@stigmer/server 3.15.3-dev.20260914121148 → 3.16.0

package/dist/domain/iampolicy/membership.d.ts

@@ -7,7 +7,8 @@
  * no unit registered an Authorizer); a composition with its own
  * Authorizer has its own onboarding and never constructs this.
  *
- * Two moments:
+ * Three moments, one set of arms (`roleFor`, the pure function the first
+ * and third share):
  *
  *   onAccountCreated(account, caller) — a person's FIRST provisioning, and
  *   only that (the identity-account domain's AccountCreatedHook, run by
@@ -50,6 +51,30 @@
  *   email and name — so its audit actor reads like every other write on
  *   that laptop.
  *
+ *   ensureRolesForExistingAccounts() — the built-in posture's boot
+ *   reconciliation, ONCE per database. The first moment runs only on the
+ *   call that CREATES an account, so a self-host whose people were
+ *   provisioned before the rules existed (3.15.x with OIDC on) holds
+ *   accounts with no role rows, and under an enforcing authorizer every
+ *   one of them would be an outsider on every organization with nobody
+ *   able to grant a way back. At the first boot where the bootstrap-state
+ *   marker (ROLES_RECONCILED_KEY) is absent, the arms above run for every
+ *   PERSON account (`isPersonAccount`: not a machine account, the row-
+ *   level twin of the `user`-class gate), acting as that account, in
+ *   creation order — the order the sign-ins would have run the hook in,
+ *   so arm 4 hands an unclaimed organization to its first sign-in and
+ *   not to whoever sorts first by id — and the marker is written after
+ *   the last account. A fault propagates and the boot fails loudly (the
+ *   storage stage's posture) with the marker unset; the grant path is
+ *   idempotent and an organization already held is skipped, so the next
+ *   boot converges. The marker, not "zero rows", is what makes it
+ *   one-shot: a database whose every role was revoked after the marker is
+ *   never handed back to anyone by a reboot (plan finding 2's reason,
+ *   applied to the whole store). Accounts are read through the generic
+ *   Store as the organizations and blueprints are (Q-S4-5) — the account
+ *   port carries no enumeration, by its own rule that a port does not
+ *   carry a method only one edition calls, and this act is open source's.
+ *
  * What a creator stamp is. The rules read `status.audit.spec_audit
  * .created_by.id` off organizations and blueprints. That stamp is the
  * caller's identityId at the time: a provisioned caller's ACCOUNT id, an
@@ -84,6 +109,7 @@
 import type { DescMessage } from "@bufbuild/protobuf";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import type { Store } from "../../store/interface.js";
 import type { AccountCreatedHook } from "../identityaccount/provisioning.js";
 import type { IamPolicyGrantPath } from "./grant-path.js";
@@ -99,6 +125,8 @@ export interface MembershipRulesDeps {
 export interface MembershipRules extends AccountCreatedHook {
     /** The trusted-local boot ensure: `owner` wherever no owner row exists. */
     ensureOperatorOwnership(operator: IdentityAccount): Promise<void>;
+    /** The built-in posture's boot reconciliation: the arms for every person provisioned before the rules existed, once per database. */
+    ensureRolesForExistingAccounts(): Promise<void>;
 }
 /**
  * The schemas the creator scan decodes with: the organization and every
@@ -107,5 +135,48 @@ export interface MembershipRules extends AccountCreatedHook {
  * of being skipped.
  */
 export declare const CREATOR_SCAN_SCHEMAS: ReadonlyMap<ApiResourceKind, DescMessage>;
+/** What the scan keeps of a resource: its id, its organization (blueprints), its creator stamp. */
+export interface ScannedResource {
+    readonly id: string;
+    readonly org: string;
+    readonly createdBy: string;
+}
+/**
+ * A creator stamp that names a person: non-empty and not the unconfigured
+ * laptop's placeholder. Exported for the built-in authorizer's derivation
+ * (authorization/derived-tuples.ts), which turns a stamp into an owner or
+ * creator tuple only when this says the stamp is somebody's — the one
+ * predicate, read from the module that owns the doctrine above.
+ */
+export declare function isPersonStamp(stamp: string): boolean;
+/**
+ * An account row that is a person's — the row-level twin of the hook's
+ * `user`-class gate, for the reconciliation, which has a row and no
+ * caller. A machine account (`is_machine_account`, or the `machine`
+ * provisioning mode) earns no role, exactly as a `machine`-class caller
+ * earns none at the hook.
+ */
+export declare function isPersonAccount(account: IdentityAccount): boolean;
+/** One organization's question for one account: everything the five arms read, resolved by the caller. */
+export interface RoleQuestion {
+    readonly accountId: string;
+    /** The account's issuer subject (`spec.idp_id`); a stamp equal to it is the account's own (the alias rule). */
+    readonly subject: string;
+    readonly email: string;
+    /** STIGMER_OPERATOR_EMAIL as configured; "" matches nobody. */
+    readonly operatorEmail: string;
+    readonly organization: ScannedResource;
+    readonly blueprintsInOrganization: ReadonlyArray<ScannedResource>;
+    /** Whether ANY role row exists on the organization — arm 4's "zero rows", read by the caller through the port. */
+    readonly organizationHasRows: boolean;
+}
+/**
+ * The five arms in their ruled order, as one pure function over what they
+ * read — the one statement of "which role does this person get here",
+ * shared by the first-sign-in hook and the boot reconciliation so the two
+ * moments cannot drift. Arms 3 and 4 both answer `admin`; 3 comes first
+ * because it is a string compare and 4 needs the rows read.
+ */
+export declare function roleFor(question: RoleQuestion): IamRole;
 export declare function newMembershipRules(deps: MembershipRulesDeps): MembershipRules;
 //# sourceMappingURL=membership.d.ts.map

package/dist/domain/iampolicy/membership.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membership.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/membership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAStD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAShG,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAE7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,yGAAyG;IACzG,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,kFAAkF;IAClF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD,2EAA2E;IAC3E,uBAAuB,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,eAAe,EAAE,WAAW,CASvE,CAAC;AAiBL,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,GAAG,eAAe,CAuH7E"}
+{"version":3,"file":"membership.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/membership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2GG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAStD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAGhG,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAQpE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAGtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAE7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,yGAAyG;IACzG,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,kFAAkF;IAClF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD,2EAA2E;IAC3E,uBAAuB,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,qIAAqI;IACrI,8BAA8B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,eAAe,EAAE,WAAW,CASvE,CAAC;AAKL,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAOjE;AAED,0GAA0G;AAC1G,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+GAA+G;IAC/G,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,wBAAwB,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAClE,kHAAkH;IAClH,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;CACvC;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CA6BvD;AAiBD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,GAAG,eAAe,CAiL7E"}

package/dist/domain/iampolicy/membership.js

@@ -6,13 +6,17 @@ import { ScheduleSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/a
 import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
 import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
 import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
 import { kindEnumName } from "../../pipeline/apiresource-meta.js";
 import { SYSTEM_OPERATOR_IDENTITY_ID } from "../../pipeline/interceptors/auth.js";
 import { auditOf } from "../../pipeline/steps/defaults.js";
 import { metadataOf } from "../../pipeline/steps/shapes.js";
-import { BLUEPRINT_KINDS } from "./constants.js";
+import { rfc3339Seconds } from "../../store/rfc3339.js";
+import { accountAsCaller } from "../identityaccount/actor.js";
+import { BLUEPRINT_KINDS, ROLES_RECONCILED_KEY } from "./constants.js";
 import { organizationRole, relationOf } from "./specs.js";
 /**
  * The schemas the creator scan decodes with: the organization and every
@@ -31,10 +35,65 @@ export const CREATOR_SCAN_SCHEMAS = new Map([
 ]);
 const ORGANIZATION = kindEnumName(ApiResourceKind.organization);
 const IDENTITY_ACCOUNT = kindEnumName(ApiResourceKind.identity_account);
-/** A creator stamp that names a person: non-empty and not the unconfigured laptop's placeholder. */
-function isPersonStamp(stamp) {
+/**
+ * A creator stamp that names a person: non-empty and not the unconfigured
+ * laptop's placeholder. Exported for the built-in authorizer's derivation
+ * (authorization/derived-tuples.ts), which turns a stamp into an owner or
+ * creator tuple only when this says the stamp is somebody's — the one
+ * predicate, read from the module that owns the doctrine above.
+ */
+export function isPersonStamp(stamp) {
     return stamp !== "" && stamp !== SYSTEM_OPERATOR_IDENTITY_ID;
 }
+/**
+ * An account row that is a person's — the row-level twin of the hook's
+ * `user`-class gate, for the reconciliation, which has a row and no
+ * caller. A machine account (`is_machine_account`, or the `machine`
+ * provisioning mode) earns no role, exactly as a `machine`-class caller
+ * earns none at the hook.
+ */
+export function isPersonAccount(account) {
+    const spec = account.spec;
+    return (spec !== undefined &&
+        !spec.isMachineAccount &&
+        spec.provisioningMode !== IdentityAccountProvisioningMode.machine);
+}
+/**
+ * The five arms in their ruled order, as one pure function over what they
+ * read — the one statement of "which role does this person get here",
+ * shared by the first-sign-in hook and the boot reconciliation so the two
+ * moments cannot drift. Arms 3 and 4 both answer `admin`; 3 comes first
+ * because it is a string compare and 4 needs the rows read.
+ */
+export function roleFor(question) {
+    const { accountId, subject, email, operatorEmail, organization, blueprintsInOrganization, organizationHasRows, } = question;
+    const isMine = (stamp) => stamp !== "" && (stamp === subject || stamp === accountId);
+    if (isMine(organization.createdBy)) {
+        return IamRole.owner;
+    }
+    if (blueprintsInOrganization.some((b) => isMine(b.createdBy))) {
+        return IamRole.admin;
+    }
+    if (operatorEmail !== "" && email === operatorEmail) {
+        return IamRole.admin;
+    }
+    const anotherPersonStamped = [
+        organization.createdBy,
+        ...blueprintsInOrganization.map((b) => b.createdBy),
+    ].some((stamp) => isPersonStamp(stamp) && !isMine(stamp));
+    if (!anotherPersonStamped && !organizationHasRows) {
+        return IamRole.admin;
+    }
+    return IamRole.member;
+}
+/** `spec_audit.created_at` in epoch milliseconds; a row with no stamp sorts first (it is the oldest thing we know nothing about). */
+function createdAtMillisOf(account) {
+    const stamp = account.status?.audit?.specAudit?.createdAt;
+    if (stamp === undefined) {
+        return Number.NEGATIVE_INFINITY;
+    }
+    return Number(stamp.seconds) * 1000 + Math.floor(stamp.nanos / 1_000_000);
+}
 export function newMembershipRules(deps) {
     const { grantPath, policies, store, operatorEmail } = deps;
     async function scan(kind) {
@@ -67,59 +126,104 @@ export function newMembershipRules(deps) {
             .filter((row) => row.spec?.resource?.kind === ORGANIZATION)
             .map((row) => row.spec?.resource?.id ?? ""));
     }
+    /** The whole world one pass reads, scanned once: every organization and every blueprint. */
+    async function scanWorld() {
+        return {
+            organizations: await scan(ApiResourceKind.organization),
+            blueprints: await scanBlueprints(),
+        };
+    }
+    /**
+     * The arms for ONE account over a scanned world: a row on every
+     * organization the account holds none on, granted as `caller`. Shared
+     * by the hook (one account, the world scanned for it) and the
+     * reconciliation (the world scanned once for every account).
+     */
+    async function applyRulesTo(account, caller, world) {
+        const accountId = account.metadata?.id ?? "";
+        if (accountId === "") {
+            throw new Error("membership rules: the account carries no id");
+        }
+        const subject = account.spec?.idpId ?? "";
+        const email = account.spec?.email ?? "";
+        const held = await organizationsHeldBy(accountId);
+        for (const organization of world.organizations) {
+            if (held.has(organization.id)) {
+                continue;
+            }
+            const blueprintsInOrganization = world.blueprints.filter((blueprint) => blueprint.org === organization.id);
+            const role = roleFor({
+                accountId,
+                subject,
+                email,
+                operatorEmail,
+                organization,
+                blueprintsInOrganization,
+                organizationHasRows: (await policies.findByResource(ORGANIZATION, organization.id))
+                    .length > 0,
+            });
+            await grantPath.grant(organizationRole(accountId, role, organization.id), caller);
+        }
+    }
+    /** Every person account the store holds, oldest first (creation stamp, then id) — the order their sign-ins ran in. */
+    async function scanPersonAccounts() {
+        const rows = await store.listResources(ApiResourceKind.identity_account);
+        return rows
+            .map((bytes) => fromBinary(IdentityAccountSchema, bytes))
+            .filter(isPersonAccount)
+            .sort((a, b) => {
+            const byCreation = createdAtMillisOf(a) - createdAtMillisOf(b);
+            if (byCreation !== 0) {
+                return byCreation;
+            }
+            return (a.metadata?.id ?? "").localeCompare(b.metadata?.id ?? "");
+        });
+    }
     return {
         async onAccountCreated(account, caller) {
             if (caller.callerClass !== "user") {
                 return;
             }
-            const accountId = account.metadata?.id ?? "";
-            if (accountId === "") {
+            if ((account.metadata?.id ?? "") === "") {
                 throw new Error("membership rules: the provisioned account carries no id");
             }
             const organizations = await scan(ApiResourceKind.organization);
             if (organizations.length === 0) {
                 return;
             }
-            const subject = account.spec?.idpId ?? "";
-            const email = account.spec?.email ?? "";
-            const isMine = (stamp) => stamp !== "" && (stamp === subject || stamp === accountId);
-            const held = await organizationsHeldBy(accountId);
-            const blueprints = await scanBlueprints();
-            for (const organization of organizations) {
-                if (held.has(organization.id)) {
-                    continue;
-                }
-                const inOrganization = blueprints.filter((blueprint) => blueprint.org === organization.id);
-                let role;
-                if (isMine(organization.createdBy)) {
-                    role = IamRole.owner;
-                }
-                else if (inOrganization.some((b) => isMine(b.createdBy))) {
-                    role = IamRole.admin;
-                }
-                else if (operatorEmail !== "" && email === operatorEmail) {
-                    role = IamRole.admin;
-                }
-                else if (![
-                    organization.createdBy,
-                    ...inOrganization.map((b) => b.createdBy),
-                ].some((stamp) => isPersonStamp(stamp) && !isMine(stamp)) &&
-                    (await policies.findByResource(ORGANIZATION, organization.id))
-                        .length === 0) {
-                    role = IamRole.admin;
-                }
-                else {
-                    role = IamRole.member;
+            await applyRulesTo(account, caller, {
+                organizations,
+                blueprints: await scanBlueprints(),
+            });
+        },
+        async ensureRolesForExistingAccounts() {
+            if ((await store.bootstrapState.get(ROLES_RECONCILED_KEY)) !== "") {
+                return;
+            }
+            const accounts = await scanPersonAccounts();
+            if (accounts.length > 0) {
+                const world = await scanWorld();
+                for (const account of accounts) {
+                    // As the account itself (actor.ts, the one construction), so the
+                    // row's audit actor reads exactly as the person's own first
+                    // sign-in would have stamped it.
+                    await applyRulesTo(account, accountAsCaller(account), world);
                 }
-                await grantPath.grant(organizationRole(accountId, role, organization.id), caller);
             }
+            // After the last account, never before: a fault above leaves the
+            // marker unset and the next boot converges (the grant path is
+            // idempotent; an organization already held is skipped).
+            await store.bootstrapState.set(ROLES_RECONCILED_KEY, rfc3339Seconds(new Date()));
         },
         async ensureOperatorOwnership(operator) {
             const accountId = operator.metadata?.id ?? "";
             if (accountId === "") {
                 throw new Error("membership rules: the operator account carries no id");
             }
-            const actor = operatorActor(operator, accountId);
+            // The operator acting as its account (domain/identityaccount/actor.ts,
+            // the one construction): the row's audit actor is the account,
+            // named the way every other trusted-local write names it.
+            const actor = accountAsCaller(operator);
             for (const organization of await scan(ApiResourceKind.organization)) {
                 const owners = await policies.findByResourceWithRelations(ORGANIZATION, organization.id, [relationOf(IamRole.owner)]);
                 if (owners.length > 0) {
@@ -130,23 +234,4 @@ export function newMembershipRules(deps) {
         },
     };
 }
-/**
- * The operator acting as its account: the trusted-local identity shape
- * (pipeline/interceptors/auth.ts trustedLocalIdentityFor — no issuer, no
- * token; email and display name only when known) with the account id as
- * the principal, so the row's audit actor is the account, named the way
- * every other trusted-local write names it.
- */
-function operatorActor(operator, accountId) {
-    const email = operator.spec?.email ?? "";
-    const displayName = operator.metadata?.name ?? "";
-    return {
-        identityId: accountId,
-        callerClass: "user",
-        issuer: "",
-        rawToken: "",
-        ...(email !== "" ? { email } : {}),
-        ...(displayName !== "" ? { displayName } : {}),
-    };
-}
 //# sourceMappingURL=membership.js.map

package/dist/domain/iampolicy/membership.js.map

@@ -1 +1 @@
-{"version":3,"file":"membership.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/membership.ts"],"names":[],"mappings":"AAoFA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAG/F,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAG5D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAiB1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAC/B,IAAI,GAAG,CAA+B;IACpC,CAAC,eAAe,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAClD,CAAC,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC;IACpC,CAAC,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC;IAC1C,CAAC,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC;IACpC,CAAC,eAAe,CAAC,UAAU,EAAE,eAAe,CAAC;IAC7C,CAAC,eAAe,CAAC,WAAW,EAAE,iBAAiB,CAAC;IAChD,CAAC,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC;CAC3C,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;AAChE,MAAM,gBAAgB,GAAG,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;AASxE,oGAAoG;AACpG,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,2BAA2B,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAyB;IAC1D,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAE3D,KAAK,UAAU,IAAI,CAAC,IAAqB;QACvC,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,uBAAuB,YAAY,CAAC,IAAI,CAAC,4BAA4B,CACtE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACxB,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO;gBACL,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE;gBACtB,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE;gBACxB,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE;aACrE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,cAAc;QAC3B,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,oFAAoF;IACpF,KAAK,UAAU,mBAAmB,CAChC,SAAiB;QAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QACzE,OAAO,IAAI,GAAG,CACZ,IAAI;aACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,YAAY,CAAC;aAC1D,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAC9C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM;YACpC,IAAI,MAAM,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;gBAClC,OAAO;YACT,CAAC;YACD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YAC7C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;YAC/D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAW,EAAE,CACxC,KAAK,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC;YAC7D,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC;YAClD,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;YAE1C,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;gBACzC,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC9B,SAAS;gBACX,CAAC;gBACD,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CACtC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,YAAY,CAAC,EAAE,CACjD,CAAC;gBACF,IAAI,IAAa,CAAC;gBAClB,IAAI,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;oBACnC,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;gBACvB,CAAC;qBAAM,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;oBAC3D,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;gBACvB,CAAC;qBAAM,IAAI,aAAa,KAAK,EAAE,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;oBAC3D,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;gBACvB,CAAC;qBAAM,IACL,CAAC;oBACC,YAAY,CAAC,SAAS;oBACtB,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;iBAC1C,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACzD,CAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;yBAC3D,MAAM,KAAK,CAAC,EACf,CAAC;oBACD,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;gBACvB,CAAC;qBAAM,CAAC;oBACN,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;gBACxB,CAAC;gBACD,MAAM,SAAS,CAAC,KAAK,CACnB,gBAAgB,CAAC,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC,EAClD,MAAM,CACP,CAAC;YACJ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,uBAAuB,CAAC,QAAQ;YACpC,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACjD,KAAK,MAAM,YAAY,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;gBACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,2BAA2B,CACvD,YAAY,EACZ,YAAY,CAAC,EAAE,EACf,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAC5B,CAAC;gBACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtB,SAAS;gBACX,CAAC;gBACD,MAAM,SAAS,CAAC,KAAK,CACnB,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC,EAC3D,KAAK,CACN,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CACpB,QAAyB,EACzB,SAAiB;IAEjB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;IAClD,OAAO;QACL,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,MAAM;QACnB,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,EAAE;QACZ,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"membership.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/membership.ts"],"names":[],"mappings":"AA6GA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AACjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAC5G,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAG/F,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAmB1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAC/B,IAAI,GAAG,CAA+B;IACpC,CAAC,eAAe,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAClD,CAAC,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC;IACpC,CAAC,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC;IAC1C,CAAC,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC;IACpC,CAAC,eAAe,CAAC,UAAU,EAAE,eAAe,CAAC;IAC7C,CAAC,eAAe,CAAC,WAAW,EAAE,iBAAiB,CAAC;IAChD,CAAC,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC;CAC3C,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;AAChE,MAAM,gBAAgB,GAAG,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;AASxE;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,2BAA2B,CAAC;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,OAAwB;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,OAAO,CACL,IAAI,KAAK,SAAS;QAClB,CAAC,IAAI,CAAC,gBAAgB;QACtB,IAAI,CAAC,gBAAgB,KAAK,+BAA+B,CAAC,OAAO,CAClE,CAAC;AACJ,CAAC;AAgBD;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,QAAsB;IAC5C,MAAM,EACJ,SAAS,EACT,OAAO,EACP,KAAK,EACL,aAAa,EACb,YAAY,EACZ,wBAAwB,EACxB,mBAAmB,GACpB,GAAG,QAAQ,CAAC;IACb,MAAM,MAAM,GAAG,CAAC,KAAa,EAAW,EAAE,CACxC,KAAK,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,IAAI,aAAa,KAAK,EAAE,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QACpD,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,MAAM,oBAAoB,GAAG;QAC3B,YAAY,CAAC,SAAS;QACtB,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;KACpD,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,oBAAoB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClD,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC;AAQD,qIAAqI;AACrI,SAAS,iBAAiB,CAAC,OAAwB;IACjD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;IAC1D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,iBAAiB,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAyB;IAC1D,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAE3D,KAAK,UAAU,IAAI,CAAC,IAAqB;QACvC,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,uBAAuB,YAAY,CAAC,IAAI,CAAC,4BAA4B,CACtE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACxB,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO;gBACL,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE;gBACtB,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE;gBACxB,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE;aACrE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,cAAc;QAC3B,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,oFAAoF;IACpF,KAAK,UAAU,mBAAmB,CAChC,SAAiB;QAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QACzE,OAAO,IAAI,GAAG,CACZ,IAAI;aACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,YAAY,CAAC;aAC1D,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAC9C,CAAC;IACJ,CAAC;IAED,4FAA4F;IAC5F,KAAK,UAAU,SAAS;QACtB,OAAO;YACL,aAAa,EAAE,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC;YACvD,UAAU,EAAE,MAAM,cAAc,EAAE;SACnC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,YAAY,CACzB,OAAwB,EACxB,MAAsB,EACtB,KAAmB;QAEnB,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAElD,KAAK,MAAM,YAAY,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC9B,SAAS;YACX,CAAC;YACD,MAAM,wBAAwB,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CACtD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,YAAY,CAAC,EAAE,CACjD,CAAC;YACF,MAAM,IAAI,GAAG,OAAO,CAAC;gBACnB,SAAS;gBACT,OAAO;gBACP,KAAK;gBACL,aAAa;gBACb,YAAY;gBACZ,wBAAwB;gBACxB,mBAAmB,EACjB,CAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;qBAC3D,MAAM,GAAG,CAAC;aAChB,CAAC,CAAC;YACH,MAAM,SAAS,CAAC,KAAK,CACnB,gBAAgB,CAAC,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC,EAClD,MAAM,CACP,CAAC;QACJ,CAAC;IACH,CAAC;IAED,sHAAsH;IACtH,KAAK,UAAU,kBAAkB;QAC/B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;QACzE,OAAO,IAAI;aACR,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;aACxD,MAAM,CAAC,eAAe,CAAC;aACvB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACb,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC/D,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;gBACrB,OAAO,UAAU,CAAC;YACpB,CAAC;YACD,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACP,CAAC;IAED,OAAO;QACL,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM;YACpC,IAAI,MAAM,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;gBAClC,OAAO;YACT,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;YAC/D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,OAAO;YACT,CAAC;YACD,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE;gBAClC,aAAa;gBACb,UAAU,EAAE,MAAM,cAAc,EAAE;aACnC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,8BAA8B;YAClC,IAAI,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBAClE,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC5C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;gBAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC/B,iEAAiE;oBACjE,4DAA4D;oBAC5D,iCAAiC;oBACjC,MAAM,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;YACD,iEAAiE;YACjE,8DAA8D;YAC9D,wDAAwD;YACxD,MAAM,KAAK,CAAC,cAAc,CAAC,GAAG,CAC5B,oBAAoB,EACpB,cAAc,CAAC,IAAI,IAAI,EAAE,CAAC,CAC3B,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,uBAAuB,CAAC,QAAQ;YACpC,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC1E,CAAC;YACD,uEAAuE;YACvE,+DAA+D;YAC/D,0DAA0D;YAC1D,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YACxC,KAAK,MAAM,YAAY,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;gBACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,2BAA2B,CACvD,YAAY,EACZ,YAAY,CAAC,EAAE,EACf,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAC5B,CAAC;gBACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtB,SAAS;gBACX,CAAC;gBACD,MAAM,SAAS,CAAC,KAAK,CACnB,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC,EAC3D,KAAK,CACN,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/identityaccount/actor.d.ts

@@ -0,0 +1,41 @@
+/**
+ * An account acting as itself — the ONE place server code builds the
+ * caller identity for a person it has resolved from a row rather than
+ * from the token that person presented. Two constructions, one shape:
+ * the account id is the principal, so the audit actor on every write
+ * names the account the way every other write names it, and email and
+ * display name ride along when the row knows them (the trusted-local
+ * identity's shape, pipeline/interceptors/auth.ts).
+ *
+ * `accountAsCaller(account)` — the IN-PROCESS lane: no issuer, no token,
+ * class `user`. Two consumers: the trusted-local boot ensure, which
+ * grants the operator ownership AS their account
+ * (domain/iampolicy/membership.ts), and the built-in schedule fire
+ * caller, which makes a fire act as the schedule's creator
+ * (authorization/schedule-fire-caller.ts). Both ride the in-process
+ * transport, whose interceptor stamps `origin: "in-process"` on top —
+ * the transport-trust marker is never set here.
+ *
+ * `accountAsRunnerCaller(account, rawToken)` — the WIRE lane: the
+ * runner-subject verifier (runnerauth/runner-subject-verifier.ts) admits
+ * the bearer of a run credential as the human whose run it is. Class
+ * `runner`, because the Authorizer's lane admission and the memory
+ * capture gate must tell a runner acting as a person from the person
+ * (extensions/identity.ts names the class for exactly this), and the
+ * verified token carried, because the provider's capabilities re-read the
+ * binding off `rawToken` (the cloud's own pattern) — one HMAC, no store
+ * read. No issuer: the server signed it.
+ *
+ * Why not a token for the in-process lane: open source mints no
+ * credential for a person the server is composing a request for; the
+ * identity is what the propagation header carries, and every consumer
+ * that reads a subject off the raw token (`idpIdOf`) is reached only
+ * through `accountForCaller`, which resolves this identity by its id
+ * first and never asks the token. The same holds for the runner lane:
+ * our token carries no `sub`, and nothing downstream needs one.
+ */
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import type { CallerIdentity } from "../../extensions/identity.js";
+export declare function accountAsCaller(account: IdentityAccount): CallerIdentity;
+export declare function accountAsRunnerCaller(account: IdentityAccount, rawToken: string): CallerIdentity;
+//# sourceMappingURL=actor.d.ts.map

package/dist/domain/identityaccount/actor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/actor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAEhG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,wBAAgB,eAAe,CAAC,OAAO,EAAE,eAAe,GAAG,cAAc,CAOxE;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,MAAM,GACf,cAAc,CAYhB"}

package/dist/domain/identityaccount/actor.js

@@ -0,0 +1,34 @@
+export function accountAsCaller(account) {
+    return {
+        ...principalOf(account),
+        callerClass: "user",
+        issuer: "",
+        rawToken: "",
+    };
+}
+export function accountAsRunnerCaller(account, rawToken) {
+    if (rawToken === "") {
+        throw new Error("a runner caller carries the credential it presented — refusing to build one with none");
+    }
+    return {
+        ...principalOf(account),
+        callerClass: "runner",
+        issuer: "",
+        rawToken,
+    };
+}
+/** The account id as principal, with the display identity the row knows. */
+function principalOf(account) {
+    const accountId = account.metadata?.id ?? "";
+    if (accountId === "") {
+        throw new Error("identity account carries no id — refusing to build a caller for an empty principal");
+    }
+    const email = account.spec?.email ?? "";
+    const displayName = account.metadata?.name ?? "";
+    return {
+        identityId: accountId,
+        ...(email !== "" ? { email } : {}),
+        ...(displayName !== "" ? { displayName } : {}),
+    };
+}
+//# sourceMappingURL=actor.js.map

package/dist/domain/identityaccount/actor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/actor.ts"],"names":[],"mappings":"AAwCA,MAAM,UAAU,eAAe,CAAC,OAAwB;IACtD,OAAO;QACL,GAAG,WAAW,CAAC,OAAO,CAAC;QACvB,WAAW,EAAE,MAAM;QACnB,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAwB,EACxB,QAAgB;IAEhB,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,WAAW,CAAC,OAAO,CAAC;QACvB,WAAW,EAAE,QAAQ;QACrB,MAAM,EAAE,EAAE;QACV,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAClB,OAAwB;IAExB,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;IACjD,OAAO;QACL,UAAU,EAAE,SAAS;QACrB,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;AACJ,CAAC"}

package/dist/domain/identityaccount/resolve.d.ts

@@ -41,6 +41,19 @@
  * cannot answer the same question two ways. A credential naming no
  * subject is `undefined` with no second read: the store is never asked
  * about "".
+ *
+ * The third reading is a ROW's creator stamp, `accountForStamp`: the
+ * account a `created_by.id` names, read the two ways a stamp has been
+ * written — as an account id (rows stamped since 3.15.0) and as the raw
+ * issuer subject (rows the 3.14.x verifiers stamped) — in
+ * `accountForCaller`'s order. Two lanes make the server act as the
+ * person a row names: the built-in schedule fire caller (a fire acts as
+ * the schedule's creator) and the runner-subject verifier (a run
+ * credential admits its bearer as the execution's creator). Stated here
+ * so they cannot resolve one stamp two ways; each decides for itself
+ * what "nobody" means (the fire caller's deterministic refusal, the
+ * verifier's liveness sentence), so this function answers `undefined`
+ * and never throws for it. The empty stamp is `undefined` with no read.
  */
 import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
 import type { CallerIdentity } from "../../extensions/identity.js";
@@ -56,4 +69,10 @@ export declare function identityIdForSubject(accounts: AccountsBySubject, subjec
  * Faults propagate as they are — the caller decides the wire shape.
  */
 export declare function accountForCaller(accounts: AccountsByCaller, caller: CallerIdentity): Promise<IdentityAccount | undefined>;
+/**
+ * The account a row's creator stamp names, or `undefined` when it names
+ * nobody (the laptop's `"system"`, a trusted-local email, a deleted
+ * account, the empty stamp). Faults propagate as they are.
+ */
+export declare function accountForStamp(accounts: AccountsByCaller, stamp: string): Promise<IdentityAccount | undefined>;
 //# sourceMappingURL=resolve.d.ts.map

package/dist/domain/identityaccount/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAEhG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,uFAAuF;AACvF,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;AAEhF,mFAAmF;AACnF,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,oBAAoB,EACpB,UAAU,GAAG,mBAAmB,CACjC,CAAC;AAEF,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAUtC"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAEhG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,uFAAuF;AACvF,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;AAEhF,mFAAmF;AACnF,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,oBAAoB,EACpB,UAAU,GAAG,mBAAmB,CACjC,CAAC;AAEF,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAUtC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAQtC"}

package/dist/domain/identityaccount/resolve.js

@@ -26,4 +26,16 @@ export async function accountForCaller(accounts, caller) {
     }
     return accounts.findDirectByIdpId(subject);
 }
+/**
+ * The account a row's creator stamp names, or `undefined` when it names
+ * nobody (the laptop's `"system"`, a trusted-local email, a deleted
+ * account, the empty stamp). Faults propagate as they are.
+ */
+export async function accountForStamp(accounts, stamp) {
+    if (stamp === "") {
+        return undefined;
+    }
+    return ((await accounts.findById(stamp)) ??
+        (await accounts.findDirectByIdpId(stamp)));
+}
 //# sourceMappingURL=resolve.js.map

package/dist/domain/identityaccount/resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/resolve.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAYzC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAA2B,EAC3B,OAAe;IAEf,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,iCAAiC,OAAO,wDAAwD,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAA0B,EAC1B,MAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/resolve.ts"],"names":[],"mappings":"AA4DA,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAYzC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAA2B,EAC3B,OAAe;IAEf,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,iCAAiC,OAAO,wDAAwD,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAA0B,EAC1B,MAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAA0B,EAC1B,KAAa;IAEb,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,CACL,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAC1C,CAAC;AACJ,CAAC"}

package/dist/domain/mcpserver/connect-execution-id.d.ts

@@ -0,0 +1,5 @@
+/** One connect's execution id: the server it discovers plus eight hex of entropy per attempt. */
+export declare function newConnectExecutionId(mcpServerId: string): string;
+/** Whether `executionId` is a connect's — the runner-credential lane's recognition of the third binding. */
+export declare function isConnectExecutionId(executionId: string): boolean;
+//# sourceMappingURL=connect-execution-id.d.ts.map

package/dist/domain/mcpserver/connect-execution-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-execution-id.d.ts","sourceRoot":"","sources":["../../../src/domain/mcpserver/connect-execution-id.ts"],"names":[],"mappings":"AAyBA,iGAAiG;AACjG,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,4GAA4G;AAC5G,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAEjE"}

package/dist/domain/mcpserver/connect-execution-id.js

@@ -0,0 +1,32 @@
+/**
+ * The synthetic execution id of an MCP connect — the ONE home for its
+ * shape, built here by the connect lane and recognized here by the
+ * runner-credential lane, so the two can never drift apart.
+ *
+ * A connect is not an execution: it has no AgentExecution or
+ * WorkflowExecution row. What it has is an ephemeral ExecutionContext
+ * (connect.ts `createConnectExecutionContext`) whose `spec.execution_id`
+ * must name SOMETHING for the decrypt lane's binding check
+ * (executioncontext/resolve-values-for-caller.ts: the token's
+ * `execution_id` claim must equal the EC's), and this id is that
+ * something — an id that names no resource kind, so the contract's
+ * `kind_meta` prefix table (pipeline/apiresource-meta.ts) cannot mistake
+ * it for a row. The runner-credential lane reads it the other way round
+ * (runnerauth/bound-execution.ts `boundExecutionKindOf`): an id this
+ * predicate recognizes is a connect binding, resolved through the EC row
+ * whose `spec.execution_id` it is. Keep the builder and the predicate
+ * together; a second copy of the prefix anywhere would be the drift this
+ * module exists to prevent.
+ */
+import { randomUUID } from "node:crypto";
+/** The prefix every connect execution id carries — no resource kind's id starts with it. */
+const CONNECT_EXECUTION_ID_PREFIX = "connect-";
+/** One connect's execution id: the server it discovers plus eight hex of entropy per attempt. */
+export function newConnectExecutionId(mcpServerId) {
+    return `${CONNECT_EXECUTION_ID_PREFIX}${mcpServerId}-${randomUUID().slice(0, 8)}`;
+}
+/** Whether `executionId` is a connect's — the runner-credential lane's recognition of the third binding. */
+export function isConnectExecutionId(executionId) {
+    return executionId.startsWith(CONNECT_EXECUTION_ID_PREFIX);
+}
+//# sourceMappingURL=connect-execution-id.js.map

package/dist/domain/mcpserver/connect-execution-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-execution-id.js","sourceRoot":"","sources":["../../../src/domain/mcpserver/connect-execution-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,4FAA4F;AAC5F,MAAM,2BAA2B,GAAG,UAAU,CAAC;AAE/C,iGAAiG;AACjG,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,OAAO,GAAG,2BAA2B,GAAG,WAAW,IAAI,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,WAAW,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;AAC7D,CAAC"}