@stigmer/server 3.14.1 → 3.15.0

package/dist/identity/oidc-verifier.js

@@ -18,46 +18,51 @@
  *   - everything else → "invalid token"
  *
  * Discovery and key handling: the issuer's /.well-known/openid-configuration
- * is fetched once (memoized on success, retried on the next request after
- * a failure — a flaky IdP at boot must not permanently brick the lane),
- * its `issuer` field must match the configured issuer exactly (RFC 8414
- * §3.3), and the JWKS rides jose's createRemoteJWKSet (cached, rotation-
- * aware). Discovery/JWKS OUTAGES are infrastructure faults — thrown as
+ * is read through the shared oidc-discovery module the composition root
+ * builds once for every lane (20260911.11 A8 — the userinfo client reads
+ * the same document, so one issuer is discovered once and validated the
+ * same way wherever it is consumed: `issuer` must match exactly, RFC 8414
+ * §3.3; `jwks_uri` required). The module memoizes on success only, so a
+ * flaky IdP at boot never permanently bricks the lane. The JWKS client
+ * (jose's createRemoteJWKSet — cached, rotation-aware) is built ONCE per
+ * verifier from the discovered location and kept: discovery hands back a
+ * URI, and a client rebuilt per request would refetch the keys per
+ * request. Discovery/JWKS OUTAGES are infrastructure faults — thrown as
  * plain errors so the chassis maps them to INTERNAL, never a credential
  * rejection (the DD-007 unavailable doctrine).
  *
- * Identity: identityId = `sub` (rejected as invalid when absent), issuer =
- * the configured issuer, email/displayName from the standard `email`/`name`
- * claims when present (the DD-007 Q5 addendum added the fields for exactly
- * these claims).
+ * Identity (20260911.11 Q-IA-2, A1 — the cloud's direct-login posture):
+ * after the token verifies, `sub` (rejected as invalid when absent) is
+ * resolved through the identity-account domain (identityIdForSubject):
+ * a subject with a direct account stamps the ACCOUNT id; a subject
+ * without one is admitted idp-shaped (identityId = sub) so whoAmI can
+ * answer NOT_FOUND and provisionMyAccount can run. One primary-key read
+ * per request, no cache; a store fault is an infrastructure fault. The
+ * issuer is the configured issuer; email/displayName come from the
+ * standard `email`/`name` claims when present (the DD-007 Q5 addendum
+ * added the fields for exactly these claims), whichever way the subject
+ * resolved. Claim-or-pass runs before any of this: a non-JWT token
+ * passes with no network.
  */
 import { createRemoteJWKSet, jwtVerify, errors as joseErrors } from "jose";
 import { Code, ConnectError } from "@connectrpc/connect";
+import { identityIdForSubject } from "../domain/identityaccount/resolve.js";
 /** Java classifyAuthError arms — byte-pinned cross-edition copy. */
 export const TOKEN_EXPIRED_MESSAGE = "token has expired";
 export const TOKEN_AUDIENCE_MESSAGE = "token audience does not match the expected audience";
 export const TOKEN_SIGNATURE_MESSAGE = "token signature verification failed";
 export const INVALID_TOKEN_MESSAGE = "invalid token";
 export function newOidcIdentityVerifier(config) {
-    let discovered;
-    async function discover() {
-        if (discovered !== undefined) {
-            return discovered;
+    // Set on the first successful discovery only: a failed discovery leaves
+    // it unset so the next request retries (the module caches no failure).
+    let jwks;
+    async function jwksFor() {
+        if (jwks !== undefined) {
+            return jwks;
         }
-        const url = discoveryUrl(config.issuer);
-        const response = await fetch(url);
-        if (!response.ok) {
-            throw new Error(`OIDC discovery failed: ${url} answered HTTP ${response.status}`);
-        }
-        const document = (await response.json());
-        if (document.issuer !== config.issuer) {
-            throw new Error(`OIDC discovery failed: document issuer '${document.issuer ?? ""}' does not match configured issuer '${config.issuer}'`);
-        }
-        if (typeof document.jwks_uri !== "string" || document.jwks_uri === "") {
-            throw new Error(`OIDC discovery failed: ${url} carries no jwks_uri`);
-        }
-        discovered = { jwks: createRemoteJWKSet(new URL(document.jwks_uri)) };
-        return discovered;
+        const { jwksUri } = await config.discovery.discover(config.issuer);
+        jwks = createRemoteJWKSet(new URL(jwksUri));
+        return jwks;
     }
     return {
         name: "oidc",
@@ -65,10 +70,10 @@ export function newOidcIdentityVerifier(config) {
             if (!isJwtShaped(token)) {
                 return null;
             }
-            const issuer = await discover();
+            const keys = await jwksFor();
             let payload;
             try {
-                ({ payload } = await jwtVerify(token, issuer.jwks, {
+                ({ payload } = await jwtVerify(token, keys, {
                     issuer: config.issuer,
                     audience: config.audience,
                 }));
@@ -80,7 +85,7 @@ export function newOidcIdentityVerifier(config) {
                 throw new ConnectError(INVALID_TOKEN_MESSAGE, Code.Unauthenticated);
             }
             return {
-                identityId: payload.sub,
+                identityId: await identityIdForSubject(config.accounts, payload.sub),
                 callerClass: "user",
                 issuer: config.issuer,
                 rawToken: token,
@@ -94,10 +99,6 @@ export function newOidcIdentityVerifier(config) {
         },
     };
 }
-/** issuer + /.well-known/openid-configuration (trailing-slash tolerant). */
-function discoveryUrl(issuer) {
-    return `${issuer.replace(/\/$/, "")}/.well-known/openid-configuration`;
-}
 /** Three non-empty dot-separated segments — the JWS compact shape. */
 function isJwtShaped(token) {
     const segments = token.split(".");

package/dist/identity/oidc-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-verifier.js","sourceRoot":"","sources":["../../src/identity/oidc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,MAAM,CAAC;AAE3E,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAOzD,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AACzD,MAAM,CAAC,MAAM,sBAAsB,GACjC,qDAAqD,CAAC;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,qCAAqC,CAAC;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAarD,MAAM,UAAU,uBAAuB,CACrC,MAA0B;IAE1B,IAAI,UAAwC,CAAC;IAE7C,KAAK,UAAU,QAAQ;QACrB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,0BAA0B,GAAG,kBAAkB,QAAQ,CAAC,MAAM,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGtC,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,2CAA2C,QAAQ,CAAC,MAAM,IAAI,EAAE,uCAAuC,MAAM,CAAC,MAAM,GAAG,CACxH,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,sBAAsB,CAAC,CAAC;QACvE,CAAC;QACD,UAAU,GAAG,EAAE,IAAI,EAAE,kBAAkB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACtE,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,IAAI,OAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE;oBACjD,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;gBAC1D,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,OAAO,CAAC,GAAG;gBACvB,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,KAAK;gBACf,GAAG,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE;oBACjE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;oBAC7B,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE;oBAC/D,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;oBAClC,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC;AACzE,CAAC;AAED,sEAAsE;AACtE,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3C,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,YAAY,UAAU,CAAC,wBAAwB,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,IAAI,YAAY,CAAC,sBAAsB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IACE,KAAK,YAAY,UAAU,CAAC,8BAA8B;QAC1D,KAAK,YAAY,UAAU,CAAC,iBAAiB;QAC7C,KAAK,YAAY,UAAU,CAAC,wBAAwB;QACpD,KAAK,YAAY,UAAU,CAAC,WAAW,EACvC,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,uBAAuB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACzE,CAAC;IACD,IACE,KAAK,YAAY,UAAU,CAAC,UAAU;QACtC,KAAK,YAAY,UAAU,CAAC,UAAU,EACtC,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,2EAA2E;IAC3E,yDAAyD;IACzD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"oidc-verifier.js","sourceRoot":"","sources":["../../src/identity/oidc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,MAAM,CAAC;AAE3E,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAQ5E,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AACzD,MAAM,CAAC,MAAM,sBAAsB,GACjC,qDAAqD,CAAC;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,qCAAqC,CAAC;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAerD,MAAM,UAAU,uBAAuB,CACrC,MAA0B;IAE1B,wEAAwE;IACxE,uEAAuE;IACvE,IAAI,IAA4B,CAAC;IAEjC,KAAK,UAAU,OAAO;QACpB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnE,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;YAC7B,IAAI,OAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;oBAC1C,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;gBAC1D,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,MAAM,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC;gBACpE,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,KAAK;gBACf,GAAG,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE;oBACjE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;oBAC7B,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE;oBAC/D,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;oBAClC,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3C,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,YAAY,UAAU,CAAC,wBAAwB,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,IAAI,YAAY,CAAC,sBAAsB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IACE,KAAK,YAAY,UAAU,CAAC,8BAA8B;QAC1D,KAAK,YAAY,UAAU,CAAC,iBAAiB;QAC7C,KAAK,YAAY,UAAU,CAAC,wBAAwB;QACpD,KAAK,YAAY,UAAU,CAAC,WAAW,EACvC,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,uBAAuB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACzE,CAAC;IACD,IACE,KAAK,YAAY,UAAU,CAAC,UAAU;QACtC,KAAK,YAAY,UAAU,CAAC,UAAU,EACtC,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,2EAA2E;IAC3E,yDAAyD;IACzD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/index.d.ts

@@ -56,6 +56,13 @@ export type { ResolvedExtensionDrivers } from "./extensions/registry.js";
 export type { DefaultInstanceLinkedEvent, ResourceAuthorizationLifecycle, ResourceCreatedEvent, ResourceDeletedEvent, VisibilityChangedEvent, VisibilityTupleShape, ResolvedParentLink, } from "./extensions/resource-authorization.js";
 export type { OrganizationDirectory } from "./extensions/organization-directory.js";
 export { ALL_ORGANIZATIONS } from "./extensions/organization-directory.js";
+export type { IdentityAccountStore } from "./domain/identityaccount/store.js";
+export { DuplicateAccountError } from "./domain/identityaccount/store.js";
+export type { IdentityAccountStoreContractCase, IdentityAccountStoreContractFixture, } from "./domain/identityaccount/store-contract.js";
+export { identityAccountStoreContract } from "./domain/identityaccount/store-contract.js";
+export type { IdentityFederation } from "./extensions/identity-federation.js";
+export type { AccountsBySubject } from "./domain/identityaccount/resolve.js";
+export { identityIdForSubject } from "./domain/identityaccount/resolve.js";
 export type { ListReadScope, ListEntryMeta, } from "./extensions/list-read-scope.js";
 export type { ScheduleFireCallerMint } from "./extensions/schedule-fire-caller.js";
 export type { VisitorErrorPolicy } from "./pipeline/interceptors/error-boundary.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,YAAY,EACV,QAAQ,EACR,SAAS,EACT,MAAM,EACN,aAAa,EACb,QAAQ,EACR,OAAO,GACR,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,4BAA4B,EAC5B,kBAAkB,EAClB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AASlC,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAOjE,YAAY,EACV,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAIzE,YAAY,EACV,0BAA0B,EAC1B,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAChD,YAAY,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAC3E,YAAY,EACV,aAAa,EACb,aAAa,GACd,MAAM,iCAAiC,CAAC;AAIzC,YAAY,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AASnF,YAAY,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAGlD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAKxD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAgBzC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAOjF,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAKtE,YAAY,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAK9B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAWhE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,YAAY,EACV,eAAe,EACf,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAIrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,YAAY,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAMvE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAKjG,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AACrG,YAAY,EACV,wBAAwB,EAKxB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EAKxB,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAcpC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMzD,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAS9E,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAQrE,YAAY,EACV,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,0CAA0C,CAAC;AAOlD,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,YAAY,EACV,QAAQ,EACR,SAAS,EACT,MAAM,EACN,aAAa,EACb,QAAQ,EACR,OAAO,GACR,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,4BAA4B,EAC5B,kBAAkB,EAClB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AASlC,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAOjE,YAAY,EACV,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAIzE,YAAY,EACV,0BAA0B,EAC1B,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAChD,YAAY,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAO3E,YAAY,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAI1E,YAAY,EACV,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAC1F,YAAY,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,YAAY,EACV,aAAa,EACb,aAAa,GACd,MAAM,iCAAiC,CAAC;AAIzC,YAAY,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AASnF,YAAY,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAGlD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAKxD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAgBzC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAOjF,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAKtE,YAAY,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAK9B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAWhE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,YAAY,EACV,eAAe,EACf,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAIrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,YAAY,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAMvE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAKjG,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AACrG,YAAY,EACV,wBAAwB,EAKxB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EAKxB,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAcpC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMzD,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAS9E,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAQrE,YAAY,EACV,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,0CAA0C,CAAC;AAOlD,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -44,6 +44,9 @@ export { composeServer } from "./boot/compose.js";
 export { loadConfig } from "./boot/config.js";
 export { createLogger } from "./boot/logger.js";
 export { ALL_ORGANIZATIONS } from "./extensions/organization-directory.js";
+export { DuplicateAccountError } from "./domain/identityaccount/store.js";
+export { identityAccountStoreContract } from "./domain/identityaccount/store-contract.js";
+export { identityIdForSubject } from "./domain/identityaccount/resolve.js";
 export { createErrorBoundaryInterceptor } from "./pipeline/interceptors/error-boundary.js";
 export { diffVisibilityShapes, visibilityShapesFor, } from "./pipeline/steps/authorization-tuples.js";
 export { RequestContext } from "./pipeline/request-context.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,wCAAwC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA+DhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAkB3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAIlD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,yEAAyE;AACzE,+DAA+D;AAC/D,wEAAwE;AACxE,QAAQ;AACR,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,sEAAsE;AACtE,qEAAqE;AACrE,6DAA6D;AAC7D,iEAAiE;AACjE,wEAAwE;AACxE,iEAAiE;AACjE,yEAAyE;AACzE,+DAA+D;AAC/D,yEAAyE;AACzE,8DAA8D;AAC9D,wEAAwE;AACxE,uEAAuE;AACvE,mEAAmE;AACnE,2DAA2D;AAC3D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,+DAA+D;AAC/D,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,oEAAoE;AACpE,wEAAwE;AACxE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kDAAkD;AAClD,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,0EAA0E;AAC1E,uEAAuE;AACvE,oEAAoE;AACpE,uEAAuE;AACvE,oEAAoE;AACpE,wCAAwC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAMtE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAM9B,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAO1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAQvE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AAkBrG,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,6DAA6D;AAC7D,uEAAuE;AACvE,qEAAqE;AACrE,gEAAgE;AAChE,0EAA0E;AAC1E,qEAAqE;AACrE,uEAAuE;AACvE,iEAAiE;AACjE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AAepC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAE9E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,kDAAkD;AAClD,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AA0BrE,oEAAoE;AACpE,yEAAyE;AACzE,iDAAiD;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,wCAAwC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA+DhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAQ3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAQ1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAG1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAkB3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAIlD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,yEAAyE;AACzE,+DAA+D;AAC/D,wEAAwE;AACxE,QAAQ;AACR,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,sEAAsE;AACtE,qEAAqE;AACrE,6DAA6D;AAC7D,iEAAiE;AACjE,wEAAwE;AACxE,iEAAiE;AACjE,yEAAyE;AACzE,+DAA+D;AAC/D,yEAAyE;AACzE,8DAA8D;AAC9D,wEAAwE;AACxE,uEAAuE;AACvE,mEAAmE;AACnE,2DAA2D;AAC3D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,+DAA+D;AAC/D,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,oEAAoE;AACpE,wEAAwE;AACxE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kDAAkD;AAClD,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,0EAA0E;AAC1E,uEAAuE;AACvE,oEAAoE;AACpE,uEAAuE;AACvE,oEAAoE;AACpE,wCAAwC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAMtE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAM9B,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAO1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAQvE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AAkBrG,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,6DAA6D;AAC7D,uEAAuE;AACvE,qEAAqE;AACrE,gEAAgE;AAChE,0EAA0E;AAC1E,qEAAqE;AACrE,uEAAuE;AACvE,iEAAiE;AACjE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AAepC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAE9E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,kDAAkD;AAClD,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AA0BrE,oEAAoE;AACpE,yEAAyE;AACzE,iDAAiD;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/pipeline/interceptors/auth.d.ts

@@ -51,6 +51,16 @@ export declare function callerIdentityOf(ctx: HandlerContext): CallerIdentity;
  * operator seam remains process-global.
  */
 export declare function trustedLocalIdentity(): CallerIdentity;
+/**
+ * The trusted-local identity for a given operator — the one construction
+ * of that principal, shared by the per-request stamp above and by the
+ * boot-time operator account (domain/identityaccount/operator.ts), so the
+ * row the server ensures and the caller it stamps can never disagree.
+ */
+export declare function trustedLocalIdentityFor(operator: {
+    readonly email: string;
+    readonly displayName: string;
+}): CallerIdentity;
 /**
  * The serving chain's position-1 identity source: walks the composed
  * verifiers in order (OSS entries first, extension entries after, in

package/dist/pipeline/interceptors/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/pipeline/interceptors/auth.ts"],"names":[],"mappings":"AAiFA,OAAO,KAAK,EACV,cAAc,EACd,WAAW,EAGZ,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAIrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AAItC;;;GAGG;AACH,eAAO,MAAM,oCAAoC,iCACjB,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,CAE7D,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAKlE;AAED;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,sEAG7B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,cAAc,CASpE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,cAAc,CAkBrD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,aAAa,CAAC,gBAAgB,CAAC,EAC1C,MAAM,EAAE,aAAa,CAAC,WAAW,CAAC,EAClC,MAAM,EAAE,MAAM,EACd,qBAAqB,UAAQ,GAC5B,WAAW,CAwCb;AAyCD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,+BAA+B,CAAC;AAErE,2DAA2D;AAC3D,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAEpE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gCAAgC,IAAI,WAAW,CA6B9D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,aAAa,CAAC,gBAAgB,CAAC,EAC1C,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAoBrC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAUlE"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/pipeline/interceptors/auth.ts"],"names":[],"mappings":"AAiFA,OAAO,KAAK,EACV,cAAc,EACd,WAAW,EAGZ,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAIrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AAItC;;;GAGG;AACH,eAAO,MAAM,oCAAoC,iCACjB,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,CAE7D,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAKlE;AAED;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,sEAG7B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,cAAc,CASpE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,cAAc,CAErD;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE;IAChD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GAAG,cAAc,CAiBjB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,aAAa,CAAC,gBAAgB,CAAC,EAC1C,MAAM,EAAE,aAAa,CAAC,WAAW,CAAC,EAClC,MAAM,EAAE,MAAM,EACd,qBAAqB,UAAQ,GAC5B,WAAW,CAwCb;AAyCD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,+BAA+B,CAAC;AAErE,2DAA2D;AAC3D,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAEpE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gCAAgC,IAAI,WAAW,CA6B9D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,aAAa,CAAC,gBAAgB,CAAC,EAC1C,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAoBrC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAUlE"}

package/dist/pipeline/interceptors/auth.js

@@ -142,7 +142,15 @@ export function callerIdentityOf(ctx) {
  * operator seam remains process-global.
  */
 export function trustedLocalIdentity() {
-    const operator = operatorIdentitySnapshot();
+    return trustedLocalIdentityFor(operatorIdentitySnapshot());
+}
+/**
+ * The trusted-local identity for a given operator — the one construction
+ * of that principal, shared by the per-request stamp above and by the
+ * boot-time operator account (domain/identityaccount/operator.ts), so the
+ * row the server ensures and the caller it stamps can never disagree.
+ */
+export function trustedLocalIdentityFor(operator) {
     if (operator.email === "") {
         return {
             identityId: "system",

package/dist/pipeline/interceptors/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/pipeline/interceptors/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAO3E,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,OAAO,EAAE,SAAS,EAAE,MAAM,0DAA0D,CAAC;AAQrF,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhE;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAC/C,8BAA8B,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC;IACzE,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAkB;IACvD,OAAO,CACL,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC;QAC5B,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,gBAAgB,CAC/C,SAAS,EACT,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAChE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAmB;IAClD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,kDAAkD,CAAC,EAC7D,uBAAuB,CACxB,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,IAAI,QAAQ,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QAC1B,OAAO;YACL,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,MAAM;YACnB,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IACD,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,KAAK;QAC1B,WAAW,EAAE,MAAM;QACnB,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,EAAE;QACZ,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,8BAA8B,CAC5C,SAA0C,EAC1C,MAAkC,EAClC,MAAc,EACd,qBAAqB,GAAG,KAAK;IAE7B,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACjC,qEAAqE;QACrE,mEAAmE;QACnE,kEAAkE;QAClE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,IAAI,QAAoC,CAAC;QACzC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,QAAQ,GAAG,MAAM,uBAAuB,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACnE,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnD,kEAAkE;gBAClE,+DAA+D;gBAC/D,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;oBAClE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;iBACnD,CAAC,CAAC;gBACH,MAAM,IAAI,YAAY,CACpB,0EAA0E,EAC1E,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IACL,qBAAqB;YACrB,CAAC,sBAAsB,CAAC,OAAO,CAAC,MAAM,CAAC,EACvC,CAAC;YACD,mEAAmE;YACnE,kEAAkE;YAClE,oEAAoE;YACpE,oEAAoE;YACpE,gDAAgD;YAChD,MAAM,IAAI,YAAY,CACpB,oCAAoC,EACpC,IAAI,CAAC,eAAe,CACrB,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,IAAI,oBAAoB,EAAE,CAAC;QACnD,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAkC,EAClC,MAAsB,EACtB,OAAqC,EACrC,MAAc;IAEd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACxE,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;oBAC9C,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,SAAS;oBACT,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;iBACvB,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBAClC,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,SAAS;gBACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;AAErE,2DAA2D;AAC3D,MAAM,UAAU,qBAAqB,CAAC,MAAsB;IAC1D,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,gCAAgC;IAC9C,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAC7D,IAAI,QAAwB,CAAC;QAC7B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,QAAQ,GAAG;oBACT,GAAI,IAAI,CAAC,KAAK,CACZ,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAChC;oBACpB,MAAM,EAAE,YAAY;iBACrB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CACjB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACzD,uBAAuB,CACxB,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG;gBACT,GAAG,oBAAoB,EAAE;gBACzB,WAAW,EAAE,UAAU;gBACvB,MAAM,EAAE,YAAY;aACrB,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAA0C,EAC1C,KAAa,EACb,MAAc;IAEd,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,OAA8B,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;gBAClC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE;gBACvC,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,iBAAyB;IACxD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,SAAS,CAAC;IACzB,IACE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,EACvD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/pipeline/interceptors/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAO3E,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,OAAO,EAAE,SAAS,EAAE,MAAM,0DAA0D,CAAC;AAQrF,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhE;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAC/C,8BAA8B,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC;IACzE,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAkB;IACvD,OAAO,CACL,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC;QAC5B,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,gBAAgB,CAC/C,SAAS,EACT,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAChE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAmB;IAClD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,kDAAkD,CAAC,EAC7D,uBAAuB,CACxB,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,uBAAuB,CAAC,wBAAwB,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAGvC;IACC,IAAI,QAAQ,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QAC1B,OAAO;YACL,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,MAAM;YACnB,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IACD,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,KAAK;QAC1B,WAAW,EAAE,MAAM;QACnB,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,EAAE;QACZ,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,8BAA8B,CAC5C,SAA0C,EAC1C,MAAkC,EAClC,MAAc,EACd,qBAAqB,GAAG,KAAK;IAE7B,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACjC,qEAAqE;QACrE,mEAAmE;QACnE,kEAAkE;QAClE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,IAAI,QAAoC,CAAC;QACzC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,QAAQ,GAAG,MAAM,uBAAuB,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACnE,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnD,kEAAkE;gBAClE,+DAA+D;gBAC/D,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;oBAClE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;iBACnD,CAAC,CAAC;gBACH,MAAM,IAAI,YAAY,CACpB,0EAA0E,EAC1E,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IACL,qBAAqB;YACrB,CAAC,sBAAsB,CAAC,OAAO,CAAC,MAAM,CAAC,EACvC,CAAC;YACD,mEAAmE;YACnE,kEAAkE;YAClE,oEAAoE;YACpE,oEAAoE;YACpE,gDAAgD;YAChD,MAAM,IAAI,YAAY,CACpB,oCAAoC,EACpC,IAAI,CAAC,eAAe,CACrB,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,IAAI,oBAAoB,EAAE,CAAC;QACnD,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAkC,EAClC,MAAsB,EACtB,OAAqC,EACrC,MAAc;IAEd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACxE,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;oBAC9C,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,SAAS;oBACT,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;iBACvB,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBAClC,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,SAAS;gBACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;AAErE,2DAA2D;AAC3D,MAAM,UAAU,qBAAqB,CAAC,MAAsB;IAC1D,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,gCAAgC;IAC9C,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAC7D,IAAI,QAAwB,CAAC;QAC7B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,QAAQ,GAAG;oBACT,GAAI,IAAI,CAAC,KAAK,CACZ,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAChC;oBACpB,MAAM,EAAE,YAAY;iBACrB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CACjB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACzD,uBAAuB,CACxB,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG;gBACT,GAAG,oBAAoB,EAAE;gBACzB,WAAW,EAAE,UAAU;gBACvB,MAAM,EAAE,YAAY;aACrB,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAA0C,EAC1C,KAAa,EACb,MAAc;IAEd,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,OAA8B,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;gBAClC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE;gBACvC,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,iBAAyB;IACxD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,SAAS,CAAC;IACzB,IACE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,EACvD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/server",
-  "version": "3.14.1",
+  "version": "3.15.0",
   "description": "The Stigmer OSS control plane as a composable library: composeServer, the extension registry and the driver seams a composition builds on. The self-contained deployable of the same server is @stigmer/server-slim.",
   "license": "Apache-2.0",
   "type": "module",
@@ -62,9 +62,9 @@
     "@connectrpc/connect-node": "^2.0.0",
     "@kubernetes/client-node": "2.0.0",
     "@opentelemetry/api": "^1.9.0",
-    "@stigmer/protos": "3.14.1",
-    "@stigmer/temporal-codecs": "3.14.1",
-    "@stigmer/zip-structure": "3.14.1",
+    "@stigmer/protos": "3.15.0",
+    "@stigmer/temporal-codecs": "3.15.0",
+    "@stigmer/zip-structure": "3.15.0",
     "@temporalio/activity": "1.16.2",
     "@temporalio/client": "1.16.2",
     "@temporalio/common": "1.16.2",

package/src/boot/__tests__/auth-enabled-composition.test.ts

@@ -14,7 +14,14 @@
  *      owning user (the runner's credential lane, ruling Q3 — the runner
  *      presents exactly such a key via STIGMER_TOKEN);
  *   4. deleting the key revokes it on the very next request;
- *   5. garbage credentials keep the Q6 unclaimed-token rejection.
+ *   5. garbage credentials keep the Q6 unclaimed-token rejection;
+ *   6. (20260911.11) the identity-account arms: an unprovisioned subject is
+ *      idp-shaped (whoAmI NOT_FOUND, writes stamped with the raw sub);
+ *      provisionMyAccount creates the account under the derived id with
+ *      the issuer's userinfo profile; from then on the verifier resolves
+ *      the subject to the account id and API keys minted before OR after
+ *      provisioning answer whoAmI with the owner's account; no operator
+ *      account exists under the posture.
  */
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -30,8 +37,12 @@ import { SignJWT, exportJWK, generateKeyPair } from "jose";
 import type { GenerateKeyPairResult } from "jose";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ApiKeyCommandController } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/command_pb";
 import { ApiKeyQueryController } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/query_pb";
+import { IdentityAccountCommandController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/command_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
+import { IdentityAccountQueryController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/query_pb";
 import { PlatformQueryController } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
 import {
   Health,
@@ -42,6 +53,11 @@ import { loadConfig } from "../config.js";
 import { composeServer } from "../compose.js";
 import type { ComposedServer } from "../compose.js";
 import { createLogger } from "../logger.js";
+import {
+  ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE,
+  USERINFO_UNAVAILABLE_PREFIX,
+  accountIdFor,
+} from "../../domain/identityaccount/constants.js";
 import { AUTHENTICATION_TOKEN_MISSING_MESSAGE } from "../../pipeline/interceptors/auth.js";
 
 const AUDIENCE = "https://api.stigmer.test/";
@@ -50,8 +66,15 @@ let dir: string;
 let issuerServer: Server;
 let issuer: string;
 let privateKey: GenerateKeyPairResult["privateKey"];
+// A lever for the UNAVAILABLE arm: the issuer's /userinfo answers 503 for
+// this subject while set. Undefined = every subject is served.
+let userinfoRefusesSub: string | undefined;
 let server: ComposedServer;
 let port: number;
+// A key minted while its owner was still idp-shaped: its creator stamp is
+// the raw sub. The identity-account arms prove that stamp resolves to the
+// owner's account once one exists (20260911.11 A1's derived id).
+let keyMintedBeforeProvisioning: string;
 
 function bearer(token: string): Interceptor {
   return (next) => (request) => {
@@ -88,8 +111,16 @@ beforeAll(async () => {
   };
   issuerServer = createServer((req, res) => {
     if (req.url === "/.well-known/openid-configuration") {
+      // The provisioning lane reads userinfo_endpoint from here (A8) —
+      // never a guessed `<issuer>/userinfo`.
       res.setHeader("content-type", "application/json");
-      res.end(JSON.stringify({ issuer, jwks_uri: `${issuer}/jwks` }));
+      res.end(
+        JSON.stringify({
+          issuer,
+          jwks_uri: `${issuer}/jwks`,
+          userinfo_endpoint: `${issuer}/userinfo`,
+        }),
+      );
       return;
     }
     if (req.url === "/jwks") {
@@ -97,6 +128,43 @@ beforeAll(async () => {
       res.end(JSON.stringify({ keys: [jwk] }));
       return;
     }
+    if (req.url === "/userinfo") {
+      // The provisioning lane's profile source (20260911.11 A1/Q-IA-2):
+      // answers the bearer's own claims as an IdP would, given_name and
+      // family_name included — the signature was already proven upstream.
+      const header = req.headers.authorization ?? "";
+      const token = header.startsWith("Bearer ")
+        ? header.slice("Bearer ".length)
+        : "";
+      const payloadSegment = token.split(".")[1];
+      if (payloadSegment === undefined) {
+        res.statusCode = 401;
+        res.end();
+        return;
+      }
+      const claims = JSON.parse(
+        Buffer.from(payloadSegment, "base64url").toString("utf8"),
+      ) as { sub?: string; email?: string };
+      if (
+        userinfoRefusesSub !== undefined &&
+        claims.sub === userinfoRefusesSub
+      ) {
+        res.statusCode = 503;
+        res.end();
+        return;
+      }
+      res.setHeader("content-type", "application/json");
+      res.end(
+        JSON.stringify({
+          sub: claims.sub ?? "",
+          email: claims.email ?? "",
+          given_name: "Composed",
+          family_name: "User",
+          picture: `${issuer}/pictures/${encodeURIComponent(claims.sub ?? "")}`,
+        }),
+      );
+      return;
+    }
     res.statusCode = 404;
     res.end();
   });
@@ -221,6 +289,7 @@ describe("the full credential loop (OIDC login → API key → revocation)", ()
     expect(second.status?.audit?.specAudit?.createdBy?.id).toBe(
       "auth0|loop-user",
     );
+    keyMintedBeforeProvisioning = second.spec?.keyHash ?? "";
   });
 
   it("deleting the key revokes it on the very next request", async () => {
@@ -243,3 +312,158 @@ describe("the full credential loop (OIDC login → API key → revocation)", ()
     expect(ConnectError.from(error).rawMessage).toBe("invalid token");
   });
 });
+
+describe("identity accounts under the OIDC posture (20260911.11; Q-IA-2, A1, A2)", () => {
+  const SUB = "auth0|loop-user";
+  const accountId = accountIdFor(SUB);
+
+  it("no operator account exists under an authentication posture — the boot-time ensure is trusted-local only", async () => {
+    const rows = await server.store.listResources(
+      ApiResourceKind.identity_account,
+    );
+    expect(rows).toHaveLength(0);
+  });
+
+  it("whoAmI for an unprovisioned subject is NOT_FOUND with the cloud's copy, and its writes stay stamped with the raw sub", async () => {
+    const token = await mintOidcToken(SUB, "loop@example.com");
+    const query = createClient(
+      IdentityAccountQueryController,
+      transportWith(token),
+    );
+    const error = await query.whoAmI({}).catch((e: unknown) => e);
+    expect(ConnectError.from(error).code).toBe(Code.NotFound);
+    expect(ConnectError.from(error).rawMessage).toBe(
+      ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE,
+    );
+  });
+
+  it("provisionMyAccount creates the account under the derived id with the userinfo profile", async () => {
+    const token = await mintOidcToken(SUB, "loop@example.com");
+    const command = createClient(
+      IdentityAccountCommandController,
+      transportWith(token),
+    );
+    const account = await command.provisionMyAccount({});
+    expect(account.metadata?.id).toBe(accountId);
+    expect(account.metadata?.name).toBe("loop@example.com");
+    expect(account.spec).toMatchObject({
+      idpId: SUB,
+      email: "loop@example.com",
+      firstName: "Composed",
+      lastName: "User",
+      provisioningMode: IdentityAccountProvisioningMode.direct,
+      isMachineAccount: false,
+    });
+    // The account is created BY the subject it is for: the stamp is the
+    // sub the verifier admitted idp-shaped — no account existed yet.
+    expect(account.status?.audit?.specAudit?.createdBy?.id).toBe(SUB);
+  });
+
+  it("from the next request on, the verifier resolves the subject to the account id — whoAmI answers and writes are stamped with it", async () => {
+    const token = await mintOidcToken(SUB, "loop@example.com");
+    const query = createClient(
+      IdentityAccountQueryController,
+      transportWith(token),
+    );
+    const me = await query.whoAmI({});
+    expect(me.metadata?.id).toBe(accountId);
+
+    const keys = createClient(ApiKeyCommandController, transportWith(token));
+    const key = await keys.create({
+      apiVersion: "iam.stigmer.ai/v1",
+      kind: "ApiKey",
+      metadata: { name: "minted after provisioning", org: "local" },
+      spec: {},
+    });
+    expect(key.status?.audit?.specAudit?.createdBy?.id).toBe(accountId);
+    expect(key.status?.audit?.specAudit?.createdBy?.email).toBe(
+      "loop@example.com",
+    );
+
+    // Over that key, whoAmI is the owner's account — the key is the user.
+    const overKey = createClient(
+      IdentityAccountQueryController,
+      transportWith(key.spec?.keyHash ?? ""),
+    );
+    expect((await overKey.whoAmI({})).metadata?.id).toBe(accountId);
+  });
+
+  it("a key minted BEFORE provisioning still resolves to the owner's account — the raw-sub stamp derives to the same id", async () => {
+    const overLegacyKey = createClient(
+      IdentityAccountQueryController,
+      transportWith(keyMintedBeforeProvisioning),
+    );
+    expect((await overLegacyKey.whoAmI({})).metadata?.id).toBe(accountId);
+  });
+
+  it("provisionMyAccount is idempotent for a provisioned subject", async () => {
+    const token = await mintOidcToken(SUB, "loop@example.com");
+    const command = createClient(
+      IdentityAccountCommandController,
+      transportWith(token),
+    );
+    const before = (
+      await server.store.listResources(ApiResourceKind.identity_account)
+    ).length;
+    const again = await command.provisionMyAccount({});
+    expect(again.metadata?.id).toBe(accountId);
+    expect(
+      (await server.store.listResources(ApiResourceKind.identity_account))
+        .length,
+    ).toBe(before);
+  });
+
+  it("two concurrent first logins for one subject end in exactly one account", async () => {
+    const token = await mintOidcToken("auth0|racer", "racer@example.com");
+    const command = createClient(
+      IdentityAccountCommandController,
+      transportWith(token),
+    );
+    const before = (
+      await server.store.listResources(ApiResourceKind.identity_account)
+    ).length;
+    const [a, b] = await Promise.all([
+      command.provisionMyAccount({}),
+      command.provisionMyAccount({}),
+    ]);
+    expect(a.metadata?.id).toBe(accountIdFor("auth0|racer"));
+    expect(b.metadata?.id).toBe(a.metadata?.id);
+    expect(
+      (await server.store.listResources(ApiResourceKind.identity_account))
+        .length,
+    ).toBe(before + 1);
+  });
+
+  it("a userinfo failure is UNAVAILABLE with the cloud's copy, and no account is created", async () => {
+    // A real token (the verifier must admit it) whose subject the issuer's
+    // /userinfo refuses while the lever is set.
+    const token = await mintOidcToken(
+      "auth0|userinfo-down",
+      "down@example.com",
+    );
+    userinfoRefusesSub = "auth0|userinfo-down";
+    try {
+      const command = createClient(
+        IdentityAccountCommandController,
+        transportWith(token),
+      );
+      const error = await command
+        .provisionMyAccount({})
+        .catch((e: unknown) => e);
+      expect(ConnectError.from(error).code).toBe(Code.Unavailable);
+      expect(
+        ConnectError.from(error).rawMessage.startsWith(
+          USERINFO_UNAVAILABLE_PREFIX,
+        ),
+      ).toBe(true);
+      const query = createClient(
+        IdentityAccountQueryController,
+        transportWith(token),
+      );
+      const missing = await query.whoAmI({}).catch((e: unknown) => e);
+      expect(ConnectError.from(missing).code).toBe(Code.NotFound);
+    } finally {
+      userinfoRefusesSub = undefined;
+    }
+  });
+});