@stigmer/server 3.40.1 → 3.41.0

package/dist/extensions/resource-authorization.d.ts

@@ -52,6 +52,17 @@
  *     before the row mirror existed.
  * Absent method = no mirror is written (the OSS posture: rows are the
  * record).
+ *
+ * One more structural relation rides the seam the way `default_of` does:
+ * a workflow instance's run audience, `execution_viewer`, which open
+ * source derives from `spec.execution_visibility` when a check asks
+ * (authorization/model/execution-viewer.ts) and an edition that stores
+ * tuples must write. `onExecutionVisibilityChanged` hands the driver the
+ * audience the stored level names, from the two doors that may set it
+ * (create, and updateExecutionVisibility; Update and Apply keep the
+ * stored level, domain/workflowinstance/steps.ts). Synchronous,
+ * post-persist; a throw fails the request with the level persisted, and a
+ * retry converges because the event is the whole target state.
  */
 import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { OwnerAttributionType } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
@@ -69,6 +80,15 @@ import type { CallerIdentity } from "./identity.js";
  * reaches every account.
  */
 export type VisibilityTupleShape = "org-viewer" | "platform-viewer";
+/**
+ * The run-audience shapes of a workflow instance's execution visibility,
+ * named edition-neutrally. The driver maps each to its tuple:
+ *   - org-viewer: <instanceKind>:<id>#execution_viewer@organization:<org>#viewer
+ * The same word as the resource visibility's org shape, a different
+ * relation: making an instance's RUNS observable never widens who can see
+ * or run the instance itself (fga/model/agentic/workflow_instance.fga).
+ */
+export type ExecutionAudienceShape = "org-viewer";
 /**
  * One resolved structural link from the created resource to a parent
  * object — the scope link (relation `organization` for ORGANIZATION
@@ -153,6 +173,8 @@ export interface VisibilityChangedEvent {
     readonly kind: ApiResourceKind;
     readonly resourceId: string;
     readonly orgId: string;
+    /** Who changed the visibility — the audience rows a driver writes are theirs to answer for. */
+    readonly caller: CallerIdentity;
     /** Shapes present in the new level but not the old — to be written. */
     readonly shapesToCreate: ReadonlyArray<VisibilityTupleShape>;
     /** Shapes present in the old level but not the new — to be deleted. */
@@ -176,6 +198,21 @@ export interface DefaultInstanceLinkedEvent {
     readonly blueprintKind: ApiResourceKind;
     readonly blueprintId: string;
 }
+/**
+ * Fired synchronously after a workflow instance's
+ * `spec.execution_visibility` is persisted at create (only when the level
+ * names an audience) or by updateExecutionVisibility (always). `shapes` is
+ * the audience the stored level names — ["org-viewer"] for ORGANIZATION,
+ * [] for PRIVATE and unset — never a diff: the driver makes its tuples
+ * match it, so a retry, a repeat, or a transition whose old level it never
+ * saw all converge.
+ */
+export interface ExecutionVisibilityChangedEvent {
+    readonly instanceKind: ApiResourceKind;
+    readonly instanceId: string;
+    readonly orgId: string;
+    readonly shapes: ReadonlyArray<ExecutionAudienceShape>;
+}
 /**
  * Fired synchronously AFTER an IamPolicy row is persisted by the domain's
  * grant path — and on the duplicate arm, when the triple was already held
@@ -199,6 +236,21 @@ export interface PolicyRevokedEvent {
     readonly spec: IamPolicySpec;
     readonly policy: IamPolicy | undefined;
 }
+/**
+ * A person's organization rows are about to change, or have changed. The
+ * model's `organization#affiliated` (fga/model/tenancy/organization.fga)
+ * stands exactly while the person holds at least one row on the
+ * organization; the grant path announces every change of those rows and an
+ * edition that stores tuples keeps the relation from the announcements.
+ * The grant path never says whether the person is still affiliated: the
+ * driver derives that from the committed rows, so two changes racing on
+ * one person cannot leave the tuple standing on the word of the one that
+ * read first.
+ */
+export interface OrganizationAffiliationEvent {
+    readonly identityAccountId: string;
+    readonly organizationId: string;
+}
 /**
  * The driver interface (single-instance point, registered via
  * ExtensionDrivers.resourceAuthorizationLifecycle). Implementations must
@@ -216,6 +268,13 @@ export interface ResourceAuthorizationLifecycle {
      * (the OSS posture: local access control needs none).
      */
     onDefaultInstanceLinked?(event: DefaultInstanceLinkedEvent): Promise<void>;
+    /**
+     * OPTIONAL (stigmer-cloud#720): synchronous, post-persist; a throw fails
+     * the request (the level survives — retry converges, the event is the
+     * target state). Absent method = no run-audience tuple is written (the
+     * OSS posture: the relation is derived from the row at check time).
+     */
+    onExecutionVisibilityChanged?(event: ExecutionVisibilityChangedEvent): Promise<void>;
     /**
      * OPTIONAL (added 20260913.01 slice 2): synchronous, AFTER the row
      * persist, on the duplicate arm too; a throw fails the grant with the
@@ -228,5 +287,24 @@ export interface ResourceAuthorizationLifecycle {
      * rows are the record (the OSS posture).
      */
     onPolicyRevoked?(event: PolicyRevokedEvent): Promise<void>;
+    /**
+     * OPTIONAL: synchronous, BEFORE a row naming an account on an
+     * organization is deleted, ahead of that row's `onPolicyRevoked`. A
+     * driver removes the organization's `affiliated` tuple for the account
+     * here, so a crash anywhere after it leaves the person denied, never
+     * admitted. A throw leaves every row in place for the retry. Absent
+     * method = the edition derives the relation from rows (the OSS posture).
+     */
+    onOrganizationAffiliationChanging?(event: OrganizationAffiliationEvent): Promise<void>;
+    /**
+     * OPTIONAL: synchronous, AFTER a row naming an account on an organization
+     * is written (the duplicate arm too, the inline heal) or deleted, and
+     * after a revoke that found no row. A driver re-derives the
+     * organization's `affiliated` tuple for the account from the committed
+     * rows: written while one remains, removed when none does. A throw fails
+     * the request with the rows committed; the next change or the driver's
+     * own reconcile converges. Absent method = as above.
+     */
+    onOrganizationAffiliationChanged?(event: OrganizationAffiliationEvent): Promise<void>;
 }
 //# sourceMappingURL=resource-authorization.d.ts.map

package/dist/extensions/resource-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-authorization.d.ts","sourceRoot":"","sources":["../../src/extensions/resource-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAC3H,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wFAAwF,CAAC;AACnI,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qDAAqD,CAAC;AAEzF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;;;;;GAQG;AACH,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,iBAAiB,CAAC;AAEpE;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,4FAA4F;IAC5F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gCAAgC;IAChC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,uCAAuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,wGAAwG;IACxG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C,8GAA8G;IAC9G,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CACzD;AAED,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;IAChD,kFAAkF;IAClF,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,uDAAuD;IACvD,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACxD;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAChE;AAED,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAC7D,uEAAuE;IACvE,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9D;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,eAAe,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,8BAA8B;IAC7C,iBAAiB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,iBAAiB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,mBAAmB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;OAKG;IACH,uBAAuB,CAAC,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E;;;;OAIG;IACH,eAAe,CAAC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D;;;;OAIG;IACH,eAAe,CAAC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D"}
+{"version":3,"file":"resource-authorization.d.ts","sourceRoot":"","sources":["../../src/extensions/resource-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAC3H,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wFAAwF,CAAC;AACnI,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qDAAqD,CAAC;AAEzF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;;;;;GAQG;AACH,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,iBAAiB,CAAC;AAEpE;;;;;;;GAOG;AACH,MAAM,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAElD;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,4FAA4F;IAC5F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gCAAgC;IAChC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,uCAAuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,wGAAwG;IACxG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C,8GAA8G;IAC9G,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CACzD;AAED,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;IAChD,kFAAkF;IAClF,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,uDAAuD;IACvD,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACxD;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAChE;AAED,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,uEAAuE;IACvE,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAC7D,uEAAuE;IACvE,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9D;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,eAAe,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;CACxD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;CACxC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,8BAA8B;IAC7C,iBAAiB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,iBAAiB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,mBAAmB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;OAKG;IACH,uBAAuB,CAAC,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E;;;;;OAKG;IACH,4BAA4B,CAAC,CAC3B,KAAK,EAAE,+BAA+B,GACrC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;OAIG;IACH,eAAe,CAAC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D;;;;OAIG;IACH,eAAe,CAAC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D;;;;;;;OAOG;IACH,iCAAiC,CAAC,CAChC,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;;;;OAQG;IACH,gCAAgC,CAAC,CAC/B,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB"}

package/dist/extensions/resource-row-reader.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The resource-row-reader driver point: where the built-in authorizer
+ * reads the rows of a kind a unit keeps in a store of its own. Keyed by
+ * kind, registered as `drivers.resourceRowReaders`.
+ *
+ * The built-in authorizer evaluates the one authorization model over the
+ * tuples each row stands for, derived from the row when a check asks
+ * (authorization/derived-tuples.ts). It reads open source's kinds from the
+ * generic Store and identity accounts through the account port. A kind an
+ * edition above open source serves (an identity provider, an invitation,
+ * a team) lives wherever the unit that serves it keeps it, so the unit
+ * says where: it registers a reader for each such kind, and the built-in
+ * loader asks that reader before the generic Store. A unit that keeps its
+ * rows in the generic Store registers a reader over it; one with tables of
+ * its own registers a reader over those. Under a composition's own
+ * Authorizer nothing reads them.
+ *
+ * The contract:
+ *   - `findById` answers the row decoded with the kind's model schema
+ *     (authorization/model/bindings.ts), or undefined when no row has the
+ *     id. Undefined is a real answer: the authorizer then denies, and never
+ *     reports the row missing, for the kinds whose existence it does not
+ *     disclose (authorization/authorizer.ts, NOT_FOUND_EXEMPT_KINDS).
+ *   - A fault it cannot answer through THROWS (the ListReadScope rule: an
+ *     absent row is never an outage in disguise), and the check answers
+ *     unavailable, never a denial.
+ *   - The row's organization, creator stamp and visibility are the ones
+ *     its unit wrote: the tuples derive from them, so a reader that hands
+ *     back a different organization grants that organization's members.
+ *
+ * The merge rules (extensions/registry.ts): one reader per kind across the
+ * composed set; never for an open-source kind, whose rows are open
+ * source's own store's; never for `identity_account`, whose rows are read
+ * through the account port a composition substitutes as
+ * `drivers.identityAccountStore`. Each is a boot throw naming the unit.
+ */
+import type { Message } from "@bufbuild/protobuf";
+/** The row-reader contract (keyed point, ExtensionDrivers.resourceRowReaders). */
+export interface ResourceRowReader {
+    /** The row with this id, decoded with the kind's model schema, or undefined when absent. */
+    findById(id: string): Promise<Message | undefined>;
+}
+//# sourceMappingURL=resource-row-reader.d.ts.map

package/dist/extensions/resource-row-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-row-reader.d.ts","sourceRoot":"","sources":["../../src/extensions/resource-row-reader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;CACpD"}

package/dist/extensions/resource-row-reader.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=resource-row-reader.js.map

package/dist/extensions/resource-row-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-row-reader.js","sourceRoot":"","sources":["../../src/extensions/resource-row-reader.ts"],"names":[],"mappings":""}

package/dist/extensions/visitor-classifier.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The visitor-classifier driver point: which callers are VISITORS, people
+ * the organization lets reach its agents without belonging to it.
+ * Single instance, registered as `drivers.visitorClassifier`.
+ *
+ * Open source has no visitor lanes: every caller it authenticates is the
+ * organization's own (a person, a runner, a machine account, the server
+ * itself). An edition that admits outsiders mints their credentials (the
+ * cloud's shared-agent guests and channel senders, each a caller class of
+ * its own) and says here which callers those are. OSS never learns the
+ * lane names (the guard-memory-capture.ts doctrine); it asks this point.
+ * Absent means nobody is a visitor, which is true of open source.
+ *
+ * A core step reads it wherever an outsider must be treated differently
+ * from a member. Today that is ComposeDeclaredPreferences: the
+ * organization's standing context, written by its admins for its own
+ * work, is never composed onto a visitor's run (stigmer/stigmer#1401).
+ * The error boundary's VisitorErrorPolicy stays its own seam: its
+ * eligibility is method-aware and must answer before an identity exists
+ * (pipeline/interceptors/error-boundary.ts).
+ *
+ * The contract:
+ *   - Synchronous and cheap: it runs on every execution create. The
+ *     classification keys on the verified identity alone (its class,
+ *     its raw token), never on a store read.
+ *   - It classifies the caller whatever the transport: in-process
+ *     propagation keeps the forwarded identity's class
+ *     (pipeline/interceptors/auth.ts), so a visitor's request the server
+ *     composes further stays a visitor's.
+ *   - A throw counts as a visitor at every consumer, which logs it:
+ *     withholding the organization's context from a member is
+ *     recoverable, handing it to an outsider is not (the error boundary's
+ *     posture).
+ */
+import type { CallerIdentity } from "./identity.js";
+/** The visitor-classifier contract (single-instance point, ExtensionDrivers.visitorClassifier). */
+export interface VisitorClassifier {
+    /** Whether `caller` is a visitor: admitted to the organization's agents without belonging to it. */
+    isVisitor(caller: CallerIdentity): boolean;
+}
+//# sourceMappingURL=visitor-classifier.d.ts.map

package/dist/extensions/visitor-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"visitor-classifier.d.ts","sourceRoot":"","sources":["../../src/extensions/visitor-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,mGAAmG;AACnG,MAAM,WAAW,iBAAiB;IAChC,oGAAoG;IACpG,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC;CAC5C"}

package/dist/extensions/visitor-classifier.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=visitor-classifier.js.map

package/dist/extensions/visitor-classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"visitor-classifier.js","sourceRoot":"","sources":["../../src/extensions/visitor-classifier.ts"],"names":[],"mappings":""}

package/dist/identity/oidc-userinfo.d.ts

@@ -11,7 +11,12 @@
  * the cloud's verifiers name theirs on the CallerIdentity they mint. The
  * one issuer whose userinfo can answer for a token is the one that issued
  * it — and a verifier already trusted it, so the token goes only where it
- * came from.
+ * came from. The domain calls this only for a caller the platform's own
+ * sign-in vouched for (domain/identityaccount/resolve.ts
+ * `mayProvisionDirectAccount`), so the issuer is always the operator's own
+ * configuration: an issuer an organization admin registered, whose
+ * discovery document could name any address, never reaches this plain
+ * fetch.
  *
  * The endpoint is the discovery document's word, never a guessed
  * `<issuer>/userinfo`: a document that names no `userinfo_endpoint` is

package/dist/identity/oidc-userinfo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-userinfo.d.ts","sourceRoot":"","sources":["../../src/identity/oidc-userinfo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,eAAe,EAC1B,SAAS,GAAE,OAAO,KAAa,GAC9B,cAAc,CA4BhB"}
+{"version":3,"file":"oidc-userinfo.d.ts","sourceRoot":"","sources":["../../src/identity/oidc-userinfo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,eAAe,EAC1B,SAAS,GAAE,OAAO,KAAa,GAC9B,cAAc,CA4BhB"}

package/dist/identity/oidc-userinfo.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-userinfo.js","sourceRoot":"","sources":["../../src/identity/oidc-userinfo.ts"],"names":[],"mappings":"AAgCA,MAAM,UAAU,qBAAqB,CACnC,SAA0B,EAC1B,YAA0B,KAAK;IAE/B,OAAO;QACL,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW;YACxC,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,WAAW,MAAM,4DAA4D,CAC9E,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,gBAAgB,EAAE;gBACjD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;aACpD,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;YAClE,MAAM,IAAI,GAAG,CAAC,GAAW,EAAU,EAAE;gBACnC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,CAAC,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;gBACpB,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;gBAC7B,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC;gBAC7B,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC;aAC5B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oidc-userinfo.js","sourceRoot":"","sources":["../../src/identity/oidc-userinfo.ts"],"names":[],"mappings":"AAqCA,MAAM,UAAU,qBAAqB,CACnC,SAA0B,EAC1B,YAA0B,KAAK;IAE/B,OAAO;QACL,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW;YACxC,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,WAAW,MAAM,4DAA4D,CAC9E,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,gBAAgB,EAAE;gBACjD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;aACpD,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;YAClE,MAAM,IAAI,GAAG,CAAC,GAAW,EAAU,EAAE;gBACnC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,CAAC,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;gBACpB,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;gBAC7B,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC;gBAC7B,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC;aAC5B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/identity/oidc-verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-verifier.d.ts","sourceRoot":"","sources":["../../src/identity/oidc-verifier.ts"],"names":[],"mappings":"AAmDA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,oEAAoE;AACpE,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,sBAAsB,wDACoB,CAAC;AACxD,eAAO,MAAM,uBAAuB,wCAAwC,CAAC;AAC7E,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAErD,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;CACrC;AAID,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,GACzB,gBAAgB,CA+ClB"}
+{"version":3,"file":"oidc-verifier.d.ts","sourceRoot":"","sources":["../../src/identity/oidc-verifier.ts"],"names":[],"mappings":"AAgEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,oEAAoE;AACpE,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,sBAAsB,wDACoB,CAAC;AACxD,eAAO,MAAM,uBAAuB,wCAAwC,CAAC;AAC7E,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAErD,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;CACrC;AAID,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,GACzB,gBAAgB,CAkDlB"}

package/dist/identity/oidc-verifier.js

@@ -6,11 +6,19 @@
  * Cloud points STIGMER_OIDC_ISSUER at Auth0 and registers NO code here;
  * any self-host points it at their own issuer (Keycloak, Okta, Dex, …).
  *
- * Claim rule: any JWT-shaped token (three non-empty dot-separated
- * segments). API keys never look like JWTs (`stk_` + one Base64URL run),
- * so ordering after the apikey verifier keeps both claims disjoint; a
- * JWT-shaped token that fails verification THROWS (identity.ts contract)
- * with the Java classifyAuthError copy, byte-pinned:
+ * Claim rule: a JWT-shaped token (three non-empty dot-separated segments)
+ * whose `iss` is this lane's issuer, compared exactly, as discovery
+ * compares it. API keys never look like JWTs (`stk_` + one Base64URL run),
+ * so ordering after the apikey verifier keeps both claims disjoint. A JWT
+ * naming another issuer PASSES, so a lane composed after this one (a
+ * composition's own sign-in lane for another issuer) can claim it, and a
+ * token no lane claims is refused by the verifier chain as unclaimed —
+ * UNAUTHENTICATED either way. The `iss` read before verification only
+ * routes the token; it grants nothing, because a claimed token is then
+ * verified whole against this issuer's keys. A JWT-shaped token with no
+ * readable string `iss` is malformed and THROWS "invalid token". A claimed
+ * token that fails verification THROWS (identity.ts contract) with the
+ * Java classifyAuthError copy, byte-pinned:
  *
  *   - expiry → "token has expired"
  *   - audience mismatch → "token audience does not match the expected audience"
@@ -41,10 +49,10 @@
  * issuer is the configured issuer; email/displayName come from the
  * standard `email`/`name` claims when present (the DD-007 Q5 addendum
  * added the fields for exactly these claims), whichever way the subject
- * resolved. Claim-or-pass runs before any of this: a non-JWT token
- * passes with no network.
+ * resolved. Claim-or-pass runs before any of this: a non-JWT token, and a
+ * JWT from another issuer, passes with no network.
  */
-import { createRemoteJWKSet, jwtVerify, errors as joseErrors } from "jose";
+import { createRemoteJWKSet, decodeJwt, jwtVerify, errors as joseErrors, } from "jose";
 import { Code, ConnectError } from "@connectrpc/connect";
 import { identityIdForSubject } from "../domain/identityaccount/resolve.js";
 /** Java classifyAuthError arms — byte-pinned cross-edition copy. */
@@ -70,6 +78,9 @@ export function newOidcIdentityVerifier(config) {
             if (!isJwtShaped(token)) {
                 return null;
             }
+            if (unverifiedIssuerOf(token) !== config.issuer) {
+                return null;
+            }
             const keys = await jwksFor();
             let payload;
             try {
@@ -99,6 +110,24 @@ export function newOidcIdentityVerifier(config) {
         },
     };
 }
+/**
+ * The `iss` a JWT-shaped token names, read without verifying it — only to
+ * decide which lane verifies it. A payload that does not decode, or names
+ * no string issuer, is a malformed credential this lane refuses outright.
+ */
+function unverifiedIssuerOf(token) {
+    let issuer;
+    try {
+        issuer = decodeJwt(token).iss;
+    }
+    catch {
+        throw new ConnectError(INVALID_TOKEN_MESSAGE, Code.Unauthenticated);
+    }
+    if (typeof issuer !== "string" || issuer === "") {
+        throw new ConnectError(INVALID_TOKEN_MESSAGE, Code.Unauthenticated);
+    }
+    return issuer;
+}
 /** Three non-empty dot-separated segments — the JWS compact shape. */
 function isJwtShaped(token) {
     const segments = token.split(".");

package/dist/identity/oidc-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-verifier.js","sourceRoot":"","sources":["../../src/identity/oidc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,MAAM,CAAC;AAE3E,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAQ5E,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AACzD,MAAM,CAAC,MAAM,sBAAsB,GACjC,qDAAqD,CAAC;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,qCAAqC,CAAC;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAerD,MAAM,UAAU,uBAAuB,CACrC,MAA0B;IAE1B,wEAAwE;IACxE,uEAAuE;IACvE,IAAI,IAA4B,CAAC;IAEjC,KAAK,UAAU,OAAO;QACpB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnE,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;YAC7B,IAAI,OAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;oBAC1C,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;gBAC1D,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,MAAM,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC;gBACpE,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,KAAK;gBACf,GAAG,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE;oBACjE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;oBAC7B,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE;oBAC/D,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;oBAClC,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3C,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,YAAY,UAAU,CAAC,wBAAwB,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,IAAI,YAAY,CAAC,sBAAsB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IACE,KAAK,YAAY,UAAU,CAAC,8BAA8B;QAC1D,KAAK,YAAY,UAAU,CAAC,iBAAiB;QAC7C,KAAK,YAAY,UAAU,CAAC,wBAAwB;QACpD,KAAK,YAAY,UAAU,CAAC,WAAW,EACvC,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,uBAAuB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACzE,CAAC;IACD,IACE,KAAK,YAAY,UAAU,CAAC,UAAU;QACtC,KAAK,YAAY,UAAU,CAAC,UAAU;QACtC,oEAAoE;QACpE,sEAAsE;QACtE,2DAA2D;QAC3D,oEAAoE;QACpE,sEAAsE;QACtE,mCAAmC;QACnC,KAAK,YAAY,UAAU,CAAC,gBAAgB,EAC5C,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,2EAA2E;IAC3E,yDAAyD;IACzD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"oidc-verifier.js","sourceRoot":"","sources":["../../src/identity/oidc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,MAAM,IAAI,UAAU,GACrB,MAAM,MAAM,CAAC;AAEd,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAQ5E,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AACzD,MAAM,CAAC,MAAM,sBAAsB,GACjC,qDAAqD,CAAC;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,qCAAqC,CAAC;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAerD,MAAM,UAAU,uBAAuB,CACrC,MAA0B;IAE1B,wEAAwE;IACxE,uEAAuE;IACvE,IAAI,IAA4B,CAAC;IAEjC,KAAK,UAAU,OAAO;QACpB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnE,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;gBAChD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;YAC7B,IAAI,OAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;oBAC1C,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;gBAC1D,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,MAAM,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC;gBACpE,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,KAAK;gBACf,GAAG,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE;oBACjE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;oBAC7B,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE;oBAC/D,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;oBAClC,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAChD,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,sEAAsE;AACtE,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3C,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,YAAY,UAAU,CAAC,wBAAwB,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,IAAI,YAAY,CAAC,sBAAsB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IACE,KAAK,YAAY,UAAU,CAAC,8BAA8B;QAC1D,KAAK,YAAY,UAAU,CAAC,iBAAiB;QAC7C,KAAK,YAAY,UAAU,CAAC,wBAAwB;QACpD,KAAK,YAAY,UAAU,CAAC,WAAW,EACvC,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,uBAAuB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACzE,CAAC;IACD,IACE,KAAK,YAAY,UAAU,CAAC,UAAU;QACtC,KAAK,YAAY,UAAU,CAAC,UAAU;QACtC,oEAAoE;QACpE,sEAAsE;QACtE,2DAA2D;QAC3D,oEAAoE;QACpE,sEAAsE;QACtE,mCAAmC;QACnC,KAAK,YAAY,UAAU,CAAC,gBAAgB,EAC5C,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,2EAA2E;IAC3E,yDAAyD;IACzD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/index.d.ts

@@ -51,7 +51,8 @@ export { loadConfig } from "./boot/config.js";
 export type { ServerConfig } from "./boot/config.js";
 export { createLogger } from "./boot/logger.js";
 export type { LogEntry, LogFields, Logger, LoggerOptions, LogLevel, LogSink, } from "./boot/logger.js";
-export type { ExtensionServiceRegistration, ResolvedExtensions, ResolvedServiceRegistration, ServerExtension, } from "./extensions/registry.js";
+export type { ExtensionServiceRegistration, ResolvedExtensions, ResolvedServiceRegistration, ResolvedUnitHook, ServerExtension, } from "./extensions/registry.js";
+export type { ComposedServices } from "./extensions/composed-services.js";
 export type { CallerClass, CallerIdentity, IdentityVerifier, } from "./extensions/identity.js";
 export type { CallerGuard } from "./extensions/caller-guards.js";
 export type { Authorizer, AuthzCheck, AuthzDecision, } from "./extensions/authorizer.js";
@@ -59,7 +60,7 @@ export type { GateSlotName } from "./extensions/gate-slots.js";
 export type { AgentExecutionResponseDecorator, AgentExecutionStatusHooks, AgentExecutionStatusObserver, AgentExecutionStatusTransition, } from "./extensions/status-hooks.js";
 export type { ExtensionDrivers } from "./extensions/drivers.js";
 export type { ResolvedExtensionDrivers } from "./extensions/registry.js";
-export type { DefaultInstanceLinkedEvent, PolicyGrantedEvent, PolicyRevokedEvent, ResourceAuthorizationLifecycle, ResourceCreatedEvent, ResourceDeletedEvent, VisibilityChangedEvent, VisibilityTupleShape, ResolvedParentLink, } from "./extensions/resource-authorization.js";
+export type { DefaultInstanceLinkedEvent, ExecutionAudienceShape, ExecutionVisibilityChangedEvent, OrganizationAffiliationEvent, PolicyGrantedEvent, PolicyRevokedEvent, ResourceAuthorizationLifecycle, ResourceCreatedEvent, ResourceDeletedEvent, VisibilityChangedEvent, VisibilityTupleShape, ResolvedParentLink, } from "./extensions/resource-authorization.js";
 export type { ExternalOrganizationLookup, IdentityProviderRef, OrganizationDirectory, } from "./extensions/organization-directory.js";
 export { ALL_ORGANIZATIONS } from "./extensions/organization-directory.js";
 export type { LicenseStatusProvider, LicenseStatusReport, } from "./extensions/license-status.js";
@@ -69,17 +70,22 @@ export type { IdentityAccountStore } from "./domain/identityaccount/store.js";
 export { DuplicateAccountError } from "./domain/identityaccount/store.js";
 export type { IdentityAccountStoreContractCase, IdentityAccountStoreContractFixture, } from "./domain/identityaccount/store-contract.js";
 export { identityAccountStoreContract } from "./domain/identityaccount/store-contract.js";
+export type { PortContractBody, PortContractCase, PortContractDeclaration, PortContractFixture, } from "./store/port-contract.js";
+export { portContractCases } from "./store/port-contract.js";
 export type { IamPolicyStore } from "./domain/iampolicy/store.js";
 export { DuplicatePolicyError } from "./domain/iampolicy/store.js";
+export type { PolicyActor, PolicyChangeCause, PolicyChangeRecord, } from "./domain/iampolicy/change.js";
 export type { IamPolicyStoreContractCase, IamPolicyStoreContractFixture, } from "./domain/iampolicy/store-contract.js";
 export { iamPolicyStoreContract } from "./domain/iampolicy/store-contract.js";
 export { OWNER_ASSIGNMENT_DENIED_MESSAGE } from "./domain/iampolicy/constants.js";
 export type { PolicyGrantScope } from "./extensions/policy-grant-scope.js";
 export type { AuthorizationQueryEngine } from "./extensions/authorization-queries.js";
 export type { PrincipalDisplay } from "./extensions/principal-display.js";
+export type { ResourceRowReader } from "./extensions/resource-row-reader.js";
 export type { IdentityFederation } from "./extensions/identity-federation.js";
 export type { AccountsBySubject } from "./domain/identityaccount/resolve.js";
 export { identityIdForSubject } from "./domain/identityaccount/resolve.js";
+export { accountIdFor } from "./domain/identityaccount/constants.js";
 export type { PlatformClientStore } from "./domain/platformclient/store.js";
 export { DuplicatePlatformClientError } from "./domain/platformclient/store.js";
 export type { PlatformClientStoreContractCase, PlatformClientStoreContractFixture, } from "./domain/platformclient/store-contract.js";
@@ -100,13 +106,14 @@ export type { ScheduleFireCallerMint } from "./extensions/schedule-fire-caller.j
 export { ScheduleFireCallerRefusedError } from "./extensions/schedule-fire-caller.js";
 export type { VisitorErrorPolicy } from "./pipeline/interceptors/error-boundary.js";
 export { createErrorBoundaryInterceptor } from "./pipeline/interceptors/error-boundary.js";
-export { diffVisibilityShapes, resolveResourceCreatedEvent, visibilityShapesFor, } from "./pipeline/steps/authorization-tuples.js";
+export type { VisitorClassifier } from "./extensions/visitor-classifier.js";
+export { diffVisibilityShapes, executionAudienceShapes, resolveResourceCreatedEvent, visibilityShapesFor, } from "./pipeline/steps/authorization-tuples.js";
 export type { PipelineStep } from "./pipeline/pipeline.js";
 export { RequestContext } from "./pipeline/request-context.js";
-export { abortedError, alreadyExistsError, alreadyExistsWithReasonError, ERROR_REASON_DOMAIN, failedPreconditionError, internalError, invalidArgumentError, notFoundError, unavailableError, } from "./pipeline/errors.js";
+export { abortedError, alreadyExistsError, alreadyExistsWithReasonError, ERROR_REASON_DOMAIN, failedPreconditionError, internalError, invalidArgumentError, notFoundError, unauthenticatedWithReasonError, unavailableError, } from "./pipeline/errors.js";
 export type { RefusalReason } from "./pipeline/errors.js";
 export { generateSlug } from "./pipeline/steps/slug.js";
-export { encodeInProcessCaller, IN_PROCESS_CALLER_HEADER, } from "./pipeline/interceptors/auth.js";
+export { encodeInProcessCaller, IN_PROCESS_CALLER_HEADER, serverActingFor, } from "./pipeline/interceptors/auth.js";
 export { callerIdentityKey, callerIdentityOf, } from "./pipeline/interceptors/auth.js";
 export { createVerifierChainInterceptor } from "./pipeline/interceptors/auth.js";
 export { authenticateBearerToken, parseBearerToken, } from "./pipeline/interceptors/auth.js";
@@ -114,7 +121,7 @@ export { newPipeline } from "./pipeline/pipeline.js";
 export { newAuthorizeStep } from "./pipeline/steps/authorize.js";
 export { isRunGateCheck } from "./pipeline/steps/authorize-run-target.js";
 export { newValidateProtoStep } from "./pipeline/steps/validation.js";
-export { newBuildNewStateStep } from "./pipeline/steps/defaults.js";
+export { assignServerId, newBuildNewStateStep, SERVER_ASSIGNED_ID_KEY, } from "./pipeline/steps/defaults.js";
 export { newResolveSlugStep } from "./pipeline/steps/slug.js";
 export { newBuildUpdateStateStep } from "./pipeline/steps/build-update-state.js";
 export { EXISTING_RESOURCE_KEY } from "./pipeline/steps/load-existing.js";
@@ -124,6 +131,7 @@ export type { Store, StoreOpenOptions } from "./store/interface.js";
 export { AuditNotFoundError, ResourceNotFoundError, } from "./store/interface.js";
 export type { OrganizationSlugClaim, OrganizationSlugEntry, OrganizationSlugStore, } from "./store/interface.js";
 export { ORGANIZATION_SLUG_RESERVED } from "./domain/organization/slug-ledger.js";
+export { API_KEY_CREATED_BEFORE_SIGN_IN } from "./domain/apikey/verifier.js";
 export type { ListIndexCursor, ListIndexDeclaration, ListIndexQuery, ListIndexRow, } from "./store/list-index.js";
 export type { RawResourceDocument } from "./store/interface.js";
 export { PostgresStore } from "./store/postgres/store.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,YAAY,EACV,QAAQ,EACR,SAAS,EACT,MAAM,EACN,aAAa,EACb,QAAQ,EACR,OAAO,GACR,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,4BAA4B,EAC5B,kBAAkB,EAClB,2BAA2B,EAC3B,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AASlC,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAOjE,YAAY,EACV,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAIzE,YAAY,EACV,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAChD,YAAY,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAK3E,YAAY,EACV,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AAMxC,YAAY,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EACL,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,iCAAiC,CAAC;AAOzC,YAAY,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAI1E,YAAY,EACV,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAU1F,YAAY,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,YAAY,EACV,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAK9E,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAClF,YAAY,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,YAAY,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AAGtF,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAS3E,YAAY,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAChF,YAAY,EACV,+BAA+B,EAC/B,kCAAkC,GACnC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAClG,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAOhF,YAAY,EACV,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,EAC3B,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,qBAAqB,EACrB,+BAA+B,EAC/B,gBAAgB,EAChB,kCAAkC,EAClC,yBAAyB,EACzB,iBAAiB,EACjB,WAAW,EACX,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,kCAAkC,EAClC,OAAO,EACP,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AAOrC,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,YAAY,EACV,aAAa,EACb,aAAa,GACd,MAAM,iCAAiC,CAAC;AAKzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAI1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAM7E,YAAY,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAStF,YAAY,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAM3F,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAGlD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,4BAA4B,EAC5B,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAK1D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAKxD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAgBzC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAOjF,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAYtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAW9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EACL,oBAAoB,EACpB,8BAA8B,GAC/B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAKtE,YAAY,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAK9B,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAIlF,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,YAAY,GACb,MAAM,uBAAuB,CAAC;AAK/B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAWhE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,YAAY,EACV,eAAe,EACf,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAIrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,YAAY,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAMvE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAKjG,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AACrG,YAAY,EACV,wBAAwB,EAKxB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EAKxB,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAcpC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMzD,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAS9E,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAQrE,YAAY,EACV,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,0CAA0C,CAAC;AAOlD,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,YAAY,EACV,QAAQ,EACR,SAAS,EACT,MAAM,EACN,aAAa,EACb,QAAQ,EACR,OAAO,GACR,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,4BAA4B,EAC5B,kBAAkB,EAClB,2BAA2B,EAC3B,gBAAgB,EAChB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAIlC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AASlC,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAOjE,YAAY,EACV,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAIzE,YAAY,EACV,0BAA0B,EAC1B,sBAAsB,EACtB,+BAA+B,EAC/B,4BAA4B,EAC5B,kBAAkB,EAClB,kBAAkB,EAClB,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAChD,YAAY,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAK3E,YAAY,EACV,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AAMxC,YAAY,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EACL,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,iCAAiC,CAAC;AAOzC,YAAY,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAI1E,YAAY,EACV,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAI1F,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAU7D,YAAY,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAInE,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAK9E,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAClF,YAAY,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,YAAY,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AAGtF,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAG1E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAI3E,OAAO,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AASrE,YAAY,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAChF,YAAY,EACV,+BAA+B,EAC/B,kCAAkC,GACnC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAClG,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAOhF,YAAY,EACV,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,EAC3B,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,qBAAqB,EACrB,+BAA+B,EAC/B,gBAAgB,EAChB,kCAAkC,EAClC,yBAAyB,EACzB,iBAAiB,EACjB,WAAW,EACX,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,kCAAkC,EAClC,OAAO,EACP,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AAOrC,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,YAAY,EACV,aAAa,EACb,aAAa,GACd,MAAM,iCAAiC,CAAC;AAKzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAI1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAM7E,YAAY,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAStF,YAAY,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAI3F,YAAY,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAM5E,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAGlD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,4BAA4B,EAC5B,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAK1D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AASxD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,GAChB,MAAM,iCAAiC,CAAC;AAgBzC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAOjF,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAetE,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAW9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EACL,oBAAoB,EACpB,8BAA8B,GAC/B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAKtE,YAAY,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAK9B,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAIlF,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAI7E,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,YAAY,GACb,MAAM,uBAAuB,CAAC;AAK/B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAWhE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,YAAY,EACV,eAAe,EACf,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAIrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,YAAY,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAMvE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAKjG,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AACrG,YAAY,EACV,wBAAwB,EAKxB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EAKxB,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAcpC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMzD,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAS9E,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAQrE,YAAY,EACV,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,0CAA0C,CAAC;AAOlD,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -53,6 +53,7 @@ export { ALL_ORGANIZATIONS } from "./extensions/organization-directory.js";
 export { relaxedEgressPolicy, strictEgressPolicy, } from "./extensions/outbound-egress.js";
 export { DuplicateAccountError } from "./domain/identityaccount/store.js";
 export { identityAccountStoreContract } from "./domain/identityaccount/store-contract.js";
+export { portContractCases } from "./store/port-contract.js";
 export { DuplicatePolicyError } from "./domain/iampolicy/store.js";
 export { iamPolicyStoreContract } from "./domain/iampolicy/store-contract.js";
 // The owner rule's refusal, the one sentence every door that grants the
@@ -61,6 +62,10 @@ export { iamPolicyStoreContract } from "./domain/iampolicy/store-contract.js";
 // owner invitation).
 export { OWNER_ASSIGNMENT_DENIED_MESSAGE } from "./domain/iampolicy/constants.js";
 export { identityIdForSubject } from "./domain/identityaccount/resolve.js";
+// The derived id of the account under a subject. An edition's own per-org
+// system accounts take the id of their own subject, so the primary key holds
+// one row per subject there as it does for every account the library mints.
+export { accountIdFor } from "./domain/identityaccount/constants.js";
 export { DuplicatePlatformClientError } from "./domain/platformclient/store.js";
 export { platformClientStoreContract } from "./domain/platformclient/store-contract.js";
 export { newSystemManagedPlatformClient } from "./domain/platformclient/system-managed.js";
@@ -90,9 +95,9 @@ export { createErrorBoundaryInterceptor } from "./pipeline/interceptors/error-bo
 // derives the creation event from the kind's `kind_meta` exactly as the
 // shared CreateAuthorizationTuples step does, so the driver sees one shape
 // whichever chain created the row.
-export { diffVisibilityShapes, resolveResourceCreatedEvent, visibilityShapesFor, } from "./pipeline/steps/authorization-tuples.js";
+export { diffVisibilityShapes, executionAudienceShapes, resolveResourceCreatedEvent, visibilityShapesFor, } from "./pipeline/steps/authorization-tuples.js";
 export { RequestContext } from "./pipeline/request-context.js";
-export { abortedError, alreadyExistsError, alreadyExistsWithReasonError, ERROR_REASON_DOMAIN, failedPreconditionError, internalError, invalidArgumentError, notFoundError, unavailableError, } from "./pipeline/errors.js";
+export { abortedError, alreadyExistsError, alreadyExistsWithReasonError, ERROR_REASON_DOMAIN, failedPreconditionError, internalError, invalidArgumentError, notFoundError, unauthenticatedWithReasonError, unavailableError, } from "./pipeline/errors.js";
 // The shared slug derivation (C2 Stage 3): extension-registered resource
 // kinds derive slugs with the SAME generator both editions pin
 // (ApiRequestResourceSlugGenerator parity) — the semantics live exactly
@@ -102,7 +107,11 @@ export { generateSlug } from "./pipeline/steps/slug.js";
 // composing requests through the in-process transport AS a caller rides
 // the same header the OSS asCaller adapters use. (callerIdentityOf and
 // callerIdentityKey ride the request-idiom export block below.)
-export { encodeInProcessCaller, IN_PROCESS_CALLER_HEADER, } from "./pipeline/interceptors/auth.js";
+// serverActingFor is the one construction of "the server acting for" a
+// principal: an extension that writes on a person's behalf (an invitation,
+// a deleted team's cleanup) sends it so the write names that person while
+// the server's own admission rules apply.
+export { encodeInProcessCaller, IN_PROCESS_CALLER_HEADER, serverActingFor, } from "./pipeline/interceptors/auth.js";
 // The request idiom for extension-REGISTERED services (C4 Stage 4): a
 // service contributed through ServerExtension.services runs the same
 // chain shape every OSS controller runs — identity read once
@@ -133,10 +142,10 @@ export { createVerifierChainInterceptor } from "./pipeline/interceptors/auth.js"
 export { authenticateBearerToken, parseBearerToken, } from "./pipeline/interceptors/auth.js";
 export { newPipeline } from "./pipeline/pipeline.js";
 export { newAuthorizeStep } from "./pipeline/steps/authorize.js";
-// The run gate's check set (P1 sp.run-gate): an edition's Authorizer keys
-// its lane admission on this predicate — the runtime lanes it mints (a
-// guest share, a channel, a schedule fire, a workflow sandbox) were
-// admitted upstream by their own gate steps and are not re-asked here.
+// The run gate's check set: an edition's Authorizer keys its lane
+// admission on this predicate — the runtime lanes it mints (a guest
+// share, a channel, a schedule fire) were admitted upstream by their own
+// gate steps and are not re-asked here.
 // OSS defines the gate, so OSS defines which checks are the gate; a
 // composition never re-derives the set.
 export { isRunGateCheck } from "./pipeline/steps/authorize-run-target.js";
@@ -151,8 +160,11 @@ export { newValidateProtoStep } from "./pipeline/steps/validation.js";
 // constructor argument) for BuildNewState to pick the id prefix.
 // CheckDuplicate is deliberately not here: it reads this server's Store,
 // and a composition's own table answers that question in a step of the
-// same name over its own repo.
-export { newBuildNewStateStep } from "./pipeline/steps/defaults.js";
+// same name over its own repo. BuildNewState replaces any id a request
+// carries (stigmer/stigmer#1266); a composition step that derives a
+// create's id before it runs claims that id with assignServerId, the one
+// way an id survives the step.
+export { assignServerId, newBuildNewStateStep, SERVER_ASSIGNED_ID_KEY, } from "./pipeline/steps/defaults.js";
 export { newResolveSlugStep } from "./pipeline/steps/slug.js";
 // The update and reference-read steps for the same kinds, on the same
 // terms. An update runs BuildUpdateState after the composition's own
@@ -170,6 +182,10 @@ export { loadedTargetAsMethod, newAuthorizeResolvedTargetStep, } from "./pipelin
 export { TARGET_RESOURCE_KEY } from "./pipeline/steps/load-target.js";
 export { AuditNotFoundError, ResourceNotFoundError, } from "./store/interface.js";
 export { ORGANIZATION_SLUG_RESERVED } from "./domain/organization/slug-ledger.js";
+// The API-key verifier's refusal of a key created before sign-in was
+// turned on (stigmer/stigmer#1169): a client branches on the reason, not
+// the copy.
+export { API_KEY_CREATED_BEFORE_SIGN_IN } from "./domain/apikey/verifier.js";
 // The Postgres driver constructor (stigmer-cloud 20260910.04 ruling 4;
 // the newR2ArtifactStorage precedent for blessing a driver constructor).
 // A composition that runs its own schema chain in the SAME database as

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,wCAAwC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAsEhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAe3E,OAAO,EACL,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,iCAAiC,CAAC;AAQzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAQ1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAW1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAKnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,wEAAwE;AACxE,4EAA4E;AAC5E,wEAAwE;AACxE,qBAAqB;AACrB,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAQlF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAU3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAKhF,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AAGxF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAehF,OAAO,EACL,qBAAqB,EACrB,+BAA+B,EAC/B,gBAAgB,EAChB,kCAAkC,EAClC,yBAAyB,EACzB,iBAAiB,EACjB,WAAW,EACX,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAOrC,OAAO,EACL,kCAAkC,EAClC,OAAO,EACP,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AACrC,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,wEAAwE;AACxE,uEAAuE;AACvE,WAAW;AACX,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAKvE,6EAA6E;AAC7E,0EAA0E;AAC1E,uEAAuE;AACvE,2CAA2C;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,0EAA0E;AAC1E,qEAAqE;AACrE,2EAA2E;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAO7E,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAUtF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,4EAA4E;AAC5E,4EAA4E;AAC5E,wEAAwE;AACxE,2EAA2E;AAC3E,mCAAmC;AACnC,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAIlD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,4BAA4B,EAC5B,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAE9B,yEAAyE;AACzE,+DAA+D;AAC/D,wEAAwE;AACxE,QAAQ;AACR,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,sEAAsE;AACtE,qEAAqE;AACrE,6DAA6D;AAC7D,iEAAiE;AACjE,wEAAwE;AACxE,iEAAiE;AACjE,yEAAyE;AACzE,+DAA+D;AAC/D,yEAAyE;AACzE,8DAA8D;AAC9D,wEAAwE;AACxE,uEAAuE;AACvE,mEAAmE;AACnE,2DAA2D;AAC3D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,+DAA+D;AAC/D,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,oEAAoE;AACpE,wEAAwE;AACxE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kDAAkD;AAClD,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,0EAA0E;AAC1E,uEAAuE;AACvE,oEAAoE;AACpE,uEAAuE;AACvE,oEAAoE;AACpE,wCAAwC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,sEAAsE;AACtE,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,+DAA+D;AAC/D,iEAAiE;AACjE,yEAAyE;AACzE,uEAAuE;AACvE,+BAA+B;AAC/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,sEAAsE;AACtE,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,kEAAkE;AAClE,qEAAqE;AACrE,sEAAsE;AACtE,qEAAqE;AACrE,yEAAyE;AACzE,2BAA2B;AAC3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EACL,oBAAoB,EACpB,8BAA8B,GAC/B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAMtE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAU9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAelF,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAO1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAQvE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AAkBrG,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,6DAA6D;AAC7D,uEAAuE;AACvE,qEAAqE;AACrE,gEAAgE;AAChE,0EAA0E;AAC1E,qEAAqE;AACrE,uEAAuE;AACvE,iEAAiE;AACjE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AAepC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAE9E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,kDAAkD;AAClD,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AA0BrE,oEAAoE;AACpE,yEAAyE;AACzE,iDAAiD;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,wCAAwC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA8EhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAe3E,OAAO,EACL,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,iCAAiC,CAAC;AAQzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAQ1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAU1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAW7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAanE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,wEAAwE;AACxE,4EAA4E;AAC5E,wEAAwE;AACxE,qBAAqB;AACrB,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAWlF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,0EAA0E;AAC1E,6EAA6E;AAC7E,4EAA4E;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAUrE,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAKhF,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AAGxF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAehF,OAAO,EACL,qBAAqB,EACrB,+BAA+B,EAC/B,gBAAgB,EAChB,kCAAkC,EAClC,yBAAyB,EACzB,iBAAiB,EACjB,WAAW,EACX,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAOrC,OAAO,EACL,kCAAkC,EAClC,OAAO,EACP,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AACrC,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,wEAAwE;AACxE,uEAAuE;AACvE,WAAW;AACX,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAKvE,6EAA6E;AAC7E,0EAA0E;AAC1E,uEAAuE;AACvE,2CAA2C;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,0EAA0E;AAC1E,qEAAqE;AACrE,2EAA2E;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAO7E,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAUtF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAK3F,4EAA4E;AAC5E,4EAA4E;AAC5E,wEAAwE;AACxE,2EAA2E;AAC3E,mCAAmC;AACnC,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAIlD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,4BAA4B,EAC5B,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAE9B,yEAAyE;AACzE,+DAA+D;AAC/D,wEAAwE;AACxE,QAAQ;AACR,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,uEAAuE;AACvE,2EAA2E;AAC3E,0EAA0E;AAC1E,0CAA0C;AAC1C,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,GAChB,MAAM,iCAAiC,CAAC;AAEzC,sEAAsE;AACtE,qEAAqE;AACrE,6DAA6D;AAC7D,iEAAiE;AACjE,wEAAwE;AACxE,iEAAiE;AACjE,yEAAyE;AACzE,+DAA+D;AAC/D,yEAAyE;AACzE,8DAA8D;AAC9D,wEAAwE;AACxE,uEAAuE;AACvE,mEAAmE;AACnE,2DAA2D;AAC3D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,+DAA+D;AAC/D,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,oEAAoE;AACpE,wEAAwE;AACxE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kDAAkD;AAClD,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,kEAAkE;AAClE,oEAAoE;AACpE,yEAAyE;AACzE,wCAAwC;AACxC,oEAAoE;AACpE,wCAAwC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,sEAAsE;AACtE,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,+DAA+D;AAC/D,iEAAiE;AACjE,yEAAyE;AACzE,uEAAuE;AACvE,uEAAuE;AACvE,oEAAoE;AACpE,yEAAyE;AACzE,+BAA+B;AAC/B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,sEAAsE;AACtE,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,kEAAkE;AAClE,qEAAqE;AACrE,sEAAsE;AACtE,qEAAqE;AACrE,yEAAyE;AACzE,2BAA2B;AAC3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EACL,oBAAoB,EACpB,8BAA8B,GAC/B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAMtE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAU9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,qEAAqE;AACrE,yEAAyE;AACzE,YAAY;AACZ,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAe7E,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAO1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAQvE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AAkBrG,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,6DAA6D;AAC7D,uEAAuE;AACvE,qEAAqE;AACrE,gEAAgE;AAChE,0EAA0E;AAC1E,qEAAqE;AACrE,uEAAuE;AACvE,iEAAiE;AACjE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AAepC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAE9E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,kDAAkD;AAClD,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AA0BrE,oEAAoE;AACpE,yEAAyE;AACzE,iDAAiD;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}