@stigmer/server 3.15.2 → 3.15.3-dev.20260914100347

package/dist/domain/identityaccount/controller.d.ts

@@ -5,7 +5,7 @@ import type { Authorizer } from "../../extensions/authorizer.js";
 import type { ResolvedGateSteps } from "../../extensions/gate-slots.js";
 import type { IdentityFederation } from "../../extensions/identity-federation.js";
 import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
-import type { CreateAccount, DirectAccountProvisioner } from "./provisioning.js";
+import type { AccountCreatedHook, CreateAccount, DirectAccountProvisioner } from "./provisioning.js";
 import type { IdentityAccountStore } from "./store.js";
 /** What the create path needs — the subset every caller of it composes. */
 export interface CreateAccountPathDeps {
@@ -22,6 +22,13 @@ export interface IdentityAccountControllerDeps extends CreateAccountPathDeps {
     readonly federation: IdentityFederation | undefined;
     /** The composed slot registrations — this domain's provision slot (Q-IA-9, A10). */
     readonly gateSteps: ResolvedGateSteps;
+    /**
+     * The core first-provisioning rule — open source's membership rules
+     * under the built-in authorization posture; undefined when a
+     * composition brings its own Authorizer and so its own onboarding
+     * (20260913.01, Q-OR-6).
+     */
+    readonly membership: AccountCreatedHook | undefined;
 }
 /** Registers both identityaccount services on the router (routes stage). */
 export declare function registerIdentityAccountServices(router: ConnectRouter, deps: IdentityAccountControllerDeps): void;

package/dist/domain/identityaccount/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/controller.ts"],"names":[],"mappings":"AAgDA,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAKzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAc3H,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAExE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AA8BjG,OAAO,KAAK,EACV,aAAa,EAEb,wBAAwB,EACzB,MAAM,mBAAmB,CAAC;AAiB3B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8GAA8G;IAC9G,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,gFAAgF;IAChF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;CAC7E;AAED,MAAM,WAAW,6BAA8B,SAAQ,qBAAqB;IAC1E,QAAQ,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAC/C,2FAA2F;IAC3F,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACpD,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;CACvC;AAED,4EAA4E;AAC5E,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,6BAA6B,GAClC,IAAI,CAkDN;AA0DD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,qBAAqB,EAC3B,IAAI,EAAE,eAAe,GACpB,aAAa,CAaf"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/controller.ts"],"names":[],"mappings":"AAmDA,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAKzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAc3H,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAGxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AA8BjG,OAAO,KAAK,EACV,kBAAkB,EAClB,aAAa,EAEb,wBAAwB,EACzB,MAAM,mBAAmB,CAAC;AAkB3B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8GAA8G;IAC9G,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,gFAAgF;IAChF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;CAC7E;AAED,MAAM,WAAW,6BAA8B,SAAQ,qBAAqB;IAC1E,QAAQ,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAC/C,2FAA2F;IAC3F,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACpD,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,SAAS,CAAC;CACrD;AAED,4EAA4E;AAC5E,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,6BAA6B,GAClC,IAAI,CAkDN;AA0DD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,qBAAqB,EAC3B,IAAI,EAAE,eAAe,GACpB,aAAa,CAaf"}

package/dist/domain/identityaccount/controller.js

@@ -27,13 +27,16 @@
  * ensure runs it as the trusted-local user.
  *
  * Direct handlers (no pipeline): whoAmI (the cloud's two primary-key
- * reads through idpIdOf; NOT_FOUND for the unprovisioned), getByEmail and
- * getByIdpId (lookup FIRST, then authorizeDirect on the FOUND id — the
- * cloud's order; the annotation's `field_path = "value"` would otherwise
- * hand the Authorizer an email as a resource id), getActorInfo, and
- * provisionMyAccount (the provisioner, then the composed post-persist
- * gates; UNAUTHENTICATED with the cloud's copy for a credential naming no
- * subject; UNAVAILABLE with the cloud's copy when userinfo fails).
+ * reads, stated once as resolve.ts accountForCaller; NOT_FOUND for the
+ * unprovisioned), getByEmail and getByIdpId (lookup FIRST, then
+ * authorizeDirect on the FOUND id — the cloud's order; the annotation's
+ * `field_path = "value"` would otherwise hand the Authorizer an email as a
+ * resource id), getActorInfo, and provisionMyAccount (the provisioner,
+ * then — on the call that CREATED the row — the core AccountCreatedHook
+ * (open source's membership rules, 20260913.01 slice 4), then the composed
+ * post-persist gates; UNAUTHENTICATED with the cloud's copy for a
+ * credential naming no subject; UNAVAILABLE with the cloud's copy when
+ * userinfo fails).
  *
  * The four federation RPCs refuse UNIMPLEMENTED with the edition reason
  * when no unit composes the capability (never INTERNAL; the organization
@@ -52,6 +55,7 @@ import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityac
 import { IdentityAccountCommandController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/command_pb";
 import { IdentityAccountQueryController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/query_pb";
 import { stepsForSlot } from "../../extensions/gate-slots.js";
+import { isPlatformPipelineCaller } from "../../extensions/identity.js";
 import { internalError, invalidArgumentError } from "../../pipeline/errors.js";
 import { apiResourceKindKey } from "../../pipeline/interceptors/apiresource.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
@@ -69,6 +73,7 @@ import { newResolveSlugStep } from "../../pipeline/steps/slug.js";
 import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
 import { ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE, CREATE_IS_INTERNAL_MESSAGE, NO_IDP_ID_MESSAGE, USERINFO_UNAVAILABLE_PREFIX, federationUnimplementedMessage, idpIdOf, } from "./constants.js";
 import { UserInfoFetchError } from "./provisioning.js";
+import { accountForCaller } from "./resolve.js";
 import { accountNotFoundError, newAssignBackendFieldsStep, newCheckDuplicateStep, newDefaultAccountNameStep, newDeleteAccountStep, newDeriveAccountIdStep, newGuardImmutableSubjectStep, newLoadExistingAccountForDeleteStep, newLoadExistingAccountStep, newLoadTargetAccountStep, newPersistNewAccountStep, newPersistUpdatedAccountStep, newPreserveBackendFieldsStep, } from "./steps.js";
 /** Registers both identityaccount services on the router (routes stage). */
 export function registerIdentityAccountServices(router, deps) {
@@ -145,9 +150,9 @@ function createRpc(deps, account, ctx) {
     return runCreateChain(deps, account, caller, kindOf(ctx));
 }
 function guardInternalRpc(caller) {
-    if (caller.callerClass === "machine" ||
-        caller.callerClass === "internal" ||
-        caller.origin === "in-process") {
+    // The one definition of "the platform's own pipelines"
+    // (extensions/identity.ts), shared with the IamPolicy system RPCs.
+    if (isPlatformPipelineCaller(caller)) {
         return;
     }
     throw new ConnectError(CREATE_IS_INTERNAL_MESSAGE, Code.PermissionDenied);
@@ -230,10 +235,9 @@ async function loadTarget(deps, method, id, ctx) {
  */
 async function whoAmI(deps, _empty, ctx) {
     const caller = callerIdentityOf(ctx);
-    let account = await read(() => deps.accounts.findById(caller.identityId), "failed to load identity account");
-    if (account === undefined) {
-        account = await read(() => deps.accounts.findDirectByIdpId(idpIdOf(caller)), "failed to load identity account");
-    }
+    // The domain's one statement of "the caller's account" (resolve.ts):
+    // by id, then by subject — shared with the built-in role lifecycle.
+    const account = await read(() => accountForCaller(deps.accounts, caller), "failed to load identity account");
     if (account === undefined) {
         throw new ConnectError(ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE, Code.NotFound);
     }
@@ -262,16 +266,28 @@ async function lookupThenAuthorize(deps, method, input, ctx, lookup, handle) {
 // ---------------------------------------------------------------------------
 /**
  * provisionMyAccount — the subject from the caller's credential, the
- * provisioner's flow, then the composed post-persist gates (the cloud's
- * personal organization) with the caller RE-STAMPED as the account: the
- * position-1 identity was idp-shaped because no row existed when the
- * verifier ran, and a gate that attributes ownership must name the
- * account, never a principal no later request carries. The gates run on
- * EVERY call, the idempotent early return included — the cloud's step
- * backfills accounts that predate personal organizations there, which is
- * why Q-IA-9 chose a slot over onResourceCreated. Non-transactional in
- * the `org-create:post-persist` sense: a gate failure fails the request,
- * the row survives, the next call heals it.
+ * provisioner's flow, then two post-persist consumers with the caller
+ * RE-STAMPED as the account: the position-1 identity was idp-shaped
+ * because no row existed when the verifier ran, and anything that
+ * attributes ownership must name the account, never a principal no later
+ * request carries.
+ *
+ *   1. The core AccountCreatedHook (open source's membership rules), on
+ *      the call that CREATED the row only (`created`): the slot below
+ *      fires on the idempotent path by design, and a rule keyed on "holds
+ *      no row" there would re-admit a member an administrator had just
+ *      revoked (20260913.01 plan finding 2). A throw fails the request
+ *      INTERNAL with the row in place and the rule does not run again for
+ *      that account — the ratified store-fault mapping, and the one loud
+ *      record of the window slice 4's Q-S4-4 accepted: the rule's writes
+ *      are idempotent, so a partial run is harmless, and the recovery is
+ *      an administrator's grant.
+ *   2. The composed post-persist gates (the cloud's personal
+ *      organization), on EVERY call — the cloud's step backfills accounts
+ *      that predate personal organizations there, which is why Q-IA-9
+ *      chose a slot over onResourceCreated. Non-transactional in the
+ *      `org-create:post-persist` sense: a gate failure fails the request,
+ *      the row survives, the next call heals it.
  */
 async function provisionMyAccount(deps, _empty, ctx) {
     const caller = callerIdentityOf(ctx);
@@ -280,8 +296,9 @@ async function provisionMyAccount(deps, _empty, ctx) {
         throw new ConnectError(NO_IDP_ID_MESSAGE, Code.Unauthenticated);
     }
     let account;
+    let created;
     try {
-        account = await deps.provisioner.provisionDirectAccount(idpId, caller);
+        ({ account, created } = await deps.provisioner.provisionDirectAccount(idpId, caller));
     }
     catch (error) {
         if (error instanceof UserInfoFetchError) {
@@ -289,14 +306,22 @@ async function provisionMyAccount(deps, _empty, ctx) {
         }
         throw error;
     }
+    const asAccount = {
+        ...caller,
+        identityId: account.metadata?.id ?? "",
+    };
+    if (created && deps.membership !== undefined) {
+        try {
+            await deps.membership.onAccountCreated(account, asAccount);
+        }
+        catch (error) {
+            throw internalError(error, "failed to record organization membership");
+        }
+    }
     // The ratified provision slot (Q-IA-9; the gate-slots.ts header carries
     // its semantics). Empty in OSS — no pipeline is built for zero steps.
     const gates = stepsForSlot(deps.gateSteps, "identity-account-provision:post-persist");
     if (gates.length > 0) {
-        const asAccount = {
-            ...caller,
-            identityId: account.metadata?.id ?? "",
-        };
         const reqCtx = new RequestContext(IdentityAccountSchema, account, asAccount, kindOf(ctx));
         const pipeline = newPipeline("identityaccount-provision-post-persist", deps.logger);
         for (const step of gates) {

package/dist/domain/identityaccount/controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAK5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,0DAA0D,CAAC;AAGvG,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AACjG,OAAO,EAAE,gCAAgC,EAAE,MAAM,8DAA8D,CAAC;AAMhH,OAAO,EAAE,8BAA8B,EAAE,MAAM,4DAA4D,CAAC;AAI5G,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAK9D,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,eAAe,EACf,gBAAgB,GACjB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EACL,oCAAoC,EACpC,0BAA0B,EAC1B,iBAAiB,EACjB,2BAA2B,EAC3B,8BAA8B,EAC9B,OAAO,GACR,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,sBAAsB,EACtB,4BAA4B,EAC5B,mCAAmC,EACnC,0BAA0B,EAC1B,wBAAwB,EACxB,wBAAwB,EACxB,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,YAAY,CAAC;AAqBpB,4EAA4E;AAC5E,MAAM,UAAU,+BAA+B,CAC7C,MAAqB,EACrB,IAAmC;IAEnC,MAAM,CAAC,OAAO,CAAC,gCAAgC,EAAE;QAC/C,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;QACvD,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;QACpD,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACjD,sBAAsB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACrC,SAAS,CACP,IAAI,EACJ,GAAG,EACH,gCAAgC,CAAC,MAAM,CAAC,sBAAsB,EAC9D,KAAK,EACL,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC1B,UAAU,CAAC,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CACxD;QACH,sBAAsB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACrC,SAAS,CACP,IAAI,EACJ,GAAG,EACH,gCAAgC,CAAC,MAAM,CAAC,sBAAsB,EAC9D,KAAK,EACL,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC1B,UAAU,CAAC,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CACxD;QACH,2BAA2B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC1C,SAAS,CACP,IAAI,EACJ,GAAG,EACH,gCAAgC,CAAC,MAAM,CAAC,2BAA2B,EACnE,KAAK,EACL,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC1B,UAAU,CAAC,2BAA2B,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAC7D;QACH,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzE,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,8BAA8B,EAAE;QAC7C,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAChD,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACxD,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACxD,gBAAgB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAChC,SAAS,CACP,IAAI,EACJ,GAAG,EACH,8BAA8B,CAAC,MAAM,CAAC,gBAAgB,EACtD,MAAM,EACN,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC1B,UAAU,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CACnD;QACH,YAAY,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;KACvD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAC3B,IAA2B,EAC3B,OAAwB,EACxB,MAAsB,EACtB,IAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,qBAAqB,EACrB,OAAO,EACP,MAAM,EACN,IAAI,CACL,CAAC;IACF,MAAM,WAAW,CACf,wBAAwB,EACxB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,gCAAgC,CAAC,MAAM,CAAC,MAAM,EAC9C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,sBAAsB,EAAE,CAAC;SACjC,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAC7C,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,CAAC;SACrC,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAChD,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAA2B,EAC3B,IAAqB;IAErB,OAAO,CAAC,KAAyB,EAAE,MAAsB,EAAE,EAAE,CAC3D,cAAc,CACZ,IAAI,EACJ,MAAM,CAAC,qBAAqB,EAAE;QAC5B,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,EACF,MAAM,EACN,IAAI,CACL,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAChB,IAAmC,EACnC,OAAwB,EACxB,GAAmB;IAEnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAsB;IAC9C,IACE,MAAM,CAAC,WAAW,KAAK,SAAS;QAChC,MAAM,CAAC,WAAW,KAAK,UAAU;QACjC,MAAM,CAAC,MAAM,KAAK,YAAY,EAC9B,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,YAAY,CAAC,0BAA0B,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAC5E,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;GAKG;AACH,KAAK,UAAU,MAAM,CACnB,IAAmC,EACnC,OAAwB,EACxB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,qBAAqB,EACrB,OAAO,EACP,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,wBAAwB,EACxB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,gCAAgC,CAAC,MAAM,CAAC,MAAM,EAC9C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAClD,OAAO,CAAC,4BAA4B,EAAE,CAAC;SACvC,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,4BAA4B,EAAE,CAAC;SACvC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SACpD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,aAAa,CAC1B,IAAmC,EACnC,EAAqB,EACrB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,gCAAgC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EACpD,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,wBAAwB,EAAE,IAAI,CAAC,MAAM,CAAC;SACrC,OAAO,CACN,gBAAgB,CACd,gCAAgC,CAAC,MAAM,CAAC,MAAM,EAC9C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,EAAE,CAAC;SACnC,OAAO,CAAC,mCAAmC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAC3D,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAC5C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,qDAAqD,CAAC,EAChE,+CAA+C,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,OAA0B,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,4EAA4E;AAC5E,KAAK,UAAU,GAAG,CAChB,IAAmC,EACnC,EAAqB,EACrB,GAAmB;IAEnB,OAAO,UAAU,CAAC,IAAI,EAAE,8BAA8B,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,YAAY,CACzB,IAAmC,EACnC,EAAqB,EACrB,GAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,UAAU,CAC9B,IAAI,EACJ,8BAA8B,CAAC,MAAM,CAAC,YAAY,EAClD,EAAE,EACF,GAAG,CACJ,CAAC;IACF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;IAC9C,OAAO,MAAM,CAAC,2BAA2B,EAAE;QACzC,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;QAC9B,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE;QACtC,WAAW,EAAE,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC,IAAI,EAAE;QAC9C,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;KACjC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,IAAmC,EACnC,MAAkB,EAClB,EAAqB,EACrB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,MAAM,CAAC,KAAK,EACZ,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,mBAAmB,MAAM,CAAC,SAAS,EAAE,EACrC,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAChD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAoB,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,MAAM,CACnB,IAAmC,EACnC,MAAa,EACb,GAAmB;IAEnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,GAAG,MAAM,IAAI,CACtB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAC/C,iCAAiC,CAClC,CAAC;IACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,GAAG,MAAM,IAAI,CAClB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EACtD,iCAAiC,CAClC,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,YAAY,CAAC,oCAAoC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,UAAU,CACvB,IAAmC,EACnC,KAA2B,EAC3B,GAAmB;IAEnB,OAAO,mBAAmB,CACxB,IAAI,EACJ,8BAA8B,CAAC,MAAM,CAAC,UAAU,EAChD,KAAK,EACL,GAAG,EACH,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,EAClD,KAAK,CAAC,KAAK,CACZ,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,KAAK,UAAU,UAAU,CACvB,IAAmC,EACnC,KAAY,EACZ,GAAmB;IAEnB,OAAO,mBAAmB,CACxB,IAAI,EACJ,8BAA8B,CAAC,MAAM,CAAC,UAAU,EAChD,KAAK,EACL,GAAG,EACH,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAC5C,KAAK,CAAC,KAAK,CACZ,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,IAAmC,EACnC,MAAkB,EAClB,KAAmC,EACnC,GAAmB,EACnB,MAAkD,EAClD,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC;IACzE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE;QAC3E,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;KACvC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,kBAAkB,CAC/B,IAAmC,EACnC,MAAa,EACb,GAAmB;IAEnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;YACxC,MAAM,IAAI,YAAY,CACpB,GAAG,2BAA2B,GAAG,KAAK,CAAC,OAAO,EAAE,EAChD,IAAI,CAAC,WAAW,CACjB,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,KAAK,GAAG,YAAY,CACxB,IAAI,CAAC,SAAS,EACd,yCAAyC,CAC1C,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,SAAS,GAAmB;YAChC,GAAG,MAAM;YACT,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;SACvC,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,qBAAqB,EACrB,OAAO,EACP,SAAS,EACT,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;QACF,MAAM,QAAQ,GAAG,WAAW,CAC1B,wCAAwC,EACxC,IAAI,CAAC,MAAM,CACZ,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAiBD,KAAK,UAAU,SAAS,CACtB,IAAmC,EACnC,GAAmB,EACnB,MAAkB,EAClB,KAAY,EACZ,GAI6B;IAE7B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACnC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,8BAA8B,CAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAChD,EACD,IAAI,CAAC,aAAa,CACnB,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,mBAAmB,CAAC;IACtC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,oBAAoB,CACxB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACtC,MAAM,oBAAoB,CACxB,8BAA8B,GAAG,CAAC,GAAG,+BAA+B,GAAG,GAAG,CAC3E,CAAC;IACJ,CAAC;IACD,sEAAsE;IACtE,qDAAqD;IACrD,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC9C,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,YAAY,CACpB,qBAAqB,MAAM,IAAI,GAAG,CAAC,IAAI,aAAa,EACpD,IAAI,CAAC,QAAQ,CACd,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC;IACjB,OAAO,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,mGAAmG;AACnG,KAAK,UAAU,IAAI,CACjB,SAA2B,EAC3B,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAK5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,0DAA0D,CAAC;AAGvG,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AACjG,OAAO,EAAE,gCAAgC,EAAE,MAAM,8DAA8D,CAAC;AAMhH,OAAO,EAAE,8BAA8B,EAAE,MAAM,4DAA4D,CAAC;AAI5G,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAIxE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,eAAe,EACf,gBAAgB,GACjB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EACL,oCAAoC,EACpC,0BAA0B,EAC1B,iBAAiB,EACjB,2BAA2B,EAC3B,8BAA8B,EAC9B,OAAO,GACR,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,sBAAsB,EACtB,4BAA4B,EAC5B,mCAAmC,EACnC,0BAA0B,EAC1B,wBAAwB,EACxB,wBAAwB,EACxB,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,YAAY,CAAC;AA4BpB,4EAA4E;AAC5E,MAAM,UAAU,+BAA+B,CAC7C,MAAqB,EACrB,IAAmC;IAEnC,MAAM,CAAC,OAAO,CAAC,gCAAgC,EAAE;QAC/C,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;QACvD,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;QACpD,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACjD,sBAAsB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACrC,SAAS,CACP,IAAI,EACJ,GAAG,EACH,gCAAgC,CAAC,MAAM,CAAC,sBAAsB,EAC9D,KAAK,EACL,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC1B,UAAU,CAAC,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CACxD;QACH,sBAAsB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACrC,SAAS,CACP,IAAI,EACJ,GAAG,EACH,gCAAgC,CAAC,MAAM,CAAC,sBAAsB,EAC9D,KAAK,EACL,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC1B,UAAU,CAAC,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CACxD;QACH,2BAA2B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC1C,SAAS,CACP,IAAI,EACJ,GAAG,EACH,gCAAgC,CAAC,MAAM,CAAC,2BAA2B,EACnE,KAAK,EACL,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC1B,UAAU,CAAC,2BAA2B,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAC7D;QACH,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzE,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,8BAA8B,EAAE;QAC7C,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAChD,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACxD,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACxD,gBAAgB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAChC,SAAS,CACP,IAAI,EACJ,GAAG,EACH,8BAA8B,CAAC,MAAM,CAAC,gBAAgB,EACtD,MAAM,EACN,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC1B,UAAU,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CACnD;QACH,YAAY,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;KACvD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAC3B,IAA2B,EAC3B,OAAwB,EACxB,MAAsB,EACtB,IAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,qBAAqB,EACrB,OAAO,EACP,MAAM,EACN,IAAI,CACL,CAAC;IACF,MAAM,WAAW,CACf,wBAAwB,EACxB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,gCAAgC,CAAC,MAAM,CAAC,MAAM,EAC9C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,sBAAsB,EAAE,CAAC;SACjC,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAC7C,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,CAAC;SACrC,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAChD,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAA2B,EAC3B,IAAqB;IAErB,OAAO,CAAC,KAAyB,EAAE,MAAsB,EAAE,EAAE,CAC3D,cAAc,CACZ,IAAI,EACJ,MAAM,CAAC,qBAAqB,EAAE;QAC5B,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,EACF,MAAM,EACN,IAAI,CACL,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAChB,IAAmC,EACnC,OAAwB,EACxB,GAAmB;IAEnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAsB;IAC9C,uDAAuD;IACvD,mEAAmE;IACnE,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO;IACT,CAAC;IACD,MAAM,IAAI,YAAY,CAAC,0BAA0B,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAC5E,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;GAKG;AACH,KAAK,UAAU,MAAM,CACnB,IAAmC,EACnC,OAAwB,EACxB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,qBAAqB,EACrB,OAAO,EACP,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,wBAAwB,EACxB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,gCAAgC,CAAC,MAAM,CAAC,MAAM,EAC9C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAClD,OAAO,CAAC,4BAA4B,EAAE,CAAC;SACvC,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,4BAA4B,EAAE,CAAC;SACvC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SACpD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,aAAa,CAC1B,IAAmC,EACnC,EAAqB,EACrB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,gCAAgC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EACpD,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,wBAAwB,EAAE,IAAI,CAAC,MAAM,CAAC;SACrC,OAAO,CACN,gBAAgB,CACd,gCAAgC,CAAC,MAAM,CAAC,MAAM,EAC9C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,EAAE,CAAC;SACnC,OAAO,CAAC,mCAAmC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAC3D,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAC5C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,qDAAqD,CAAC,EAChE,+CAA+C,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,OAA0B,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,4EAA4E;AAC5E,KAAK,UAAU,GAAG,CAChB,IAAmC,EACnC,EAAqB,EACrB,GAAmB;IAEnB,OAAO,UAAU,CAAC,IAAI,EAAE,8BAA8B,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,YAAY,CACzB,IAAmC,EACnC,EAAqB,EACrB,GAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,UAAU,CAC9B,IAAI,EACJ,8BAA8B,CAAC,MAAM,CAAC,YAAY,EAClD,EAAE,EACF,GAAG,CACJ,CAAC;IACF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;IAC9C,OAAO,MAAM,CAAC,2BAA2B,EAAE;QACzC,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;QAC9B,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE;QACtC,WAAW,EAAE,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC,IAAI,EAAE;QAC9C,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;KACjC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,IAAmC,EACnC,MAAkB,EAClB,EAAqB,EACrB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,MAAM,CAAC,KAAK,EACZ,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,mBAAmB,MAAM,CAAC,SAAS,EAAE,EACrC,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAChD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAoB,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,MAAM,CACnB,IAAmC,EACnC,MAAa,EACb,GAAmB;IAEnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,qEAAqE;IACrE,oEAAoE;IACpE,MAAM,OAAO,GAAG,MAAM,IAAI,CACxB,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAC7C,iCAAiC,CAClC,CAAC;IACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,YAAY,CAAC,oCAAoC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,UAAU,CACvB,IAAmC,EACnC,KAA2B,EAC3B,GAAmB;IAEnB,OAAO,mBAAmB,CACxB,IAAI,EACJ,8BAA8B,CAAC,MAAM,CAAC,UAAU,EAChD,KAAK,EACL,GAAG,EACH,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,EAClD,KAAK,CAAC,KAAK,CACZ,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,KAAK,UAAU,UAAU,CACvB,IAAmC,EACnC,KAAY,EACZ,GAAmB;IAEnB,OAAO,mBAAmB,CACxB,IAAI,EACJ,8BAA8B,CAAC,MAAM,CAAC,UAAU,EAChD,KAAK,EACL,GAAG,EACH,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAC5C,KAAK,CAAC,KAAK,CACZ,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,IAAmC,EACnC,MAAkB,EAClB,KAAmC,EACnC,GAAmB,EACnB,MAAkD,EAClD,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC;IACzE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE;QAC3E,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;KACvC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,KAAK,UAAU,kBAAkB,CAC/B,IAAmC,EACnC,MAAa,EACb,GAAmB;IAEnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAwB,CAAC;IAC7B,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,CACnE,KAAK,EACL,MAAM,CACP,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;YACxC,MAAM,IAAI,YAAY,CACpB,GAAG,2BAA2B,GAAG,KAAK,CAAC,OAAO,EAAE,EAChD,IAAI,CAAC,WAAW,CACjB,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAmB;QAChC,GAAG,MAAM;QACT,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;KACvC,CAAC;IACF,IAAI,OAAO,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,aAAa,CAAC,KAAK,EAAE,0CAA0C,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,KAAK,GAAG,YAAY,CACxB,IAAI,CAAC,SAAS,EACd,yCAAyC,CAC1C,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,qBAAqB,EACrB,OAAO,EACP,SAAS,EACT,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;QACF,MAAM,QAAQ,GAAG,WAAW,CAC1B,wCAAwC,EACxC,IAAI,CAAC,MAAM,CACZ,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAiBD,KAAK,UAAU,SAAS,CACtB,IAAmC,EACnC,GAAmB,EACnB,MAAkB,EAClB,KAAY,EACZ,GAI6B;IAE7B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACnC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,8BAA8B,CAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAChD,EACD,IAAI,CAAC,aAAa,CACnB,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,mBAAmB,CAAC;IACtC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,oBAAoB,CACxB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACtC,MAAM,oBAAoB,CACxB,8BAA8B,GAAG,CAAC,GAAG,+BAA+B,GAAG,GAAG,CAC3E,CAAC;IACJ,CAAC;IACD,sEAAsE;IACtE,qDAAqD;IACrD,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC9C,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,YAAY,CACpB,qBAAqB,MAAM,IAAI,GAAG,CAAC,IAAI,aAAa,EACpD,IAAI,CAAC,QAAQ,CACd,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC;IACjB,OAAO,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,mGAAmG;AACnG,KAAK,UAAU,IAAI,CACjB,SAA2B,EAC3B,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}

package/dist/domain/identityaccount/operator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operator.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/operator.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAKhG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,uFAAuF;AACvF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;CACvC;AAKD,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,mBAAmB,EACzB,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,eAAe,CAAC,CAiC1B"}
+{"version":3,"file":"operator.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/operator.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAQhG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,uFAAuF;AACvF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;CACvC;AAED,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,mBAAmB,EACzB,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,eAAe,CAAC,CAiC1B"}

package/dist/domain/identityaccount/operator.js

@@ -31,12 +31,10 @@
  */
 import { create } from "@bufbuild/protobuf";
 import { IdentityAccountSpecSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/spec_pb";
-import { trustedLocalIdentityFor } from "../../pipeline/interceptors/auth.js";
+import { SYSTEM_OPERATOR_IDENTITY_ID, trustedLocalIdentityFor, } from "../../pipeline/interceptors/auth.js";
 import { accountIdFor, localIdpIdFor } from "./constants.js";
 import { resolveCreateRace } from "./provisioning.js";
 import { assignDirectBackendFields } from "./steps.js";
-/** The unconfigured laptop's operator: what the interceptor stamps as identityId. */
-const SYSTEM_OPERATOR = "system";
 export async function ensureOperatorAccount(deps, operator) {
     // The caller the interceptor would stamp for this operator; its
     // identityId (the email, or "system") is the subject's local principal.
@@ -50,7 +48,7 @@ export async function ensureOperatorAccount(deps, operator) {
         ? operator.displayName
         : operator.email !== ""
             ? operator.email
-            : SYSTEM_OPERATOR;
+            : SYSTEM_OPERATOR_IDENTITY_ID;
     try {
         return await deps.createAccount({
             name,

package/dist/domain/identityaccount/operator.js.map

@@ -1 +1 @@
-{"version":3,"file":"operator.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/operator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AAEtG,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAcvD,qFAAqF;AACrF,MAAM,eAAe,GAAG,QAAQ,CAAC;AAEjC,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAyB,EACzB,QAA0B;IAE1B,gEAAgE;IAChE,wEAAwE;IACxE,MAAM,MAAM,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACnE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GACR,QAAQ,CAAC,WAAW,KAAK,EAAE;QACzB,CAAC,CAAC,QAAQ,CAAC,WAAW;QACtB,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE;YACrB,CAAC,CAAC,QAAQ,CAAC,KAAK;YAChB,CAAC,CAAC,eAAe,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,aAAa,CAC7B;YACE,IAAI;YACJ,IAAI,EAAE,yBAAyB,CAC7B,MAAM,CAAC,yBAAyB,EAAE;gBAChC,KAAK;gBACL,KAAK,EAAE,QAAQ,CAAC,KAAK;aACtB,CAAC,CACH;SACF,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,CACnC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAC5C,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"operator.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/operator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AAEtG,OAAO,EACL,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAcvD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAyB,EACzB,QAA0B;IAE1B,gEAAgE;IAChE,wEAAwE;IACxE,MAAM,MAAM,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACnE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GACR,QAAQ,CAAC,WAAW,KAAK,EAAE;QACzB,CAAC,CAAC,QAAQ,CAAC,WAAW;QACtB,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE;YACrB,CAAC,CAAC,QAAQ,CAAC,KAAK;YAChB,CAAC,CAAC,2BAA2B,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,aAAa,CAC7B;YACE,IAAI;YACJ,IAAI,EAAE,yBAAyB,CAC7B,MAAM,CAAC,yBAAyB,EAAE;gBAChC,KAAK;gBACL,KAAK,EAAE,QAAQ,CAAC,KAAK;aACtB,CAAC,CACH;SACF,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,CACnC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAC5C,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/domain/identityaccount/provisioning.d.ts

@@ -36,9 +36,28 @@ export interface DirectAccountProvisionerDeps {
     readonly createAccount: CreateAccount;
     readonly userInfo: UserInfoClient;
 }
+/** The provisioner's answer: the account, and whether this call created its row. */
+export interface ProvisionedAccount {
+    readonly account: IdentityAccount;
+    /** False on the idempotent early return and for a first-login race's loser. */
+    readonly created: boolean;
+}
+/**
+ * What the identity-account domain offers a core rule keyed on a person's
+ * FIRST provisioning (the open-source membership rules,
+ * domain/iampolicy/membership.ts). Runs once per account, on the call
+ * whose `created` is true, with the caller RE-STAMPED as the account, so
+ * whatever the hook writes attributes to the account and never to the
+ * idp-shaped principal the verifier admitted before the row existed. Its
+ * failure semantics are the controller's: a throw fails the request with
+ * the account in place, and the hook does not run again for that account.
+ */
+export interface AccountCreatedHook {
+    onAccountCreated(account: IdentityAccount, caller: CallerIdentity): Promise<void>;
+}
 export interface DirectAccountProvisioner {
     /** provisionMyAccount's domain flow; `idpId` is the caller's verified subject. */
-    provisionDirectAccount(idpId: string, caller: CallerIdentity): Promise<IdentityAccount>;
+    provisionDirectAccount(idpId: string, caller: CallerIdentity): Promise<ProvisionedAccount>;
 }
 export declare function newDirectAccountProvisioner(deps: DirectAccountProvisionerDeps): DirectAccountProvisioner;
 /**

package/dist/domain/identityaccount/provisioning.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisioning.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/provisioning.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2DAA2D,CAAC;AAGrG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,mEAAmE;AACnE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,gFAAgF;IAChF,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC7E;AAED,kFAAkF;AAClF,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,KAAK,EAAE,OAAO;CAI3B;AAED,0EAA0E;AAC1E,MAAM,WAAW,kBAAkB;IACjC,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;CACpC;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,KAAK,EAAE,kBAAkB,EACzB,MAAM,EAAE,cAAc,KACnB,OAAO,CAAC,eAAe,CAAC,CAAC;AAE9B,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;CACnC;AAED,MAAM,WAAW,wBAAwB;IACvC,kFAAkF;IAClF,sBAAsB,CACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,eAAe,CAAC,CAAC;CAC7B;AAED,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,4BAA4B,GACjC,wBAAwB,CA+B1B;AAkCD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,OAAO,EACd,UAAU,EAAE,MAAM,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,GACrD,OAAO,CAAC,eAAe,CAAC,CAM1B"}
+{"version":3,"file":"provisioning.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/provisioning.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2DAA2D,CAAC;AAGrG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,mEAAmE;AACnE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,gFAAgF;IAChF,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC7E;AAED,kFAAkF;AAClF,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,KAAK,EAAE,OAAO;CAI3B;AAED,0EAA0E;AAC1E,MAAM,WAAW,kBAAkB;IACjC,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;CACpC;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,KAAK,EAAE,kBAAkB,EACzB,MAAM,EAAE,cAAc,KACnB,OAAO,CAAC,eAAe,CAAC,CAAC;AAE9B,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;CACnC;AAED,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,CACd,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,kFAAkF;IAClF,sBAAsB,CACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAChC;AAED,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,4BAA4B,GACjC,wBAAwB,CAmC1B;AAkCD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,OAAO,EACd,UAAU,EAAE,MAAM,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,GACrD,OAAO,CAAC,eAAe,CAAC,CAM1B"}

package/dist/domain/identityaccount/provisioning.js

@@ -28,6 +28,16 @@
  * fires on the `identity-account-provision:post-persist` slot in the
  * composition (A10), wired by the controller.
  *
+ * The answer says whether THIS call created the row (`ProvisionedAccount.
+ * created`; 20260913.01 slice 4): the idempotent early return and the
+ * race loser answer false. The slot above fires on every call by design
+ * (the cloud's backfill needs that), so a CORE rule that must run exactly
+ * once per person — the open-source membership rules, which hand out
+ * organization roles at first sign-in — keys on `created` instead, through
+ * the AccountCreatedHook this domain offers and the controller runs. The
+ * hook is declared here, in the domain that fires it, so the domain that
+ * implements it (iampolicy) depends on this one and never the reverse.
+ *
  * This module holds the domain flow over two PORTS — the store and the
  * userinfo client — and no network code; identity/oidc-userinfo.ts is the
  * OIDC implementation the composition root wires in.
@@ -47,7 +57,7 @@ export function newDirectAccountProvisioner(deps) {
         async provisionDirectAccount(idpId, caller) {
             const existing = await deps.accounts.findDirectByIdpId(idpId);
             if (existing !== undefined) {
-                return existing;
+                return { account: existing, created: false };
             }
             const profile = await profileOf(deps.userInfo, caller);
             const input = {
@@ -61,10 +71,14 @@ export function newDirectAccountProvisioner(deps) {
                 })),
             };
             try {
-                return await deps.createAccount(input, caller);
+                return {
+                    account: await deps.createAccount(input, caller),
+                    created: true,
+                };
             }
             catch (error) {
-                return resolveCreateRace(error, () => deps.accounts.findDirectByIdpId(idpId));
+                const winner = await resolveCreateRace(error, () => deps.accounts.findDirectByIdpId(idpId));
+                return { account: winner, created: false };
             }
         },
     };

package/dist/domain/identityaccount/provisioning.js.map

@@ -1 +1 @@
-{"version":3,"file":"provisioning.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/provisioning.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAI5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AAGtG,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAiBvD,kFAAkF;AAClF,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,KAAc;QACxB,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAkCD,MAAM,UAAU,2BAA2B,CACzC,IAAkC;IAElC,OAAO;QACL,KAAK,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM;YACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC9D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvD,MAAM,KAAK,GAAuB;gBAChC,IAAI,EAAE,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC;gBACpC,IAAI,EAAE,yBAAyB,CAC7B,MAAM,CAAC,yBAAyB,EAAE;oBAChC,KAAK;oBACL,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC,CACH;aACF,CAAC;YAEF,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,CACnC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CACvC,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,SAAS,CACtB,QAAwB,EACxB,MAAsB;IAEtB,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACzB,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACzB,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,EAAE;SACf,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,MAAsB,EAAE,OAAoB;IACjE,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,KAAK,CAAC;IAC7C,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC;AACvB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAc,EACd,UAAsD;IAEtD,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"provisioning.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/provisioning.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAI5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AAGtG,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAiBvD,kFAAkF;AAClF,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,KAAc;QACxB,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AA0DD,MAAM,UAAU,2BAA2B,CACzC,IAAkC;IAElC,OAAO;QACL,KAAK,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM;YACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC9D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC/C,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvD,MAAM,KAAK,GAAuB;gBAChC,IAAI,EAAE,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC;gBACpC,IAAI,EAAE,yBAAyB,CAC7B,MAAM,CAAC,yBAAyB,EAAE;oBAChC,KAAK;oBACL,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC,CACH;aACF,CAAC;YAEF,IAAI,CAAC;gBACH,OAAO;oBACL,OAAO,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC;oBAChD,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,CACjD,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CACvC,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC7C,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,SAAS,CACtB,QAAwB,EACxB,MAAsB;IAEtB,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACzB,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACzB,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,EAAE;SACf,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,MAAsB,EAAE,OAAoB;IACjE,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,KAAK,CAAC;IAC7C,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC;AACvB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAc,EACd,UAAsD;IAEtD,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/domain/identityaccount/resolve.d.ts

@@ -28,9 +28,32 @@
  * no id is the one deliberate divergence from the cloud's inline
  * `metadata?.id ?? ""`: a `""` principal is the silent-junk failure the
  * oss#405 doctrine forbids, so it is a loud fault naming the subject.
+ *
+ * The same knowledge read in the caller's direction is `accountForCaller`
+ * (20260913.01 slice 4, Q-S4-1): the account a stamped CallerIdentity
+ * stands for. Two primary-key reads, the cloud's whoAmI order — the
+ * identityId AS an account id (a verifier that resolved), then the
+ * caller's subject through the direct lookup (a verifier that did not:
+ * the trusted-local interceptor, which stamps the operator's email and
+ * never consults the store; a composition verifier that runs before any
+ * row exists). It lives here so whoAmI and the built-in role lifecycle,
+ * which asks "whose organization is this" from the creating caller,
+ * cannot answer the same question two ways. A credential naming no
+ * subject is `undefined` with no second read: the store is never asked
+ * about "".
  */
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import type { CallerIdentity } from "../../extensions/identity.js";
 import type { IdentityAccountStore } from "./store.js";
 /** The one read a verifier needs from the domain: the direct account for a subject. */
 export type AccountsBySubject = Pick<IdentityAccountStore, "findDirectByIdpId">;
+/** The two reads the caller-direction resolution needs: by id, then by subject. */
+export type AccountsByCaller = Pick<IdentityAccountStore, "findById" | "findDirectByIdpId">;
 export declare function identityIdForSubject(accounts: AccountsBySubject, subject: string): Promise<string>;
+/**
+ * The account `caller` stands for, or `undefined` when there is none (an
+ * idp-shaped caller before provisioning; a credential naming no subject).
+ * Faults propagate as they are — the caller decides the wire shape.
+ */
+export declare function accountForCaller(accounts: AccountsByCaller, caller: CallerIdentity): Promise<IdentityAccount | undefined>;
 //# sourceMappingURL=resolve.d.ts.map

package/dist/domain/identityaccount/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,uFAAuF;AACvF,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;AAEhF,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CAYjB"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAEhG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,uFAAuF;AACvF,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;AAEhF,mFAAmF;AACnF,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,oBAAoB,EACpB,UAAU,GAAG,mBAAmB,CACjC,CAAC;AAEF,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAUtC"}

package/dist/domain/identityaccount/resolve.js

@@ -1,3 +1,4 @@
+import { idpIdOf } from "./constants.js";
 export async function identityIdForSubject(accounts, subject) {
     const account = await accounts.findDirectByIdpId(subject);
     if (account === undefined) {
@@ -9,4 +10,20 @@ export async function identityIdForSubject(accounts, subject) {
     }
     return id;
 }
+/**
+ * The account `caller` stands for, or `undefined` when there is none (an
+ * idp-shaped caller before provisioning; a credential naming no subject).
+ * Faults propagate as they are — the caller decides the wire shape.
+ */
+export async function accountForCaller(accounts, caller) {
+    const byId = await accounts.findById(caller.identityId);
+    if (byId !== undefined) {
+        return byId;
+    }
+    const subject = idpIdOf(caller);
+    if (subject === "") {
+        return undefined;
+    }
+    return accounts.findDirectByIdpId(subject);
+}
 //# sourceMappingURL=resolve.js.map

package/dist/domain/identityaccount/resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/resolve.ts"],"names":[],"mappings":"AAoCA,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAA2B,EAC3B,OAAe;IAEf,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,iCAAiC,OAAO,wDAAwD,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/resolve.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAYzC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAA2B,EAC3B,OAAe;IAEf,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,iCAAiC,OAAO,wDAAwD,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAA0B,EAC1B,MAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC"}

package/dist/domain/identityaccount/store-contract.d.ts

@@ -1,22 +1,8 @@
+import type { PortContractCase, PortContractFixture } from "../../store/port-contract.js";
 import type { IdentityAccountStore } from "./store.js";
-/** One fresh, isolated store per case, plus the one escape hatch the port cannot express. */
-export interface IdentityAccountStoreContractFixture {
-    readonly store: IdentityAccountStore;
-    /**
-     * Cuts the store from its database so every later call is an
-     * infrastructure fault. `cleanup` still runs afterwards and must tolerate
-     * a disconnected store (both OSS drivers' `close` is idempotent; a pool
-     * fixture ends a per-case pool here and skips it in cleanup).
-     */
-    disconnect(): Promise<void>;
-    cleanup(): Promise<void>;
-}
-export interface IdentityAccountStoreContractCase {
-    /** The contract line, in the port's words; the framework prints it as the test name. */
-    readonly name: string;
-    /** Makes a FRESH fixture, runs the case, cleans up. A failing assertion wins over a failing cleanup. */
-    run(): Promise<void>;
-}
+/** The runner's fixture over this port — the name a driver's test and the barrel know it by. */
+export type IdentityAccountStoreContractFixture = PortContractFixture<IdentityAccountStore>;
+export type IdentityAccountStoreContractCase = PortContractCase;
 /** The port's cases over `makeFixture`, one fresh fixture per case. */
 export declare function identityAccountStoreContract(makeFixture: () => Promise<IdentityAccountStoreContractFixture>): ReadonlyArray<IdentityAccountStoreContractCase>;
 //# sourceMappingURL=store-contract.d.ts.map

package/dist/domain/identityaccount/store-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store-contract.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/store-contract.ts"],"names":[],"mappings":"AAwDA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,6FAA6F;AAC7F,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC;;;;;OAKG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,gCAAgC;IAC/C,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wGAAwG;IACxG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACtB;AAkYD,uEAAuE;AACvE,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,OAAO,CAAC,mCAAmC,CAAC,GAC9D,aAAa,CAAC,gCAAgC,CAAC,CAKjD"}
+{"version":3,"file":"store-contract.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/store-contract.ts"],"names":[],"mappings":"AAgDA,OAAO,KAAK,EACV,gBAAgB,EAEhB,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,gGAAgG;AAChG,MAAM,MAAM,mCAAmC,GAC7C,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;AAE5C,MAAM,MAAM,gCAAgC,GAAG,gBAAgB,CAAC;AAoWhE,uEAAuE;AACvE,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,OAAO,CAAC,mCAAmC,CAAC,GAC9D,aAAa,CAAC,gCAAgC,CAAC,CAEjD"}

package/dist/domain/identityaccount/store-contract.js

@@ -8,23 +8,16 @@
  * `cloud.iam_identity_account` store), so "the port holds" is one
  * statement proven per driver, never restated per repository.
  *
- * Shape. The package's precedent is store/__tests__/store-contract.ts —
- * `describeStoreContract(makeFixture)`: a fresh fixture per test, named
- * escape hatches for the arms the interface cannot express, driver-physical
- * behavior left to each driver's own tests. This kit follows it in
- * everything but the framework: it is consumed by ANOTHER package's tests,
- * so it ships in dist/ and must not import vitest — a devDependency that
- * would enter the root barrel's runtime import graph. It therefore returns
- * cases instead of calling `describe`, asserts through node:assert/strict,
- * and the consumer's framework does `for (const c of cases) it(c.name,
- * c.run)`. Do not "fix" it back to the precedent's vitest shape.
- *
- * Every case makes a FRESH fixture, runs, and cleans up; a failing
- * assertion wins over a failing cleanup. `disconnect` is the one escape
- * hatch: the port has no lifecycle by design (a composition owns its
- * store's), yet "an outage never reads as no account" is the line that
- * matters most, so the fixture cuts the store from its database and the
- * kit asserts that the fault propagates instead of reading as `undefined`.
+ * Shape. The kit is a list of declarations over the port-contract runner
+ * (store/port-contract.ts, lifted from this file in 20260913.01 slice 2
+ * when the IamPolicy kit became the second): the runner owns the fresh
+ * fixture per case, the cleanup, the rule that a failing assertion wins
+ * over a failing cleanup, and the reason the kit returns cases instead of
+ * calling vitest's `describe`. `disconnect` is the one escape hatch: the
+ * port has no lifecycle by design (a composition owns its store's), yet
+ * "an outage never reads as no account" is the line that matters most, so
+ * the fixture cuts the store from its database and the kit asserts that
+ * the fault propagates instead of reading as `undefined`.
  *
  * What the kit deliberately does not carry: open source's primary-key read
  * (the findByField spy) and its derived-id refusal, the cloud's column
@@ -48,6 +41,7 @@ import { create, equals } from "@bufbuild/protobuf";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
 import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
+import { portContractCases } from "../../store/port-contract.js";
 import { accountIdFor } from "./constants.js";
 import { DuplicateAccountError } from "./store.js";
 /** A direct account as the domain writes it: id derived from the subject, mode direct. */
@@ -271,37 +265,8 @@ const CASES = [
         },
     ],
 ];
-/**
- * Runs `body` over a fresh fixture. The body's failure is the one reported:
- * a cleanup failure after a failed body would otherwise replace the
- * assertion that matters with a teardown detail.
- */
-async function withFixture(makeFixture, body) {
-    const fixture = await makeFixture();
-    let failed = false;
-    try {
-        await body(fixture);
-    }
-    catch (error) {
-        failed = true;
-        throw error;
-    }
-    finally {
-        try {
-            await fixture.cleanup();
-        }
-        catch (cleanupError) {
-            if (!failed) {
-                throw cleanupError;
-            }
-        }
-    }
-}
 /** The port's cases over `makeFixture`, one fresh fixture per case. */
 export function identityAccountStoreContract(makeFixture) {
-    return CASES.map(([name, body]) => ({
-        name,
-        run: () => withFixture(makeFixture, body),
-    }));
+    return portContractCases(CASES, makeFixture);
 }
 //# sourceMappingURL=store-contract.js.map