@stigmer/server 3.14.1 → 3.15.0

package/dist/domain/identityaccount/store.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The IdentityAccountStore PORT (20260911.11, T01_0_plan.md §3a; Q-IA-4):
+ * the storage contract the identity-account domain writes and reads
+ * through, cut from the cloud's row store (iam/account/store.ts) to its
+ * DIRECT subset. This is the first OSS domain whose persistence is a port
+ * rather than the generic Store: the cloud serves the same controller
+ * over its own `cloud.iam_identity_account` table by registering an
+ * implementation as `drivers.identityAccountStore`, so the domain's
+ * pipeline steps take this interface, never `Store`. Open source's own
+ * implementation is resource-store.ts over the generic Store.
+ *
+ * What the port deliberately does not carry: the two federation lookups
+ * (`findByProviderAndIdpId`, `findByOrgAndSlug`) stay on the cloud's own
+ * store behind the IdentityFederation capability — a port does not carry
+ * methods only one edition calls.
+ *
+ * Contract every implementation must satisfy — proven by the port-contract
+ * kit (store-contract.ts, exported), which the OSS adapter's test iterates
+ * on both drivers and a composition's driver test iterates too:
+ *   - `save` is create-only in effect: a save under a held id raises
+ *     DuplicateAccountError, never a silent overwrite; a direct account
+ *     with an empty `idp_id` is refused, since no lookup could reach it;
+ *   - `update` replaces, never creates: an unknown id writes nothing;
+ *   - `deleteById` of an unknown id resolves;
+ *   - `findDirectByIdpId` answers only non-federated accounts (the
+ *     platform's own subjects) — a customer's federated IdP may mint the
+ *     same `auth0|…` shape and the platform lane must never resolve to it;
+ *   - `findDirectByEmail` answers direct accounts only, by exact match:
+ *     federation legitimately duplicates emails, so the email axis is
+ *     non-unique;
+ *   - `findByIds` answers one row per distinct id, in first-occurrence
+ *     order, and skips unknown ids;
+ *   - a typed not-found reads as `undefined`; any other storage failure
+ *     propagates as the infrastructure fault it is (the ratified
+ *     store-fault mapping — an outage must never read as "no account").
+ */
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+/**
+ * Raised by `save` when the id is already held, so callers run their own
+ * race arms (provisioning resolves the winner by subject; the create RPC
+ * answers ALREADY_EXISTS). `cause` carries a driver's own error (the
+ * cloud's SQLSTATE 23505) for the logs; the message is the port's.
+ */
+export declare class DuplicateAccountError extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+export interface IdentityAccountStore {
+    /** Insert; a held id raises DuplicateAccountError; a direct account with no idp_id is refused. */
+    save(account: IdentityAccount): Promise<void>;
+    /** Full-row replace by id (profile updates, preference writes); an unknown id writes nothing. */
+    update(account: IdentityAccount): Promise<void>;
+    /** Removes the row; no error when it does not exist. */
+    deleteById(id: string): Promise<void>;
+    findById(id: string): Promise<IdentityAccount | undefined>;
+    /** Any provisioning mode — the getByIdpId RPC's lookup. */
+    findByIdpId(idpId: string): Promise<IdentityAccount | undefined>;
+    /** Non-federated accounts only — the verifiers' and whoAmI's lookup. */
+    findDirectByIdpId(idpId: string): Promise<IdentityAccount | undefined>;
+    /** Direct accounts only, exact match — the getByEmail RPC's lookup. */
+    findDirectByEmail(email: string): Promise<IdentityAccount | undefined>;
+    /** The present ones, once per distinct id, in first-occurrence order; unknown ids are skipped. */
+    findByIds(ids: ReadonlyArray<string>): Promise<ReadonlyArray<IdentityAccount>>;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/domain/identityaccount/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAEhG;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAED,MAAM,WAAW,oBAAoB;IACnC,kGAAkG;IAClG,IAAI,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,iGAAiG;IACjG,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,wDAAwD;IACxD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IAC3D,2DAA2D;IAC3D,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IACjE,wEAAwE;IACxE,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IACvE,uEAAuE;IACvE,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IACvE,kGAAkG;IAClG,SAAS,CACP,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,GACzB,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;CAC5C"}

package/dist/domain/identityaccount/store.js

@@ -0,0 +1,13 @@
+/**
+ * Raised by `save` when the id is already held, so callers run their own
+ * race arms (provisioning resolves the winner by subject; the create RPC
+ * answers ALREADY_EXISTS). `cause` carries a driver's own error (the
+ * cloud's SQLSTATE 23505) for the logs; the message is the port's.
+ */
+export class DuplicateAccountError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "DuplicateAccountError";
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/domain/identityaccount/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/store.ts"],"names":[],"mappings":"AAsCA;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF"}

package/dist/extensions/drivers.d.ts

@@ -23,6 +23,9 @@
  *   - schedule-fire caller (who a schedule fire acts as) — landed with
  *     the stigmer-cloud#572 fix (the Java schedule-token mechanism's
  *     seam; ruled 2026-09-01)
+ *   - identity-account store + identity federation (the first domain
+ *     whose persistence is a PORT, and the four federated RPC arms only
+ *     one edition serves) — landed with 20260911.11, gate ruling Q-IA-9
  *
  * Merge rules (enforced by resolveExtensions, DD-006 §2b): the two
  * provider kinds are single-instance points — a second declaring unit is
@@ -36,11 +39,13 @@
  */
 import type { ArtifactStorageDriverFactory } from "../artifactstorage/artifact-storage.js";
 import type { ChannelRuntime } from "../domain/agentchannel/channel-runtime.js";
+import type { IdentityAccountStore } from "../domain/identityaccount/store.js";
 import type { SecretCodec } from "../encryption/codec.js";
 import type { ModelCatalogProvider } from "../domain/workflow/registry/model-catalog-provider.js";
 import type { VisitorErrorPolicy } from "../pipeline/interceptors/error-boundary.js";
 import type { RunnerCredentialProvider } from "../runnerauth/runner-credential-provider.js";
 import type { SandboxProvisionerFactory } from "../sandbox/provisioner.js";
+import type { IdentityFederation } from "./identity-federation.js";
 import type { ListReadScope } from "./list-read-scope.js";
 import type { OrganizationDirectory } from "./organization-directory.js";
 import type { ResourceAuthorizationLifecycle } from "./resource-authorization.js";
@@ -136,5 +141,26 @@ export interface ExtensionDrivers {
      * the `internal` class — OSS behavior byte-identical.
      */
     readonly scheduleFireCaller?: ScheduleFireCallerMint;
+    /**
+     * The identity-account store driver (20260911.11, Q-IA-9;
+     * single-instance point). The identity-account domain is the first
+     * whose persistence is a PORT rather than the generic Store: when
+     * composed, the domain's every read and write — the create path, the
+     * provisioner, the boot-time operator ensure and BOTH OSS verifiers'
+     * subject resolution — goes through this driver (the cloud serves the
+     * domain over its own `cloud.iam_identity_account` table this way).
+     * When absent, the OSS adapter over the generic Store installs at the
+     * compose.ts consumption site — OSS behavior byte-identical.
+     */
+    readonly identityAccountStore?: IdentityAccountStore;
+    /**
+     * The identity-federation capability (20260911.11, Q-IA-9;
+     * single-instance point): the four federated-account RPC arms plus the
+     * IdP-exists probe their shared precondition rides. When composed, the
+     * identity-account controller dispatches to it after its own shared
+     * checks; when absent, the four RPCs refuse UNIMPLEMENTED with the
+     * edition reason — the organizationDirectory absent-method shape.
+     */
+    readonly identityFederation?: IdentityFederation;
 }
 //# sourceMappingURL=drivers.d.ts.map

package/dist/extensions/drivers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"drivers.d.ts","sourceRoot":"","sources":["../../src/extensions/drivers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,WAAW,CAC3C,MAAM,EACN,4BAA4B,CAC7B,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,WAAW,CAC9C,MAAM,EACN,yBAAyB,CAC1B,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC;IACzE;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;CACtD"}
+{"version":3,"file":"drivers.d.ts","sourceRoot":"","sources":["../../src/extensions/drivers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,WAAW,CAC3C,MAAM,EACN,4BAA4B,CAC7B,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,WAAW,CAC9C,MAAM,EACN,yBAAyB,CAC1B,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC;IACzE;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IACrD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CAClD"}

package/dist/extensions/gate-slots.d.ts

@@ -19,6 +19,21 @@
  * splice — its capacity gates ride the two declared agent-execution
  * slots, whose positions coincide exactly with the Java session gate.
  *
+ * 20260911.11 (Q-IA-9) declares the seventh,
+ * `identity-account-provision:post-persist`: inside provisionMyAccount,
+ * after the provisioner has answered the caller's row — created on this
+ * call or found by the idempotent early return — and before the reply,
+ * with the caller RE-STAMPED as the account (the position-1 identity was
+ * idp-shaped because no row existed when the verifier ran). It fires on
+ * EVERY provisionMyAccount, not only the creating one: the cloud's
+ * personal-organization step backfills accounts that predate personal
+ * organizations on the idempotent path, which is exactly why a slot was
+ * chosen over the tuple lifecycle's onResourceCreated (never fired for a
+ * row that already exists). Never on the create RPC and never at the
+ * boot-time operator ensure, which take the create path, not this one.
+ * Non-transactional in the `org-create:post-persist` sense: a gate
+ * failure fails the request, the row survives, the next call heals.
+ *
  * Two enforcement layers, deliberately redundant, both derived from the
  * ONE literal tuple below (lockstep by construction):
  *   - GateSlotName (compile time): the union of declared slot literals.
@@ -46,7 +61,7 @@ import type { PipelineStep } from "../pipeline/pipeline.js";
  * owner-visible slot additions — each entry cites its chain position in
  * the guidelines' slot table, which must match the splice sites exactly.
  */
-export declare const GATE_SLOT_NAMES: readonly ["agent-execution-create:pre-side-effect-gate", "agent-execution-recover:pre-side-effect-gate", "agent-execution-submit-approval:gate", "session-create:pre-side-effect-gate", "org-create:post-persist", "sandbox-acquisition:gate"];
+export declare const GATE_SLOT_NAMES: readonly ["agent-execution-create:pre-side-effect-gate", "agent-execution-recover:pre-side-effect-gate", "agent-execution-submit-approval:gate", "session-create:pre-side-effect-gate", "org-create:post-persist", "sandbox-acquisition:gate", "identity-account-provision:post-persist"];
 /** The declared slot-name union — a registration outside it fails tsc. */
 export type GateSlotName = (typeof GATE_SLOT_NAMES)[number];
 /**

package/dist/extensions/gate-slots.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-slots.d.ts","sourceRoot":"","sources":["../../src/extensions/gate-slots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,eAAe,gPAOlB,CAAC;AAEX,0EAA0E;AAC1E,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAEnD,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,WAAW,CACzC,MAAM,EACN,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CACzC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAS,WAAW,EACnD,SAAS,EAAE,iBAAiB,EAC5B,IAAI,EAAE,YAAY,GACjB,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAOnC"}
+{"version":3,"file":"gate-slots.d.ts","sourceRoot":"","sources":["../../src/extensions/gate-slots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,eAAe,2RAQlB,CAAC;AAEX,0EAA0E;AAC1E,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAEnD,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,WAAW,CACzC,MAAM,EACN,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CACzC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAS,WAAW,EACnD,SAAS,EAAE,iBAAiB,EAC5B,IAAI,EAAE,YAAY,GACjB,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAOnC"}

package/dist/extensions/gate-slots.js

@@ -10,6 +10,7 @@ export const GATE_SLOT_NAMES = [
     "session-create:pre-side-effect-gate",
     "org-create:post-persist",
     "sandbox-acquisition:gate",
+    "identity-account-provision:post-persist",
 ];
 /**
  * The boot-time declared-slot set — resolveExtensions validates every

package/dist/extensions/gate-slots.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate-slots.js","sourceRoot":"","sources":["../../src/extensions/gate-slots.ts"],"names":[],"mappings":"AA6CA;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,6CAA6C;IAC7C,8CAA8C;IAC9C,sCAAsC;IACtC,qCAAqC;IACrC,yBAAyB;IACzB,0BAA0B;CAClB,CAAC;AAKX;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAC7D,eAAe,CAChB,CAAC;AAWF;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,SAA4B,EAC5B,IAAkB;IAElB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACxC,kDAAkD;IAClD,oEAAoE;IACpE,sEAAsE;IACtE,cAAc;IACd,OAAO,KAA0C,CAAC;AACpD,CAAC"}
+{"version":3,"file":"gate-slots.js","sourceRoot":"","sources":["../../src/extensions/gate-slots.ts"],"names":[],"mappings":"AA4DA;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,6CAA6C;IAC7C,8CAA8C;IAC9C,sCAAsC;IACtC,qCAAqC;IACrC,yBAAyB;IACzB,0BAA0B;IAC1B,yCAAyC;CACjC,CAAC;AAKX;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAC7D,eAAe,CAChB,CAAC;AAWF;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,SAA4B,EAC5B,IAAkB;IAElB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACxC,kDAAkD;IAClD,oEAAoE;IACpE,sEAAsE;IACtE,cAAc;IACd,OAAO,KAA0C,CAAC;AACpD,CAAC"}

package/dist/extensions/identity-federation.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The identity-federation capability (20260911.11, Q-IA-9): the four
+ * federated-account RPC arms the identity-account controller dispatches
+ * to when a composed unit provides them, plus the identity-provider
+ * existence check their shared precondition rides. Single instance,
+ * registered as `drivers.identityFederation` (the organizationDirectory
+ * shape: a driver point that is byte-identical OSS behaviour when absent).
+ *
+ * Absent, the controller refuses the four RPCs UNIMPLEMENTED with the
+ * edition reason (domain/identityaccount/constants.ts) — never INTERNAL,
+ * the organization directory's absent-method precedent. Present, the
+ * controller still owns what is shared: the annotation's Authorize step
+ * on the organization, the ref-with-slug and org-match checks, and the
+ * IdP-exists refusal through `providerExists`; the arm receives the
+ * RESOLVED ref (org filled from the input when the ref left it empty)
+ * and the authenticated caller, and owns only what differs per edition —
+ * the natural-key lookups and writes on the federated rows.
+ *
+ * The federated natural key (provider ref + external subject) and its
+ * lookups stay on the unit's own store: the IdentityAccountStore port
+ * carries direct-account methods only, because a port does not carry
+ * methods only one edition calls.
+ */
+import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import type { CreateFederatedAccountInput, DeprovisionFederatedAccountInput, ExternalSubLookup, UpdateFederatedAccountInput } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/io_pb";
+import type { CallerIdentity } from "./identity.js";
+export interface IdentityFederation {
+    createFederatedAccount(input: CreateFederatedAccountInput, ref: ApiResourceReference, caller: CallerIdentity): Promise<IdentityAccount>;
+    updateFederatedAccount(input: UpdateFederatedAccountInput, ref: ApiResourceReference, caller: CallerIdentity): Promise<IdentityAccount>;
+    deprovisionFederatedAccount(input: DeprovisionFederatedAccountInput, ref: ApiResourceReference, caller: CallerIdentity): Promise<IdentityAccount>;
+    getByExternalSub(lookup: ExternalSubLookup, ref: ApiResourceReference, caller: CallerIdentity): Promise<IdentityAccount>;
+    /** Whether the IdentityProvider `org/slug` exists — the arms' shared precondition. */
+    providerExists(org: string, slug: string): Promise<boolean>;
+}
+//# sourceMappingURL=identity-federation.d.ts.map

package/dist/extensions/identity-federation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-federation.d.ts","sourceRoot":"","sources":["../../src/extensions/identity-federation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EACV,2BAA2B,EAC3B,gCAAgC,EAChC,iBAAiB,EACjB,2BAA2B,EAC5B,MAAM,yDAAyD,CAAC;AAEjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,WAAW,kBAAkB;IACjC,sBAAsB,CACpB,KAAK,EAAE,2BAA2B,EAClC,GAAG,EAAE,oBAAoB,EACzB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5B,sBAAsB,CACpB,KAAK,EAAE,2BAA2B,EAClC,GAAG,EAAE,oBAAoB,EACzB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5B,2BAA2B,CACzB,KAAK,EAAE,gCAAgC,EACvC,GAAG,EAAE,oBAAoB,EACzB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5B,gBAAgB,CACd,MAAM,EAAE,iBAAiB,EACzB,GAAG,EAAE,oBAAoB,EACzB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5B,sFAAsF;IACtF,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7D"}

package/dist/extensions/identity-federation.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=identity-federation.js.map

package/dist/extensions/identity-federation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-federation.js","sourceRoot":"","sources":["../../src/extensions/identity-federation.ts"],"names":[],"mappings":""}

package/dist/extensions/registry.d.ts

@@ -30,14 +30,20 @@
  * provider) and O6's sandbox provisioners are consumed at their
  * compose.ts construction sites; the require-authentication posture
  * (20260904.02) is consumed where compose.ts builds the serving chain's
- * identity source, OR'd with the OIDC-issuer arm.
+ * identity source, OR'd with the OIDC-issuer arm; the identity-account
+ * points (20260911.11) at the identity-accounts stage (the store driver,
+ * ahead of the boot-time operator ensure) and the routes stage (the
+ * federation capability and the provision slot's steps, into the
+ * identity-account controller).
  */
 import type { DescMessage } from "@bufbuild/protobuf";
 import type { ConnectRouter } from "@connectrpc/connect";
 import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
 import type { ArtifactStorageDriverFactory } from "../artifactstorage/artifact-storage.js";
 import type { ChannelRuntime } from "../domain/agentchannel/channel-runtime.js";
+import type { IdentityAccountStore } from "../domain/identityaccount/store.js";
 import type { SecretCodec } from "../encryption/codec.js";
+import type { IdentityFederation } from "./identity-federation.js";
 import type { ListReadScope } from "./list-read-scope.js";
 import type { ModelCatalogProvider } from "../domain/workflow/registry/model-catalog-provider.js";
 import type { VisitorErrorPolicy } from "../pipeline/interceptors/error-boundary.js";
@@ -210,6 +216,17 @@ export interface ResolvedExtensionDrivers {
      * codec in and resolves the write version fail-fast.
      */
     readonly secretCodecs: ReadonlyMap<string, SecretCodec>;
+    /**
+     * The 20260911.11 identity-account store driver — undefined = the
+     * compose.ts identity-accounts stage installs the OSS adapter over the
+     * generic Store, OSS behavior byte-identical.
+     */
+    readonly identityAccountStore: IdentityAccountStore | undefined;
+    /**
+     * The 20260911.11 identity-federation capability — undefined = the
+     * four federated RPCs refuse UNIMPLEMENTED with the edition reason.
+     */
+    readonly identityFederation: IdentityFederation | undefined;
 }
 /**
  * Merges the composed units, enforcing the §2b loud-fail rules. Runs

package/dist/extensions/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/extensions/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAE3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,KAAK,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC7B,MAAM,mBAAmB,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;AAE3E;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAC9B,YAAY,EACZ,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CACzC,CAAC;IACF,oEAAoE;IACpE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,yBAAyB,CAAC;IAC3D,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IAChE,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CACjD;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC5E;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC5D,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAClD,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IACtE,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,+BAA+B,CAAC,CAAC;IAC5E,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IAC/D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,wBAAwB,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACxE,0EAA0E;IAC1E,QAAQ,CAAC,8BAA8B,EACnC,8BAA8B,GAC9B,SAAS,CAAC;IACd,sEAAsE;IACtE,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAClE,uEAAuE;IACvE,QAAQ,CAAC,sBAAsB,EAAE,WAAW,CAC1C,MAAM,EACN,4BAA4B,CAC7B,CAAC;IACF,6EAA6E;IAC7E,QAAQ,CAAC,yBAAyB,EAAE,WAAW,CAC7C,MAAM,EACN,yBAAyB,CAC1B,CAAC;IACF;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,SAAS,CAAC;IACpD,uEAAuE;IACvE,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC5D;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAChE;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACzD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,GAAE,aAAa,CAAC,eAAe,CAAM,GACzC,kBAAkB,CA0SpB"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/extensions/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAE3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,KAAK,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC7B,MAAM,mBAAmB,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;AAE3E;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAC9B,YAAY,EACZ,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CACzC,CAAC;IACF,oEAAoE;IACpE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,yBAAyB,CAAC;IAC3D,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IAChE,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CACjD;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC5E;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC5D,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAClD,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IACtE,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,+BAA+B,CAAC,CAAC;IAC5E,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IAC/D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,wBAAwB,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACxE,0EAA0E;IAC1E,QAAQ,CAAC,8BAA8B,EACnC,8BAA8B,GAC9B,SAAS,CAAC;IACd,sEAAsE;IACtE,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAClE,uEAAuE;IACvE,QAAQ,CAAC,sBAAsB,EAAE,WAAW,CAC1C,MAAM,EACN,4BAA4B,CAC7B,CAAC;IACF,6EAA6E;IAC7E,QAAQ,CAAC,yBAAyB,EAAE,WAAW,CAC7C,MAAM,EACN,yBAAyB,CAC1B,CAAC;IACF;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,SAAS,CAAC;IACpD,uEAAuE;IACvE,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC5D;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAChE;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAChE;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAC7D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,GAAE,aAAa,CAAC,eAAe,CAAM,GACzC,kBAAkB,CAoUpB"}

package/dist/extensions/registry.js

@@ -39,6 +39,10 @@ export function resolveExtensions(units = []) {
     let visitorErrorPolicyDeclaredBy;
     let scheduleFireCaller;
     let scheduleFireCallerDeclaredBy;
+    let identityAccountStore;
+    let identityAccountStoreDeclaredBy;
+    let identityFederation;
+    let identityFederationDeclaredBy;
     const artifactStorageDrivers = new Map();
     const storageDriverDeclaredBy = new Map();
     const sandboxProvisionerDrivers = new Map();
@@ -133,6 +137,20 @@ export function resolveExtensions(units = []) {
             scheduleFireCaller = unit.drivers.scheduleFireCaller;
             scheduleFireCallerDeclaredBy = unit.name;
         }
+        if (unit.drivers?.identityAccountStore !== undefined) {
+            if (identityAccountStoreDeclaredBy !== undefined) {
+                throw new Error(`extension '${unit.name}' registers an IdentityAccountStore, but '${identityAccountStoreDeclaredBy}' already did — exactly one may be composed`);
+            }
+            identityAccountStore = unit.drivers.identityAccountStore;
+            identityAccountStoreDeclaredBy = unit.name;
+        }
+        if (unit.drivers?.identityFederation !== undefined) {
+            if (identityFederationDeclaredBy !== undefined) {
+                throw new Error(`extension '${unit.name}' registers an IdentityFederation, but '${identityFederationDeclaredBy}' already did — exactly one may be composed`);
+            }
+            identityFederation = unit.drivers.identityFederation;
+            identityFederationDeclaredBy = unit.name;
+        }
         if (unit.drivers?.artifactStorageDrivers !== undefined) {
             for (const [name, factory] of unit.drivers.artifactStorageDrivers) {
                 if (BUILT_IN_STORAGE_TYPES.includes(name)) {
@@ -222,6 +240,8 @@ export function resolveExtensions(units = []) {
             visitorErrorPolicy,
             secretCodecs,
             scheduleFireCaller,
+            identityAccountStore,
+            identityFederation,
         },
         services,
         workers,

package/dist/extensions/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/extensions/registry.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAGtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAGhF,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAQvD,OAAO,EAAE,kCAAkC,EAAE,MAAM,2BAA2B,CAAC;AAK/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAqLtD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAwC,EAAE;IAE1C,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,iBAAiB,GAAuB,EAAE,CAAC;IACjD,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC9E,MAAM,eAAe,GAAmC,EAAE,CAAC;IAC3D,MAAM,kBAAkB,GAAsC,EAAE,CAAC;IACjE,MAAM,QAAQ,GAAmC,EAAE,CAAC;IACpD,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,IAAI,OAAkC,CAAC;IACvC,IAAI,iBAAqC,CAAC;IAC1C,IAAI,+BAAmD,CAAC;IACxD,IAAI,UAAkC,CAAC;IACvC,IAAI,oBAAwC,CAAC;IAC7C,IAAI,oBAAsD,CAAC;IAC3D,IAAI,iBAAqC,CAAC;IAC1C,IAAI,wBAA8D,CAAC;IACnE,IAAI,oBAAwC,CAAC;IAC7C,IAAI,8BAES,CAAC;IACd,IAAI,gCAAoD,CAAC;IACzD,IAAI,qBAAwD,CAAC;IAC7D,IAAI,+BAAmD,CAAC;IACxD,IAAI,cAA0C,CAAC;IAC/C,IAAI,wBAA4C,CAAC;IACjD,IAAI,aAAwC,CAAC;IAC7C,IAAI,uBAA2C,CAAC;IAChD,IAAI,kBAAkD,CAAC;IACvD,IAAI,4BAAgD,CAAC;IACrD,IAAI,kBAAsD,CAAC;IAC3D,IAAI,4BAAgD,CAAC;IACrD,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAGnC,CAAC;IACJ,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1D,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAGtC,CAAC;IACJ,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAExD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,uHAAuH,CACxH,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,CAAC,IAAI,4DAA4D,CACnG,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE1B,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,OAAO,KAAK,aAAa,CAAC,0BAA0B,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,gGAAgG,CACxH,CAAC;YACJ,CAAC;YACD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,uCAAuC,iBAAiB,+DAA+D,CAC/I,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YACvB,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC;QAChC,CAAC;QAED,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YAC7C,IAAI,+BAA+B,KAAK,SAAS,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,uDAAuD,+BAA+B,sDAAsD,CACpK,CAAC;YACJ,CAAC;YACD,+BAA+B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC9C,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,mCAAmC,oBAAoB,wDAAwD,CACvI,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YAC7B,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACrD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,4CAA4C,iBAAiB,6CAA6C,CAClI,CAAC;YACJ,CAAC;YACD,oBAAoB,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;YACzD,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC;QAChC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,wBAAwB,KAAK,SAAS,EAAE,CAAC;YACzD,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,gDAAgD,oBAAoB,6CAA6C,CACzI,CAAC;YACJ,CAAC;YACD,wBAAwB,GAAG,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC;YACjE,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,8BAA8B,KAAK,SAAS,EAAE,CAAC;YAC/D,IAAI,gCAAgC,KAAK,SAAS,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,sDAAsD,gCAAgC,6CAA6C,CAC3J,CAAC;YACJ,CAAC;YACD,8BAA8B;gBAC5B,IAAI,CAAC,OAAO,CAAC,8BAA8B,CAAC;YAC9C,gCAAgC,GAAG,IAAI,CAAC,IAAI,CAAC;QAC/C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,qBAAqB,KAAK,SAAS,EAAE,CAAC;YACtD,IAAI,+BAA+B,KAAK,SAAS,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,8CAA8C,+BAA+B,6CAA6C,CAClJ,CAAC;YACJ,CAAC;YACD,qBAAqB,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC;YAC3D,+BAA+B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC9C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,cAAc,KAAK,SAAS,EAAE,CAAC;YAC/C,IAAI,wBAAwB,KAAK,SAAS,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,sCAAsC,wBAAwB,6CAA6C,CACnI,CAAC;YACJ,CAAC;YACD,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YAC7C,wBAAwB,GAAG,IAAI,CAAC,IAAI,CAAC;QACvC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,aAAa,KAAK,SAAS,EAAE,CAAC;YAC9C,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,qCAAqC,uBAAuB,6CAA6C,CACjI,CAAC;YACJ,CAAC;YACD,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;YAC3C,uBAAuB,GAAG,IAAI,CAAC,IAAI,CAAC;QACtC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,4BAA4B,KAAK,SAAS,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,0CAA0C,4BAA4B,6CAA6C,CAC3I,CAAC;YACJ,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACrD,4BAA4B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC3C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,4BAA4B,KAAK,SAAS,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,8CAA8C,4BAA4B,6CAA6C,CAC/I,CAAC;YACJ,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACrD,4BAA4B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC3C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,sBAAsB,KAAK,SAAS,EAAE,CAAC;YACvD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;gBAClE,IAAK,sBAAgD,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrE,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,wCAAwC,IAAI,mEAAmE,CACvI,CAAC;gBACJ,CAAC;gBACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,wCAAwC,IAAI,WAAW,UAAU,qEAAqE,CAC9J,CAAC;gBACJ,CAAC;gBACD,sBAAsB,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC1C,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,yBAAyB,KAAK,SAAS,EAAE,CAAC;YAC1D,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;gBACrE,IAEI,kCACD,CAAC,QAAQ,CAAC,IAAI,CAAC,EAChB,CAAC;oBACD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,oCAAoC,IAAI,kEAAkE,CAClI,CAAC;gBACJ,CAAC;gBACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,oCAAoC,IAAI,WAAW,UAAU,qEAAqE,CAC1J,CAAC;gBACJ,CAAC;gBACD,yBAAyB,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC7C,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;YAC7C,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBACzD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,6BAA6B,OAAO,2EAA2E,CACvI,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;oBACzD,8DAA8D;oBAC9D,4DAA4D;oBAC5D,4DAA4D;oBAC5D,WAAW;oBACX,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,6BAA6B,OAAO,sBAAsB,KAAK,CAAC,OAAO,kEAAkE,CACjK,CAAC;gBACJ,CAAC;gBACD,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACtD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,6BAA6B,OAAO,WAAW,UAAU,uEAAuE,CACxJ,CAAC;gBACJ,CAAC;gBACD,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACjC,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC3C,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,MAAM,QAAQ,GACZ,mBAAmB,CAAC,IAAI,GAAG,CAAC;wBAC1B,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;wBAC9C,CAAC,CAAC,EAAE,CAAC;oBACT,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,8CAA8C,IAAI,uBACvE,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,QAAQ,GACzD,EAAE,CACH,CAAC;gBACJ,CAAC;gBACD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC3C,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1D,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QAChD,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,kBAAkB,CAAC,IAAI,CACrB,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAC1D,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,OAAO;QACL,SAAS;QACT,OAAO,EAAE,OAAO,IAAI,aAAa,CAAC,GAAG;QACrC,qBAAqB,EACnB,+BAA+B,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE,UAAU,EAAE,+BAA+B,EAAE;YACjD,CAAC,CAAC,SAAS;QACf,UAAU;QACV,iBAAiB;QACjB,YAAY;QACZ,SAAS;QACT,eAAe;QACf,kBAAkB;QAClB,OAAO,EAAE;YACP,oBAAoB;YACpB,wBAAwB;YACxB,8BAA8B;YAC9B,qBAAqB;YACrB,sBAAsB;YACtB,yBAAyB;YACzB,cAAc;YACd,aAAa;YACb,kBAAkB;YAClB,YAAY;YACZ,kBAAkB;SACnB;QACD,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/extensions/registry.ts"],"names":[],"mappings":"AAyCA,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAGtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAIhF,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AASvD,OAAO,EAAE,kCAAkC,EAAE,MAAM,2BAA2B,CAAC;AAK/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAgMtD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAwC,EAAE;IAE1C,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,iBAAiB,GAAuB,EAAE,CAAC;IACjD,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC9E,MAAM,eAAe,GAAmC,EAAE,CAAC;IAC3D,MAAM,kBAAkB,GAAsC,EAAE,CAAC;IACjE,MAAM,QAAQ,GAAmC,EAAE,CAAC;IACpD,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,IAAI,OAAkC,CAAC;IACvC,IAAI,iBAAqC,CAAC;IAC1C,IAAI,+BAAmD,CAAC;IACxD,IAAI,UAAkC,CAAC;IACvC,IAAI,oBAAwC,CAAC;IAC7C,IAAI,oBAAsD,CAAC;IAC3D,IAAI,iBAAqC,CAAC;IAC1C,IAAI,wBAA8D,CAAC;IACnE,IAAI,oBAAwC,CAAC;IAC7C,IAAI,8BAES,CAAC;IACd,IAAI,gCAAoD,CAAC;IACzD,IAAI,qBAAwD,CAAC;IAC7D,IAAI,+BAAmD,CAAC;IACxD,IAAI,cAA0C,CAAC;IAC/C,IAAI,wBAA4C,CAAC;IACjD,IAAI,aAAwC,CAAC;IAC7C,IAAI,uBAA2C,CAAC;IAChD,IAAI,kBAAkD,CAAC;IACvD,IAAI,4BAAgD,CAAC;IACrD,IAAI,kBAAsD,CAAC;IAC3D,IAAI,4BAAgD,CAAC;IACrD,IAAI,oBAAsD,CAAC;IAC3D,IAAI,8BAAkD,CAAC;IACvD,IAAI,kBAAkD,CAAC;IACvD,IAAI,4BAAgD,CAAC;IACrD,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAGnC,CAAC;IACJ,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1D,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAGtC,CAAC;IACJ,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAExD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,uHAAuH,CACxH,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,CAAC,IAAI,4DAA4D,CACnG,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE1B,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,OAAO,KAAK,aAAa,CAAC,0BAA0B,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,gGAAgG,CACxH,CAAC;YACJ,CAAC;YACD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,uCAAuC,iBAAiB,+DAA+D,CAC/I,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YACvB,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC;QAChC,CAAC;QAED,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YAC7C,IAAI,+BAA+B,KAAK,SAAS,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,uDAAuD,+BAA+B,sDAAsD,CACpK,CAAC;YACJ,CAAC;YACD,+BAA+B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC9C,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,mCAAmC,oBAAoB,wDAAwD,CACvI,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YAC7B,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACrD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,4CAA4C,iBAAiB,6CAA6C,CAClI,CAAC;YACJ,CAAC;YACD,oBAAoB,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;YACzD,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC;QAChC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,wBAAwB,KAAK,SAAS,EAAE,CAAC;YACzD,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,gDAAgD,oBAAoB,6CAA6C,CACzI,CAAC;YACJ,CAAC;YACD,wBAAwB,GAAG,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC;YACjE,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,8BAA8B,KAAK,SAAS,EAAE,CAAC;YAC/D,IAAI,gCAAgC,KAAK,SAAS,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,sDAAsD,gCAAgC,6CAA6C,CAC3J,CAAC;YACJ,CAAC;YACD,8BAA8B;gBAC5B,IAAI,CAAC,OAAO,CAAC,8BAA8B,CAAC;YAC9C,gCAAgC,GAAG,IAAI,CAAC,IAAI,CAAC;QAC/C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,qBAAqB,KAAK,SAAS,EAAE,CAAC;YACtD,IAAI,+BAA+B,KAAK,SAAS,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,8CAA8C,+BAA+B,6CAA6C,CAClJ,CAAC;YACJ,CAAC;YACD,qBAAqB,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC;YAC3D,+BAA+B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC9C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,cAAc,KAAK,SAAS,EAAE,CAAC;YAC/C,IAAI,wBAAwB,KAAK,SAAS,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,sCAAsC,wBAAwB,6CAA6C,CACnI,CAAC;YACJ,CAAC;YACD,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YAC7C,wBAAwB,GAAG,IAAI,CAAC,IAAI,CAAC;QACvC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,aAAa,KAAK,SAAS,EAAE,CAAC;YAC9C,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,qCAAqC,uBAAuB,6CAA6C,CACjI,CAAC;YACJ,CAAC;YACD,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;YAC3C,uBAAuB,GAAG,IAAI,CAAC,IAAI,CAAC;QACtC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,4BAA4B,KAAK,SAAS,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,0CAA0C,4BAA4B,6CAA6C,CAC3I,CAAC;YACJ,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACrD,4BAA4B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC3C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,4BAA4B,KAAK,SAAS,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,8CAA8C,4BAA4B,6CAA6C,CAC/I,CAAC;YACJ,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACrD,4BAA4B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC3C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACrD,IAAI,8BAA8B,KAAK,SAAS,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,6CAA6C,8BAA8B,6CAA6C,CAChJ,CAAC;YACJ,CAAC;YACD,oBAAoB,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;YACzD,8BAA8B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC7C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,4BAA4B,KAAK,SAAS,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,2CAA2C,4BAA4B,6CAA6C,CAC5I,CAAC;YACJ,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACrD,4BAA4B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC3C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,sBAAsB,KAAK,SAAS,EAAE,CAAC;YACvD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;gBAClE,IAAK,sBAAgD,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrE,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,wCAAwC,IAAI,mEAAmE,CACvI,CAAC;gBACJ,CAAC;gBACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,wCAAwC,IAAI,WAAW,UAAU,qEAAqE,CAC9J,CAAC;gBACJ,CAAC;gBACD,sBAAsB,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC1C,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,yBAAyB,KAAK,SAAS,EAAE,CAAC;YAC1D,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;gBACrE,IAEI,kCACD,CAAC,QAAQ,CAAC,IAAI,CAAC,EAChB,CAAC;oBACD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,oCAAoC,IAAI,kEAAkE,CAClI,CAAC;gBACJ,CAAC;gBACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,oCAAoC,IAAI,WAAW,UAAU,qEAAqE,CAC1J,CAAC;gBACJ,CAAC;gBACD,yBAAyB,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC7C,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;YAC7C,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBACzD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,6BAA6B,OAAO,2EAA2E,CACvI,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;oBACzD,8DAA8D;oBAC9D,4DAA4D;oBAC5D,4DAA4D;oBAC5D,WAAW;oBACX,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,6BAA6B,OAAO,sBAAsB,KAAK,CAAC,OAAO,kEAAkE,CACjK,CAAC;gBACJ,CAAC;gBACD,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACtD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,6BAA6B,OAAO,WAAW,UAAU,uEAAuE,CACxJ,CAAC;gBACJ,CAAC;gBACD,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACjC,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC3C,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,MAAM,QAAQ,GACZ,mBAAmB,CAAC,IAAI,GAAG,CAAC;wBAC1B,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;wBAC9C,CAAC,CAAC,EAAE,CAAC;oBACT,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,8CAA8C,IAAI,uBACvE,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,QAAQ,GACzD,EAAE,CACH,CAAC;gBACJ,CAAC;gBACD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC3C,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1D,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QAChD,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,kBAAkB,CAAC,IAAI,CACrB,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAC1D,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,OAAO;QACL,SAAS;QACT,OAAO,EAAE,OAAO,IAAI,aAAa,CAAC,GAAG;QACrC,qBAAqB,EACnB,+BAA+B,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE,UAAU,EAAE,+BAA+B,EAAE;YACjD,CAAC,CAAC,SAAS;QACf,UAAU;QACV,iBAAiB;QACjB,YAAY;QACZ,SAAS;QACT,eAAe;QACf,kBAAkB;QAClB,OAAO,EAAE;YACP,oBAAoB;YACpB,wBAAwB;YACxB,8BAA8B;YAC9B,qBAAqB;YACrB,sBAAsB;YACtB,yBAAyB;YACzB,cAAc;YACd,aAAa;YACb,kBAAkB;YAClB,YAAY;YACZ,kBAAkB;YAClB,oBAAoB;YACpB,kBAAkB;SACnB;QACD,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/identity/oidc-discovery.d.ts

@@ -0,0 +1,36 @@
+/**
+ * OIDC issuer discovery (20260911.11, T01_1_review.md A8) — the one
+ * reader of `/.well-known/openid-configuration`, shared by every lane
+ * that needs an issuer's endpoints: the userinfo client (oidc-userinfo.ts)
+ * and the identity verifier's JWKS location (oidc-verifier.ts), so one
+ * issuer is discovered once and validated the same way wherever it is
+ * consumed. The composition root builds ONE instance and hands it to
+ * both.
+ *
+ * The verifier's rules, kept: the document's `issuer` must equal the
+ * requested issuer exactly (RFC 8414 §3.3 — a document that names another
+ * issuer is a misconfiguration or a redirect to somewhere else); `jwks_uri`
+ * is required (OpenID Connect Discovery 1.0 §3 says so). `userinfo_endpoint`
+ * is RECOMMENDED by the spec, so it is carried when present and its
+ * consumer decides what its absence means.
+ *
+ * Memoized per issuer ON SUCCESS only: a failed fetch is retried on the
+ * next call, so a flaky IdP at boot never permanently bricks a lane. An
+ * outage is an infrastructure fault thrown as a plain error — the caller
+ * maps it (the chassis to INTERNAL, the provisioning handler to
+ * UNAVAILABLE), never a credential rejection. The fetch is injected so
+ * tests never dial out and the composition root owns the process boundary.
+ */
+export interface DiscoveredIssuer {
+    readonly issuer: string;
+    readonly jwksUri: string;
+    /** Absent when the document names none. */
+    readonly userinfoEndpoint: string | undefined;
+}
+export interface IssuerDiscovery {
+    /** The validated document for `issuer`, from the cache after the first success. */
+    discover(issuer: string): Promise<DiscoveredIssuer>;
+}
+export declare function discoveryUrl(issuer: string): string;
+export declare function newIssuerDiscovery(fetchImpl?: typeof fetch): IssuerDiscovery;
+//# sourceMappingURL=oidc-discovery.d.ts.map

package/dist/identity/oidc-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-discovery.d.ts","sourceRoot":"","sources":["../../src/identity/oidc-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2CAA2C;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/C;AAED,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACrD;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,kBAAkB,CAChC,SAAS,GAAE,OAAO,KAAa,GAC9B,eAAe,CAyCjB"}

package/dist/identity/oidc-discovery.js

@@ -0,0 +1,60 @@
+/**
+ * OIDC issuer discovery (20260911.11, T01_1_review.md A8) — the one
+ * reader of `/.well-known/openid-configuration`, shared by every lane
+ * that needs an issuer's endpoints: the userinfo client (oidc-userinfo.ts)
+ * and the identity verifier's JWKS location (oidc-verifier.ts), so one
+ * issuer is discovered once and validated the same way wherever it is
+ * consumed. The composition root builds ONE instance and hands it to
+ * both.
+ *
+ * The verifier's rules, kept: the document's `issuer` must equal the
+ * requested issuer exactly (RFC 8414 §3.3 — a document that names another
+ * issuer is a misconfiguration or a redirect to somewhere else); `jwks_uri`
+ * is required (OpenID Connect Discovery 1.0 §3 says so). `userinfo_endpoint`
+ * is RECOMMENDED by the spec, so it is carried when present and its
+ * consumer decides what its absence means.
+ *
+ * Memoized per issuer ON SUCCESS only: a failed fetch is retried on the
+ * next call, so a flaky IdP at boot never permanently bricks a lane. An
+ * outage is an infrastructure fault thrown as a plain error — the caller
+ * maps it (the chassis to INTERNAL, the provisioning handler to
+ * UNAVAILABLE), never a credential rejection. The fetch is injected so
+ * tests never dial out and the composition root owns the process boundary.
+ */
+export function discoveryUrl(issuer) {
+    return `${issuer.replace(/\/$/, "")}/.well-known/openid-configuration`;
+}
+export function newIssuerDiscovery(fetchImpl = fetch) {
+    const discovered = new Map();
+    return {
+        async discover(issuer) {
+            const cached = discovered.get(issuer);
+            if (cached !== undefined) {
+                return cached;
+            }
+            const url = discoveryUrl(issuer);
+            const response = await fetchImpl(url);
+            if (!response.ok) {
+                throw new Error(`OIDC discovery failed: ${url} answered HTTP ${response.status}`);
+            }
+            const document = (await response.json());
+            if (document.issuer !== issuer) {
+                throw new Error(`OIDC discovery failed: document issuer '${typeof document.issuer === "string" ? document.issuer : ""}' does not match configured issuer '${issuer}'`);
+            }
+            if (typeof document.jwks_uri !== "string" || document.jwks_uri === "") {
+                throw new Error(`OIDC discovery failed: ${url} carries no jwks_uri`);
+            }
+            const result = {
+                issuer,
+                jwksUri: document.jwks_uri,
+                userinfoEndpoint: typeof document.userinfo_endpoint === "string" &&
+                    document.userinfo_endpoint !== ""
+                    ? document.userinfo_endpoint
+                    : undefined,
+            };
+            discovered.set(issuer, result);
+            return result;
+        },
+    };
+}
+//# sourceMappingURL=oidc-discovery.js.map

package/dist/identity/oidc-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-discovery.js","sourceRoot":"","sources":["../../src/identity/oidc-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAcH,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,YAA0B,KAAK;IAE/B,MAAM,UAAU,GAAG,IAAI,GAAG,EAA4B,CAAC;IACvD,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,MAAc;YAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CACb,0BAA0B,GAAG,kBAAkB,QAAQ,CAAC,MAAM,EAAE,CACjE,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAItC,CAAC;YACF,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CACb,2CAA2C,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,uCAAuC,MAAM,GAAG,CACtJ,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACtE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,sBAAsB,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,MAAM,GAAqB;gBAC/B,MAAM;gBACN,OAAO,EAAE,QAAQ,CAAC,QAAQ;gBAC1B,gBAAgB,EACd,OAAO,QAAQ,CAAC,iBAAiB,KAAK,QAAQ;oBAC9C,QAAQ,CAAC,iBAAiB,KAAK,EAAE;oBAC/B,CAAC,CAAC,QAAQ,CAAC,iBAAiB;oBAC5B,CAAC,CAAC,SAAS;aAChB,CAAC;YACF,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC/B,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/identity/oidc-userinfo.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The OIDC userinfo client (20260911.11, T01_1_review.md A8) — the
+ * infrastructure behind the identity-account domain's UserInfoClient
+ * port (domain/identityaccount/provisioning.ts): the profile of the
+ * bearer of an access token, from the `userinfo_endpoint` the token's
+ * ISSUER publishes, fetched with that very token.
+ *
+ * The issuer is a per-call argument, not a construction-time binding,
+ * because the composition does not know which issuer will vouch for a
+ * caller: open source's own OIDC lane names one in STIGMER_OIDC_ISSUER,
+ * the cloud's verifiers name theirs on the CallerIdentity they mint. The
+ * one issuer whose userinfo can answer for a token is the one that issued
+ * it — and a verifier already trusted it, so the token goes only where it
+ * came from.
+ *
+ * The endpoint is the discovery document's word, never a guessed
+ * `<issuer>/userinfo`: a document that names no `userinfo_endpoint` is
+ * refused as a fetch failure (the domain maps it UNAVAILABLE with the
+ * cloud's copy), so a misconfigured issuer fails loudly at the first
+ * sign-in rather than silently against a wrong URL.
+ *
+ * Claims read as the cloud's client reads them: `email`, `given_name`,
+ * `family_name`, `picture`; a missing or non-string claim is the empty
+ * string. Any non-2xx or malformed answer throws; the domain's
+ * UserInfoFetchError wraps it.
+ */
+import type { UserInfoClient } from "../domain/identityaccount/provisioning.js";
+import type { IssuerDiscovery } from "./oidc-discovery.js";
+export declare function newOidcUserInfoClient(discovery: IssuerDiscovery, fetchImpl?: typeof fetch): UserInfoClient;
+//# sourceMappingURL=oidc-userinfo.d.ts.map

package/dist/identity/oidc-userinfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-userinfo.d.ts","sourceRoot":"","sources":["../../src/identity/oidc-userinfo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,eAAe,EAC1B,SAAS,GAAE,OAAO,KAAa,GAC9B,cAAc,CA4BhB"}

package/dist/identity/oidc-userinfo.js

@@ -0,0 +1,28 @@
+export function newOidcUserInfoClient(discovery, fetchImpl = fetch) {
+    return {
+        async fetchUserProfile(issuer, accessToken) {
+            const { userinfoEndpoint } = await discovery.discover(issuer);
+            if (userinfoEndpoint === undefined) {
+                throw new Error(`issuer '${issuer}' publishes no userinfo_endpoint in its discovery document`);
+            }
+            const response = await fetchImpl(userinfoEndpoint, {
+                headers: { authorization: `Bearer ${accessToken}` },
+            });
+            if (!response.ok) {
+                throw new Error(`userinfo answered ${response.status}`);
+            }
+            const claims = (await response.json());
+            const text = (key) => {
+                const value = claims[key];
+                return typeof value === "string" ? value : "";
+            };
+            return {
+                email: text("email"),
+                firstName: text("given_name"),
+                lastName: text("family_name"),
+                pictureUrl: text("picture"),
+            };
+        },
+    };
+}
+//# sourceMappingURL=oidc-userinfo.js.map

package/dist/identity/oidc-userinfo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-userinfo.js","sourceRoot":"","sources":["../../src/identity/oidc-userinfo.ts"],"names":[],"mappings":"AAgCA,MAAM,UAAU,qBAAqB,CACnC,SAA0B,EAC1B,YAA0B,KAAK;IAE/B,OAAO;QACL,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW;YACxC,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,WAAW,MAAM,4DAA4D,CAC9E,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,gBAAgB,EAAE;gBACjD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;aACpD,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;YAClE,MAAM,IAAI,GAAG,CAAC,GAAW,EAAU,EAAE;gBACnC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,CAAC,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;gBACpB,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;gBAC7B,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC;gBAC7B,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC;aAC5B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/identity/oidc-verifier.d.ts

@@ -1,4 +1,6 @@
+import type { AccountsBySubject } from "../domain/identityaccount/resolve.js";
 import type { IdentityVerifier } from "../extensions/identity.js";
+import type { IssuerDiscovery } from "./oidc-discovery.js";
 /** Java classifyAuthError arms — byte-pinned cross-edition copy. */
 export declare const TOKEN_EXPIRED_MESSAGE = "token has expired";
 export declare const TOKEN_AUDIENCE_MESSAGE = "token audience does not match the expected audience";
@@ -9,6 +11,10 @@ export interface OidcVerifierConfig {
     readonly issuer: string;
     /** The audience access tokens must carry. */
     readonly audience: string;
+    /** The identity-account domain's subject lookup — REQUIRED: what identityId means depends on it. */
+    readonly accounts: AccountsBySubject;
+    /** The composition root's one discovery for every lane (A8). */
+    readonly discovery: IssuerDiscovery;
 }
 export declare function newOidcIdentityVerifier(config: OidcVerifierConfig): IdentityVerifier;
 //# sourceMappingURL=oidc-verifier.d.ts.map

package/dist/identity/oidc-verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-verifier.d.ts","sourceRoot":"","sources":["../../src/identity/oidc-verifier.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,2BAA2B,CAAC;AAEnC,oEAAoE;AACpE,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,sBAAsB,wDACoB,CAAC;AACxD,eAAO,MAAM,uBAAuB,wCAAwC,CAAC;AAC7E,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAErD,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAMD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,GACzB,gBAAgB,CA+DlB"}
+{"version":3,"file":"oidc-verifier.d.ts","sourceRoot":"","sources":["../../src/identity/oidc-verifier.ts"],"names":[],"mappings":"AAmDA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,oEAAoE;AACpE,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,sBAAsB,wDACoB,CAAC;AACxD,eAAO,MAAM,uBAAuB,wCAAwC,CAAC;AAC7E,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAErD,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;CACrC;AAID,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,GACzB,gBAAgB,CA+ClB"}