@stigmer/server 3.14.0 → 3.15.0

package/dist/domain/identityaccount/store-contract.js

@@ -0,0 +1,307 @@
+/**
+ * The IdentityAccountStore PORT-CONTRACT KIT (20260911.11, T01_1_review.md
+ * A11 and A12): every behavior an implementation of store.ts must satisfy
+ * identically, as cases a driver's test iterates. Open source runs them
+ * over its own adapter (resource-store.ts) on sqlite and Postgres in
+ * __tests__/resource-store.test.ts; a composition runs the SAME cases over
+ * the store it registers as `drivers.identityAccountStore` (the cloud's
+ * `cloud.iam_identity_account` store), so "the port holds" is one
+ * statement proven per driver, never restated per repository.
+ *
+ * Shape. The package's precedent is store/__tests__/store-contract.ts —
+ * `describeStoreContract(makeFixture)`: a fresh fixture per test, named
+ * escape hatches for the arms the interface cannot express, driver-physical
+ * behavior left to each driver's own tests. This kit follows it in
+ * everything but the framework: it is consumed by ANOTHER package's tests,
+ * so it ships in dist/ and must not import vitest — a devDependency that
+ * would enter the root barrel's runtime import graph. It therefore returns
+ * cases instead of calling `describe`, asserts through node:assert/strict,
+ * and the consumer's framework does `for (const c of cases) it(c.name,
+ * c.run)`. Do not "fix" it back to the precedent's vitest shape.
+ *
+ * Every case makes a FRESH fixture, runs, and cleans up; a failing
+ * assertion wins over a failing cleanup. `disconnect` is the one escape
+ * hatch: the port has no lifecycle by design (a composition owns its
+ * store's), yet "an outage never reads as no account" is the line that
+ * matters most, so the fixture cuts the store from its database and the
+ * kit asserts that the fault propagates instead of reading as `undefined`.
+ *
+ * What the kit deliberately does not carry: open source's primary-key read
+ * (the findByField spy) and its derived-id refusal, the cloud's column
+ * layout and SQLSTATE 23505 mapping — driver-physical, each driver's own
+ * tests. Nor does any case hold a direct and a federated row under one
+ * subject: open source has no federated writer and its derived-id key could
+ * not hold both. The federated fixture carries the derived id of its
+ * subject, so the OSS adapter's mode filter — not an unreachable id — is
+ * what the direct-only arms exercise.
+ *
+ * The duplicate arm checks `instanceof DuplicateAccountError` on the
+ * exported class, because that is how the domain's race arm (steps.ts)
+ * catches it: a driver throwing a lookalike fails here for the reason it
+ * would fail provisioning.
+ *
+ * Case names are the contract lines, in the port's words. The OSS test pins
+ * the full list, so a case cannot drop out of the kit unnoticed.
+ */
+import assert from "node:assert/strict";
+import { create, equals } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
+import { accountIdFor } from "./constants.js";
+import { DuplicateAccountError } from "./store.js";
+/** A direct account as the domain writes it: id derived from the subject, mode direct. */
+function directAccount(overrides) {
+    return create(IdentityAccountSchema, {
+        apiVersion: "iam.stigmer.ai/v1",
+        kind: "IdentityAccount",
+        metadata: {
+            id: accountIdFor(overrides.idpId),
+            name: overrides.email ?? overrides.idpId,
+        },
+        spec: {
+            idpId: overrides.idpId,
+            email: overrides.email ?? "",
+            firstName: overrides.firstName ?? "",
+            provisioningMode: IdentityAccountProvisioningMode.direct,
+        },
+    });
+}
+/**
+ * A federated account: a customer IdP's subject, marked by its
+ * identity_provider_ref and mode. Its id is the derived id of its subject
+ * (see the header: the mode filter, not the id, must be what excludes it).
+ */
+function federatedAccount(overrides) {
+    return create(IdentityAccountSchema, {
+        apiVersion: "iam.stigmer.ai/v1",
+        kind: "IdentityAccount",
+        metadata: { id: accountIdFor(overrides.idpId), name: overrides.email },
+        spec: {
+            idpId: overrides.idpId,
+            email: overrides.email,
+            provisioningMode: IdentityAccountProvisioningMode.federated,
+            identityProviderRef: {
+                org: "acme",
+                kind: ApiResourceKind.identity_provider,
+                slug: "acme-okta",
+            },
+        },
+    });
+}
+/** A direct account with no subject — the row no lookup could ever reach. */
+function subjectlessDirectAccount() {
+    return create(IdentityAccountSchema, {
+        apiVersion: "iam.stigmer.ai/v1",
+        kind: "IdentityAccount",
+        metadata: { id: "ida_00000000000000000000000000", name: "subjectless" },
+        spec: {
+            idpId: "",
+            provisioningMode: IdentityAccountProvisioningMode.direct,
+        },
+    });
+}
+/** The id of the account, asserted present so a message names the row, not `undefined`. */
+function idOf(account) {
+    const id = account.metadata?.id ?? "";
+    assert.notEqual(id, "", "a fixture account must carry an id");
+    return id;
+}
+function subjectsOf(accounts) {
+    return accounts.map((account) => account.spec?.idpId ?? "");
+}
+const CASES = [
+    [
+        "save then findById round-trips the account",
+        async ({ store }) => {
+            const account = directAccount({
+                idpId: "auth0|alice",
+                email: "alice@example.com",
+            });
+            await store.save(account);
+            const found = await store.findById(idOf(account));
+            assert.ok(found !== undefined, "a saved account must be readable by id");
+            assert.ok(equals(IdentityAccountSchema, found, account), "findById must return the account exactly as it was saved");
+        },
+    ],
+    [
+        "a second save under a held id is DuplicateAccountError, and the first row stands",
+        async ({ store }) => {
+            const first = directAccount({ idpId: "auth0|bob", firstName: "First" });
+            const second = directAccount({
+                idpId: "auth0|bob",
+                firstName: "Second",
+            });
+            await store.save(first);
+            await assert.rejects(store.save(second), DuplicateAccountError, "save under a held id must raise the exported DuplicateAccountError, never overwrite");
+            const standing = await store.findDirectByIdpId("auth0|bob");
+            assert.equal(standing?.spec?.firstName, "First", "the first writer's row must stand after a refused duplicate");
+        },
+    ],
+    [
+        "findDirectByIdpId answers a direct account by its subject and undefined for an unknown one",
+        async ({ store }) => {
+            await store.save(directAccount({ idpId: "auth0|carol" }));
+            const hit = await store.findDirectByIdpId("auth0|carol");
+            assert.equal(hit?.metadata?.id, accountIdFor("auth0|carol"), "the direct account for a subject must be found by that subject");
+            assert.equal(await store.findDirectByIdpId("auth0|nobody"), undefined, "an unknown subject must read as undefined, not as an error");
+        },
+    ],
+    [
+        "findByIdpId (any mode) answers the same direct account",
+        async ({ store }) => {
+            await store.save(directAccount({ idpId: "auth0|dave" }));
+            assert.equal((await store.findByIdpId("auth0|dave"))?.spec?.idpId, "auth0|dave", "findByIdpId must answer a direct account by its subject");
+            assert.equal(await store.findByIdpId("auth0|nobody"), undefined, "an unknown subject must read as undefined on the any-mode lookup too");
+        },
+    ],
+    [
+        "findDirectByEmail is an exact, case-sensitive match on direct accounts",
+        async ({ store }) => {
+            await store.save(directAccount({ idpId: "auth0|erin", email: "erin@example.com" }));
+            assert.equal((await store.findDirectByEmail("erin@example.com"))?.spec?.idpId, "auth0|erin", "the direct account with an email must be found by that exact email");
+            assert.equal(await store.findDirectByEmail("ERIN@example.com"), undefined, "the email match is exact: a different case is a different string");
+            assert.equal(await store.findDirectByEmail("nobody@example.com"), undefined, "an unknown email must read as undefined");
+        },
+    ],
+    [
+        "update replaces the row in place and keeps the id",
+        async ({ store }) => {
+            const account = directAccount({
+                idpId: "auth0|frank",
+                firstName: "Frank",
+            });
+            await store.save(account);
+            await store.update(directAccount({ idpId: "auth0|frank", firstName: "Francis" }));
+            const updated = await store.findById(idOf(account));
+            assert.equal(updated?.spec?.firstName, "Francis", "update must replace the stored row with the given one");
+            assert.equal(updated?.metadata?.id, idOf(account), "update must not move the row to another id");
+        },
+    ],
+    [
+        "deleteById removes the row; the subject is free to be provisioned again",
+        async ({ store }) => {
+            const account = directAccount({ idpId: "auth0|grace" });
+            await store.save(account);
+            await store.deleteById(idOf(account));
+            assert.equal(await store.findById(idOf(account)), undefined, "a deleted account must not be readable by id");
+            assert.equal(await store.findDirectByIdpId("auth0|grace"), undefined, "a deleted account must not be readable by subject");
+            await assert.doesNotReject(store.save(account), "the subject of a deleted account must be savable again");
+        },
+    ],
+    [
+        "findByIds answers the present ones in request order and skips the unknown",
+        async ({ store }) => {
+            const heidi = directAccount({ idpId: "auth0|heidi" });
+            const ivan = directAccount({ idpId: "auth0|ivan" });
+            await store.save(heidi);
+            await store.save(ivan);
+            const found = await store.findByIds([
+                idOf(ivan),
+                "ida_00000000000000000000000000",
+                idOf(heidi),
+            ]);
+            assert.deepEqual(subjectsOf(found), ["auth0|ivan", "auth0|heidi"], "findByIds must keep the request's order and skip ids that are not held");
+        },
+    ],
+    [
+        "a disconnected store is an infrastructure fault, never 'not found'",
+        async (fixture) => {
+            await fixture.disconnect();
+            await assert.rejects(fixture.store.findDirectByIdpId("auth0|anyone"), "a subject read on a disconnected store must reject, never read as undefined");
+            await assert.rejects(fixture.store.findById(accountIdFor("auth0|anyone")), "an id read on a disconnected store must reject, never read as undefined");
+        },
+    ],
+    [
+        "two concurrent saves of one subject end in fulfilments and DuplicateAccountErrors only, and the winner is readable by subject",
+        async ({ store }) => {
+            const results = await Promise.allSettled([
+                store.save(directAccount({ idpId: "auth0|race", firstName: "A" })),
+                store.save(directAccount({ idpId: "auth0|race", firstName: "B" })),
+            ]);
+            for (const result of results) {
+                if (result.status === "rejected") {
+                    assert.ok(result.reason instanceof DuplicateAccountError, `a losing concurrent save must fail as DuplicateAccountError, got ${String(result.reason)}`);
+                }
+            }
+            assert.ok(results.some((result) => result.status === "fulfilled"), "at least one of two concurrent saves must win");
+            const winner = await store.findDirectByIdpId("auth0|race");
+            assert.equal(winner?.metadata?.id, accountIdFor("auth0|race"), "the winner must be readable by its subject");
+        },
+    ],
+    [
+        "findDirectByIdpId and findDirectByEmail never answer a federated account, while findByIdpId (any mode) does",
+        async ({ store }) => {
+            await store.save(federatedAccount({ idpId: "auth0|fed", email: "fed@example.com" }));
+            assert.equal(await store.findDirectByIdpId("auth0|fed"), undefined, "the direct-subject lookup must not resolve to a federated account");
+            assert.equal(await store.findDirectByEmail("fed@example.com"), undefined, "the direct-email lookup must not resolve to a federated account");
+            assert.equal((await store.findByIdpId("auth0|fed"))?.spec?.provisioningMode, IdentityAccountProvisioningMode.federated, "the any-mode subject lookup must answer the federated account");
+        },
+    ],
+    [
+        "findByIds answers one row per distinct id, in first-occurrence order; an empty request answers an empty list",
+        async ({ store }) => {
+            const judy = directAccount({ idpId: "auth0|judy" });
+            const kim = directAccount({ idpId: "auth0|kim" });
+            await store.save(judy);
+            await store.save(kim);
+            assert.deepEqual(subjectsOf(await store.findByIds([idOf(kim), idOf(judy), idOf(kim), idOf(judy)])), ["auth0|kim", "auth0|judy"], "a repeated id must answer once, at its first position");
+            assert.deepEqual(await store.findByIds([]), [], "an empty request must answer an empty list, not a scan");
+        },
+    ],
+    [
+        "update of an unknown id is a no-op: no row appears",
+        async ({ store }) => {
+            const ghost = directAccount({ idpId: "auth0|ghost" });
+            await store.update(ghost);
+            assert.equal(await store.findById(idOf(ghost)), undefined, "update must replace, never create: an unknown id must leave no row by id");
+            assert.equal(await store.findDirectByIdpId("auth0|ghost"), undefined, "update must replace, never create: an unknown id must leave no row by subject");
+        },
+    ],
+    [
+        "deleteById of an unknown id resolves",
+        async ({ store }) => {
+            await assert.doesNotReject(store.deleteById(accountIdFor("auth0|nobody")), "deleting an id that is not held must resolve, not reject");
+        },
+    ],
+    [
+        "save refuses a direct account with an empty idp_id",
+        async ({ store }) => {
+            await assert.rejects(store.save(subjectlessDirectAccount()), "a direct account with no subject has no principal and must be refused, never stored");
+        },
+    ],
+];
+/**
+ * Runs `body` over a fresh fixture. The body's failure is the one reported:
+ * a cleanup failure after a failed body would otherwise replace the
+ * assertion that matters with a teardown detail.
+ */
+async function withFixture(makeFixture, body) {
+    const fixture = await makeFixture();
+    let failed = false;
+    try {
+        await body(fixture);
+    }
+    catch (error) {
+        failed = true;
+        throw error;
+    }
+    finally {
+        try {
+            await fixture.cleanup();
+        }
+        catch (cleanupError) {
+            if (!failed) {
+                throw cleanupError;
+            }
+        }
+    }
+}
+/** The port's cases over `makeFixture`, one fresh fixture per case. */
+export function identityAccountStoreContract(makeFixture) {
+    return CASES.map(([name, body]) => ({
+        name,
+        run: () => withFixture(makeFixture, body),
+    }));
+}
+//# sourceMappingURL=store-contract.js.map

package/dist/domain/identityaccount/store-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-contract.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/store-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AACjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAE5G,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AA0BnD,0FAA0F;AAC1F,SAAS,aAAa,CAAC,SAItB;IACC,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE;YACR,EAAE,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC;YACjC,IAAI,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK;SACzC;QACD,IAAI,EAAE;YACJ,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE;YAC5B,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,EAAE;YACpC,gBAAgB,EAAE,+BAA+B,CAAC,MAAM;SACzD;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,SAGzB;IACC,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE;QACtE,IAAI,EAAE;YACJ,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,gBAAgB,EAAE,+BAA+B,CAAC,SAAS;YAC3D,mBAAmB,EAAE;gBACnB,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,eAAe,CAAC,iBAAiB;gBACvC,IAAI,EAAE,WAAW;aAClB;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,SAAS,wBAAwB;IAC/B,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,EAAE,EAAE,gCAAgC,EAAE,IAAI,EAAE,aAAa,EAAE;QACvE,IAAI,EAAE;YACJ,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,+BAA+B,CAAC,MAAM;SACzD;KACF,CAAC,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,SAAS,IAAI,CAAC,OAAwB;IACpC,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,oCAAoC,CAAC,CAAC;IAC9D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,UAAU,CAAC,QAAwC;IAC1D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,KAAK,GAA+C;IACxD;QACE,4CAA4C;QAC5C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC;gBAC5B,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,mBAAmB;aAC3B,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAClD,MAAM,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,EAAE,wCAAwC,CAAC,CAAC;YACzE,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,CAAC,EAC7C,0DAA0D,CAC3D,CAAC;QACJ,CAAC;KACF;IACD;QACE,kFAAkF;QAClF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,aAAa,CAAC;gBAC3B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAClB,qBAAqB,EACrB,qFAAqF,CACtF,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,CACV,QAAQ,EAAE,IAAI,EAAE,SAAS,EACzB,OAAO,EACP,6DAA6D,CAC9D,CAAC;QACJ,CAAC;KACF;IACD;QACE,4FAA4F;QAC5F,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACzD,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,QAAQ,EAAE,EAAE,EACjB,YAAY,CAAC,aAAa,CAAC,EAC3B,gEAAgE,CACjE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAC7C,SAAS,EACT,4DAA4D,CAC7D,CAAC;QACJ,CAAC;KACF;IACD;QACE,wDAAwD;QACxD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EACpD,YAAY,EACZ,yDAAyD,CAC1D,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,EACvC,SAAS,EACT,sEAAsE,CACvE,CAAC;QACJ,CAAC;KACF;IACD;QACE,wEAAwE;QACxE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CACd,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAClE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAChE,YAAY,EACZ,oEAAoE,CACrE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EACjD,SAAS,EACT,kEAAkE,CACnE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,EACnD,SAAS,EACT,yCAAyC,CAC1C,CAAC;QACJ,CAAC;KACF;IACD;QACE,mDAAmD;QACnD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC;gBAC5B,KAAK,EAAE,aAAa;gBACpB,SAAS,EAAE,OAAO;aACnB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,MAAM,CAChB,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAC9D,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACpD,MAAM,CAAC,KAAK,CACV,OAAO,EAAE,IAAI,EAAE,SAAS,EACxB,SAAS,EACT,uDAAuD,CACxD,CAAC;YACF,MAAM,CAAC,KAAK,CACV,OAAO,EAAE,QAAQ,EAAE,EAAE,EACrB,IAAI,CAAC,OAAO,CAAC,EACb,4CAA4C,CAC7C,CAAC;QACJ,CAAC;KACF;IACD;QACE,yEAAyE;QACzE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACxD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACtC,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EACnC,SAAS,EACT,8CAA8C,CAC/C,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAC5C,SAAS,EACT,mDAAmD,CACpD,CAAC;YACF,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EACnB,wDAAwD,CACzD,CAAC;QACJ,CAAC;KACF;IACD;QACE,2EAA2E;QAC3E,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACpD,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC;gBACV,gCAAgC;gBAChC,IAAI,CAAC,KAAK,CAAC;aACZ,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CACd,UAAU,CAAC,KAAK,CAAC,EACjB,CAAC,YAAY,EAAE,aAAa,CAAC,EAC7B,wEAAwE,CACzE,CAAC;QACJ,CAAC;KACF;IACD;QACE,oEAAoE;QACpE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAC/C,6EAA6E,CAC9E,CAAC;YACF,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EACpD,yEAAyE,CAC1E,CAAC;QACJ,CAAC;KACF;IACD;QACE,+HAA+H;QAC/H,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;gBACvC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;gBAClE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;aACnE,CAAC,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBACjC,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,MAAM,YAAY,qBAAqB,EAC9C,oEAAoE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAC5F,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,CAAC,EAAE,CACP,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,EACvD,+CAA+C,CAChD,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CACV,MAAM,EAAE,QAAQ,EAAE,EAAE,EACpB,YAAY,CAAC,YAAY,CAAC,EAC1B,4CAA4C,CAC7C,CAAC;QACJ,CAAC;KACF;IACD;QACE,6GAA6G;QAC7G,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CACd,gBAAgB,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CACnE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAC1C,SAAS,EACT,mEAAmE,CACpE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAChD,SAAS,EACT,iEAAiE,CAClE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAC9D,+BAA+B,CAAC,SAAS,EACzC,+DAA+D,CAChE,CAAC;QACJ,CAAC;KACF;IACD;QACE,8GAA8G;QAC9G,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,MAAM,CAAC,SAAS,CACd,UAAU,CACR,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CACtE,EACD,CAAC,WAAW,EAAE,YAAY,CAAC,EAC3B,uDAAuD,CACxD,CAAC;YACF,MAAM,CAAC,SAAS,CACd,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EACzB,EAAE,EACF,wDAAwD,CACzD,CAAC;QACJ,CAAC;KACF;IACD;QACE,oDAAoD;QACpD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EACjC,SAAS,EACT,0EAA0E,CAC3E,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAC5C,SAAS,EACT,+EAA+E,CAChF,CAAC;QACJ,CAAC;KACF;IACD;QACE,sCAAsC;QACtC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EAC9C,0DAA0D,CAC3D,CAAC;QACJ,CAAC;KACF;IACD;QACE,oDAAoD;QACpD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,EACtC,qFAAqF,CACtF,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAEF;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,WAA+D,EAC/D,IAAc;IAEd,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,YAAY,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,4BAA4B,CAC1C,WAA+D;IAE/D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI;QACJ,GAAG,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC;KAC1C,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/domain/identityaccount/store.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The IdentityAccountStore PORT (20260911.11, T01_0_plan.md §3a; Q-IA-4):
+ * the storage contract the identity-account domain writes and reads
+ * through, cut from the cloud's row store (iam/account/store.ts) to its
+ * DIRECT subset. This is the first OSS domain whose persistence is a port
+ * rather than the generic Store: the cloud serves the same controller
+ * over its own `cloud.iam_identity_account` table by registering an
+ * implementation as `drivers.identityAccountStore`, so the domain's
+ * pipeline steps take this interface, never `Store`. Open source's own
+ * implementation is resource-store.ts over the generic Store.
+ *
+ * What the port deliberately does not carry: the two federation lookups
+ * (`findByProviderAndIdpId`, `findByOrgAndSlug`) stay on the cloud's own
+ * store behind the IdentityFederation capability — a port does not carry
+ * methods only one edition calls.
+ *
+ * Contract every implementation must satisfy — proven by the port-contract
+ * kit (store-contract.ts, exported), which the OSS adapter's test iterates
+ * on both drivers and a composition's driver test iterates too:
+ *   - `save` is create-only in effect: a save under a held id raises
+ *     DuplicateAccountError, never a silent overwrite; a direct account
+ *     with an empty `idp_id` is refused, since no lookup could reach it;
+ *   - `update` replaces, never creates: an unknown id writes nothing;
+ *   - `deleteById` of an unknown id resolves;
+ *   - `findDirectByIdpId` answers only non-federated accounts (the
+ *     platform's own subjects) — a customer's federated IdP may mint the
+ *     same `auth0|…` shape and the platform lane must never resolve to it;
+ *   - `findDirectByEmail` answers direct accounts only, by exact match:
+ *     federation legitimately duplicates emails, so the email axis is
+ *     non-unique;
+ *   - `findByIds` answers one row per distinct id, in first-occurrence
+ *     order, and skips unknown ids;
+ *   - a typed not-found reads as `undefined`; any other storage failure
+ *     propagates as the infrastructure fault it is (the ratified
+ *     store-fault mapping — an outage must never read as "no account").
+ */
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+/**
+ * Raised by `save` when the id is already held, so callers run their own
+ * race arms (provisioning resolves the winner by subject; the create RPC
+ * answers ALREADY_EXISTS). `cause` carries a driver's own error (the
+ * cloud's SQLSTATE 23505) for the logs; the message is the port's.
+ */
+export declare class DuplicateAccountError extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+export interface IdentityAccountStore {
+    /** Insert; a held id raises DuplicateAccountError; a direct account with no idp_id is refused. */
+    save(account: IdentityAccount): Promise<void>;
+    /** Full-row replace by id (profile updates, preference writes); an unknown id writes nothing. */
+    update(account: IdentityAccount): Promise<void>;
+    /** Removes the row; no error when it does not exist. */
+    deleteById(id: string): Promise<void>;
+    findById(id: string): Promise<IdentityAccount | undefined>;
+    /** Any provisioning mode — the getByIdpId RPC's lookup. */
+    findByIdpId(idpId: string): Promise<IdentityAccount | undefined>;
+    /** Non-federated accounts only — the verifiers' and whoAmI's lookup. */
+    findDirectByIdpId(idpId: string): Promise<IdentityAccount | undefined>;
+    /** Direct accounts only, exact match — the getByEmail RPC's lookup. */
+    findDirectByEmail(email: string): Promise<IdentityAccount | undefined>;
+    /** The present ones, once per distinct id, in first-occurrence order; unknown ids are skipped. */
+    findByIds(ids: ReadonlyArray<string>): Promise<ReadonlyArray<IdentityAccount>>;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/domain/identityaccount/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAEhG;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAED,MAAM,WAAW,oBAAoB;IACnC,kGAAkG;IAClG,IAAI,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,iGAAiG;IACjG,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,wDAAwD;IACxD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IAC3D,2DAA2D;IAC3D,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IACjE,wEAAwE;IACxE,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IACvE,uEAAuE;IACvE,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IACvE,kGAAkG;IAClG,SAAS,CACP,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,GACzB,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;CAC5C"}

package/dist/domain/identityaccount/store.js

@@ -0,0 +1,13 @@
+/**
+ * Raised by `save` when the id is already held, so callers run their own
+ * race arms (provisioning resolves the winner by subject; the create RPC
+ * answers ALREADY_EXISTS). `cause` carries a driver's own error (the
+ * cloud's SQLSTATE 23505) for the logs; the message is the port's.
+ */
+export class DuplicateAccountError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "DuplicateAccountError";
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/domain/identityaccount/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/store.ts"],"names":[],"mappings":"AAsCA;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF"}

package/dist/domain/session/constants.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Session byte-pinned wire copy — every string a client can observe from
+ * this domain that is not already a proto annotation's error_msg. Wire
+ * once merged: the conformance run-gate suite asserts these characters.
+ */
+/**
+ * The run gate's deny copy when a session names an agent instance the
+ * caller may not run (P1 sp.run-gate, ruling Q-RG-4). NEW copy quotes the
+ * handle single-quoted (the ratified 2026-08-26 quoting rule). Identical to
+ * the agent-execution domain's instance copy on purpose — one fact, one
+ * sentence — the ENGINE_UNAVAILABLE_MESSAGE precedent for cross-domain
+ * twins: each domain owns its constant, the twin is named here.
+ */
+export declare function runAgentInstanceDeniedMessage(agentInstanceId: string): string;
+//# sourceMappingURL=constants.d.ts.map

package/dist/domain/session/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/session/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAE7E"}

package/dist/domain/session/constants.js

@@ -0,0 +1,17 @@
+/**
+ * Session byte-pinned wire copy — every string a client can observe from
+ * this domain that is not already a proto annotation's error_msg. Wire
+ * once merged: the conformance run-gate suite asserts these characters.
+ */
+/**
+ * The run gate's deny copy when a session names an agent instance the
+ * caller may not run (P1 sp.run-gate, ruling Q-RG-4). NEW copy quotes the
+ * handle single-quoted (the ratified 2026-08-26 quoting rule). Identical to
+ * the agent-execution domain's instance copy on purpose — one fact, one
+ * sentence — the ENGINE_UNAVAILABLE_MESSAGE precedent for cross-domain
+ * twins: each domain owns its constant, the twin is named here.
+ */
+export function runAgentInstanceDeniedMessage(agentInstanceId) {
+    return `unauthorized to run agent instance '${agentInstanceId}'`;
+}
+//# sourceMappingURL=constants.js.map

package/dist/domain/session/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/session/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,eAAuB;IACnE,OAAO,uCAAuC,eAAe,GAAG,CAAC;AACnE,CAAC"}

package/dist/domain/session/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/session/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAkBzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AACjG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAExE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAsDzF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAczE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAE/D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kHAAkH;IAClH,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,qFAAqF;IACrF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC5E;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,4BAA4B,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,EAAE,4BAA4B,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;CACnD;AAED,oEAAoE;AACpE,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,qBAAqB,GAC1B,IAAI,CAeN"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/session/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAkBzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AACjG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAExE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAuDzF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAczE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAE/D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kHAAkH;IAClH,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,qFAAqF;IACrF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC5E;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,4BAA4B,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,EAAE,4BAA4B,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;CACnD;AAED,oEAAoE;AACpE,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,qBAAqB,GAC1B,IAAI,CAeN"}

package/dist/domain/session/controller.js

@@ -11,6 +11,7 @@ import { newPipeline } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { authorizeDirect, newAuthorizeStep, } from "../../pipeline/steps/authorize.js";
+import { newAuthorizeRunTargetStep } from "../../pipeline/steps/authorize-run-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import { newBuildNewStateStep, setAuditFieldsForUpdate, } from "../../pipeline/steps/defaults.js";
 import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
@@ -28,6 +29,7 @@ import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
 import { newValidateVisibilityStep } from "../../pipeline/steps/validate-visibility.js";
 import { ResourceNotFoundError } from "../../store/interface.js";
 import { deprovisionSessionSandboxBestEffort } from "../../sandbox/steps.js";
+import { sessionRunTarget } from "./run-target.js";
 import { sessionSearchExtractor } from "./search-extractor.js";
 import { LIST_RESULT_KEY, newAuthorizeChannelAccessStep, newCascadeDeleteAgentExecutionsStep, newFilterByAgentInstanceStep, newFilterByChannelStep, newListAllSessionsStep, newRecordHarnessStateHistoryStep, newRejectDeleteWithActiveExecutionsStep, newResolveDefaultAgentInstanceStep, newValidateExecutionTargetImmutabilityStep, newValidateHarnessImmutabilityStep, } from "./steps.js";
 /** Registers both session services on the router (routes stage). */
@@ -54,6 +56,13 @@ function kindOf(ctx) {
  * runs BEFORE ValidateProto: when agent_instance_id is omitted, the
  * resolution fills it in before validation sees the spec.
  *
+ * AuthorizeRunTarget (the run gate, P1 sp.run-gate) follows it directly:
+ * the first step after the instance the session binds to is known, so a
+ * caller who may not run that instance is refused before validation reads
+ * anything further and before any step the chain owns side-effects. The
+ * default-instance creation INSIDE the resolution step still precedes it —
+ * the inherited pre-gate side effect recorded below, unchanged here.
+ *
  * The pre-side-effect gate slot splices before Persist, after the last
  * pure step (O4 plan-gate ruling Q2, mirroring the Java baseline's
  * post-resolution gate position). The default-instance resolution above
@@ -66,6 +75,7 @@ async function createSession(deps, session, ctx) {
     const builder = newPipeline("session-create", deps.logger)
         .addStep(newAuthorizeStep(SessionCommandController.method.create, deps.authorizer))
         .addStep(newResolveDefaultAgentInstanceStep(deps.store, deps.agentInstanceCreator, deps.logger, deps.authorizationLifecycle))
+        .addStep(newAuthorizeRunTargetStep(deps.authorizer, sessionRunTarget))
         .addStep(newValidateProtoStep())
         .addStep(newValidateVisibilityStep())
         .addStep(newResolveSlugStep())

package/dist/domain/session/controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/session/controller.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,wBAAwB,EAAE,MAAM,0DAA0D,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,wDAAwD,CAAC;AAChG,OAAO,EAAE,aAAa,EAAE,MAAM,sDAAsD,CAAC;AAUrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,uDAAuD,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAM5C,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EACL,eAAe,EACf,gBAAgB,GACjB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,OAAO,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,OAAO,EACL,eAAe,EACf,6BAA6B,EAC7B,mCAAmC,EACnC,4BAA4B,EAC5B,sBAAsB,EACtB,sBAAsB,EACtB,gCAAgC,EAChC,uCAAuC,EACvC,kCAAkC,EAClC,0CAA0C,EAC1C,kCAAkC,GACnC,MAAM,YAAY,CAAC;AAsCpB,oEAAoE;AACpE,MAAM,UAAU,uBAAuB,CACrC,MAAqB,EACrB,IAA2B;IAE3B,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE;QACvC,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;QAClD,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;QAC3D,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;QACpD,aAAa,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAC1B,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;KAClD,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,sBAAsB,EAAE;QACrC,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QACxC,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QACtE,aAAa,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;KAC3D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,aAAa,CAC1B,IAA2B,EAC3B,OAAgB,EAChB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,aAAa,EACb,OAAO,EACP,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,OAAO,GAAG,WAAW,CACzB,gBAAgB,EAChB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,wBAAwB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAC1E;SACA,OAAO,CACN,kCAAkC,CAChC,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,oBAAoB,EACzB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,sBAAsB,CAC5B,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAAC;IACzC,mEAAmE;IACnE,sDAAsD;IACtD,KAAK,MAAM,IAAI,IAAI,YAAY,CAC7B,IAAI,CAAC,SAAS,EACd,qCAAqC,CACtC,EAAE,CAAC;QACF,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,OAAO;SACV,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,OAAO,CACN,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,MAAM,CACnB,IAA2B,EAC3B,OAAgB,EAChB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,aAAa,EACb,OAAO,EACP,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAuB,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC;SACnE,OAAO,CACN,gBAAgB,CAAC,wBAAwB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAC1E;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,OAAO,CAAC,kCAAkC,EAAE,CAAC;SAC7C,OAAO,CAAC,0CAA0C,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;SACxE,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,gCAAgC,EAAE,CAAC;SAC3C,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,KAAK,CAClB,IAA2B,EAC3B,OAAgB,EAChB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,aAAa,EACb,OAAO,EACP,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAuB,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC;SAClE,OAAO,CACN,gBAAgB,CAAC,wBAAwB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CACzE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,OAAO,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,8CAA8C,CAAC,EACzD,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,YAAY;QACjB,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;QACnC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAC1B,IAA2B,EAC3B,SAAoB,EACpB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAC5C,SAAS,EACT,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,gBAAgB,EAChB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,wBAAwB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAC1E;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,EAAE,CAAC;SACnC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;SAChE,OAAO,CAAC,uCAAuC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SACzE,OAAO,CAAC,mCAAmC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SACrE,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SAC1D,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,sCAAsC,CAAC,EACjD,sCAAsC,CACvC,CAAC;IACJ,CAAC;IACD,qEAAqE;IACrE,uEAAuE;IACvE,2DAA2D;IAC3D,MAAM,mCAAmC,CACvC,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,MAAM,EACV,OAAmB,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CACxC,CAAC;IACF,OAAO,OAAkB,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,aAAa,CAC1B,IAA2B,EAC3B,GAAgC,EAChC,QAAwB;IAExB,kEAAkE;IAClE,oEAAoE;IACpE,uDAAuD;IACvD,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QAClB,MAAM,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;IAErC,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;YAC3C,MAAM,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,aAAa,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,aAAa,EAC7C,IAAI,CAAC,UAAU,EACf,QAAQ,EACR,GAAG,CACJ,CAAC;IAEF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAEnC,uBAAuB,CAAC,aAAa,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAExE,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAE9C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAC/B,IAA2B,EAC3B,IAAqB,EACrB,OAAgB;IAEhB,MAAM,KAAK,GAAG,sBAAsB,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4DAA4D,EAC5D;YACE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;YAC9B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,GAAG,CAChB,IAA2B,EAC3B,EAAa,EACb,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EACvC,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,aAAa,EACb,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,sBAAsB,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CACrE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;SACrD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAY,CAAC;AACpD,CAAC;AAED,yCAAyC;AACzC,KAAK,UAAU,IAAI,CACjB,IAA2B,EAC3B,GAAwB,EACxB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EACxC,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,cAAc,EACd,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,sBAAsB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CACtE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;SAC5E,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,oEAAoE;AACpE,KAAK,UAAU,mBAAmB,CAChC,IAA2B,EAC3B,GAAuC,EACvC,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,sBAAsB,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,EACvD,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,gCAAgC,EAAE,IAAI,CAAC,MAAM,CAAC;SAC7C,OAAO,CACN,gBAAgB,CACd,sBAAsB,CAAC,MAAM,CAAC,mBAAmB,EACjD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CACN,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAC1E;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,4EAA4E;AAC5E,KAAK,UAAU,aAAa,CAC1B,IAA2B,EAC3B,GAAiC,EACjC,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,sBAAsB,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EACjD,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,yBAAyB,EACzB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,sBAAsB,CAAC,MAAM,CAAC,aAAa,EAC3C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,6BAA6B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACvD,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;SAC5E,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAe;IACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,mCAAmC,CAAC,EAC9C,mCAAmC,CACpC,CAAC;IACJ,CAAC;IACD,OAAO,MAAqB,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/session/controller.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,wBAAwB,EAAE,MAAM,0DAA0D,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,wDAAwD,CAAC;AAChG,OAAO,EAAE,aAAa,EAAE,MAAM,sDAAsD,CAAC;AAUrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,uDAAuD,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAM5C,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EACL,eAAe,EACf,gBAAgB,GACjB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,OAAO,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,OAAO,EACL,eAAe,EACf,6BAA6B,EAC7B,mCAAmC,EACnC,4BAA4B,EAC5B,sBAAsB,EACtB,sBAAsB,EACtB,gCAAgC,EAChC,uCAAuC,EACvC,kCAAkC,EAClC,0CAA0C,EAC1C,kCAAkC,GACnC,MAAM,YAAY,CAAC;AAsCpB,oEAAoE;AACpE,MAAM,UAAU,uBAAuB,CACrC,MAAqB,EACrB,IAA2B;IAE3B,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE;QACvC,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;QAClD,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;QAC3D,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;QACpD,aAAa,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAC1B,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;KAClD,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,sBAAsB,EAAE;QACrC,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QACxC,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QACtE,aAAa,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;KAC3D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,aAAa,CAC1B,IAA2B,EAC3B,OAAgB,EAChB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,aAAa,EACb,OAAO,EACP,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,OAAO,GAAG,WAAW,CACzB,gBAAgB,EAChB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,wBAAwB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAC1E;SACA,OAAO,CACN,kCAAkC,CAChC,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,oBAAoB,EACzB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,sBAAsB,CAC5B,CACF;SACA,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;SACrE,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAAC;IACzC,mEAAmE;IACnE,sDAAsD;IACtD,KAAK,MAAM,IAAI,IAAI,YAAY,CAC7B,IAAI,CAAC,SAAS,EACd,qCAAqC,CACtC,EAAE,CAAC;QACF,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,OAAO;SACV,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,OAAO,CACN,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,MAAM,CACnB,IAA2B,EAC3B,OAAgB,EAChB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,aAAa,EACb,OAAO,EACP,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAuB,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC;SACnE,OAAO,CACN,gBAAgB,CAAC,wBAAwB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAC1E;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,OAAO,CAAC,kCAAkC,EAAE,CAAC;SAC7C,OAAO,CAAC,0CAA0C,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;SACxE,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,gCAAgC,EAAE,CAAC;SAC3C,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,KAAK,CAClB,IAA2B,EAC3B,OAAgB,EAChB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,aAAa,EACb,OAAO,EACP,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAuB,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC;SAClE,OAAO,CACN,gBAAgB,CAAC,wBAAwB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CACzE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,OAAO,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,8CAA8C,CAAC,EACzD,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,YAAY;QACjB,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;QACnC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAC1B,IAA2B,EAC3B,SAAoB,EACpB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAC5C,SAAS,EACT,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,gBAAgB,EAChB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,wBAAwB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAC1E;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,EAAE,CAAC;SACnC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;SAChE,OAAO,CAAC,uCAAuC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SACzE,OAAO,CAAC,mCAAmC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SACrE,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SAC1D,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,sCAAsC,CAAC,EACjD,sCAAsC,CACvC,CAAC;IACJ,CAAC;IACD,qEAAqE;IACrE,uEAAuE;IACvE,2DAA2D;IAC3D,MAAM,mCAAmC,CACvC,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,MAAM,EACV,OAAmB,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CACxC,CAAC;IACF,OAAO,OAAkB,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,aAAa,CAC1B,IAA2B,EAC3B,GAAgC,EAChC,QAAwB;IAExB,kEAAkE;IAClE,oEAAoE;IACpE,uDAAuD;IACvD,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QAClB,MAAM,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;IAErC,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;YAC3C,MAAM,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,aAAa,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,aAAa,EAC7C,IAAI,CAAC,UAAU,EACf,QAAQ,EACR,GAAG,CACJ,CAAC;IAEF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAEnC,uBAAuB,CAAC,aAAa,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAExE,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAE9C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAC/B,IAA2B,EAC3B,IAAqB,EACrB,OAAgB;IAEhB,MAAM,KAAK,GAAG,sBAAsB,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4DAA4D,EAC5D;YACE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;YAC9B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,GAAG,CAChB,IAA2B,EAC3B,EAAa,EACb,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EACvC,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,aAAa,EACb,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,sBAAsB,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CACrE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;SACrD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAY,CAAC;AACpD,CAAC;AAED,yCAAyC;AACzC,KAAK,UAAU,IAAI,CACjB,IAA2B,EAC3B,GAAwB,EACxB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EACxC,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,cAAc,EACd,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,sBAAsB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CACtE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;SAC5E,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,oEAAoE;AACpE,KAAK,UAAU,mBAAmB,CAChC,IAA2B,EAC3B,GAAuC,EACvC,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,sBAAsB,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,EACvD,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,gCAAgC,EAAE,IAAI,CAAC,MAAM,CAAC;SAC7C,OAAO,CACN,gBAAgB,CACd,sBAAsB,CAAC,MAAM,CAAC,mBAAmB,EACjD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CACN,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAC1E;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,4EAA4E;AAC5E,KAAK,UAAU,aAAa,CAC1B,IAA2B,EAC3B,GAAiC,EACjC,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,sBAAsB,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EACjD,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,yBAAyB,EACzB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,sBAAsB,CAAC,MAAM,CAAC,aAAa,EAC3C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,6BAA6B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACvD,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;SAC5E,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAe;IACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,mCAAmC,CAAC,EAC9C,mCAAmC,CACpC,CAAC;IACJ,CAAC;IACD,OAAO,MAAqB,CAAC;AAC/B,CAAC"}

package/dist/domain/session/run-target.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The session run-target resolver (P1 sp.run-gate): a session is a
+ * conversation bound to ONE agent instance, so its run target is that
+ * instance — agent_instance#can_execute on spec.agent_instance_id.
+ *
+ * Pure over the record being built. ResolveDefaultAgentInstance runs before
+ * the gate and guarantees the id (the caller's, or the platform default
+ * agent's default instance), so an empty id here is that step's own
+ * refusal already thrown, never a check to make. Read from newState, where
+ * the resolution writes — the same clone gotcha steps.ts records.
+ */
+import type { Session } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
+import { type RunTarget } from "../../pipeline/steps/authorize-run-target.js";
+export declare function sessionRunTarget(session: Session): RunTarget | undefined;
+//# sourceMappingURL=run-target.d.ts.map

package/dist/domain/session/run-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-target.d.ts","sourceRoot":"","sources":["../../../src/domain/session/run-target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sDAAsD,CAAC;AAEpF,OAAO,EAEL,KAAK,SAAS,EACf,MAAM,8CAA8C,CAAC;AAGtD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAUxE"}

package/dist/domain/session/run-target.js

@@ -0,0 +1,14 @@
+import { RUN_GATE_CHECKS, } from "../../pipeline/steps/authorize-run-target.js";
+import { runAgentInstanceDeniedMessage } from "./constants.js";
+export function sessionRunTarget(session) {
+    const agentInstanceId = session.spec?.agentInstanceId ?? "";
+    if (agentInstanceId === "") {
+        return undefined;
+    }
+    return {
+        ...RUN_GATE_CHECKS.agentInstance,
+        resourceId: agentInstanceId,
+        deniedMessage: runAgentInstanceDeniedMessage(agentInstanceId),
+    };
+}
+//# sourceMappingURL=run-target.js.map

package/dist/domain/session/run-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-target.js","sourceRoot":"","sources":["../../../src/domain/session/run-target.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,eAAe,GAEhB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE/D,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,EAAE,eAAe,IAAI,EAAE,CAAC;IAC5D,IAAI,eAAe,KAAK,EAAE,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,GAAG,eAAe,CAAC,aAAa;QAChC,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,6BAA6B,CAAC,eAAe,CAAC;KAC9D,CAAC;AACJ,CAAC"}

package/dist/domain/workflowexecution/constants.d.ts

@@ -13,6 +13,15 @@
  * the Class A conformance engine-gate test.
  */
 export declare const ENGINE_UNAVAILABLE_MESSAGE = "The execution engine is temporarily unavailable. Please try again shortly.";
+/**
+ * The run gate's deny copy per request shape (P1 sp.run-gate, ruling
+ * Q-RG-4; wire once merged, asserted by the conformance run-gate suite).
+ * NEW copy quotes the handle single-quoted (the ratified 2026-08-26 rule).
+ * The agent-execution domain's `runAgent*` functions are these copies'
+ * twins; each domain owns its own.
+ */
+export declare function runWorkflowDeniedMessage(workflowId: string): string;
+export declare function runWorkflowInstanceDeniedMessage(workflowInstanceId: string): string;
 /**
  * The lifecycle steps' engineless refusal (lifecycle_steps.go, five
  * sites: pause/resume/cancel/terminate signal steps and recover's

package/dist/domain/workflowexecution/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/workflowexecution/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,+EACuC,CAAC;AAE/E;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,8BAA8B,CAAC;AAExE;;;;GAIG;AACH,eAAO,MAAM,oCAAoC,yDACO,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,oCAAoC,sCACZ,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,sCACf,CAAC;AAEtC,0EAA0E;AAC1E,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,UAAU,CAAC;AACzC,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAC3C,eAAO,MAAM,yBAAyB,gBAAgB,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,iBAAiB,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC;;;GAGG;AACH,eAAO,MAAM,mCAAmC,KAAK,CAAC;AACtD,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,MAAM,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/workflowexecution/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,+EACuC,CAAC;AAE/E;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,wBAAgB,gCAAgC,CAC9C,kBAAkB,EAAE,MAAM,GACzB,MAAM,CAER;AAED;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,8BAA8B,CAAC;AAExE;;;;GAIG;AACH,eAAO,MAAM,oCAAoC,yDACO,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,oCAAoC,sCACZ,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,sCACf,CAAC;AAEtC,0EAA0E;AAC1E,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,UAAU,CAAC;AACzC,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAC3C,eAAO,MAAM,yBAAyB,gBAAgB,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,iBAAiB,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC;;;GAGG;AACH,eAAO,MAAM,mCAAmC,KAAK,CAAC;AACtD,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,MAAM,CAAC"}