@stigmer/server 3.14.1 → 3.15.0

package/dist/domain/identityaccount/steps.js

@@ -0,0 +1,291 @@
+/**
+ * Identity-account domain steps (20260911.11; T01_1_review.md A1, A9).
+ *
+ * This is the first OSS domain whose persistence is a PORT
+ * (IdentityAccountStore) rather than the generic Store, so the cloud can
+ * serve the same controller over its own table. The shared steps that
+ * touch storage (CheckDuplicate, LoadExisting, LoadTarget, Persist, the
+ * delete pair) are typed over `Store`; this module brings the domain's
+ * own under the SAME names, so a chain reads onto the inventory unchanged
+ * (the organization domain's "own step, same name" precedent), and reuses
+ * every storage-free shared step as it is. The shared context keys are
+ * reused too, so BuildUpdateState finds EXISTING_RESOURCE_KEY exactly
+ * where it expects it.
+ *
+ * The domain's own rules:
+ *   - DefaultAccountName: `metadata.name` falls back to the email, then
+ *     the subject. ResolveSlug refuses an empty name and the field is not
+ *     proto-required, and a machine subject whose IdP releases no email
+ *     must still provision.
+ *   - DeriveAccountId (A1): `metadata.id = accountIdFor(spec.idp_id)`,
+ *     replacing whatever the caller sent (the organization's CopySlugToId
+ *     precedent, `metadata.proto`'s documented exception). Runs BEFORE
+ *     BuildNewState, which mints only when the id is empty.
+ *   - CheckDuplicate: by SUBJECT, a primary-key read of the derived id —
+ *     two accounts may share an email; the account's uniqueness is its
+ *     subject, never its slug (the guideline's "domains with different
+ *     uniqueness rules bring their own step under the same name").
+ *   - AssignBackendFields: `is_machine_account` from the `@clients`
+ *     suffix and `provisioning_mode direct` on create (the spec's
+ *     "assigned by backend" fields); on update, every backend-assigned
+ *     field and the email are preserved from the existing row (A9: the
+ *     cloud's writable surface — first/last name, picture, preferences —
+ *     and nothing else; the `preserveImmutableFields` shape).
+ *   - GuardImmutableSubject (A1): a changed `spec.idp_id` is refused
+ *     FAILED_PRECONDITION (the schedule domain's shape), never silently
+ *     preserved — the subject IS the identity, and a client that sends a
+ *     different one has a bug it should hear about.
+ *
+ * NOT_FOUND copy is the domain's (`Identity account not found: <id>`, the
+ * cloud's byte-pinned sentence); the shared `notFoundError` would render
+ * the kind_meta name `IdentityAccount`.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { create } from "@bufbuild/protobuf";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
+import { IdentityAccountSpecSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/spec_pb";
+import { alreadyExistsError, failedPreconditionError, internalError, invalidArgumentError, } from "../../pipeline/errors.js";
+import { RESOURCE_ID_KEY } from "../../pipeline/steps/delete.js";
+import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
+import { TARGET_RESOURCE_KEY } from "../../pipeline/steps/load-target.js";
+import { idValueOf, metadataOf } from "../../pipeline/steps/shapes.js";
+import { accountIdFor, accountNotFoundMessage, idpIdImmutableMessage, isMachineSubject, } from "./constants.js";
+import { DuplicateAccountError } from "./store.js";
+/** The kind's name as the shared error constructors render it. */
+const KIND_NAME = "IdentityAccount";
+/** `Identity account not found: <handle>` as a NOT_FOUND ConnectError. */
+export function accountNotFoundError(handle) {
+    return new ConnectError(accountNotFoundMessage(handle), Code.NotFound);
+}
+// ---------------------------------------------------------------------------
+// Create
+// ---------------------------------------------------------------------------
+export function newDefaultAccountNameStep() {
+    return {
+        name: "DefaultAccountName",
+        execute(ctx) {
+            const metadata = requireMetadata(ctx, "default account name");
+            if (metadata.name === "") {
+                const spec = specOf(ctx);
+                metadata.name = spec.email !== "" ? spec.email : spec.idpId;
+            }
+        },
+    };
+}
+export function newDeriveAccountIdStep() {
+    return {
+        name: "DeriveAccountId",
+        execute(ctx) {
+            const metadata = requireMetadata(ctx, "derive account id");
+            // ValidateProto ran upstream (idp_id is required), so an empty
+            // subject here is a pipeline-ordering bug, not bad client input.
+            const idpId = specOf(ctx).idpId;
+            if (idpId === "") {
+                throw internalError(new Error("identity account idp_id is empty"), "derive account id");
+            }
+            metadata.id = accountIdFor(idpId);
+        },
+    };
+}
+/** Rejects a create whose SUBJECT already has an account (a primary-key read). */
+export function newCheckDuplicateStep(accounts) {
+    return {
+        name: "CheckDuplicate",
+        async execute(ctx) {
+            const metadata = requireMetadata(ctx, "duplicate check");
+            const idpId = specOf(ctx).idpId;
+            let existing;
+            try {
+                existing = await accounts.findById(metadata.id);
+            }
+            catch (error) {
+                throw internalError(error, "failed to check for duplicate identity account");
+            }
+            if (existing !== undefined) {
+                throw alreadyExistsError(KIND_NAME, `subject '${idpId}'`);
+            }
+        },
+    };
+}
+/**
+ * The backend-assigned fields of a DIRECT account, applied in place: the
+ * machine flag from the subject's shape, `provisioning_mode direct`, no
+ * provider ref (a direct account is the platform's own subject). The ONE
+ * writer of these fields; the provisioner builds its spec through it too.
+ */
+export function assignDirectBackendFields(spec) {
+    spec.isMachineAccount = isMachineSubject(spec.idpId);
+    spec.provisioningMode = IdentityAccountProvisioningMode.direct;
+    spec.identityProviderRef = undefined;
+    return spec;
+}
+export function newAssignBackendFieldsStep() {
+    return {
+        name: "AssignBackendFields",
+        execute(ctx) {
+            assignDirectBackendFields(specOf(ctx));
+        },
+    };
+}
+/** Saves the new account through the port; a held subject is ALREADY_EXISTS. */
+export function newPersistNewAccountStep(accounts) {
+    return {
+        name: "Persist",
+        async execute(ctx) {
+            try {
+                await accounts.save(ctx.newState);
+            }
+            catch (error) {
+                if (error instanceof DuplicateAccountError) {
+                    // The race the duplicate check could not see: another writer
+                    // took the subject between the read and this save. The
+                    // provisioner's race arm resolves the winner from this code.
+                    throw alreadyExistsError(KIND_NAME, `subject '${specOf(ctx).idpId}'`);
+                }
+                throw internalError(error, "failed to save identity account");
+            }
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Update
+// ---------------------------------------------------------------------------
+/** Loads the existing account by id into EXISTING_RESOURCE_KEY; the domain's NOT_FOUND copy. */
+export function newLoadExistingAccountStep(accounts) {
+    return {
+        name: "LoadExisting",
+        async execute(ctx) {
+            const metadata = requireMetadata(ctx, "load existing");
+            if (metadata.id === "") {
+                // By id only: an account's slug is derived from its display name
+                // and two accounts may share one, so a slug lookup could never be
+                // an identity.
+                throw invalidArgumentError("resource id is required for update");
+            }
+            const existing = await readAccount(accounts, metadata.id);
+            ctx.set(EXISTING_RESOURCE_KEY, existing);
+        },
+    };
+}
+export function newGuardImmutableSubjectStep() {
+    return {
+        name: "GuardImmutableSubject",
+        execute(ctx) {
+            const existing = existingAccountOf(ctx);
+            const existingIdpId = existing.spec?.idpId ?? "";
+            if (specOf(ctx).idpId !== existingIdpId) {
+                throw failedPreconditionError(idpIdImmutableMessage(existingIdpId));
+            }
+        },
+    };
+}
+/** Preserves the backend-assigned fields and the email from the existing row (A9). */
+export function newPreserveBackendFieldsStep() {
+    return {
+        name: "AssignBackendFields",
+        execute(ctx) {
+            const existingSpec = existingAccountOf(ctx).spec;
+            const spec = specOf(ctx);
+            spec.idpId = existingSpec?.idpId ?? spec.idpId;
+            spec.email = existingSpec?.email ?? "";
+            spec.isMachineAccount = existingSpec?.isMachineAccount ?? false;
+            spec.provisioningMode =
+                existingSpec?.provisioningMode ??
+                    IdentityAccountProvisioningMode.identity_account_provisioning_mode_unspecified;
+            spec.identityProviderRef = existingSpec?.identityProviderRef;
+        },
+    };
+}
+/** Replaces the row through the port. */
+export function newPersistUpdatedAccountStep(accounts) {
+    return {
+        name: "Persist",
+        async execute(ctx) {
+            try {
+                await accounts.update(ctx.newState);
+            }
+            catch (error) {
+                throw internalError(error, "failed to save identity account");
+            }
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Get / Delete (ID-wrapper inputs)
+// ---------------------------------------------------------------------------
+/** Loads the account named by an ID-wrapper input into TARGET_RESOURCE_KEY. */
+export function newLoadTargetAccountStep(accounts) {
+    return {
+        name: "LoadTarget",
+        async execute(ctx) {
+            const id = idValueOf(ctx.input);
+            if (id === "") {
+                throw invalidArgumentError("resource id is required");
+            }
+            ctx.set(TARGET_RESOURCE_KEY, await readAccount(accounts, id));
+        },
+    };
+}
+/** Loads the doomed account (after ExtractResourceId) so delete can return it. */
+export function newLoadExistingAccountForDeleteStep(accounts) {
+    return {
+        name: "LoadExistingForDelete",
+        async execute(ctx) {
+            ctx.set(EXISTING_RESOURCE_KEY, await readAccount(accounts, requireResourceId(ctx)));
+        },
+    };
+}
+export function newDeleteAccountStep(accounts) {
+    return {
+        name: "DeleteResource",
+        async execute(ctx) {
+            try {
+                await accounts.deleteById(requireResourceId(ctx));
+            }
+            catch (error) {
+                throw internalError(error, "failed to delete identity account");
+            }
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Shared readers
+// ---------------------------------------------------------------------------
+/** The account by id, or the domain's NOT_FOUND; any other fault propagates. */
+async function readAccount(accounts, id) {
+    const account = await accounts.findById(id);
+    if (account === undefined) {
+        throw accountNotFoundError(id);
+    }
+    return account;
+}
+function requireMetadata(ctx, operation) {
+    const metadata = metadataOf(ctx.newState);
+    if (metadata === undefined) {
+        throw internalError(new Error("identity account metadata is nil"), operation);
+    }
+    return metadata;
+}
+/** The spec being built, created in place when the caller omitted it. */
+function specOf(ctx) {
+    const state = ctx.newState;
+    if (state.spec === undefined) {
+        state.spec = create(IdentityAccountSpecSchema);
+    }
+    return state.spec;
+}
+function existingAccountOf(ctx) {
+    const existing = ctx.get(EXISTING_RESOURCE_KEY);
+    if (existing === undefined) {
+        throw internalError(new Error("existing identity account not found in context - LoadExisting must run first"), "identity account update ordering");
+    }
+    return existing;
+}
+function requireResourceId(ctx) {
+    const id = ctx.get(RESOURCE_ID_KEY);
+    if (typeof id !== "string" || id === "") {
+        throw internalError(new Error("resource id not found in context (ExtractResourceId must run first)"), "identity account delete ordering");
+    }
+    return id;
+}
+//# sourceMappingURL=steps.js.map

package/dist/domain/identityaccount/steps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAI5C,OAAO,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAE5G,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AAEtG,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAMnD,kEAAkE;AAClE,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAEpC,0EAA0E;AAC1E,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,OAAO,IAAI,YAAY,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,OAAO,CAAC,GAAmB;YACzB,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;YAC9D,IAAI,QAAQ,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;gBACzB,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YAC9D,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,CAAC,GAAmB;YACzB,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YAC3D,+DAA+D;YAC/D,iEAAiE;YACjE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;YAChC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACjB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,kCAAkC,CAAC,EAC7C,mBAAmB,CACpB,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,qBAAqB,CACnC,QAA8B;IAE9B,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,OAAO,CAAC,GAAmB;YAC/B,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YACzD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;YAChC,IAAI,QAAqC,CAAC;YAC1C,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CACjB,KAAK,EACL,gDAAgD,CACjD,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,kBAAkB,CAAC,SAAS,EAAE,YAAY,KAAK,GAAG,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAyB;IAEzB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,gBAAgB,GAAG,+BAA+B,CAAC,MAAM,CAAC;IAC/D,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAC;IACrC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,OAAO,CAAC,GAAmB;YACzB,yBAAyB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,wBAAwB,CACtC,QAA8B;IAE9B,OAAO;QACL,IAAI,EAAE,SAAS;QACf,KAAK,CAAC,OAAO,CAAC,GAAmB;YAC/B,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACpC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,6DAA6D;oBAC7D,uDAAuD;oBACvD,6DAA6D;oBAC7D,MAAM,kBAAkB,CAAC,SAAS,EAAE,YAAY,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;gBACxE,CAAC;gBACD,MAAM,aAAa,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,gGAAgG;AAChG,MAAM,UAAU,0BAA0B,CACxC,QAA8B;IAE9B,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,KAAK,CAAC,OAAO,CAAC,GAAmB;YAC/B,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;YACvD,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACvB,iEAAiE;gBACjE,kEAAkE;gBAClE,eAAe;gBACf,MAAM,oBAAoB,CAAC,oCAAoC,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC1D,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,OAAO,CAAC,GAAmB;YACzB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACxC,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACjD,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;gBACxC,MAAM,uBAAuB,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,OAAO,CAAC,GAAmB;YACzB,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,CAAC,KAAK,GAAG,YAAY,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;YAC/C,IAAI,CAAC,KAAK,GAAG,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC;YACvC,IAAI,CAAC,gBAAgB,GAAG,YAAY,EAAE,gBAAgB,IAAI,KAAK,CAAC;YAChE,IAAI,CAAC,gBAAgB;gBACnB,YAAY,EAAE,gBAAgB;oBAC9B,+BAA+B,CAAC,8CAA8C,CAAC;YACjF,IAAI,CAAC,mBAAmB,GAAG,YAAY,EAAE,mBAAmB,CAAC;QAC/D,CAAC;KACF,CAAC;AACJ,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,4BAA4B,CAC1C,QAA8B;IAE9B,OAAO;QACL,IAAI,EAAE,SAAS;QACf,KAAK,CAAC,OAAO,CAAC,GAAmB;YAC/B,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E,+EAA+E;AAC/E,MAAM,UAAU,wBAAwB,CACtC,QAA8B;IAE9B,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,KAAK,CAAC,OAAO,CAAC,GAA8B;YAC1C,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACd,MAAM,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;YACxD,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,mCAAmC,CAEjD,QAA8B;IAC9B,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,KAAK,CAAC,OAAO,CAAC,GAA8B;YAC1C,GAAG,CAAC,GAAG,CACL,qBAAqB,EACrB,MAAM,WAAW,CAAC,QAAQ,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CACpD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAA8B;IAE9B,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,OAAO,CAAC,GAA8B;YAC1C,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,mCAAmC,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,gFAAgF;AAChF,KAAK,UAAU,WAAW,CACxB,QAA8B,EAC9B,EAAU;IAEV,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,GAAmB,EAAE,SAAiB;IAC7D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,kCAAkC,CAAC,EAC7C,SAAS,CACV,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,yEAAyE;AACzE,SAAS,MAAM,CAAC,GAAmB;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAmB;IAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAEjC,CAAC;IACd,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,8EAA8E,CAC/E,EACD,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAyB;IAEzB,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,qEAAqE,CACtE,EACD,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/domain/identityaccount/store-contract.d.ts

@@ -0,0 +1,22 @@
+import type { IdentityAccountStore } from "./store.js";
+/** One fresh, isolated store per case, plus the one escape hatch the port cannot express. */
+export interface IdentityAccountStoreContractFixture {
+    readonly store: IdentityAccountStore;
+    /**
+     * Cuts the store from its database so every later call is an
+     * infrastructure fault. `cleanup` still runs afterwards and must tolerate
+     * a disconnected store (both OSS drivers' `close` is idempotent; a pool
+     * fixture ends a per-case pool here and skips it in cleanup).
+     */
+    disconnect(): Promise<void>;
+    cleanup(): Promise<void>;
+}
+export interface IdentityAccountStoreContractCase {
+    /** The contract line, in the port's words; the framework prints it as the test name. */
+    readonly name: string;
+    /** Makes a FRESH fixture, runs the case, cleans up. A failing assertion wins over a failing cleanup. */
+    run(): Promise<void>;
+}
+/** The port's cases over `makeFixture`, one fresh fixture per case. */
+export declare function identityAccountStoreContract(makeFixture: () => Promise<IdentityAccountStoreContractFixture>): ReadonlyArray<IdentityAccountStoreContractCase>;
+//# sourceMappingURL=store-contract.d.ts.map

package/dist/domain/identityaccount/store-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-contract.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/store-contract.ts"],"names":[],"mappings":"AAwDA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,6FAA6F;AAC7F,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC;;;;;OAKG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,gCAAgC;IAC/C,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wGAAwG;IACxG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACtB;AAkYD,uEAAuE;AACvE,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,OAAO,CAAC,mCAAmC,CAAC,GAC9D,aAAa,CAAC,gCAAgC,CAAC,CAKjD"}

package/dist/domain/identityaccount/store-contract.js

@@ -0,0 +1,307 @@
+/**
+ * The IdentityAccountStore PORT-CONTRACT KIT (20260911.11, T01_1_review.md
+ * A11 and A12): every behavior an implementation of store.ts must satisfy
+ * identically, as cases a driver's test iterates. Open source runs them
+ * over its own adapter (resource-store.ts) on sqlite and Postgres in
+ * __tests__/resource-store.test.ts; a composition runs the SAME cases over
+ * the store it registers as `drivers.identityAccountStore` (the cloud's
+ * `cloud.iam_identity_account` store), so "the port holds" is one
+ * statement proven per driver, never restated per repository.
+ *
+ * Shape. The package's precedent is store/__tests__/store-contract.ts —
+ * `describeStoreContract(makeFixture)`: a fresh fixture per test, named
+ * escape hatches for the arms the interface cannot express, driver-physical
+ * behavior left to each driver's own tests. This kit follows it in
+ * everything but the framework: it is consumed by ANOTHER package's tests,
+ * so it ships in dist/ and must not import vitest — a devDependency that
+ * would enter the root barrel's runtime import graph. It therefore returns
+ * cases instead of calling `describe`, asserts through node:assert/strict,
+ * and the consumer's framework does `for (const c of cases) it(c.name,
+ * c.run)`. Do not "fix" it back to the precedent's vitest shape.
+ *
+ * Every case makes a FRESH fixture, runs, and cleans up; a failing
+ * assertion wins over a failing cleanup. `disconnect` is the one escape
+ * hatch: the port has no lifecycle by design (a composition owns its
+ * store's), yet "an outage never reads as no account" is the line that
+ * matters most, so the fixture cuts the store from its database and the
+ * kit asserts that the fault propagates instead of reading as `undefined`.
+ *
+ * What the kit deliberately does not carry: open source's primary-key read
+ * (the findByField spy) and its derived-id refusal, the cloud's column
+ * layout and SQLSTATE 23505 mapping — driver-physical, each driver's own
+ * tests. Nor does any case hold a direct and a federated row under one
+ * subject: open source has no federated writer and its derived-id key could
+ * not hold both. The federated fixture carries the derived id of its
+ * subject, so the OSS adapter's mode filter — not an unreachable id — is
+ * what the direct-only arms exercise.
+ *
+ * The duplicate arm checks `instanceof DuplicateAccountError` on the
+ * exported class, because that is how the domain's race arm (steps.ts)
+ * catches it: a driver throwing a lookalike fails here for the reason it
+ * would fail provisioning.
+ *
+ * Case names are the contract lines, in the port's words. The OSS test pins
+ * the full list, so a case cannot drop out of the kit unnoticed.
+ */
+import assert from "node:assert/strict";
+import { create, equals } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
+import { accountIdFor } from "./constants.js";
+import { DuplicateAccountError } from "./store.js";
+/** A direct account as the domain writes it: id derived from the subject, mode direct. */
+function directAccount(overrides) {
+    return create(IdentityAccountSchema, {
+        apiVersion: "iam.stigmer.ai/v1",
+        kind: "IdentityAccount",
+        metadata: {
+            id: accountIdFor(overrides.idpId),
+            name: overrides.email ?? overrides.idpId,
+        },
+        spec: {
+            idpId: overrides.idpId,
+            email: overrides.email ?? "",
+            firstName: overrides.firstName ?? "",
+            provisioningMode: IdentityAccountProvisioningMode.direct,
+        },
+    });
+}
+/**
+ * A federated account: a customer IdP's subject, marked by its
+ * identity_provider_ref and mode. Its id is the derived id of its subject
+ * (see the header: the mode filter, not the id, must be what excludes it).
+ */
+function federatedAccount(overrides) {
+    return create(IdentityAccountSchema, {
+        apiVersion: "iam.stigmer.ai/v1",
+        kind: "IdentityAccount",
+        metadata: { id: accountIdFor(overrides.idpId), name: overrides.email },
+        spec: {
+            idpId: overrides.idpId,
+            email: overrides.email,
+            provisioningMode: IdentityAccountProvisioningMode.federated,
+            identityProviderRef: {
+                org: "acme",
+                kind: ApiResourceKind.identity_provider,
+                slug: "acme-okta",
+            },
+        },
+    });
+}
+/** A direct account with no subject — the row no lookup could ever reach. */
+function subjectlessDirectAccount() {
+    return create(IdentityAccountSchema, {
+        apiVersion: "iam.stigmer.ai/v1",
+        kind: "IdentityAccount",
+        metadata: { id: "ida_00000000000000000000000000", name: "subjectless" },
+        spec: {
+            idpId: "",
+            provisioningMode: IdentityAccountProvisioningMode.direct,
+        },
+    });
+}
+/** The id of the account, asserted present so a message names the row, not `undefined`. */
+function idOf(account) {
+    const id = account.metadata?.id ?? "";
+    assert.notEqual(id, "", "a fixture account must carry an id");
+    return id;
+}
+function subjectsOf(accounts) {
+    return accounts.map((account) => account.spec?.idpId ?? "");
+}
+const CASES = [
+    [
+        "save then findById round-trips the account",
+        async ({ store }) => {
+            const account = directAccount({
+                idpId: "auth0|alice",
+                email: "alice@example.com",
+            });
+            await store.save(account);
+            const found = await store.findById(idOf(account));
+            assert.ok(found !== undefined, "a saved account must be readable by id");
+            assert.ok(equals(IdentityAccountSchema, found, account), "findById must return the account exactly as it was saved");
+        },
+    ],
+    [
+        "a second save under a held id is DuplicateAccountError, and the first row stands",
+        async ({ store }) => {
+            const first = directAccount({ idpId: "auth0|bob", firstName: "First" });
+            const second = directAccount({
+                idpId: "auth0|bob",
+                firstName: "Second",
+            });
+            await store.save(first);
+            await assert.rejects(store.save(second), DuplicateAccountError, "save under a held id must raise the exported DuplicateAccountError, never overwrite");
+            const standing = await store.findDirectByIdpId("auth0|bob");
+            assert.equal(standing?.spec?.firstName, "First", "the first writer's row must stand after a refused duplicate");
+        },
+    ],
+    [
+        "findDirectByIdpId answers a direct account by its subject and undefined for an unknown one",
+        async ({ store }) => {
+            await store.save(directAccount({ idpId: "auth0|carol" }));
+            const hit = await store.findDirectByIdpId("auth0|carol");
+            assert.equal(hit?.metadata?.id, accountIdFor("auth0|carol"), "the direct account for a subject must be found by that subject");
+            assert.equal(await store.findDirectByIdpId("auth0|nobody"), undefined, "an unknown subject must read as undefined, not as an error");
+        },
+    ],
+    [
+        "findByIdpId (any mode) answers the same direct account",
+        async ({ store }) => {
+            await store.save(directAccount({ idpId: "auth0|dave" }));
+            assert.equal((await store.findByIdpId("auth0|dave"))?.spec?.idpId, "auth0|dave", "findByIdpId must answer a direct account by its subject");
+            assert.equal(await store.findByIdpId("auth0|nobody"), undefined, "an unknown subject must read as undefined on the any-mode lookup too");
+        },
+    ],
+    [
+        "findDirectByEmail is an exact, case-sensitive match on direct accounts",
+        async ({ store }) => {
+            await store.save(directAccount({ idpId: "auth0|erin", email: "erin@example.com" }));
+            assert.equal((await store.findDirectByEmail("erin@example.com"))?.spec?.idpId, "auth0|erin", "the direct account with an email must be found by that exact email");
+            assert.equal(await store.findDirectByEmail("ERIN@example.com"), undefined, "the email match is exact: a different case is a different string");
+            assert.equal(await store.findDirectByEmail("nobody@example.com"), undefined, "an unknown email must read as undefined");
+        },
+    ],
+    [
+        "update replaces the row in place and keeps the id",
+        async ({ store }) => {
+            const account = directAccount({
+                idpId: "auth0|frank",
+                firstName: "Frank",
+            });
+            await store.save(account);
+            await store.update(directAccount({ idpId: "auth0|frank", firstName: "Francis" }));
+            const updated = await store.findById(idOf(account));
+            assert.equal(updated?.spec?.firstName, "Francis", "update must replace the stored row with the given one");
+            assert.equal(updated?.metadata?.id, idOf(account), "update must not move the row to another id");
+        },
+    ],
+    [
+        "deleteById removes the row; the subject is free to be provisioned again",
+        async ({ store }) => {
+            const account = directAccount({ idpId: "auth0|grace" });
+            await store.save(account);
+            await store.deleteById(idOf(account));
+            assert.equal(await store.findById(idOf(account)), undefined, "a deleted account must not be readable by id");
+            assert.equal(await store.findDirectByIdpId("auth0|grace"), undefined, "a deleted account must not be readable by subject");
+            await assert.doesNotReject(store.save(account), "the subject of a deleted account must be savable again");
+        },
+    ],
+    [
+        "findByIds answers the present ones in request order and skips the unknown",
+        async ({ store }) => {
+            const heidi = directAccount({ idpId: "auth0|heidi" });
+            const ivan = directAccount({ idpId: "auth0|ivan" });
+            await store.save(heidi);
+            await store.save(ivan);
+            const found = await store.findByIds([
+                idOf(ivan),
+                "ida_00000000000000000000000000",
+                idOf(heidi),
+            ]);
+            assert.deepEqual(subjectsOf(found), ["auth0|ivan", "auth0|heidi"], "findByIds must keep the request's order and skip ids that are not held");
+        },
+    ],
+    [
+        "a disconnected store is an infrastructure fault, never 'not found'",
+        async (fixture) => {
+            await fixture.disconnect();
+            await assert.rejects(fixture.store.findDirectByIdpId("auth0|anyone"), "a subject read on a disconnected store must reject, never read as undefined");
+            await assert.rejects(fixture.store.findById(accountIdFor("auth0|anyone")), "an id read on a disconnected store must reject, never read as undefined");
+        },
+    ],
+    [
+        "two concurrent saves of one subject end in fulfilments and DuplicateAccountErrors only, and the winner is readable by subject",
+        async ({ store }) => {
+            const results = await Promise.allSettled([
+                store.save(directAccount({ idpId: "auth0|race", firstName: "A" })),
+                store.save(directAccount({ idpId: "auth0|race", firstName: "B" })),
+            ]);
+            for (const result of results) {
+                if (result.status === "rejected") {
+                    assert.ok(result.reason instanceof DuplicateAccountError, `a losing concurrent save must fail as DuplicateAccountError, got ${String(result.reason)}`);
+                }
+            }
+            assert.ok(results.some((result) => result.status === "fulfilled"), "at least one of two concurrent saves must win");
+            const winner = await store.findDirectByIdpId("auth0|race");
+            assert.equal(winner?.metadata?.id, accountIdFor("auth0|race"), "the winner must be readable by its subject");
+        },
+    ],
+    [
+        "findDirectByIdpId and findDirectByEmail never answer a federated account, while findByIdpId (any mode) does",
+        async ({ store }) => {
+            await store.save(federatedAccount({ idpId: "auth0|fed", email: "fed@example.com" }));
+            assert.equal(await store.findDirectByIdpId("auth0|fed"), undefined, "the direct-subject lookup must not resolve to a federated account");
+            assert.equal(await store.findDirectByEmail("fed@example.com"), undefined, "the direct-email lookup must not resolve to a federated account");
+            assert.equal((await store.findByIdpId("auth0|fed"))?.spec?.provisioningMode, IdentityAccountProvisioningMode.federated, "the any-mode subject lookup must answer the federated account");
+        },
+    ],
+    [
+        "findByIds answers one row per distinct id, in first-occurrence order; an empty request answers an empty list",
+        async ({ store }) => {
+            const judy = directAccount({ idpId: "auth0|judy" });
+            const kim = directAccount({ idpId: "auth0|kim" });
+            await store.save(judy);
+            await store.save(kim);
+            assert.deepEqual(subjectsOf(await store.findByIds([idOf(kim), idOf(judy), idOf(kim), idOf(judy)])), ["auth0|kim", "auth0|judy"], "a repeated id must answer once, at its first position");
+            assert.deepEqual(await store.findByIds([]), [], "an empty request must answer an empty list, not a scan");
+        },
+    ],
+    [
+        "update of an unknown id is a no-op: no row appears",
+        async ({ store }) => {
+            const ghost = directAccount({ idpId: "auth0|ghost" });
+            await store.update(ghost);
+            assert.equal(await store.findById(idOf(ghost)), undefined, "update must replace, never create: an unknown id must leave no row by id");
+            assert.equal(await store.findDirectByIdpId("auth0|ghost"), undefined, "update must replace, never create: an unknown id must leave no row by subject");
+        },
+    ],
+    [
+        "deleteById of an unknown id resolves",
+        async ({ store }) => {
+            await assert.doesNotReject(store.deleteById(accountIdFor("auth0|nobody")), "deleting an id that is not held must resolve, not reject");
+        },
+    ],
+    [
+        "save refuses a direct account with an empty idp_id",
+        async ({ store }) => {
+            await assert.rejects(store.save(subjectlessDirectAccount()), "a direct account with no subject has no principal and must be refused, never stored");
+        },
+    ],
+];
+/**
+ * Runs `body` over a fresh fixture. The body's failure is the one reported:
+ * a cleanup failure after a failed body would otherwise replace the
+ * assertion that matters with a teardown detail.
+ */
+async function withFixture(makeFixture, body) {
+    const fixture = await makeFixture();
+    let failed = false;
+    try {
+        await body(fixture);
+    }
+    catch (error) {
+        failed = true;
+        throw error;
+    }
+    finally {
+        try {
+            await fixture.cleanup();
+        }
+        catch (cleanupError) {
+            if (!failed) {
+                throw cleanupError;
+            }
+        }
+    }
+}
+/** The port's cases over `makeFixture`, one fresh fixture per case. */
+export function identityAccountStoreContract(makeFixture) {
+    return CASES.map(([name, body]) => ({
+        name,
+        run: () => withFixture(makeFixture, body),
+    }));
+}
+//# sourceMappingURL=store-contract.js.map

package/dist/domain/identityaccount/store-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-contract.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/store-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AACjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAE5G,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AA0BnD,0FAA0F;AAC1F,SAAS,aAAa,CAAC,SAItB;IACC,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE;YACR,EAAE,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC;YACjC,IAAI,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK;SACzC;QACD,IAAI,EAAE;YACJ,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE;YAC5B,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,EAAE;YACpC,gBAAgB,EAAE,+BAA+B,CAAC,MAAM;SACzD;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,SAGzB;IACC,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE;QACtE,IAAI,EAAE;YACJ,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,gBAAgB,EAAE,+BAA+B,CAAC,SAAS;YAC3D,mBAAmB,EAAE;gBACnB,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,eAAe,CAAC,iBAAiB;gBACvC,IAAI,EAAE,WAAW;aAClB;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,SAAS,wBAAwB;IAC/B,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,EAAE,EAAE,gCAAgC,EAAE,IAAI,EAAE,aAAa,EAAE;QACvE,IAAI,EAAE;YACJ,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,+BAA+B,CAAC,MAAM;SACzD;KACF,CAAC,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,SAAS,IAAI,CAAC,OAAwB;IACpC,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,oCAAoC,CAAC,CAAC;IAC9D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,UAAU,CAAC,QAAwC;IAC1D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,KAAK,GAA+C;IACxD;QACE,4CAA4C;QAC5C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC;gBAC5B,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,mBAAmB;aAC3B,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAClD,MAAM,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,EAAE,wCAAwC,CAAC,CAAC;YACzE,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,CAAC,EAC7C,0DAA0D,CAC3D,CAAC;QACJ,CAAC;KACF;IACD;QACE,kFAAkF;QAClF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,aAAa,CAAC;gBAC3B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAClB,qBAAqB,EACrB,qFAAqF,CACtF,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,CACV,QAAQ,EAAE,IAAI,EAAE,SAAS,EACzB,OAAO,EACP,6DAA6D,CAC9D,CAAC;QACJ,CAAC;KACF;IACD;QACE,4FAA4F;QAC5F,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACzD,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,QAAQ,EAAE,EAAE,EACjB,YAAY,CAAC,aAAa,CAAC,EAC3B,gEAAgE,CACjE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAC7C,SAAS,EACT,4DAA4D,CAC7D,CAAC;QACJ,CAAC;KACF;IACD;QACE,wDAAwD;QACxD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EACpD,YAAY,EACZ,yDAAyD,CAC1D,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,EACvC,SAAS,EACT,sEAAsE,CACvE,CAAC;QACJ,CAAC;KACF;IACD;QACE,wEAAwE;QACxE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CACd,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAClE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAChE,YAAY,EACZ,oEAAoE,CACrE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EACjD,SAAS,EACT,kEAAkE,CACnE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,EACnD,SAAS,EACT,yCAAyC,CAC1C,CAAC;QACJ,CAAC;KACF;IACD;QACE,mDAAmD;QACnD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC;gBAC5B,KAAK,EAAE,aAAa;gBACpB,SAAS,EAAE,OAAO;aACnB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,MAAM,CAChB,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAC9D,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACpD,MAAM,CAAC,KAAK,CACV,OAAO,EAAE,IAAI,EAAE,SAAS,EACxB,SAAS,EACT,uDAAuD,CACxD,CAAC;YACF,MAAM,CAAC,KAAK,CACV,OAAO,EAAE,QAAQ,EAAE,EAAE,EACrB,IAAI,CAAC,OAAO,CAAC,EACb,4CAA4C,CAC7C,CAAC;QACJ,CAAC;KACF;IACD;QACE,yEAAyE;QACzE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACxD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACtC,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EACnC,SAAS,EACT,8CAA8C,CAC/C,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAC5C,SAAS,EACT,mDAAmD,CACpD,CAAC;YACF,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EACnB,wDAAwD,CACzD,CAAC;QACJ,CAAC;KACF;IACD;QACE,2EAA2E;QAC3E,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACpD,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC;gBACV,gCAAgC;gBAChC,IAAI,CAAC,KAAK,CAAC;aACZ,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CACd,UAAU,CAAC,KAAK,CAAC,EACjB,CAAC,YAAY,EAAE,aAAa,CAAC,EAC7B,wEAAwE,CACzE,CAAC;QACJ,CAAC;KACF;IACD;QACE,oEAAoE;QACpE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAC/C,6EAA6E,CAC9E,CAAC;YACF,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EACpD,yEAAyE,CAC1E,CAAC;QACJ,CAAC;KACF;IACD;QACE,+HAA+H;QAC/H,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;gBACvC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;gBAClE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;aACnE,CAAC,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBACjC,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,MAAM,YAAY,qBAAqB,EAC9C,oEAAoE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAC5F,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,CAAC,EAAE,CACP,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,EACvD,+CAA+C,CAChD,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CACV,MAAM,EAAE,QAAQ,EAAE,EAAE,EACpB,YAAY,CAAC,YAAY,CAAC,EAC1B,4CAA4C,CAC7C,CAAC;QACJ,CAAC;KACF;IACD;QACE,6GAA6G;QAC7G,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CACd,gBAAgB,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CACnE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAC1C,SAAS,EACT,mEAAmE,CACpE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAChD,SAAS,EACT,iEAAiE,CAClE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAC9D,+BAA+B,CAAC,SAAS,EACzC,+DAA+D,CAChE,CAAC;QACJ,CAAC;KACF;IACD;QACE,8GAA8G;QAC9G,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,MAAM,CAAC,SAAS,CACd,UAAU,CACR,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CACtE,EACD,CAAC,WAAW,EAAE,YAAY,CAAC,EAC3B,uDAAuD,CACxD,CAAC;YACF,MAAM,CAAC,SAAS,CACd,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EACzB,EAAE,EACF,wDAAwD,CACzD,CAAC;QACJ,CAAC;KACF;IACD;QACE,oDAAoD;QACpD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EACjC,SAAS,EACT,0EAA0E,CAC3E,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAC5C,SAAS,EACT,+EAA+E,CAChF,CAAC;QACJ,CAAC;KACF;IACD;QACE,sCAAsC;QACtC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EAC9C,0DAA0D,CAC3D,CAAC;QACJ,CAAC;KACF;IACD;QACE,oDAAoD;QACpD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,EACtC,qFAAqF,CACtF,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAEF;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,WAA+D,EAC/D,IAAc;IAEd,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,YAAY,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,4BAA4B,CAC1C,WAA+D;IAE/D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI;QACJ,GAAG,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC;KAC1C,CAAC,CAAC,CAAC;AACN,CAAC"}