@stigmer/server 3.14.0 → 3.15.0

package/dist/identity/oidc-userinfo.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The OIDC userinfo client (20260911.11, T01_1_review.md A8) — the
+ * infrastructure behind the identity-account domain's UserInfoClient
+ * port (domain/identityaccount/provisioning.ts): the profile of the
+ * bearer of an access token, from the `userinfo_endpoint` the token's
+ * ISSUER publishes, fetched with that very token.
+ *
+ * The issuer is a per-call argument, not a construction-time binding,
+ * because the composition does not know which issuer will vouch for a
+ * caller: open source's own OIDC lane names one in STIGMER_OIDC_ISSUER,
+ * the cloud's verifiers name theirs on the CallerIdentity they mint. The
+ * one issuer whose userinfo can answer for a token is the one that issued
+ * it — and a verifier already trusted it, so the token goes only where it
+ * came from.
+ *
+ * The endpoint is the discovery document's word, never a guessed
+ * `<issuer>/userinfo`: a document that names no `userinfo_endpoint` is
+ * refused as a fetch failure (the domain maps it UNAVAILABLE with the
+ * cloud's copy), so a misconfigured issuer fails loudly at the first
+ * sign-in rather than silently against a wrong URL.
+ *
+ * Claims read as the cloud's client reads them: `email`, `given_name`,
+ * `family_name`, `picture`; a missing or non-string claim is the empty
+ * string. Any non-2xx or malformed answer throws; the domain's
+ * UserInfoFetchError wraps it.
+ */
+import type { UserInfoClient } from "../domain/identityaccount/provisioning.js";
+import type { IssuerDiscovery } from "./oidc-discovery.js";
+export declare function newOidcUserInfoClient(discovery: IssuerDiscovery, fetchImpl?: typeof fetch): UserInfoClient;
+//# sourceMappingURL=oidc-userinfo.d.ts.map

package/dist/identity/oidc-userinfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-userinfo.d.ts","sourceRoot":"","sources":["../../src/identity/oidc-userinfo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,eAAe,EAC1B,SAAS,GAAE,OAAO,KAAa,GAC9B,cAAc,CA4BhB"}

package/dist/identity/oidc-userinfo.js

@@ -0,0 +1,28 @@
+export function newOidcUserInfoClient(discovery, fetchImpl = fetch) {
+    return {
+        async fetchUserProfile(issuer, accessToken) {
+            const { userinfoEndpoint } = await discovery.discover(issuer);
+            if (userinfoEndpoint === undefined) {
+                throw new Error(`issuer '${issuer}' publishes no userinfo_endpoint in its discovery document`);
+            }
+            const response = await fetchImpl(userinfoEndpoint, {
+                headers: { authorization: `Bearer ${accessToken}` },
+            });
+            if (!response.ok) {
+                throw new Error(`userinfo answered ${response.status}`);
+            }
+            const claims = (await response.json());
+            const text = (key) => {
+                const value = claims[key];
+                return typeof value === "string" ? value : "";
+            };
+            return {
+                email: text("email"),
+                firstName: text("given_name"),
+                lastName: text("family_name"),
+                pictureUrl: text("picture"),
+            };
+        },
+    };
+}
+//# sourceMappingURL=oidc-userinfo.js.map

package/dist/identity/oidc-userinfo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-userinfo.js","sourceRoot":"","sources":["../../src/identity/oidc-userinfo.ts"],"names":[],"mappings":"AAgCA,MAAM,UAAU,qBAAqB,CACnC,SAA0B,EAC1B,YAA0B,KAAK;IAE/B,OAAO;QACL,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW;YACxC,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,WAAW,MAAM,4DAA4D,CAC9E,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,gBAAgB,EAAE;gBACjD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;aACpD,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;YAClE,MAAM,IAAI,GAAG,CAAC,GAAW,EAAU,EAAE;gBACnC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,CAAC,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;gBACpB,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;gBAC7B,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC;gBAC7B,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC;aAC5B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/identity/oidc-verifier.d.ts

@@ -1,4 +1,6 @@
+import type { AccountsBySubject } from "../domain/identityaccount/resolve.js";
 import type { IdentityVerifier } from "../extensions/identity.js";
+import type { IssuerDiscovery } from "./oidc-discovery.js";
 /** Java classifyAuthError arms — byte-pinned cross-edition copy. */
 export declare const TOKEN_EXPIRED_MESSAGE = "token has expired";
 export declare const TOKEN_AUDIENCE_MESSAGE = "token audience does not match the expected audience";
@@ -9,6 +11,10 @@ export interface OidcVerifierConfig {
     readonly issuer: string;
     /** The audience access tokens must carry. */
     readonly audience: string;
+    /** The identity-account domain's subject lookup — REQUIRED: what identityId means depends on it. */
+    readonly accounts: AccountsBySubject;
+    /** The composition root's one discovery for every lane (A8). */
+    readonly discovery: IssuerDiscovery;
 }
 export declare function newOidcIdentityVerifier(config: OidcVerifierConfig): IdentityVerifier;
 //# sourceMappingURL=oidc-verifier.d.ts.map

package/dist/identity/oidc-verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-verifier.d.ts","sourceRoot":"","sources":["../../src/identity/oidc-verifier.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,2BAA2B,CAAC;AAEnC,oEAAoE;AACpE,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,sBAAsB,wDACoB,CAAC;AACxD,eAAO,MAAM,uBAAuB,wCAAwC,CAAC;AAC7E,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAErD,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAMD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,GACzB,gBAAgB,CA+DlB"}
+{"version":3,"file":"oidc-verifier.d.ts","sourceRoot":"","sources":["../../src/identity/oidc-verifier.ts"],"names":[],"mappings":"AAmDA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,oEAAoE;AACpE,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,sBAAsB,wDACoB,CAAC;AACxD,eAAO,MAAM,uBAAuB,wCAAwC,CAAC;AAC7E,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAErD,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;CACrC;AAID,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,GACzB,gBAAgB,CA+ClB"}

package/dist/identity/oidc-verifier.js

@@ -18,46 +18,51 @@
  *   - everything else → "invalid token"
  *
  * Discovery and key handling: the issuer's /.well-known/openid-configuration
- * is fetched once (memoized on success, retried on the next request after
- * a failure — a flaky IdP at boot must not permanently brick the lane),
- * its `issuer` field must match the configured issuer exactly (RFC 8414
- * §3.3), and the JWKS rides jose's createRemoteJWKSet (cached, rotation-
- * aware). Discovery/JWKS OUTAGES are infrastructure faults — thrown as
+ * is read through the shared oidc-discovery module the composition root
+ * builds once for every lane (20260911.11 A8 — the userinfo client reads
+ * the same document, so one issuer is discovered once and validated the
+ * same way wherever it is consumed: `issuer` must match exactly, RFC 8414
+ * §3.3; `jwks_uri` required). The module memoizes on success only, so a
+ * flaky IdP at boot never permanently bricks the lane. The JWKS client
+ * (jose's createRemoteJWKSet — cached, rotation-aware) is built ONCE per
+ * verifier from the discovered location and kept: discovery hands back a
+ * URI, and a client rebuilt per request would refetch the keys per
+ * request. Discovery/JWKS OUTAGES are infrastructure faults — thrown as
  * plain errors so the chassis maps them to INTERNAL, never a credential
  * rejection (the DD-007 unavailable doctrine).
  *
- * Identity: identityId = `sub` (rejected as invalid when absent), issuer =
- * the configured issuer, email/displayName from the standard `email`/`name`
- * claims when present (the DD-007 Q5 addendum added the fields for exactly
- * these claims).
+ * Identity (20260911.11 Q-IA-2, A1 — the cloud's direct-login posture):
+ * after the token verifies, `sub` (rejected as invalid when absent) is
+ * resolved through the identity-account domain (identityIdForSubject):
+ * a subject with a direct account stamps the ACCOUNT id; a subject
+ * without one is admitted idp-shaped (identityId = sub) so whoAmI can
+ * answer NOT_FOUND and provisionMyAccount can run. One primary-key read
+ * per request, no cache; a store fault is an infrastructure fault. The
+ * issuer is the configured issuer; email/displayName come from the
+ * standard `email`/`name` claims when present (the DD-007 Q5 addendum
+ * added the fields for exactly these claims), whichever way the subject
+ * resolved. Claim-or-pass runs before any of this: a non-JWT token
+ * passes with no network.
  */
 import { createRemoteJWKSet, jwtVerify, errors as joseErrors } from "jose";
 import { Code, ConnectError } from "@connectrpc/connect";
+import { identityIdForSubject } from "../domain/identityaccount/resolve.js";
 /** Java classifyAuthError arms — byte-pinned cross-edition copy. */
 export const TOKEN_EXPIRED_MESSAGE = "token has expired";
 export const TOKEN_AUDIENCE_MESSAGE = "token audience does not match the expected audience";
 export const TOKEN_SIGNATURE_MESSAGE = "token signature verification failed";
 export const INVALID_TOKEN_MESSAGE = "invalid token";
 export function newOidcIdentityVerifier(config) {
-    let discovered;
-    async function discover() {
-        if (discovered !== undefined) {
-            return discovered;
+    // Set on the first successful discovery only: a failed discovery leaves
+    // it unset so the next request retries (the module caches no failure).
+    let jwks;
+    async function jwksFor() {
+        if (jwks !== undefined) {
+            return jwks;
         }
-        const url = discoveryUrl(config.issuer);
-        const response = await fetch(url);
-        if (!response.ok) {
-            throw new Error(`OIDC discovery failed: ${url} answered HTTP ${response.status}`);
-        }
-        const document = (await response.json());
-        if (document.issuer !== config.issuer) {
-            throw new Error(`OIDC discovery failed: document issuer '${document.issuer ?? ""}' does not match configured issuer '${config.issuer}'`);
-        }
-        if (typeof document.jwks_uri !== "string" || document.jwks_uri === "") {
-            throw new Error(`OIDC discovery failed: ${url} carries no jwks_uri`);
-        }
-        discovered = { jwks: createRemoteJWKSet(new URL(document.jwks_uri)) };
-        return discovered;
+        const { jwksUri } = await config.discovery.discover(config.issuer);
+        jwks = createRemoteJWKSet(new URL(jwksUri));
+        return jwks;
     }
     return {
         name: "oidc",
@@ -65,10 +70,10 @@ export function newOidcIdentityVerifier(config) {
             if (!isJwtShaped(token)) {
                 return null;
             }
-            const issuer = await discover();
+            const keys = await jwksFor();
             let payload;
             try {
-                ({ payload } = await jwtVerify(token, issuer.jwks, {
+                ({ payload } = await jwtVerify(token, keys, {
                     issuer: config.issuer,
                     audience: config.audience,
                 }));
@@ -80,7 +85,7 @@ export function newOidcIdentityVerifier(config) {
                 throw new ConnectError(INVALID_TOKEN_MESSAGE, Code.Unauthenticated);
             }
             return {
-                identityId: payload.sub,
+                identityId: await identityIdForSubject(config.accounts, payload.sub),
                 callerClass: "user",
                 issuer: config.issuer,
                 rawToken: token,
@@ -94,10 +99,6 @@ export function newOidcIdentityVerifier(config) {
         },
     };
 }
-/** issuer + /.well-known/openid-configuration (trailing-slash tolerant). */
-function discoveryUrl(issuer) {
-    return `${issuer.replace(/\/$/, "")}/.well-known/openid-configuration`;
-}
 /** Three non-empty dot-separated segments — the JWS compact shape. */
 function isJwtShaped(token) {
     const segments = token.split(".");

package/dist/identity/oidc-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-verifier.js","sourceRoot":"","sources":["../../src/identity/oidc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,MAAM,CAAC;AAE3E,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAOzD,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AACzD,MAAM,CAAC,MAAM,sBAAsB,GACjC,qDAAqD,CAAC;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,qCAAqC,CAAC;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAarD,MAAM,UAAU,uBAAuB,CACrC,MAA0B;IAE1B,IAAI,UAAwC,CAAC;IAE7C,KAAK,UAAU,QAAQ;QACrB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,0BAA0B,GAAG,kBAAkB,QAAQ,CAAC,MAAM,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGtC,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,2CAA2C,QAAQ,CAAC,MAAM,IAAI,EAAE,uCAAuC,MAAM,CAAC,MAAM,GAAG,CACxH,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,sBAAsB,CAAC,CAAC;QACvE,CAAC;QACD,UAAU,GAAG,EAAE,IAAI,EAAE,kBAAkB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACtE,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,IAAI,OAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE;oBACjD,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;gBAC1D,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,OAAO,CAAC,GAAG;gBACvB,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,KAAK;gBACf,GAAG,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE;oBACjE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;oBAC7B,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE;oBAC/D,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;oBAClC,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC;AACzE,CAAC;AAED,sEAAsE;AACtE,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3C,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,YAAY,UAAU,CAAC,wBAAwB,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,IAAI,YAAY,CAAC,sBAAsB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IACE,KAAK,YAAY,UAAU,CAAC,8BAA8B;QAC1D,KAAK,YAAY,UAAU,CAAC,iBAAiB;QAC7C,KAAK,YAAY,UAAU,CAAC,wBAAwB;QACpD,KAAK,YAAY,UAAU,CAAC,WAAW,EACvC,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,uBAAuB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACzE,CAAC;IACD,IACE,KAAK,YAAY,UAAU,CAAC,UAAU;QACtC,KAAK,YAAY,UAAU,CAAC,UAAU,EACtC,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,2EAA2E;IAC3E,yDAAyD;IACzD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"oidc-verifier.js","sourceRoot":"","sources":["../../src/identity/oidc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,MAAM,CAAC;AAE3E,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAQ5E,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AACzD,MAAM,CAAC,MAAM,sBAAsB,GACjC,qDAAqD,CAAC;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,qCAAqC,CAAC;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAerD,MAAM,UAAU,uBAAuB,CACrC,MAA0B;IAE1B,wEAAwE;IACxE,uEAAuE;IACvE,IAAI,IAA4B,CAAC;IAEjC,KAAK,UAAU,OAAO;QACpB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnE,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;YAC7B,IAAI,OAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;oBAC1C,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;gBAC1D,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,MAAM,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC;gBACpE,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,KAAK;gBACf,GAAG,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE;oBACjE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;oBAC7B,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE;oBAC/D,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;oBAClC,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3C,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,YAAY,UAAU,CAAC,wBAAwB,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,IAAI,YAAY,CAAC,sBAAsB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IACE,KAAK,YAAY,UAAU,CAAC,8BAA8B;QAC1D,KAAK,YAAY,UAAU,CAAC,iBAAiB;QAC7C,KAAK,YAAY,UAAU,CAAC,wBAAwB;QACpD,KAAK,YAAY,UAAU,CAAC,WAAW,EACvC,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,uBAAuB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACzE,CAAC;IACD,IACE,KAAK,YAAY,UAAU,CAAC,UAAU;QACtC,KAAK,YAAY,UAAU,CAAC,UAAU,EACtC,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,2EAA2E;IAC3E,yDAAyD;IACzD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/index.d.ts

@@ -56,6 +56,13 @@ export type { ResolvedExtensionDrivers } from "./extensions/registry.js";
 export type { DefaultInstanceLinkedEvent, ResourceAuthorizationLifecycle, ResourceCreatedEvent, ResourceDeletedEvent, VisibilityChangedEvent, VisibilityTupleShape, ResolvedParentLink, } from "./extensions/resource-authorization.js";
 export type { OrganizationDirectory } from "./extensions/organization-directory.js";
 export { ALL_ORGANIZATIONS } from "./extensions/organization-directory.js";
+export type { IdentityAccountStore } from "./domain/identityaccount/store.js";
+export { DuplicateAccountError } from "./domain/identityaccount/store.js";
+export type { IdentityAccountStoreContractCase, IdentityAccountStoreContractFixture, } from "./domain/identityaccount/store-contract.js";
+export { identityAccountStoreContract } from "./domain/identityaccount/store-contract.js";
+export type { IdentityFederation } from "./extensions/identity-federation.js";
+export type { AccountsBySubject } from "./domain/identityaccount/resolve.js";
+export { identityIdForSubject } from "./domain/identityaccount/resolve.js";
 export type { ListReadScope, ListEntryMeta, } from "./extensions/list-read-scope.js";
 export type { ScheduleFireCallerMint } from "./extensions/schedule-fire-caller.js";
 export type { VisitorErrorPolicy } from "./pipeline/interceptors/error-boundary.js";
@@ -71,6 +78,7 @@ export { createVerifierChainInterceptor } from "./pipeline/interceptors/auth.js"
 export { authenticateBearerToken, parseBearerToken, } from "./pipeline/interceptors/auth.js";
 export { newPipeline } from "./pipeline/pipeline.js";
 export { newAuthorizeStep } from "./pipeline/steps/authorize.js";
+export { isRunGateCheck } from "./pipeline/steps/authorize-run-target.js";
 export { newValidateProtoStep } from "./pipeline/steps/validation.js";
 export type { Store } from "./store/interface.js";
 export { AuditNotFoundError, ResourceNotFoundError, } from "./store/interface.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,YAAY,EACV,QAAQ,EACR,SAAS,EACT,MAAM,EACN,aAAa,EACb,QAAQ,EACR,OAAO,GACR,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,4BAA4B,EAC5B,kBAAkB,EAClB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AASlC,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAOjE,YAAY,EACV,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAIzE,YAAY,EACV,0BAA0B,EAC1B,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAChD,YAAY,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAC3E,YAAY,EACV,aAAa,EACb,aAAa,GACd,MAAM,iCAAiC,CAAC;AAIzC,YAAY,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AASnF,YAAY,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAGlD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAKxD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAgBzC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAOjF,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAKtE,YAAY,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAK9B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAWhE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,YAAY,EACV,eAAe,EACf,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAIrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,YAAY,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAMvE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAKjG,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AACrG,YAAY,EACV,wBAAwB,EAKxB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EAKxB,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAcpC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMzD,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAS9E,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAQrE,YAAY,EACV,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,0CAA0C,CAAC;AAOlD,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,YAAY,EACV,QAAQ,EACR,SAAS,EACT,MAAM,EACN,aAAa,EACb,QAAQ,EACR,OAAO,GACR,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,4BAA4B,EAC5B,kBAAkB,EAClB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AASlC,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAOjE,YAAY,EACV,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAIzE,YAAY,EACV,0BAA0B,EAC1B,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAChD,YAAY,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAO3E,YAAY,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAI1E,YAAY,EACV,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAC1F,YAAY,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,YAAY,EACV,aAAa,EACb,aAAa,GACd,MAAM,iCAAiC,CAAC;AAIzC,YAAY,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AASnF,YAAY,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAGlD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAKxD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAgBzC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAOjF,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAKtE,YAAY,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAK9B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAWhE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,YAAY,EACV,eAAe,EACf,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAIrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,YAAY,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAMvE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAKjG,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AACrG,YAAY,EACV,wBAAwB,EAKxB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EAKxB,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAcpC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMzD,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAS9E,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAQrE,YAAY,EACV,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,0CAA0C,CAAC;AAOlD,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -44,6 +44,9 @@ export { composeServer } from "./boot/compose.js";
 export { loadConfig } from "./boot/config.js";
 export { createLogger } from "./boot/logger.js";
 export { ALL_ORGANIZATIONS } from "./extensions/organization-directory.js";
+export { DuplicateAccountError } from "./domain/identityaccount/store.js";
+export { identityAccountStoreContract } from "./domain/identityaccount/store-contract.js";
+export { identityIdForSubject } from "./domain/identityaccount/resolve.js";
 export { createErrorBoundaryInterceptor } from "./pipeline/interceptors/error-boundary.js";
 export { diffVisibilityShapes, visibilityShapesFor, } from "./pipeline/steps/authorization-tuples.js";
 export { RequestContext } from "./pipeline/request-context.js";
@@ -88,6 +91,13 @@ export { createVerifierChainInterceptor } from "./pipeline/interceptors/auth.js"
 export { authenticateBearerToken, parseBearerToken, } from "./pipeline/interceptors/auth.js";
 export { newPipeline } from "./pipeline/pipeline.js";
 export { newAuthorizeStep } from "./pipeline/steps/authorize.js";
+// The run gate's check set (P1 sp.run-gate): an edition's Authorizer keys
+// its lane admission on this predicate — the runtime lanes it mints (a
+// guest share, a channel, a schedule fire, a workflow sandbox) were
+// admitted upstream by their own gate steps and are not re-asked here.
+// OSS defines the gate, so OSS defines which checks are the gate; a
+// composition never re-derives the set.
+export { isRunGateCheck } from "./pipeline/steps/authorize-run-target.js";
 export { newValidateProtoStep } from "./pipeline/steps/validation.js";
 export { AuditNotFoundError, ResourceNotFoundError, } from "./store/interface.js";
 // The Postgres driver constructor (stigmer-cloud 20260910.04 ruling 4;

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,wCAAwC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA+DhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAkB3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAIlD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,yEAAyE;AACzE,+DAA+D;AAC/D,wEAAwE;AACxE,QAAQ;AACR,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,sEAAsE;AACtE,qEAAqE;AACrE,6DAA6D;AAC7D,iEAAiE;AACjE,wEAAwE;AACxE,iEAAiE;AACjE,yEAAyE;AACzE,+DAA+D;AAC/D,yEAAyE;AACzE,8DAA8D;AAC9D,wEAAwE;AACxE,uEAAuE;AACvE,mEAAmE;AACnE,2DAA2D;AAC3D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,+DAA+D;AAC/D,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,oEAAoE;AACpE,wEAAwE;AACxE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kDAAkD;AAClD,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAMtE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAM9B,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAO1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAQvE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AAkBrG,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,6DAA6D;AAC7D,uEAAuE;AACvE,qEAAqE;AACrE,gEAAgE;AAChE,0EAA0E;AAC1E,qEAAqE;AACrE,uEAAuE;AACvE,iEAAiE;AACjE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AAepC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAE9E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,kDAAkD;AAClD,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AA0BrE,oEAAoE;AACpE,yEAAyE;AACzE,iDAAiD;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,wCAAwC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA+DhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAQ3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAQ1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAG1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAkB3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAIlD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,yEAAyE;AACzE,+DAA+D;AAC/D,wEAAwE;AACxE,QAAQ;AACR,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,sEAAsE;AACtE,qEAAqE;AACrE,6DAA6D;AAC7D,iEAAiE;AACjE,wEAAwE;AACxE,iEAAiE;AACjE,yEAAyE;AACzE,+DAA+D;AAC/D,yEAAyE;AACzE,8DAA8D;AAC9D,wEAAwE;AACxE,uEAAuE;AACvE,mEAAmE;AACnE,2DAA2D;AAC3D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,+DAA+D;AAC/D,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,oEAAoE;AACpE,wEAAwE;AACxE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kDAAkD;AAClD,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,0EAA0E;AAC1E,uEAAuE;AACvE,oEAAoE;AACpE,uEAAuE;AACvE,oEAAoE;AACpE,wCAAwC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAMtE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAM9B,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAO1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAQvE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AAkBrG,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,6DAA6D;AAC7D,uEAAuE;AACvE,qEAAqE;AACrE,gEAAgE;AAChE,0EAA0E;AAC1E,qEAAqE;AACrE,uEAAuE;AACvE,iEAAiE;AACjE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AAepC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAE9E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,kDAAkD;AAClD,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AA0BrE,oEAAoE;AACpE,yEAAyE;AACzE,iDAAiD;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/pipeline/interceptors/auth.d.ts

@@ -51,6 +51,16 @@ export declare function callerIdentityOf(ctx: HandlerContext): CallerIdentity;
  * operator seam remains process-global.
  */
 export declare function trustedLocalIdentity(): CallerIdentity;
+/**
+ * The trusted-local identity for a given operator — the one construction
+ * of that principal, shared by the per-request stamp above and by the
+ * boot-time operator account (domain/identityaccount/operator.ts), so the
+ * row the server ensures and the caller it stamps can never disagree.
+ */
+export declare function trustedLocalIdentityFor(operator: {
+    readonly email: string;
+    readonly displayName: string;
+}): CallerIdentity;
 /**
  * The serving chain's position-1 identity source: walks the composed
  * verifiers in order (OSS entries first, extension entries after, in

package/dist/pipeline/interceptors/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/pipeline/interceptors/auth.ts"],"names":[],"mappings":"AAiFA,OAAO,KAAK,EACV,cAAc,EACd,WAAW,EAGZ,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAIrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AAItC;;;GAGG;AACH,eAAO,MAAM,oCAAoC,iCACjB,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,CAE7D,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAKlE;AAED;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,sEAG7B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,cAAc,CASpE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,cAAc,CAkBrD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,aAAa,CAAC,gBAAgB,CAAC,EAC1C,MAAM,EAAE,aAAa,CAAC,WAAW,CAAC,EAClC,MAAM,EAAE,MAAM,EACd,qBAAqB,UAAQ,GAC5B,WAAW,CAwCb;AAyCD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,+BAA+B,CAAC;AAErE,2DAA2D;AAC3D,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAEpE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gCAAgC,IAAI,WAAW,CA6B9D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,aAAa,CAAC,gBAAgB,CAAC,EAC1C,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAoBrC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAUlE"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/pipeline/interceptors/auth.ts"],"names":[],"mappings":"AAiFA,OAAO,KAAK,EACV,cAAc,EACd,WAAW,EAGZ,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAIrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AAItC;;;GAGG;AACH,eAAO,MAAM,oCAAoC,iCACjB,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,CAE7D,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAKlE;AAED;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,sEAG7B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,cAAc,CASpE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,cAAc,CAErD;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE;IAChD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GAAG,cAAc,CAiBjB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,aAAa,CAAC,gBAAgB,CAAC,EAC1C,MAAM,EAAE,aAAa,CAAC,WAAW,CAAC,EAClC,MAAM,EAAE,MAAM,EACd,qBAAqB,UAAQ,GAC5B,WAAW,CAwCb;AAyCD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,+BAA+B,CAAC;AAErE,2DAA2D;AAC3D,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAEpE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gCAAgC,IAAI,WAAW,CA6B9D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,aAAa,CAAC,gBAAgB,CAAC,EAC1C,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAoBrC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAUlE"}

package/dist/pipeline/interceptors/auth.js

@@ -142,7 +142,15 @@ export function callerIdentityOf(ctx) {
  * operator seam remains process-global.
  */
 export function trustedLocalIdentity() {
-    const operator = operatorIdentitySnapshot();
+    return trustedLocalIdentityFor(operatorIdentitySnapshot());
+}
+/**
+ * The trusted-local identity for a given operator — the one construction
+ * of that principal, shared by the per-request stamp above and by the
+ * boot-time operator account (domain/identityaccount/operator.ts), so the
+ * row the server ensures and the caller it stamps can never disagree.
+ */
+export function trustedLocalIdentityFor(operator) {
     if (operator.email === "") {
         return {
             identityId: "system",

package/dist/pipeline/interceptors/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/pipeline/interceptors/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAO3E,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,OAAO,EAAE,SAAS,EAAE,MAAM,0DAA0D,CAAC;AAQrF,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhE;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAC/C,8BAA8B,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC;IACzE,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAkB;IACvD,OAAO,CACL,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC;QAC5B,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,gBAAgB,CAC/C,SAAS,EACT,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAChE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAmB;IAClD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,kDAAkD,CAAC,EAC7D,uBAAuB,CACxB,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,IAAI,QAAQ,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QAC1B,OAAO;YACL,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,MAAM;YACnB,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IACD,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,KAAK;QAC1B,WAAW,EAAE,MAAM;QACnB,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,EAAE;QACZ,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,8BAA8B,CAC5C,SAA0C,EAC1C,MAAkC,EAClC,MAAc,EACd,qBAAqB,GAAG,KAAK;IAE7B,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACjC,qEAAqE;QACrE,mEAAmE;QACnE,kEAAkE;QAClE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,IAAI,QAAoC,CAAC;QACzC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,QAAQ,GAAG,MAAM,uBAAuB,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACnE,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnD,kEAAkE;gBAClE,+DAA+D;gBAC/D,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;oBAClE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;iBACnD,CAAC,CAAC;gBACH,MAAM,IAAI,YAAY,CACpB,0EAA0E,EAC1E,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IACL,qBAAqB;YACrB,CAAC,sBAAsB,CAAC,OAAO,CAAC,MAAM,CAAC,EACvC,CAAC;YACD,mEAAmE;YACnE,kEAAkE;YAClE,oEAAoE;YACpE,oEAAoE;YACpE,gDAAgD;YAChD,MAAM,IAAI,YAAY,CACpB,oCAAoC,EACpC,IAAI,CAAC,eAAe,CACrB,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,IAAI,oBAAoB,EAAE,CAAC;QACnD,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAkC,EAClC,MAAsB,EACtB,OAAqC,EACrC,MAAc;IAEd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACxE,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;oBAC9C,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,SAAS;oBACT,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;iBACvB,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBAClC,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,SAAS;gBACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;AAErE,2DAA2D;AAC3D,MAAM,UAAU,qBAAqB,CAAC,MAAsB;IAC1D,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,gCAAgC;IAC9C,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAC7D,IAAI,QAAwB,CAAC;QAC7B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,QAAQ,GAAG;oBACT,GAAI,IAAI,CAAC,KAAK,CACZ,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAChC;oBACpB,MAAM,EAAE,YAAY;iBACrB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CACjB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACzD,uBAAuB,CACxB,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG;gBACT,GAAG,oBAAoB,EAAE;gBACzB,WAAW,EAAE,UAAU;gBACvB,MAAM,EAAE,YAAY;aACrB,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAA0C,EAC1C,KAAa,EACb,MAAc;IAEd,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,OAA8B,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;gBAClC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE;gBACvC,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,iBAAyB;IACxD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,SAAS,CAAC;IACzB,IACE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,EACvD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/pipeline/interceptors/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAO3E,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,OAAO,EAAE,SAAS,EAAE,MAAM,0DAA0D,CAAC;AAQrF,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhE;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAC/C,8BAA8B,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC;IACzE,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAkB;IACvD,OAAO,CACL,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC;QAC5B,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,gBAAgB,CAC/C,SAAS,EACT,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAChE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAmB;IAClD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,kDAAkD,CAAC,EAC7D,uBAAuB,CACxB,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,uBAAuB,CAAC,wBAAwB,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAGvC;IACC,IAAI,QAAQ,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QAC1B,OAAO;YACL,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,MAAM;YACnB,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IACD,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,KAAK;QAC1B,WAAW,EAAE,MAAM;QACnB,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,EAAE;QACZ,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,8BAA8B,CAC5C,SAA0C,EAC1C,MAAkC,EAClC,MAAc,EACd,qBAAqB,GAAG,KAAK;IAE7B,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACjC,qEAAqE;QACrE,mEAAmE;QACnE,kEAAkE;QAClE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,IAAI,QAAoC,CAAC;QACzC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,QAAQ,GAAG,MAAM,uBAAuB,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACnE,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnD,kEAAkE;gBAClE,+DAA+D;gBAC/D,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;oBAClE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;iBACnD,CAAC,CAAC;gBACH,MAAM,IAAI,YAAY,CACpB,0EAA0E,EAC1E,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IACL,qBAAqB;YACrB,CAAC,sBAAsB,CAAC,OAAO,CAAC,MAAM,CAAC,EACvC,CAAC;YACD,mEAAmE;YACnE,kEAAkE;YAClE,oEAAoE;YACpE,oEAAoE;YACpE,gDAAgD;YAChD,MAAM,IAAI,YAAY,CACpB,oCAAoC,EACpC,IAAI,CAAC,eAAe,CACrB,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,IAAI,oBAAoB,EAAE,CAAC;QACnD,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAkC,EAClC,MAAsB,EACtB,OAAqC,EACrC,MAAc;IAEd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACxE,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;oBAC9C,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,SAAS;oBACT,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;iBACvB,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBAClC,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,SAAS;gBACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;AAErE,2DAA2D;AAC3D,MAAM,UAAU,qBAAqB,CAAC,MAAsB;IAC1D,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,gCAAgC;IAC9C,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAC7D,IAAI,QAAwB,CAAC;QAC7B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,QAAQ,GAAG;oBACT,GAAI,IAAI,CAAC,KAAK,CACZ,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAChC;oBACpB,MAAM,EAAE,YAAY;iBACrB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CACjB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACzD,uBAAuB,CACxB,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG;gBACT,GAAG,oBAAoB,EAAE;gBACzB,WAAW,EAAE,UAAU;gBACvB,MAAM,EAAE,YAAY;aACrB,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAA0C,EAC1C,KAAa,EACb,MAAc;IAEd,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,OAA8B,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;gBAClC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE;gBACvC,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,iBAAyB;IACxD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,SAAS,CAAC;IACzB,IACE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,EACvD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC"}

package/dist/pipeline/steps/authorize-run-target.d.ts

@@ -0,0 +1,105 @@
+/**
+ * AuthorizeRunTarget — the run gate (P1 sp.run-gate, 2026-09-11;
+ * stigmer-cloud#709): may this caller RUN what this record targets?
+ *
+ * Every create that starts or continues a run names a target — a blueprint
+ * (`agent`, `workflow`), an instance (`agent_instance`, `workflow_instance`)
+ * or a conversation (`session`) — and until this step nothing asked whether
+ * the caller may use it: session-create authorized only the organization's
+ * `can_create_session`, agent- and workflow-execution create are
+ * `is_skip_authorization`, and `can_execute` was defined on every blueprint
+ * and instance type of the FGA model and checked nowhere. The invariant the
+ * model states ("you can run what you can read") is enforced here.
+ *
+ * One shared step, one domain resolver: the shape of IndexSearch (a shared
+ * step over a domain extractor). The resolver is a PURE function of the
+ * record being built (`ctx.newState`, where the chain's own resolution
+ * steps write) that names the target and the domain's byte-pinned deny
+ * copy; this step hands it to authorizeResolvedResource — the ratified
+ * mid-chain resolved-id form (DD-007; the ListVersions and listByChannel
+ * precedent) for lanes the position-1 annotation cannot express. A
+ * resolver that answers no target makes NO check: the chain's own
+ * invariant guards (EnsureSessionOrAgentResolved,
+ * ValidateWorkflowOrInstance) own the shape-less arm, and this step never
+ * second-guesses them.
+ *
+ * Position, in every chain: immediately after the step that guarantees the
+ * target reference exists — before EnsureEngineAvailable (a denied caller
+ * learns nothing about engine state), before every gate slot, before every
+ * side effect the chain owns. The chains' own convention, Authorize before
+ * Validate, is what places it there.
+ *
+ * Admission has one owner per lane. This step asks for EVERY caller but the
+ * `internal` class (authorizeResolvedResource's contract): a direct
+ * principal is admitted by the Authorizer; a runtime lane (a guest share, a
+ * channel, a schedule fire, a workflow sandbox's child run) is admitted by
+ * the gate step that vouches for it, and the edition's Authorizer says so
+ * for the lanes it mints — the OSS chain stays policy-free. RUN_GATE_CHECKS
+ * is the one definition of "the run-gate checks" that such an Authorizer
+ * keys on (isRunGateCheck, exported on the barrel); the resolvers draw their
+ * (kind, permission) pairs from the same table, so the predicate cannot
+ * drift from what the step actually asks.
+ */
+import type { DescMessage, MessageShape } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import type { Authorizer, AuthzCheck } from "../../extensions/authorizer.js";
+import type { PipelineStep } from "../pipeline.js";
+/** One (kind, permission) pair the run gate asks about. */
+export interface RunGateCheck {
+    readonly permission: IamPermission;
+    readonly resourceKind: ApiResourceKind;
+}
+/**
+ * The run-gate check set — exactly the pairs a resolver can produce. Each
+ * is the FGA model's own relation for "may run this": `can_execute` on the
+ * blueprints and instances (`agent.fga` `can_execute: viewer`;
+ * `agent_instance.fga` `can_execute: can_view`; the workflow twins), and
+ * `can_create_execution_in` on a session (`session.fga`: adding a turn to a
+ * conversation is the session's own permission, not the agent's).
+ */
+export declare const RUN_GATE_CHECKS: {
+    readonly agent: {
+        readonly permission: IamPermission.can_execute;
+        readonly resourceKind: ApiResourceKind.agent;
+    };
+    readonly agentInstance: {
+        readonly permission: IamPermission.can_execute;
+        readonly resourceKind: ApiResourceKind.agent_instance;
+    };
+    readonly session: {
+        readonly permission: IamPermission.can_create_execution_in;
+        readonly resourceKind: ApiResourceKind.session;
+    };
+    readonly workflow: {
+        readonly permission: IamPermission.can_execute;
+        readonly resourceKind: ApiResourceKind.workflow;
+    };
+    readonly workflowInstance: {
+        readonly permission: IamPermission.can_execute;
+        readonly resourceKind: ApiResourceKind.workflow_instance;
+    };
+};
+/**
+ * Whether `check` is one of the run gate's — the predicate an edition's
+ * Authorizer keys its lane admission on. Reads only the pair (an AuthzCheck
+ * is one); the resource id is the target's identity, not part of the
+ * question.
+ */
+export declare function isRunGateCheck(check: RunGateCheck | AuthzCheck): boolean;
+/**
+ * A resolved run target: the check plus the domain's byte-pinned deny copy
+ * for it (the lane's error_msg, in the position-1 annotation's terms).
+ */
+export interface RunTarget extends RunGateCheck {
+    readonly resourceId: string;
+    readonly deniedMessage: string;
+}
+/**
+ * Names a record's run target, or `undefined` when the record names none
+ * (a state the chain's own guards refuse; never this step's arm). Pure over
+ * the record being built — no store, no clock, no caller.
+ */
+export type RunTargetResolver<Desc extends DescMessage> = (record: MessageShape<Desc>) => RunTarget | undefined;
+export declare function newAuthorizeRunTargetStep<Desc extends DescMessage>(authorizer: Authorizer, resolveRunTarget: RunTargetResolver<Desc>): PipelineStep<Desc>;
+//# sourceMappingURL=authorize-run-target.d.ts.map

package/dist/pipeline/steps/authorize-run-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-run-target.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/authorize-run-target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEpE,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAE1E,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAInD,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;CACxC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;CAqBqB,CAAC;AAKlD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,UAAU,GAAG,OAAO,CAMxE;AAED;;;GAGG;AACH,MAAM,WAAW,SAAU,SAAQ,YAAY;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,CAAC,IAAI,SAAS,WAAW,IAAI,CACxD,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,KACvB,SAAS,GAAG,SAAS,CAAC;AAE3B,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,GACxC,YAAY,CAAC,IAAI,CAAC,CAoBpB"}

package/dist/pipeline/steps/authorize-run-target.js

@@ -0,0 +1,61 @@
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { authorizeResolvedResource } from "./authorize.js";
+/**
+ * The run-gate check set — exactly the pairs a resolver can produce. Each
+ * is the FGA model's own relation for "may run this": `can_execute` on the
+ * blueprints and instances (`agent.fga` `can_execute: viewer`;
+ * `agent_instance.fga` `can_execute: can_view`; the workflow twins), and
+ * `can_create_execution_in` on a session (`session.fga`: adding a turn to a
+ * conversation is the session's own permission, not the agent's).
+ */
+export const RUN_GATE_CHECKS = {
+    agent: {
+        permission: IamPermission.can_execute,
+        resourceKind: ApiResourceKind.agent,
+    },
+    agentInstance: {
+        permission: IamPermission.can_execute,
+        resourceKind: ApiResourceKind.agent_instance,
+    },
+    session: {
+        permission: IamPermission.can_create_execution_in,
+        resourceKind: ApiResourceKind.session,
+    },
+    workflow: {
+        permission: IamPermission.can_execute,
+        resourceKind: ApiResourceKind.workflow,
+    },
+    workflowInstance: {
+        permission: IamPermission.can_execute,
+        resourceKind: ApiResourceKind.workflow_instance,
+    },
+};
+const RUN_GATE_CHECK_LIST = Object.values(RUN_GATE_CHECKS);
+/**
+ * Whether `check` is one of the run gate's — the predicate an edition's
+ * Authorizer keys its lane admission on. Reads only the pair (an AuthzCheck
+ * is one); the resource id is the target's identity, not part of the
+ * question.
+ */
+export function isRunGateCheck(check) {
+    return RUN_GATE_CHECK_LIST.some((candidate) => candidate.permission === check.permission &&
+        candidate.resourceKind === check.resourceKind);
+}
+export function newAuthorizeRunTargetStep(authorizer, resolveRunTarget) {
+    return {
+        name: "AuthorizeRunTarget",
+        async execute(ctx) {
+            const target = resolveRunTarget(ctx.newState);
+            if (target === undefined) {
+                return;
+            }
+            await authorizeResolvedResource(authorizer, ctx.callerIdentity, {
+                permission: target.permission,
+                resourceKind: target.resourceKind,
+                resourceId: target.resourceId,
+            }, target.deniedMessage);
+        },
+    };
+}
+//# sourceMappingURL=authorize-run-target.js.map

package/dist/pipeline/steps/authorize-run-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-run-target.js","sourceRoot":"","sources":["../../../src/pipeline/steps/authorize-run-target.ts"],"names":[],"mappings":"AA4CA,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAK1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAQ3D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,KAAK,EAAE;QACL,UAAU,EAAE,aAAa,CAAC,WAAW;QACrC,YAAY,EAAE,eAAe,CAAC,KAAK;KACpC;IACD,aAAa,EAAE;QACb,UAAU,EAAE,aAAa,CAAC,WAAW;QACrC,YAAY,EAAE,eAAe,CAAC,cAAc;KAC7C;IACD,OAAO,EAAE;QACP,UAAU,EAAE,aAAa,CAAC,uBAAuB;QACjD,YAAY,EAAE,eAAe,CAAC,OAAO;KACtC;IACD,QAAQ,EAAE;QACR,UAAU,EAAE,aAAa,CAAC,WAAW;QACrC,YAAY,EAAE,eAAe,CAAC,QAAQ;KACvC;IACD,gBAAgB,EAAE;QAChB,UAAU,EAAE,aAAa,CAAC,WAAW;QACrC,YAAY,EAAE,eAAe,CAAC,iBAAiB;KAChD;CAC8C,CAAC;AAElD,MAAM,mBAAmB,GACvB,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAgC;IAC7D,OAAO,mBAAmB,CAAC,IAAI,CAC7B,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QACzC,SAAS,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,CAChD,CAAC;AACJ,CAAC;AAoBD,MAAM,UAAU,yBAAyB,CACvC,UAAsB,EACtB,gBAAyC;IAEzC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,MAAM,yBAAyB,CAC7B,UAAU,EACV,GAAG,CAAC,cAAc,EAClB;gBACE,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,EACD,MAAM,CAAC,aAAa,CACrB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/query/search/criteria.d.ts

@@ -5,7 +5,7 @@
  * discover).
  *
  * The searchable-kind set is DERIVED from the proto kind_meta extension
- * (not_search_indexed: false, tier != cloud_only) — Go's
+ * (not_search_indexed: false, tier == open_source) — Go's
  * SearchIndexedKinds() posture since stigmer/stigmer#439, where hand-copied
  * kind lists drifted from the proto and from each other. Go still carries a
  * hand map (SearchableKinds) pinned to the derivation by an invariant test;
@@ -13,6 +13,13 @@
  * registry unit test pins the registered extractors against this same
  * derivation (the #439 invariant's TS home).
  *
+ * The tier clause admits open_source alone, not "anything but cloud_only":
+ * the index is the core's, and a kind tiered enterprise (editions program,
+ * DD-001) must not enter it by accident. This derivation is edition-blind
+ * by design (the same code runs in every composition); an edition-aware
+ * derivation is a design act with a named trigger — the first searchable
+ * kind above open_source.
+ *
  * kinds are kept VERBATIM from the request; filtering to the searchable set
  * happens in effectiveKinds(). Keeping the raw request is what
  * distinguishes "no kinds requested" (discover mode) from "kinds requested
@@ -33,8 +40,8 @@ export declare const MAX_PAGE_SIZE = 100;
 export declare const MAX_QUERY_LENGTH = 500;
 /**
  * Go SearchIndexedKinds(): every kind this edition's search read side
- * serves — kind_meta declares it search-indexed and servable outside the
- * cloud. Sorted ascending by enum value, exactly Go's sort. Kinds whose
+ * serves — kind_meta declares it search-indexed and open_source-tier.
+ * Sorted ascending by enum value, exactly Go's sort. Kinds whose
  * kind_meta cannot be read are skipped (Go's contract; the registry unit
  * test separately fails on such a defect).
  */

package/dist/query/search/criteria.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"criteria.d.ts","sourceRoot":"","sources":["../../../src/query/search/criteria.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EACL,eAAe,EAGhB,MAAM,qFAAqF,CAAC;AAK7F,0BAA0B;AAC1B,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,sBAAsB;AACtB,eAAO,MAAM,aAAa,MAAM,CAAC;AACjC,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAKpC;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,SAAS,eAAe,EAAE,CAuB/D;AAUD;;GAEG;AACH,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAPhC,OAAO;IAUP;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,MAAM,CACX,KAAK,EAAE,SAAS,eAAe,EAAE,EACjC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,OAAO,EACtB,cAAc,EAAE,OAAO,EACvB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,cAAc;IAkBjB,oEAAoE;IACpE,KAAK,IAAI,SAAS,eAAe,EAAE;IAInC,KAAK,IAAI,MAAM;IAIf,SAAS,IAAI,MAAM;IAInB,aAAa,IAAI,OAAO;IAIxB,cAAc,IAAI,OAAO;IAIzB,UAAU,IAAI,MAAM;IAIpB,QAAQ,IAAI,MAAM;IAIlB;;;OAGG;IACH,cAAc,IAAI,OAAO;IAIzB,iEAAiE;IACjE,QAAQ,IAAI,OAAO;IAInB,YAAY,IAAI,OAAO;IAIvB;;;;;;OAMG;IACH,cAAc,IAAI,SAAS,eAAe,EAAE;IAQ5C,wDAAwD;IACxD,MAAM,IAAI,MAAM;CAGjB"}
+{"version":3,"file":"criteria.d.ts","sourceRoot":"","sources":["../../../src/query/search/criteria.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EACL,eAAe,EAGhB,MAAM,qFAAqF,CAAC;AAK7F,0BAA0B;AAC1B,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,sBAAsB;AACtB,eAAO,MAAM,aAAa,MAAM,CAAC;AACjC,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAKpC;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,SAAS,eAAe,EAAE,CAuB/D;AAUD;;GAEG;AACH,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAPhC,OAAO;IAUP;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,MAAM,CACX,KAAK,EAAE,SAAS,eAAe,EAAE,EACjC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,OAAO,EACtB,cAAc,EAAE,OAAO,EACvB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,cAAc;IAkBjB,oEAAoE;IACpE,KAAK,IAAI,SAAS,eAAe,EAAE;IAInC,KAAK,IAAI,MAAM;IAIf,SAAS,IAAI,MAAM;IAInB,aAAa,IAAI,OAAO;IAIxB,cAAc,IAAI,OAAO;IAIzB,UAAU,IAAI,MAAM;IAIpB,QAAQ,IAAI,MAAM;IAIlB;;;OAGG;IACH,cAAc,IAAI,OAAO;IAIzB,iEAAiE;IACjE,QAAQ,IAAI,OAAO;IAInB,YAAY,IAAI,OAAO;IAIvB;;;;;;OAMG;IACH,cAAc,IAAI,SAAS,eAAe,EAAE;IAQ5C,wDAAwD;IACxD,MAAM,IAAI,MAAM;CAGjB"}