@stigmer/server 3.14.1 → 3.15.1

package/dist/domain/identityaccount/constants.js

@@ -0,0 +1,153 @@
+/**
+ * Identity-account domain constants (20260911.11, T01_1_review.md A1, A2,
+ * A7): the derived account id, the one function that turns a caller into
+ * an issuer subject, and the byte-pinned wire copy.
+ *
+ * The derived id (A1). A direct account's id is a pure function of its
+ * subject: `ida_` + the top 130 bits of sha256(idp_id) as 26 lowercase
+ * Crockford-base32 characters. The shape is indistinguishable from a
+ * minted `{prefix}_{ulid}`, so nothing downstream learns a second id
+ * grammar, and the PRIMARY KEY becomes the one home of "one account per
+ * subject": the generic store has no secondary uniqueness and its save is
+ * an upsert (`store/sqlite/store.ts`), so a lookup-then-insert on a scan
+ * could never close the first-login race. Two replicas deriving the same
+ * id converge by primary key with no migration and no second copy of any
+ * field. The hash is one-way, so an issuer subject never leaks into the
+ * `created_by.id` stamps that ride on every resource. The golden vectors in
+ * __tests__/constants.test.ts are wire-adjacent contract: a change here
+ * re-addresses every direct account open source ever created.
+ *
+ * `idpIdOf` (A2) is the ONE place a CallerIdentity becomes a subject. An
+ * issuer-vouched token is read for its `sub` (already verified at
+ * position 1, so this is a read of trusted state, never a verification);
+ * a caller with no issuer and no token is the trusted-local operator,
+ * whose subject is `local|<identityId>`. It deliberately knows nothing
+ * about API keys: every verifier resolves its stamp to the account when
+ * one exists (A6), so a credential's shape is the verifier's business.
+ *
+ * The copy moved from the cloud's iam/account/handlers.ts as-is: the CLI,
+ * console and SDK show these sentences verbatim, so they are contract.
+ */
+import { createHash } from "node:crypto";
+/** The kind's id prefix (kind_meta `identity_account.id_prefix`). */
+export const ACCOUNT_ID_PREFIX = "ida";
+/** Crockford base32, lowercased — the alphabet every minted ULID id uses. */
+const CROCKFORD_ALPHABET = "0123456789abcdefghjkmnpqrstvwxyz";
+const DERIVED_ID_CHARS = 26;
+const DERIVED_ID_BITS = BigInt(DERIVED_ID_CHARS * 5);
+const SHA256_BITS = 256n;
+/**
+ * The derived account id of a direct account with subject `idpId`. Pure,
+ * total over non-empty input; an empty subject has no principal and so
+ * no address — refused, never hashed.
+ */
+export function accountIdFor(idpId) {
+    if (idpId === "") {
+        throw new Error("idp_id must not be empty");
+    }
+    const digest = createHash("sha256").update(idpId, "utf8").digest();
+    let bits = 0n;
+    for (const byte of digest) {
+        bits = (bits << 8n) | BigInt(byte);
+    }
+    let top = bits >> (SHA256_BITS - DERIVED_ID_BITS);
+    let encoded = "";
+    for (let i = 0; i < DERIVED_ID_CHARS; i++) {
+        encoded = CROCKFORD_ALPHABET[Number(top & 31n)] + encoded;
+        top >>= 5n;
+    }
+    return `${ACCOUNT_ID_PREFIX}_${encoded}`;
+}
+/**
+ * The subject namespace of the trusted-local posture. An OIDC subject is
+ * `<connection>|<id>` by Auth0 convention; `local|` claims the same shape
+ * for the one principal no issuer vouches for, so the derived ids of a
+ * local operator and an OIDC user can never collide by construction.
+ */
+export const LOCAL_IDP_ID_PREFIX = "local|";
+/** `local|<identityId>` — the trusted-local operator's subject. */
+export function localIdpIdFor(identityId) {
+    return `${LOCAL_IDP_ID_PREFIX}${identityId}`;
+}
+/**
+ * The issuer subject a caller stands for:
+ *   - a caller with no issuer and no token is the trusted-local operator
+ *     (`local|<identityId>`; identityId is the operator's email or
+ *     "system" — pipeline/interceptors/auth.ts trustedLocalIdentity);
+ *   - a token-bearing caller is its JWT `sub`, read from the raw token
+ *     the verifier already proved; `""` when the token carries no
+ *     readable subject (an opaque credential under an issuer), which
+ *     the provisionMyAccount handler maps to the UNAUTHENTICATED arm.
+ */
+export function idpIdOf(caller) {
+    if (caller.issuer === "" && caller.rawToken === "") {
+        return localIdpIdFor(caller.identityId);
+    }
+    return jwtSubjectOf(caller.rawToken);
+}
+/**
+ * The cloud's jwtSubjectOf verbatim: the payload segment decoded, `sub`
+ * when it is a string. Not a verification — the chain's position 1 did
+ * that; this only reads a claim from trusted state.
+ */
+function jwtSubjectOf(rawToken) {
+    const segments = rawToken.split(".");
+    if (segments.length !== 3) {
+        return "";
+    }
+    try {
+        const payload = JSON.parse(Buffer.from(segments[1] ?? "", "base64url").toString("utf8"));
+        return typeof payload.sub === "string" ? payload.sub : "";
+    }
+    catch {
+        return "";
+    }
+}
+/**
+ * Auth0's client-credentials subject shape (`<client_id>@clients`) — the
+ * cloud's IsMachineAccountVerifier rule, the one input to
+ * `is_machine_account`.
+ */
+export const MACHINE_ACCOUNT_SUFFIX = "@clients";
+export function isMachineSubject(idpId) {
+    return idpId.endsWith(MACHINE_ACCOUNT_SUFFIX);
+}
+// ---------------------------------------------------------------------------
+// Byte-pinned copy (the cloud handlers' sentences, moved as-is).
+// ---------------------------------------------------------------------------
+/** whoAmI for a caller with no account (NOT_FOUND). */
+export const ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE = "Identity account not found for the authenticated user";
+/** provisionMyAccount for a caller whose credential names no subject (UNAUTHENTICATED). */
+export const NO_IDP_ID_MESSAGE = "Cannot provision account: no IDP ID in authentication context";
+/** provisionMyAccount when the issuer's userinfo cannot be read (UNAVAILABLE); the cause follows. */
+export const USERINFO_UNAVAILABLE_PREFIX = "Failed to fetch user profile from identity provider: ";
+/** get / getByEmail / getByIdpId / getActorInfo / update / delete on a missing account (NOT_FOUND). */
+export function accountNotFoundMessage(handle) {
+    return `Identity account not found: ${handle}`;
+}
+/**
+ * The cloud#393 gate's refusal (PERMISSION_DENIED): the create RPC admits
+ * the platform's own pipelines only — machine-class callers and
+ * server-composed (in-process) requests (T01_1_review.md A7).
+ */
+export const CREATE_IS_INTERNAL_MESSAGE = "this RPC is internal to the platform";
+/**
+ * The reason a composition with no IdentityFederation unit refuses the four
+ * federation RPCs (UNIMPLEMENTED). The sentence a person can act on; the
+ * method-naming prefix is the organization directory's absent-method shape
+ * so clients matching on "is not implemented" keep working.
+ */
+export const FEDERATION_UNIMPLEMENTED_REASON = "federated identity accounts are served by the Enterprise and Cloud editions";
+export function federationUnimplementedMessage(method) {
+    return `${method} is not implemented: ${FEDERATION_UNIMPLEMENTED_REASON}`;
+}
+/**
+ * update with a changed spec.idp_id (FAILED_PRECONDITION; the schedule
+ * domain's immutability shape, T01_1_review.md A1). The subject IS the
+ * identity; a client that sends a different one has a bug it should hear
+ * about, never a silent preserve.
+ */
+export function idpIdImmutableMessage(existingIdpId) {
+    return `spec.idp_id is immutable (account subject is '${existingIdpId}') — create a new account for a different subject`;
+}
+//# sourceMappingURL=constants.js.map

package/dist/domain/identityaccount/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEvC,6EAA6E;AAC7E,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;AAC9D,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,eAAe,GAAG,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC;AACrD,MAAM,WAAW,GAAG,IAAI,CAAC;AAEzB;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnE,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,WAAW,GAAG,eAAe,CAAC,CAAC;IAClD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,gBAAgB,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC;QAC1D,GAAG,KAAK,EAAE,CAAC;IACb,CAAC;IACD,OAAO,GAAG,iBAAiB,IAAI,OAAO,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAE5C,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,OAAO,GAAG,mBAAmB,GAAG,UAAU,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,OAAO,CAAC,MAAsB;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACnD,OAAO,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACxC,CAAC;QACvB,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAEjD,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;AAChD,CAAC;AAED,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,uDAAuD;AACvD,MAAM,CAAC,MAAM,oCAAoC,GAC/C,uDAAuD,CAAC;AAE1D,2FAA2F;AAC3F,MAAM,CAAC,MAAM,iBAAiB,GAC5B,+DAA+D,CAAC;AAElE,qGAAqG;AACrG,MAAM,CAAC,MAAM,2BAA2B,GACtC,uDAAuD,CAAC;AAE1D,uGAAuG;AACvG,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,OAAO,+BAA+B,MAAM,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,sCAAsC,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAC1C,6EAA6E,CAAC;AAEhF,MAAM,UAAU,8BAA8B,CAAC,MAAc;IAC3D,OAAO,GAAG,MAAM,wBAAwB,+BAA+B,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,aAAqB;IACzD,OAAO,iDAAiD,aAAa,mDAAmD,CAAC;AAC3H,CAAC"}

package/dist/domain/identityaccount/controller.d.ts

@@ -0,0 +1,34 @@
+import type { ConnectRouter } from "@connectrpc/connect";
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { Logger } from "../../boot/logger.js";
+import type { Authorizer } from "../../extensions/authorizer.js";
+import type { ResolvedGateSteps } from "../../extensions/gate-slots.js";
+import type { IdentityFederation } from "../../extensions/identity-federation.js";
+import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
+import type { CreateAccount, DirectAccountProvisioner } from "./provisioning.js";
+import type { IdentityAccountStore } from "./store.js";
+/** What the create path needs — the subset every caller of it composes. */
+export interface CreateAccountPathDeps {
+    readonly accounts: IdentityAccountStore;
+    readonly logger: Logger;
+    /** The composed authorization seam — the Authorize step at position 1 of every chain calls it (DD-007 §3). */
+    readonly authorizer: Authorizer;
+    /** The composed tuple-lifecycle driver — undefined = the shared steps no-op. */
+    readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
+}
+export interface IdentityAccountControllerDeps extends CreateAccountPathDeps {
+    readonly provisioner: DirectAccountProvisioner;
+    /** The composed federation capability — undefined = the four RPCs refuse UNIMPLEMENTED. */
+    readonly federation: IdentityFederation | undefined;
+    /** The composed slot registrations — this domain's provision slot (Q-IA-9, A10). */
+    readonly gateSteps: ResolvedGateSteps;
+}
+/** Registers both identityaccount services on the router (routes stage). */
+export declare function registerIdentityAccountServices(router: ConnectRouter, deps: IdentityAccountControllerDeps): void;
+/**
+ * The create path as its in-process callers see it (provisioning.ts
+ * `CreateAccount`): the input becomes the resource envelope the chain
+ * expects, tagged with the kind this controller serves.
+ */
+export declare function newCreateAccountPath(deps: CreateAccountPathDeps, kind: ApiResourceKind): CreateAccount;
+//# sourceMappingURL=controller.d.ts.map

package/dist/domain/identityaccount/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/controller.ts"],"names":[],"mappings":"AAgDA,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAKzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAc3H,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAExE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AA8BjG,OAAO,KAAK,EACV,aAAa,EAEb,wBAAwB,EACzB,MAAM,mBAAmB,CAAC;AAiB3B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8GAA8G;IAC9G,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,gFAAgF;IAChF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;CAC7E;AAED,MAAM,WAAW,6BAA8B,SAAQ,qBAAqB;IAC1E,QAAQ,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAC/C,2FAA2F;IAC3F,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACpD,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;CACvC;AAED,4EAA4E;AAC5E,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,6BAA6B,GAClC,IAAI,CAkDN;AA0DD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,qBAAqB,EAC3B,IAAI,EAAE,eAAe,GACpB,aAAa,CAaf"}

package/dist/domain/identityaccount/controller.js

@@ -0,0 +1,342 @@
+/**
+ * IdentityAccount controller (20260911.11) — the identity-account domain
+ * served ONCE by @stigmer/server in every edition (the editions program's
+ * tier truth: `identity_account` is open-source tier). The behavioural
+ * reference is the cloud's iam/account/handlers.ts, whose twelve direct
+ * handlers retire against this module; the byte-pinned copy moved with it
+ * (constants.ts). The cloud keeps only what differs per edition — its row
+ * store as `drivers.identityAccountStore`, the federated arms as
+ * `drivers.identityFederation`, the personal organization as a gate on
+ * `identity-account-provision:post-persist`.
+ *
+ * Persistence is the IdentityAccountStore PORT, never the generic Store
+ * (steps.ts explains); the storage-free shared steps are reused as they
+ * are, so every chain reads onto the inventory unchanged.
+ *
+ * The ONE create path (`newCreateAccountPath`): the create RPC, the
+ * provisioner and the trusted-local operator ensure all run the same
+ * chain — DeriveAccountId, CheckDuplicate by subject, BuildNewState,
+ * AssignBackendFields, Persist through the port, CreateAuthorizationTuples
+ * (the lifecycle driver's SELF arm gives the account its self-owner grant
+ * in the cloud) — so no account exists that skipped a step. The create
+ * RPC is the cloud#393 gate in front of that path (T01_1_review.md A7):
+ * machine / internal / in-process callers only, in every edition. The
+ * gate is the RPC's admission rule and deliberately NOT a step in the
+ * path, because the provisioner runs the path as the idp-shaped wire user
+ * (the account is created by the subject it is for) and the operator
+ * ensure runs it as the trusted-local user.
+ *
+ * Direct handlers (no pipeline): whoAmI (the cloud's two primary-key
+ * reads through idpIdOf; NOT_FOUND for the unprovisioned), getByEmail and
+ * getByIdpId (lookup FIRST, then authorizeDirect on the FOUND id — the
+ * cloud's order; the annotation's `field_path = "value"` would otherwise
+ * hand the Authorizer an email as a resource id), getActorInfo, and
+ * provisionMyAccount (the provisioner, then the composed post-persist
+ * gates; UNAUTHENTICATED with the cloud's copy for a credential naming no
+ * subject; UNAVAILABLE with the cloud's copy when userinfo fails).
+ *
+ * The four federation RPCs refuse UNIMPLEMENTED with the edition reason
+ * when no unit composes the capability (never INTERNAL; the organization
+ * directory's absent-method shape); present, the controller owns the
+ * shared precondition (authorize on the org, ref-with-slug, org match,
+ * IdP exists) and dispatches to the arm with the resolved ref.
+ *
+ * Proven by __tests__/identityaccount.test.ts (the composed trusted-local
+ * server), boot/__tests__/auth-enabled-composition.test.ts (the OIDC
+ * posture end to end) and identityaccount.conformance.test.ts.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { create } from "@bufbuild/protobuf";
+import { ApiResourceAuditActorSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/status_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountCommandController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/command_pb";
+import { IdentityAccountQueryController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/query_pb";
+import { stepsForSlot } from "../../extensions/gate-slots.js";
+import { internalError, invalidArgumentError } from "../../pipeline/errors.js";
+import { apiResourceKindKey } from "../../pipeline/interceptors/apiresource.js";
+import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
+import { newPipeline } from "../../pipeline/pipeline.js";
+import { RequestContext } from "../../pipeline/request-context.js";
+import { newCleanupIamPoliciesStep, newCreateAuthorizationTuplesStep, } from "../../pipeline/steps/authorization-tuples.js";
+import { authorizeDirect, newAuthorizeStep, } from "../../pipeline/steps/authorize.js";
+import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
+import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
+import { newExtractResourceIdStep } from "../../pipeline/steps/delete.js";
+import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
+import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
+import { TARGET_RESOURCE_KEY } from "../../pipeline/steps/load-target.js";
+import { newResolveSlugStep } from "../../pipeline/steps/slug.js";
+import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
+import { ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE, CREATE_IS_INTERNAL_MESSAGE, NO_IDP_ID_MESSAGE, USERINFO_UNAVAILABLE_PREFIX, federationUnimplementedMessage, idpIdOf, } from "./constants.js";
+import { UserInfoFetchError } from "./provisioning.js";
+import { accountNotFoundError, newAssignBackendFieldsStep, newCheckDuplicateStep, newDefaultAccountNameStep, newDeleteAccountStep, newDeriveAccountIdStep, newGuardImmutableSubjectStep, newLoadExistingAccountForDeleteStep, newLoadExistingAccountStep, newLoadTargetAccountStep, newPersistNewAccountStep, newPersistUpdatedAccountStep, newPreserveBackendFieldsStep, } from "./steps.js";
+/** Registers both identityaccount services on the router (routes stage). */
+export function registerIdentityAccountServices(router, deps) {
+    router.service(IdentityAccountCommandController, {
+        create: (account, ctx) => createRpc(deps, account, ctx),
+        update: (account, ctx) => update(deps, account, ctx),
+        delete: (id, ctx) => deleteAccount(deps, id, ctx),
+        createFederatedAccount: (input, ctx) => federated(deps, ctx, IdentityAccountCommandController.method.createFederatedAccount, input, (federation, ref, caller) => federation.createFederatedAccount(input, ref, caller)),
+        updateFederatedAccount: (input, ctx) => federated(deps, ctx, IdentityAccountCommandController.method.updateFederatedAccount, input, (federation, ref, caller) => federation.updateFederatedAccount(input, ref, caller)),
+        deprovisionFederatedAccount: (input, ctx) => federated(deps, ctx, IdentityAccountCommandController.method.deprovisionFederatedAccount, input, (federation, ref, caller) => federation.deprovisionFederatedAccount(input, ref, caller)),
+        provisionMyAccount: (empty, ctx) => provisionMyAccount(deps, empty, ctx),
+    });
+    router.service(IdentityAccountQueryController, {
+        get: (id, ctx) => get(deps, id, ctx),
+        whoAmI: (empty, ctx) => whoAmI(deps, empty, ctx),
+        getByEmail: (email, ctx) => getByEmail(deps, email, ctx),
+        getByIdpId: (idpId, ctx) => getByIdpId(deps, idpId, ctx),
+        getByExternalSub: (lookup, ctx) => federated(deps, ctx, IdentityAccountQueryController.method.getByExternalSub, lookup, (federation, ref, caller) => federation.getByExternalSub(lookup, ref, caller)),
+        getActorInfo: (id, ctx) => getActorInfo(deps, id, ctx),
+    });
+}
+function kindOf(ctx) {
+    return ctx.values.get(apiResourceKindKey);
+}
+// ---------------------------------------------------------------------------
+// The one create path
+// ---------------------------------------------------------------------------
+/**
+ * Runs the create chain AS `caller` and answers the persisted account.
+ * `kind` is the service's kind tag for wire calls; the path callers with
+ * no HandlerContext (the provisioner, the operator ensure) pass the kind
+ * the controller serves.
+ */
+async function runCreateChain(deps, account, caller, kind) {
+    const reqCtx = new RequestContext(IdentityAccountSchema, account, caller, kind);
+    await newPipeline("identityaccount-create", deps.logger)
+        .addStep(newAuthorizeStep(IdentityAccountCommandController.method.create, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newDefaultAccountNameStep())
+        .addStep(newResolveSlugStep())
+        .addStep(newDeriveAccountIdStep())
+        .addStep(newCheckDuplicateStep(deps.accounts))
+        .addStep(newBuildNewStateStep())
+        .addStep(newGuardReservedLabelsStep(deps.authorizer))
+        .addStep(newAssignBackendFieldsStep())
+        .addStep(newPersistNewAccountStep(deps.accounts))
+        .addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle, deps.logger))
+        .build()
+        .execute(reqCtx);
+    return reqCtx.newState;
+}
+/**
+ * The create path as its in-process callers see it (provisioning.ts
+ * `CreateAccount`): the input becomes the resource envelope the chain
+ * expects, tagged with the kind this controller serves.
+ */
+export function newCreateAccountPath(deps, kind) {
+    return (input, caller) => runCreateChain(deps, create(IdentityAccountSchema, {
+        apiVersion: "iam.stigmer.ai/v1",
+        kind: "IdentityAccount",
+        metadata: { name: input.name },
+        spec: input.spec,
+    }), caller, kind);
+}
+/**
+ * The create RPC: the cloud#393 gate, then the path AS the caller. FGA
+ * cannot gate this RPC (the account being created IS the principal — the
+ * bootstrap problem), so the gate is caller class: the platform's own
+ * pipelines only.
+ */
+function createRpc(deps, account, ctx) {
+    const caller = callerIdentityOf(ctx);
+    guardInternalRpc(caller);
+    return runCreateChain(deps, account, caller, kindOf(ctx));
+}
+function guardInternalRpc(caller) {
+    if (caller.callerClass === "machine" ||
+        caller.callerClass === "internal" ||
+        caller.origin === "in-process") {
+        return;
+    }
+    throw new ConnectError(CREATE_IS_INTERNAL_MESSAGE, Code.PermissionDenied);
+}
+// ---------------------------------------------------------------------------
+// Update / Delete
+// ---------------------------------------------------------------------------
+/**
+ * Update: full-envelope replace with the cloud's writable surface (A9) —
+ * BuildUpdateState preserves id/slug/org/visibility, GuardImmutableSubject
+ * refuses a changed subject, AssignBackendFields preserves the rest of
+ * what the backend owns from the existing row.
+ */
+async function update(deps, account, ctx) {
+    const reqCtx = new RequestContext(IdentityAccountSchema, account, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("identityaccount-update", deps.logger)
+        .addStep(newAuthorizeStep(IdentityAccountCommandController.method.update, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadExistingAccountStep(deps.accounts))
+        .addStep(newGuardImmutableSubjectStep())
+        .addStep(newBuildUpdateStateStep())
+        .addStep(newPreserveBackendFieldsStep())
+        .addStep(newPersistUpdatedAccountStep(deps.accounts))
+        .build()
+        .execute(reqCtx);
+    return reqCtx.newState;
+}
+/** Delete — answers the pre-delete account (the canonical delete chain over the port). */
+async function deleteAccount(deps, id, ctx) {
+    const reqCtx = new RequestContext(IdentityAccountCommandController.method.delete.input, id, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("identityaccount-delete", deps.logger)
+        .addStep(newAuthorizeStep(IdentityAccountCommandController.method.delete, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newExtractResourceIdStep())
+        .addStep(newLoadExistingAccountForDeleteStep(deps.accounts))
+        .addStep(newDeleteAccountStep(deps.accounts))
+        .addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle, deps.logger))
+        .build()
+        .execute(reqCtx);
+    const deleted = reqCtx.get(EXISTING_RESOURCE_KEY);
+    if (deleted === undefined) {
+        throw internalError(new Error("delete pipeline completed without a loaded resource"), "deleted identity account not found in context");
+    }
+    return deleted;
+}
+// ---------------------------------------------------------------------------
+// Reads
+// ---------------------------------------------------------------------------
+/** Get — LoadTarget by id through the port; the domain's NOT_FOUND copy. */
+async function get(deps, id, ctx) {
+    return loadTarget(deps, IdentityAccountQueryController.method.get, id, ctx);
+}
+/** getActorInfo — the contract-shaped actor: id, avatar, "First Last", email. */
+async function getActorInfo(deps, id, ctx) {
+    const account = await loadTarget(deps, IdentityAccountQueryController.method.getActorInfo, id, ctx);
+    const firstName = account.spec?.firstName ?? "";
+    const lastName = account.spec?.lastName ?? "";
+    return create(ApiResourceAuditActorSchema, {
+        id: account.metadata?.id ?? "",
+        avatar: account.spec?.pictureUrl ?? "",
+        displayName: `${firstName} ${lastName}`.trim(),
+        email: account.spec?.email ?? "",
+    });
+}
+async function loadTarget(deps, method, id, ctx) {
+    const reqCtx = new RequestContext(method.input, id, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline(`identityaccount-${method.localName}`, deps.logger)
+        .addStep(newAuthorizeStep(method, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadTargetAccountStep(deps.accounts))
+        .build()
+        .execute(reqCtx);
+    return reqCtx.get(TARGET_RESOURCE_KEY);
+}
+/**
+ * whoAmI — the cloud's lookup verbatim: by the resolved identity, then by
+ * the derived id of the caller's subject for a caller whose identity is
+ * still idp-shaped (an unprovisioned OIDC subject), then NOT_FOUND with
+ * the cloud's copy. Two primary-key reads at most; no scan.
+ */
+async function whoAmI(deps, _empty, ctx) {
+    const caller = callerIdentityOf(ctx);
+    let account = await read(() => deps.accounts.findById(caller.identityId), "failed to load identity account");
+    if (account === undefined) {
+        account = await read(() => deps.accounts.findDirectByIdpId(idpIdOf(caller)), "failed to load identity account");
+    }
+    if (account === undefined) {
+        throw new ConnectError(ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE, Code.NotFound);
+    }
+    return account;
+}
+/** getByEmail — direct accounts only; lookup first, authorize on the FOUND id. */
+async function getByEmail(deps, email, ctx) {
+    return lookupThenAuthorize(deps, IdentityAccountQueryController.method.getByEmail, email, ctx, () => deps.accounts.findDirectByEmail(email.value), email.value);
+}
+/** getByIdpId — any provisioning mode; lookup first, authorize on the FOUND id. */
+async function getByIdpId(deps, idpId, ctx) {
+    return lookupThenAuthorize(deps, IdentityAccountQueryController.method.getByIdpId, idpId, ctx, () => deps.accounts.findByIdpId(idpId.value), idpId.value);
+}
+async function lookupThenAuthorize(deps, method, input, ctx, lookup, handle) {
+    const account = await read(lookup, "failed to look up identity account");
+    if (account === undefined) {
+        throw accountNotFoundError(handle);
+    }
+    await authorizeDirect(method, deps.authorizer, callerIdentityOf(ctx), input, {
+        resourceId: account.metadata?.id ?? "",
+    });
+    return account;
+}
+// ---------------------------------------------------------------------------
+// Provisioning
+// ---------------------------------------------------------------------------
+/**
+ * provisionMyAccount — the subject from the caller's credential, the
+ * provisioner's flow, then the composed post-persist gates (the cloud's
+ * personal organization) with the caller RE-STAMPED as the account: the
+ * position-1 identity was idp-shaped because no row existed when the
+ * verifier ran, and a gate that attributes ownership must name the
+ * account, never a principal no later request carries. The gates run on
+ * EVERY call, the idempotent early return included — the cloud's step
+ * backfills accounts that predate personal organizations there, which is
+ * why Q-IA-9 chose a slot over onResourceCreated. Non-transactional in
+ * the `org-create:post-persist` sense: a gate failure fails the request,
+ * the row survives, the next call heals it.
+ */
+async function provisionMyAccount(deps, _empty, ctx) {
+    const caller = callerIdentityOf(ctx);
+    const idpId = idpIdOf(caller);
+    if (idpId === "") {
+        throw new ConnectError(NO_IDP_ID_MESSAGE, Code.Unauthenticated);
+    }
+    let account;
+    try {
+        account = await deps.provisioner.provisionDirectAccount(idpId, caller);
+    }
+    catch (error) {
+        if (error instanceof UserInfoFetchError) {
+            throw new ConnectError(`${USERINFO_UNAVAILABLE_PREFIX}${error.message}`, Code.Unavailable);
+        }
+        throw error;
+    }
+    // The ratified provision slot (Q-IA-9; the gate-slots.ts header carries
+    // its semantics). Empty in OSS — no pipeline is built for zero steps.
+    const gates = stepsForSlot(deps.gateSteps, "identity-account-provision:post-persist");
+    if (gates.length > 0) {
+        const asAccount = {
+            ...caller,
+            identityId: account.metadata?.id ?? "",
+        };
+        const reqCtx = new RequestContext(IdentityAccountSchema, account, asAccount, kindOf(ctx));
+        const pipeline = newPipeline("identityaccount-provision-post-persist", deps.logger);
+        for (const step of gates) {
+            pipeline.addStep(step);
+        }
+        await pipeline.build().execute(reqCtx);
+    }
+    return account;
+}
+async function federated(deps, ctx, method, input, arm) {
+    const federation = deps.federation;
+    if (federation === undefined) {
+        throw new ConnectError(federationUnimplementedMessage(`${method.parent.typeName}.${method.localName}`), Code.Unimplemented);
+    }
+    const caller = callerIdentityOf(ctx);
+    const org = input.org;
+    const ref = input.identityProviderRef;
+    if (ref === undefined || ref.slug === "") {
+        throw invalidArgumentError("identity_provider_ref with a valid slug is required");
+    }
+    if (ref.org !== "" && ref.org !== org) {
+        throw invalidArgumentError(`identity_provider_ref.org '${ref.org}' does not match input org '${org}'`);
+    }
+    // The annotation's target is the org (`field_path = "org"`); resolved
+    // from the input exactly as the pipeline step would.
+    await authorizeDirect(method, deps.authorizer, caller, input);
+    const refOrg = ref.org !== "" ? ref.org : org;
+    if (!(await federation.providerExists(refOrg, ref.slug))) {
+        throw new ConnectError(`IdentityProvider '${refOrg}/${ref.slug}' not found`, Code.NotFound);
+    }
+    ref.org = refOrg;
+    return arm(federation, ref, caller);
+}
+/** A direct handler's store read: a fault is INTERNAL with a static message, never "not found". */
+async function read(operation, message) {
+    try {
+        return await operation();
+    }
+    catch (error) {
+        throw internalError(error, message);
+    }
+}
+//# sourceMappingURL=controller.js.map

package/dist/domain/identityaccount/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAK5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,0DAA0D,CAAC;AAGvG,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AACjG,OAAO,EAAE,gCAAgC,EAAE,MAAM,8DAA8D,CAAC;AAMhH,OAAO,EAAE,8BAA8B,EAAE,MAAM,4DAA4D,CAAC;AAI5G,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAK9D,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,eAAe,EACf,gBAAgB,GACjB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EACL,oCAAoC,EACpC,0BAA0B,EAC1B,iBAAiB,EACjB,2BAA2B,EAC3B,8BAA8B,EAC9B,OAAO,GACR,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,sBAAsB,EACtB,4BAA4B,EAC5B,mCAAmC,EACnC,0BAA0B,EAC1B,wBAAwB,EACxB,wBAAwB,EACxB,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,YAAY,CAAC;AAqBpB,4EAA4E;AAC5E,MAAM,UAAU,+BAA+B,CAC7C,MAAqB,EACrB,IAAmC;IAEnC,MAAM,CAAC,OAAO,CAAC,gCAAgC,EAAE;QAC/C,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;QACvD,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;QACpD,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACjD,sBAAsB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACrC,SAAS,CACP,IAAI,EACJ,GAAG,EACH,gCAAgC,CAAC,MAAM,CAAC,sBAAsB,EAC9D,KAAK,EACL,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC1B,UAAU,CAAC,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CACxD;QACH,sBAAsB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACrC,SAAS,CACP,IAAI,EACJ,GAAG,EACH,gCAAgC,CAAC,MAAM,CAAC,sBAAsB,EAC9D,KAAK,EACL,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC1B,UAAU,CAAC,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CACxD;QACH,2BAA2B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC1C,SAAS,CACP,IAAI,EACJ,GAAG,EACH,gCAAgC,CAAC,MAAM,CAAC,2BAA2B,EACnE,KAAK,EACL,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC1B,UAAU,CAAC,2BAA2B,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAC7D;QACH,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzE,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,8BAA8B,EAAE;QAC7C,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAChD,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACxD,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACxD,gBAAgB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAChC,SAAS,CACP,IAAI,EACJ,GAAG,EACH,8BAA8B,CAAC,MAAM,CAAC,gBAAgB,EACtD,MAAM,EACN,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC1B,UAAU,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CACnD;QACH,YAAY,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;KACvD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAC3B,IAA2B,EAC3B,OAAwB,EACxB,MAAsB,EACtB,IAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,qBAAqB,EACrB,OAAO,EACP,MAAM,EACN,IAAI,CACL,CAAC;IACF,MAAM,WAAW,CACf,wBAAwB,EACxB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,gCAAgC,CAAC,MAAM,CAAC,MAAM,EAC9C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,sBAAsB,EAAE,CAAC;SACjC,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAC7C,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,CAAC;SACrC,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAChD,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAA2B,EAC3B,IAAqB;IAErB,OAAO,CAAC,KAAyB,EAAE,MAAsB,EAAE,EAAE,CAC3D,cAAc,CACZ,IAAI,EACJ,MAAM,CAAC,qBAAqB,EAAE;QAC5B,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,EACF,MAAM,EACN,IAAI,CACL,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAChB,IAAmC,EACnC,OAAwB,EACxB,GAAmB;IAEnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAsB;IAC9C,IACE,MAAM,CAAC,WAAW,KAAK,SAAS;QAChC,MAAM,CAAC,WAAW,KAAK,UAAU;QACjC,MAAM,CAAC,MAAM,KAAK,YAAY,EAC9B,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,YAAY,CAAC,0BAA0B,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAC5E,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;GAKG;AACH,KAAK,UAAU,MAAM,CACnB,IAAmC,EACnC,OAAwB,EACxB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,qBAAqB,EACrB,OAAO,EACP,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,wBAAwB,EACxB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,gCAAgC,CAAC,MAAM,CAAC,MAAM,EAC9C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAClD,OAAO,CAAC,4BAA4B,EAAE,CAAC;SACvC,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,4BAA4B,EAAE,CAAC;SACvC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SACpD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,aAAa,CAC1B,IAAmC,EACnC,EAAqB,EACrB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,gCAAgC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EACpD,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,wBAAwB,EAAE,IAAI,CAAC,MAAM,CAAC;SACrC,OAAO,CACN,gBAAgB,CACd,gCAAgC,CAAC,MAAM,CAAC,MAAM,EAC9C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,EAAE,CAAC;SACnC,OAAO,CAAC,mCAAmC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAC3D,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAC5C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,qDAAqD,CAAC,EAChE,+CAA+C,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,OAA0B,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,4EAA4E;AAC5E,KAAK,UAAU,GAAG,CAChB,IAAmC,EACnC,EAAqB,EACrB,GAAmB;IAEnB,OAAO,UAAU,CAAC,IAAI,EAAE,8BAA8B,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,YAAY,CACzB,IAAmC,EACnC,EAAqB,EACrB,GAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,UAAU,CAC9B,IAAI,EACJ,8BAA8B,CAAC,MAAM,CAAC,YAAY,EAClD,EAAE,EACF,GAAG,CACJ,CAAC;IACF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;IAC9C,OAAO,MAAM,CAAC,2BAA2B,EAAE;QACzC,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;QAC9B,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE;QACtC,WAAW,EAAE,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC,IAAI,EAAE;QAC9C,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;KACjC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,IAAmC,EACnC,MAAkB,EAClB,EAAqB,EACrB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,MAAM,CAAC,KAAK,EACZ,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,mBAAmB,MAAM,CAAC,SAAS,EAAE,EACrC,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAChD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAoB,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,MAAM,CACnB,IAAmC,EACnC,MAAa,EACb,GAAmB;IAEnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,GAAG,MAAM,IAAI,CACtB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAC/C,iCAAiC,CAClC,CAAC;IACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,GAAG,MAAM,IAAI,CAClB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EACtD,iCAAiC,CAClC,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,YAAY,CAAC,oCAAoC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,UAAU,CACvB,IAAmC,EACnC,KAA2B,EAC3B,GAAmB;IAEnB,OAAO,mBAAmB,CACxB,IAAI,EACJ,8BAA8B,CAAC,MAAM,CAAC,UAAU,EAChD,KAAK,EACL,GAAG,EACH,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,EAClD,KAAK,CAAC,KAAK,CACZ,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,KAAK,UAAU,UAAU,CACvB,IAAmC,EACnC,KAAY,EACZ,GAAmB;IAEnB,OAAO,mBAAmB,CACxB,IAAI,EACJ,8BAA8B,CAAC,MAAM,CAAC,UAAU,EAChD,KAAK,EACL,GAAG,EACH,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAC5C,KAAK,CAAC,KAAK,CACZ,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,IAAmC,EACnC,MAAkB,EAClB,KAAmC,EACnC,GAAmB,EACnB,MAAkD,EAClD,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC;IACzE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE;QAC3E,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;KACvC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,kBAAkB,CAC/B,IAAmC,EACnC,MAAa,EACb,GAAmB;IAEnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;YACxC,MAAM,IAAI,YAAY,CACpB,GAAG,2BAA2B,GAAG,KAAK,CAAC,OAAO,EAAE,EAChD,IAAI,CAAC,WAAW,CACjB,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,KAAK,GAAG,YAAY,CACxB,IAAI,CAAC,SAAS,EACd,yCAAyC,CAC1C,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,SAAS,GAAmB;YAChC,GAAG,MAAM;YACT,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;SACvC,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,qBAAqB,EACrB,OAAO,EACP,SAAS,EACT,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;QACF,MAAM,QAAQ,GAAG,WAAW,CAC1B,wCAAwC,EACxC,IAAI,CAAC,MAAM,CACZ,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAiBD,KAAK,UAAU,SAAS,CACtB,IAAmC,EACnC,GAAmB,EACnB,MAAkB,EAClB,KAAY,EACZ,GAI6B;IAE7B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACnC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,8BAA8B,CAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAChD,EACD,IAAI,CAAC,aAAa,CACnB,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,mBAAmB,CAAC;IACtC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,oBAAoB,CACxB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACtC,MAAM,oBAAoB,CACxB,8BAA8B,GAAG,CAAC,GAAG,+BAA+B,GAAG,GAAG,CAC3E,CAAC;IACJ,CAAC;IACD,sEAAsE;IACtE,qDAAqD;IACrD,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC9C,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,YAAY,CACpB,qBAAqB,MAAM,IAAI,GAAG,CAAC,IAAI,aAAa,EACpD,IAAI,CAAC,QAAQ,CACd,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC;IACjB,OAAO,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,mGAAmG;AACnG,KAAK,UAAU,IAAI,CACjB,SAA2B,EAC3B,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}

package/dist/domain/identityaccount/operator.d.ts

@@ -0,0 +1,14 @@
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import type { CreateAccount } from "./provisioning.js";
+import type { IdentityAccountStore } from "./store.js";
+/** The operator as boot/config.ts loads it; empty email = the "system" placeholder. */
+export interface OperatorIdentity {
+    readonly email: string;
+    readonly displayName: string;
+}
+export interface OperatorAccountDeps {
+    readonly accounts: IdentityAccountStore;
+    readonly createAccount: CreateAccount;
+}
+export declare function ensureOperatorAccount(deps: OperatorAccountDeps, operator: OperatorIdentity): Promise<IdentityAccount>;
+//# sourceMappingURL=operator.d.ts.map

package/dist/domain/identityaccount/operator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/operator.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAKhG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,uFAAuF;AACvF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;CACvC;AAKD,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,mBAAmB,EACzB,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,eAAe,CAAC,CAiC1B"}