStep;
+/** Preserves the backend-assigned fields and the email from the existing row (A9). */
+export declare function newPreserveBackendFieldsStep(): AccountStep;
+/** Replaces the row through the port. */
+export declare function newPersistUpdatedAccountStep(accounts: IdentityAccountStore): AccountStep;
+/** Loads the account named by an ID-wrapper input into TARGET_RESOURCE_KEY. */
+export declare function newLoadTargetAccountStep<InputDesc extends DescMessage>(accounts: IdentityAccountStore): PipelineStep<InputDesc>;
+/** Loads the doomed account (after ExtractResourceId) so delete can return it. */
+export declare function newLoadExistingAccountForDeleteStep<InputDesc extends DescMessage>(accounts: IdentityAccountStore): PipelineStep<InputDesc>;
+export declare function newDeleteAccountStep<InputDesc extends DescMessage>(accounts: IdentityAccountStore): PipelineStep<InputDesc>;
+export {};
+//# sourceMappingURL=steps.d.ts.map

package/dist/domain/identityaccount/steps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAQ,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAItD,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AAEjG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2DAA2D,CAAC;AASrG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAa/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,KAAK,WAAW,GAAG,YAAY,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAM9D,0EAA0E;AAC1E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAEjE;AAMD,wBAAgB,yBAAyB,IAAI,WAAW,CAWvD;AAED,wBAAgB,sBAAsB,IAAI,WAAW,CAiBpD;AAED,kFAAkF;AAClF,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,oBAAoB,GAC7B,WAAW,CAoBb;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,mBAAmB,GACxB,mBAAmB,CAKrB;AAED,wBAAgB,0BAA0B,IAAI,WAAW,CAOxD;AAED,gFAAgF;AAChF,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,oBAAoB,GAC7B,WAAW,CAiBb;AAMD,gGAAgG;AAChG,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,oBAAoB,GAC7B,WAAW,CAeb;AAED,wBAAgB,4BAA4B,IAAI,WAAW,CAW1D;AAED,sFAAsF;AACtF,wBAAgB,4BAA4B,IAAI,WAAW,CAe1D;AAED,yCAAyC;AACzC,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,oBAAoB,GAC7B,WAAW,CAWb;AAMD,+EAA+E;AAC/E,wBAAgB,wBAAwB,CAAC,SAAS,SAAS,WAAW,EACpE,QAAQ,EAAE,oBAAoB,GAC7B,YAAY,CAAC,SAAS,CAAC,CAWzB;AAED,kFAAkF;AAClF,wBAAgB,mCAAmC,CACjD,SAAS,SAAS,WAAW,EAC7B,QAAQ,EAAE,oBAAoB,GAAG,YAAY,CAAC,SAAS,CAAC,CAUzD;AAED,wBAAgB,oBAAoB,CAAC,SAAS,SAAS,WAAW,EAChE,QAAQ,EAAE,oBAAoB,GAC7B,YAAY,CAAC,SAAS,CAAC,CAWzB"}

package/dist/domain/identityaccount/steps.js

@@ -0,0 +1,291 @@
+/**
+ * Identity-account domain steps (20260911.11; T01_1_review.md A1, A9).
+ *
+ * This is the first OSS domain whose persistence is a PORT
+ * (IdentityAccountStore) rather than the generic Store, so the cloud can
+ * serve the same controller over its own table. The shared steps that
+ * touch storage (CheckDuplicate, LoadExisting, LoadTarget, Persist, the
+ * delete pair) are typed over `Store`; this module brings the domain's
+ * own under the SAME names, so a chain reads onto the inventory unchanged
+ * (the organization domain's "own step, same name" precedent), and reuses
+ * every storage-free shared step as it is. The shared context keys are
+ * reused too, so BuildUpdateState finds EXISTING_RESOURCE_KEY exactly
+ * where it expects it.
+ *
+ * The domain's own rules:
+ *   - DefaultAccountName: `metadata.name` falls back to the email, then
+ *     the subject. ResolveSlug refuses an empty name and the field is not
+ *     proto-required, and a machine subject whose IdP releases no email
+ *     must still provision.
+ *   - DeriveAccountId (A1): `metadata.id = accountIdFor(spec.idp_id)`,
+ *     replacing whatever the caller sent (the organization's CopySlugToId
+ *     precedent, `metadata.proto`'s documented exception). Runs BEFORE
+ *     BuildNewState, which mints only when the id is empty.
+ *   - CheckDuplicate: by SUBJECT, a primary-key read of the derived id —
+ *     two accounts may share an email; the account's uniqueness is its
+ *     subject, never its slug (the guideline's "domains with different
+ *     uniqueness rules bring their own step under the same name").
+ *   - AssignBackendFields: `is_machine_account` from the `@clients`
+ *     suffix and `provisioning_mode direct` on create (the spec's
+ *     "assigned by backend" fields); on update, every backend-assigned
+ *     field and the email are preserved from the existing row (A9: the
+ *     cloud's writable surface — first/last name, picture, preferences —
+ *     and nothing else; the `preserveImmutableFields` shape).
+ *   - GuardImmutableSubject (A1): a changed `spec.idp_id` is refused
+ *     FAILED_PRECONDITION (the schedule domain's shape), never silently
+ *     preserved — the subject IS the identity, and a client that sends a
+ *     different one has a bug it should hear about.
+ *
+ * NOT_FOUND copy is the domain's (`Identity account not found: <id>`, the
+ * cloud's byte-pinned sentence); the shared `notFoundError` would render
+ * the kind_meta name `IdentityAccount`.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { create } from "@bufbuild/protobuf";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
+import { IdentityAccountSpecSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/spec_pb";
+import { alreadyExistsError, failedPreconditionError, internalError, invalidArgumentError, } from "../../pipeline/errors.js";
+import { RESOURCE_ID_KEY } from "../../pipeline/steps/delete.js";
+import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
+import { TARGET_RESOURCE_KEY } from "../../pipeline/steps/load-target.js";
+import { idValueOf, metadataOf } from "../../pipeline/steps/shapes.js";
+import { accountIdFor, accountNotFoundMessage, idpIdImmutableMessage, isMachineSubject, } from "./constants.js";
+import { DuplicateAccountError } from "./store.js";
+/** The kind's name as the shared error constructors render it. */
+const KIND_NAME = "IdentityAccount";
+/** `Identity account not found: <handle>` as a NOT_FOUND ConnectError. */
+export function accountNotFoundError(handle) {
+    return new ConnectError(accountNotFoundMessage(handle), Code.NotFound);
+}
+// ---------------------------------------------------------------------------
+// Create
+// ---------------------------------------------------------------------------
+export function newDefaultAccountNameStep() {
+    return {
+        name: "DefaultAccountName",
+        execute(ctx) {
+            const metadata = requireMetadata(ctx, "default account name");
+            if (metadata.name === "") {
+                const spec = specOf(ctx);
+                metadata.name = spec.email !== "" ? spec.email : spec.idpId;
+            }
+        },
+    };
+}
+export function newDeriveAccountIdStep() {
+    return {
+        name: "DeriveAccountId",
+        execute(ctx) {
+            const metadata = requireMetadata(ctx, "derive account id");
+            // ValidateProto ran upstream (idp_id is required), so an empty
+            // subject here is a pipeline-ordering bug, not bad client input.
+            const idpId = specOf(ctx).idpId;
+            if (idpId === "") {
+                throw internalError(new Error("identity account idp_id is empty"), "derive account id");
+            }
+            metadata.id = accountIdFor(idpId);
+        },
+    };
+}
+/** Rejects a create whose SUBJECT already has an account (a primary-key read). */
+export function newCheckDuplicateStep(accounts) {
+    return {
+        name: "CheckDuplicate",
+        async execute(ctx) {
+            const metadata = requireMetadata(ctx, "duplicate check");
+            const idpId = specOf(ctx).idpId;
+            let existing;
+            try {
+                existing = await accounts.findById(metadata.id);
+            }
+            catch (error) {
+                throw internalError(error, "failed to check for duplicate identity account");
+            }
+            if (existing !== undefined) {
+                throw alreadyExistsError(KIND_NAME, `subject '${idpId}'`);
+            }
+        },
+    };
+}
+/**
+ * The backend-assigned fields of a DIRECT account, applied in place: the
+ * machine flag from the subject's shape, `provisioning_mode direct`, no
+ * provider ref (a direct account is the platform's own subject). The ONE
+ * writer of these fields; the provisioner builds its spec through it too.
+ */
+export function assignDirectBackendFields(spec) {
+    spec.isMachineAccount = isMachineSubject(spec.idpId);
+    spec.provisioningMode = IdentityAccountProvisioningMode.direct;
+    spec.identityProviderRef = undefined;
+    return spec;
+}
+export function newAssignBackendFieldsStep() {
+    return {
+        name: "AssignBackendFields",
+        execute(ctx) {
+            assignDirectBackendFields(specOf(ctx));
+        },
+    };
+}
+/** Saves the new account through the port; a held subject is ALREADY_EXISTS. */
+export function newPersistNewAccountStep(accounts) {
+    return {
+        name: "Persist",
+        async execute(ctx) {
+            try {
+                await accounts.save(ctx.newState);
+            }
+            catch (error) {
+                if (error instanceof DuplicateAccountError) {
+                    // The race the duplicate check could not see: another writer
+                    // took the subject between the read and this save. The
+                    // provisioner's race arm resolves the winner from this code.
+                    throw alreadyExistsError(KIND_NAME, `subject '${specOf(ctx).idpId}'`);
+                }
+                throw internalError(error, "failed to save identity account");
+            }
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Update
+// ---------------------------------------------------------------------------
+/** Loads the existing account by id into EXISTING_RESOURCE_KEY; the domain's NOT_FOUND copy. */
+export function newLoadExistingAccountStep(accounts) {
+    return {
+        name: "LoadExisting",
+        async execute(ctx) {
+            const metadata = requireMetadata(ctx, "load existing");
+            if (metadata.id === "") {
+                // By id only: an account's slug is derived from its display name
+                // and two accounts may share one, so a slug lookup could never be
+                // an identity.
+                throw invalidArgumentError("resource id is required for update");
+            }
+            const existing = await readAccount(accounts, metadata.id);
+            ctx.set(EXISTING_RESOURCE_KEY, existing);
+        },
+    };
+}
+export function newGuardImmutableSubjectStep() {
+    return {
+        name: "GuardImmutableSubject",
+        execute(ctx) {
+            const existing = existingAccountOf(ctx);
+            const existingIdpId = existing.spec?.idpId ?? "";
+            if (specOf(ctx).idpId !== existingIdpId) {
+                throw failedPreconditionError(idpIdImmutableMessage(existingIdpId));
+            }
+        },
+    };
+}
+/** Preserves the backend-assigned fields and the email from the existing row (A9). */
+export function newPreserveBackendFieldsStep() {
+    return {
+        name: "AssignBackendFields",
+        execute(ctx) {
+            const existingSpec = existingAccountOf(ctx).spec;
+            const spec = specOf(ctx);
+            spec.idpId = existingSpec?.idpId ?? spec.idpId;
+            spec.email = existingSpec?.email ?? "";
+            spec.isMachineAccount = existingSpec?.isMachineAccount ?? false;
+            spec.provisioningMode =
+                existingSpec?.provisioningMode ??
+                    IdentityAccountProvisioningMode.identity_account_provisioning_mode_unspecified;
+            spec.identityProviderRef = existingSpec?.identityProviderRef;
+        },
+    };
+}
+/** Replaces the row through the port. */
+export function newPersistUpdatedAccountStep(accounts) {
+    return {
+        name: "Persist",
+        async execute(ctx) {
+            try {
+                await accounts.update(ctx.newState);
+            }
+            catch (error) {
+                throw internalError(error, "failed to save identity account");
+            }
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Get / Delete (ID-wrapper inputs)
+// ---------------------------------------------------------------------------
+/** Loads the account named by an ID-wrapper input into TARGET_RESOURCE_KEY. */
+export function newLoadTargetAccountStep(accounts) {
+    return {
+        name: "LoadTarget",
+        async execute(ctx) {
+            const id = idValueOf(ctx.input);
+            if (id === "") {
+                throw invalidArgumentError("resource id is required");
+            }
+            ctx.set(TARGET_RESOURCE_KEY, await readAccount(accounts, id));
+        },
+    };
+}
+/** Loads the doomed account (after ExtractResourceId) so delete can return it. */
+export function newLoadExistingAccountForDeleteStep(accounts) {
+    return {
+        name: "LoadExistingForDelete",
+        async execute(ctx) {
+            ctx.set(EXISTING_RESOURCE_KEY, await readAccount(accounts, requireResourceId(ctx)));
+        },
+    };
+}
+export function newDeleteAccountStep(accounts) {
+    return {
+        name: "DeleteResource",
+        async execute(ctx) {
+            try {
+                await accounts.deleteById(requireResourceId(ctx));
+            }
+            catch (error) {
+                throw internalError(error, "failed to delete identity account");
+            }
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Shared readers
+// ---------------------------------------------------------------------------
+/** The account by id, or the domain's NOT_FOUND; any other fault propagates. */
+async function readAccount(accounts, id) {
+    const account = await accounts.findById(id);
+    if (account === undefined) {
+        throw accountNotFoundError(id);
+    }
+    return account;
+}
+function requireMetadata(ctx, operation) {
+    const metadata = metadataOf(ctx.newState);
+    if (metadata === undefined) {
+        throw internalError(new Error("identity account metadata is nil"), operation);
+    }
+    return metadata;
+}
+/** The spec being built, created in place when the caller omitted it. */
+function specOf(ctx) {
+    const state = ctx.newState;
+    if (state.spec === undefined) {
+        state.spec = create(IdentityAccountSpecSchema);
+    }
+    return state.spec;
+}
+function existingAccountOf(ctx) {
+    const existing = ctx.get(EXISTING_RESOURCE_KEY);
+    if (existing === undefined) {
+        throw internalError(new Error("existing identity account not found in context - LoadExisting must run first"), "identity account update ordering");
+    }
+    return existing;
+}
+function requireResourceId(ctx) {
+    const id = ctx.get(RESOURCE_ID_KEY);
+    if (typeof id !== "string" || id === "") {
+        throw internalError(new Error("resource id not found in context (ExtractResourceId must run first)"), "identity account delete ordering");
+    }
+    return id;
+}
+//# sourceMappingURL=steps.js.map

package/dist/domain/identityaccount/steps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAI5C,OAAO,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAE5G,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AAEtG,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAMnD,kEAAkE;AAClE,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAEpC,0EAA0E;AAC1E,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,OAAO,IAAI,YAAY,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,OAAO,CAAC,GAAmB;YACzB,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;YAC9D,IAAI,QAAQ,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;gBACzB,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YAC9D,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,CAAC,GAAmB;YACzB,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YAC3D,+DAA+D;YAC/D,iEAAiE;YACjE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;YAChC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACjB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,kCAAkC,CAAC,EAC7C,mBAAmB,CACpB,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,qBAAqB,CACnC,QAA8B;IAE9B,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,OAAO,CAAC,GAAmB;YAC/B,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YACzD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;YAChC,IAAI,QAAqC,CAAC;YAC1C,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CACjB,KAAK,EACL,gDAAgD,CACjD,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,kBAAkB,CAAC,SAAS,EAAE,YAAY,KAAK,GAAG,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAyB;IAEzB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,gBAAgB,GAAG,+BAA+B,CAAC,MAAM,CAAC;IAC/D,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAC;IACrC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,OAAO,CAAC,GAAmB;YACzB,yBAAyB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,wBAAwB,CACtC,QAA8B;IAE9B,OAAO;QACL,IAAI,EAAE,SAAS;QACf,KAAK,CAAC,OAAO,CAAC,GAAmB;YAC/B,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACpC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,6DAA6D;oBAC7D,uDAAuD;oBACvD,6DAA6D;oBAC7D,MAAM,kBAAkB,CAAC,SAAS,EAAE,YAAY,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;gBACxE,CAAC;gBACD,MAAM,aAAa,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,gGAAgG;AAChG,MAAM,UAAU,0BAA0B,CACxC,QAA8B;IAE9B,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,KAAK,CAAC,OAAO,CAAC,GAAmB;YAC/B,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;YACvD,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACvB,iEAAiE;gBACjE,kEAAkE;gBAClE,eAAe;gBACf,MAAM,oBAAoB,CAAC,oCAAoC,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC1D,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,OAAO,CAAC,GAAmB;YACzB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACxC,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACjD,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;gBACxC,MAAM,uBAAuB,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,OAAO,CAAC,GAAmB;YACzB,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,CAAC,KAAK,GAAG,YAAY,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;YAC/C,IAAI,CAAC,KAAK,GAAG,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC;YACvC,IAAI,CAAC,gBAAgB,GAAG,YAAY,EAAE,gBAAgB,IAAI,KAAK,CAAC;YAChE,IAAI,CAAC,gBAAgB;gBACnB,YAAY,EAAE,gBAAgB;oBAC9B,+BAA+B,CAAC,8CAA8C,CAAC;YACjF,IAAI,CAAC,mBAAmB,GAAG,YAAY,EAAE,mBAAmB,CAAC;QAC/D,CAAC;KACF,CAAC;AACJ,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,4BAA4B,CAC1C,QAA8B;IAE9B,OAAO;QACL,IAAI,EAAE,SAAS;QACf,KAAK,CAAC,OAAO,CAAC,GAAmB;YAC/B,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E,+EAA+E;AAC/E,MAAM,UAAU,wBAAwB,CACtC,QAA8B;IAE9B,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,KAAK,CAAC,OAAO,CAAC,GAA8B;YAC1C,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACd,MAAM,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;YACxD,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,mCAAmC,CAEjD,QAA8B;IAC9B,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,KAAK,CAAC,OAAO,CAAC,GAA8B;YAC1C,GAAG,CAAC,GAAG,CACL,qBAAqB,EACrB,MAAM,WAAW,CAAC,QAAQ,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CACpD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAA8B;IAE9B,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,OAAO,CAAC,GAA8B;YAC1C,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,mCAAmC,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,gFAAgF;AAChF,KAAK,UAAU,WAAW,CACxB,QAA8B,EAC9B,EAAU;IAEV,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,GAAmB,EAAE,SAAiB;IAC7D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,kCAAkC,CAAC,EAC7C,SAAS,CACV,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,yEAAyE;AACzE,SAAS,MAAM,CAAC,GAAmB;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAmB;IAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAEjC,CAAC;IACd,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,8EAA8E,CAC/E,EACD,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAyB;IAEzB,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,qEAAqE,CACtE,EACD,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/domain/identityaccount/store-contract.d.ts

@@ -0,0 +1,22 @@
+import type { IdentityAccountStore } from "./store.js";
+/** One fresh, isolated store per case, plus the one escape hatch the port cannot express. */
+export interface IdentityAccountStoreContractFixture {
+    readonly store: IdentityAccountStore;
+    /**
+     * Cuts the store from its database so every later call is an
+     * infrastructure fault. `cleanup` still runs afterwards and must tolerate
+     * a disconnected store (both OSS drivers' `close` is idempotent; a pool
+     * fixture ends a per-case pool here and skips it in cleanup).
+     */
+    disconnect(): Promise<void>;
+    cleanup(): Promise<void>;
+}
+export interface IdentityAccountStoreContractCase {
+    /** The contract line, in the port's words; the framework prints it as the test name. */
+    readonly name: string;
+    /** Makes a FRESH fixture, runs the case, cleans up. A failing assertion wins over a failing cleanup. */
+    run(): Promise<void>;
+}
+/** The port's cases over `makeFixture`, one fresh fixture per case. */
+export declare function identityAccountStoreContract(makeFixture: () => Promise<IdentityAccountStoreContractFixture>): ReadonlyArray<IdentityAccountStoreContractCase>;
+//# sourceMappingURL=store-contract.d.ts.map

package/dist/domain/identityaccount/store-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-contract.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/store-contract.ts"],"names":[],"mappings":"AAwDA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,6FAA6F;AAC7F,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC;;;;;OAKG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,gCAAgC;IAC/C,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wGAAwG;IACxG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACtB;AAkYD,uEAAuE;AACvE,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,OAAO,CAAC,mCAAmC,CAAC,GAC9D,aAAa,CAAC,gCAAgC,CAAC,CAKjD"}