@solidxai/core 0.1.13-beta.2 → 0.1.13-beta.20

package/postman/mpin.postman_collection.json

@@ -0,0 +1,1045 @@
+{
+  "info": {
+    "name": "SolidX — MPIN",
+    "_postman_id": "b7c1e2a4-5d38-4f61-9a2b-0c7d5e91f3aa",
+    "description": "End-to-end scenarios for MPIN sign-in (Deliverable C).\n\n## Running it\n\n1. Set `baseUrl`, `username` and `password` in the collection variables.\n2. Ensure `mpinEnabled = true` in settings.\n3. **Set `mpinLockoutDuration` to 5 (seconds)** before running folder 4 — at the default 900s the ladder cannot complete in one pass.\n4. Run the collection top to bottom. Requests chain through collection variables, so no manual copying is needed.\n\nFolders 8 and 9 need settings changed mid-run and are marked manual; they are skipped by a Collection Run.\n\n## Response shapes\n\nSuccess is wrapped by `WrapResponseInterceptor`:\n```\n{ \"statusCode\": 200, \"message\": [], \"error\": \"\", \"data\": { ... } }\n```\nErrors come from `HttpExceptionFilter` and carry a canonical code — the three MPIN failures are all HTTP 401 and are distinguished **only** by `errorCode`:\n```\n{ \"statusCode\": 401, \"errorCode\": \"solidx-mpin-invalid\", \"message\": \"...\" }\n```",
+    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
+  },
+  "variable": [
+    { "key": "baseUrl", "value": "http://localhost:3000/api", "type": "string" },
+    { "key": "username", "value": "sa", "type": "string" },
+    { "key": "password", "value": "", "type": "string" },
+    { "key": "mpin", "value": "482915", "type": "string" },
+    { "key": "newMpin", "value": "739104", "type": "string" },
+    { "key": "wrongMpin", "value": "999919", "type": "string" },
+    { "key": "accessToken", "value": "", "type": "string" },
+    { "key": "refreshToken", "value": "", "type": "string" },
+    { "key": "deviceId", "value": "", "type": "string" },
+    { "key": "credentialRef", "value": "", "type": "string" },
+    { "key": "credentialId", "value": "", "type": "string" },
+    { "key": "lockDeviceId", "value": "", "type": "string" },
+    { "key": "lockCredentialRef", "value": "", "type": "string" },
+    { "key": "changeDeviceId", "value": "", "type": "string" },
+    { "key": "changeCredentialRef", "value": "", "type": "string" },
+    { "key": "revokeDeviceId", "value": "", "type": "string" },
+    { "key": "revokeCredentialRef", "value": "", "type": "string" },
+    { "key": "invalidBody", "value": "", "type": "string" },
+    { "key": "capIteration", "value": "0", "type": "string" },
+    { "key": "capDeviceId", "value": "", "type": "string" },
+    { "key": "mpinMaxDevicesPerUser", "value": "5", "type": "string" }
+  ],
+  "event": [
+    {
+      "listen": "test",
+      "script": {
+        "type": "text/javascript",
+        "exec": [
+          "// Shared helpers, available to every request in the collection.",
+          "pm.expectCode = (expectedStatus, expectedErrorCode) => {",
+          "  pm.test(`HTTP ${expectedStatus}`, () => pm.response.to.have.status(expectedStatus));",
+          "  if (expectedErrorCode) {",
+          "    pm.test(`errorCode = ${expectedErrorCode}`, () => {",
+          "      pm.expect(pm.response.json().errorCode).to.eql(expectedErrorCode);",
+          "    });",
+          "  }",
+          "};"
+        ]
+      }
+    }
+  ],
+  "item": [
+    {
+      "name": "0 · Session",
+      "description": "Obtain a normal session. Everything in folder 1 is bearer-authenticated.",
+      "item": [
+        {
+          "name": "Login (password)",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('HTTP 200', () => pm.response.to.have.status(200));",
+                  "const body = pm.response.json();",
+                  "const d = body.data || body;",
+                  "const access = d.accessToken || d.access_token;",
+                  "const refresh = d.refreshToken || d.refresh_token;",
+                  "pm.test('access token returned', () => pm.expect(access).to.be.a('string').and.not.empty);",
+                  "pm.collectionVariables.set('accessToken', access);",
+                  "pm.collectionVariables.set('refreshToken', refresh);",
+                  "// One deviceId for the whole run, as a real app would generate once and reuse.",
+                  "pm.collectionVariables.set('deviceId', pm.variables.replaceIn('{{$guid}}'));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"username\": \"{{username}}\",\n  \"password\": \"{{password}}\"\n}"
+            },
+            "url": { "raw": "{{baseUrl}}/iam/authenticate", "host": ["{{baseUrl}}"], "path": ["iam", "authenticate"] }
+          }
+        }
+      ]
+    },
+
+    {
+      "name": "1 · Setup — happy path and validation",
+      "item": [
+        {
+          "name": "Setup MPIN",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('HTTP 200', () => pm.response.to.have.status(200));",
+                  "const d = pm.response.json().data;",
+                  "pm.test('credentialRef is 64 hex chars', () => pm.expect(d.credentialRef).to.match(/^[0-9a-f]{64}$/));",
+                  "pm.test('the MPIN is never echoed back', () => pm.expect(JSON.stringify(d)).to.not.include(pm.collectionVariables.get('mpin')));",
+                  "pm.collectionVariables.set('credentialRef', d.credentialRef);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              { "key": "Content-Type", "value": "application/json" },
+              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"deviceId\": \"{{deviceId}}\",\n  \"mpin\": \"{{mpin}}\",\n  \"deviceName\": \"Postman Device\",\n  \"platform\": \"ios\"\n}"
+            },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] },
+            "description": "The handle is returned **once**. Only its SHA-256 is stored, so it can never be re-issued."
+          }
+        },
+        {
+          "name": "Reject · too short",
+          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.expectCode(400, 'solidx-mpin-format-invalid');"] } }],
+          "request": {
+            "method": "POST",
+            "header": [
+              { "key": "Content-Type", "value": "application/json" },
+              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
+            ],
+            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"{{$guid}}\",\n  \"mpin\": \"123\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] }
+          }
+        },
+        {
+          "name": "Reject · non-digits",
+          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.expectCode(400, 'solidx-mpin-format-invalid');"] } }],
+          "request": {
+            "method": "POST",
+            "header": [
+              { "key": "Content-Type", "value": "application/json" },
+              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
+            ],
+            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"{{$guid}}\",\n  \"mpin\": \"abcd12\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] }
+          }
+        },
+        {
+          "name": "Reject · all identical (111111)",
+          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.expectCode(400, 'solidx-mpin-too-predictable');"] } }],
+          "request": {
+            "method": "POST",
+            "header": [
+              { "key": "Content-Type", "value": "application/json" },
+              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
+            ],
+            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"{{$guid}}\",\n  \"mpin\": \"111111\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] }
+          }
+        },
+        {
+          "name": "Reject · sequential (3456)",
+          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.expectCode(400, 'solidx-mpin-too-predictable');"] } }],
+          "request": {
+            "method": "POST",
+            "header": [
+              { "key": "Content-Type", "value": "application/json" },
+              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
+            ],
+            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"{{$guid}}\",\n  \"mpin\": \"3456\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] }
+          }
+        },
+        {
+          "name": "Reject · denylisted (2580)",
+          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.expectCode(400, 'solidx-mpin-too-predictable');"] } }],
+          "request": {
+            "method": "POST",
+            "header": [
+              { "key": "Content-Type", "value": "application/json" },
+              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
+            ],
+            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"{{$guid}}\",\n  \"mpin\": \"2580\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] },
+            "description": "The keypad-column PIN. Caught by the denylist rather than by the identical/sequential rules."
+          }
+        },
+        {
+          "name": "Reject · ANDROID_ID as deviceId",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('HTTP 400', () => pm.response.to.have.status(400));",
+                  "pm.test('rejected by class-validator, not by MpinService', () => {",
+                  "  // No MPIN-specific errorCode: this never reaches the service.",
+                  "  pm.expect(pm.response.json().errorCode).to.not.match(/^solidx-mpin-/);",
+                  "});"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              { "key": "Content-Type", "value": "application/json" },
+              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
+            ],
+            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"9774d56d682e549c\",\n  \"mpin\": \"{{mpin}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] },
+            "description": "Android's Settings.Secure.ANDROID_ID is 16 hex chars, not a UUID. Clients must generate their own UUID v4."
+          }
+        },
+        {
+          "name": "Numeric MPIN — documents the coercion trap",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "// enableImplicitConversion on the global ValidationPipe coerces a JSON",
+                  "// number to a string, so @IsString() does NOT reject this. A client",
+                  "// sending 012345 numerically would emit 12345 and silently store a",
+                  "// SHORTER, DIFFERENT MPIN. Always send a quoted string.",
+                  "pm.test('numeric payload is accepted (coerced) — hence the client rule', () => {",
+                  "  pm.expect(pm.response.code).to.be.oneOf([200, 400]);",
+                  "});",
+                  "if (pm.response.code === 200) {",
+                  "  pm.test('coerced to a string, proving the trap is real', () => {",
+                  "    pm.expect(pm.response.json().data.credentialRef).to.be.a('string');",
+                  "  });",
+                  "}"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              { "key": "Content-Type", "value": "application/json" },
+              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
+            ],
+            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"{{$guid}}\",\n  \"mpin\": 482915\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] }
+          }
+        },
+        {
+          "name": "Re-setup on the same device rotates the handle",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('HTTP 200', () => pm.response.to.have.status(200));",
+                  "const fresh = pm.response.json().data.credentialRef;",
+                  "pm.test('a NEW handle is issued', () => pm.expect(fresh).to.not.eql(pm.collectionVariables.get('credentialRef')));",
+                  "pm.collectionVariables.set('credentialRef', fresh);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              { "key": "Content-Type", "value": "application/json" },
+              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"deviceId\": \"{{deviceId}}\",\n  \"mpin\": \"{{mpin}}\",\n  \"deviceName\": \"Postman Device\",\n  \"platform\": \"ios\"\n}"
+            },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] },
+            "description": "Same deviceId upserts the existing row rather than adding a second one. The previous handle is dead from here."
+          }
+        }
+      ]
+    },
+
+    {
+      "name": "2 · Login",
+      "item": [
+        {
+          "name": "Login with MPIN",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('HTTP 200', () => pm.response.to.have.status(200));",
+                  "const d = pm.response.json().data;",
+                  "pm.test('a fresh token pair is minted', () => {",
+                  "  pm.expect(d.accessToken).to.be.a('string').and.not.empty;",
+                  "  pm.expect(d.refreshToken).to.be.a('string').and.not.empty;",
+                  "});",
+                  "pm.test('refreshToken differs from the session one — not a replay', () => {",
+                  "  pm.expect(d.refreshToken).to.not.eql(pm.collectionVariables.get('refreshToken'));",
+                  "});",
+                  "pm.test('no request body identifier was needed', () => {",
+                  "  pm.expect(pm.request.body.raw).to.not.include('username');",
+                  "  pm.expect(pm.request.body.raw).to.not.include('mobile');",
+                  "});",
+                  "pm.collectionVariables.set('refreshToken', d.refreshToken);",
+                  "pm.collectionVariables.set('accessToken', d.accessToken);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{credentialRef}}\",\n  \"mpin\": \"{{mpin}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] },
+            "description": "Public route — no Authorization header. The handle identifies the account, so no mobile/email is sent and there is no enumeration surface."
+          }
+        },
+        {
+          "name": "Wrong MPIN",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.expectCode(401, 'solidx-mpin-invalid');",
+                  "// Stored so the next request can prove the two are indistinguishable.",
+                  "const b = pm.response.json();",
+                  "pm.collectionVariables.set('invalidBody', JSON.stringify({ statusCode: b.statusCode, errorCode: b.errorCode, message: b.message }));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{credentialRef}}\",\n  \"mpin\": \"{{wrongMpin}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] }
+          }
+        },
+        {
+          "name": "Unknown handle — must be indistinguishable",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.expectCode(401, 'solidx-mpin-invalid');",
+                  "const b = pm.response.json();",
+                  "const now = JSON.stringify({ statusCode: b.statusCode, errorCode: b.errorCode, message: b.message });",
+                  "pm.test('identical to a wrong MPIN — no enumeration oracle', () => {",
+                  "  pm.expect(now).to.eql(pm.collectionVariables.get('invalidBody'));",
+                  "});"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\",\n  \"mpin\": \"{{mpin}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] }
+          }
+        }
+      ]
+    },
+
+    {
+      "name": "3 · The bug that started this",
+      "description": "MPIN must survive logout and refresh-token expiry, because it mints a fresh pair rather than replaying a stored token.",
+      "item": [
+        {
+          "name": "Logout",
+          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.test('HTTP 200', () => pm.response.to.have.status(200));"] } }],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": { "mode": "raw", "raw": "{\n  \"refreshToken\": \"{{refreshToken}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/logout", "host": ["{{baseUrl}}"], "path": ["iam", "logout"] }
+          }
+        },
+        {
+          "name": "Refresh with the logged-out token fails",
+          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.test('HTTP 401 — the session really is gone', () => pm.response.to.have.status(401));"] } }],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": { "mode": "raw", "raw": "{\n  \"refreshToken\": \"{{refreshToken}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/refresh-tokens", "host": ["{{baseUrl}}"], "path": ["iam", "refresh-tokens"] }
+          }
+        },
+        {
+          "name": "MPIN login STILL works after logout",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('HTTP 200 — the original design failed here', () => pm.response.to.have.status(200));",
+                  "const d = pm.response.json().data;",
+                  "pm.collectionVariables.set('accessToken', d.accessToken);",
+                  "pm.collectionVariables.set('refreshToken', d.refreshToken);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{credentialRef}}\",\n  \"mpin\": \"{{mpin}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] }
+          }
+        },
+        {
+          "name": "Logout · expired/garbage token is idempotent",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('HTTP 200 — logout must never 500', () => pm.response.to.have.status(200));",
+                  "pm.test('not a 500 LOGOUT_FAILED', () => pm.expect(pm.response.code).to.not.eql(500));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": { "mode": "raw", "raw": "{\n  \"refreshToken\": \"not-a-real-token\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/logout", "host": ["{{baseUrl}}"], "path": ["iam", "logout"] },
+            "description": "Deliverable A: verifyAsync uses ignoreExpiration, and an unverifiable token returns success rather than falling into the generic 500."
+          }
+        }
+      ]
+    },
+
+    {
+      "name": "4 · Lockout ladder (destructive)",
+      "description": "Permanently deactivates its credential, so it uses a throwaway device.\n\n**Set `mpinLockoutDuration` to 5 seconds first** — the default 900s makes this unrunnable in one pass.",
+      "item": [
+        {
+          "name": "Setup a throwaway device",
+          "event": [
+            {
+              "listen": "prerequest",
+              "script": { "type": "text/javascript", "exec": ["pm.collectionVariables.set('lockDeviceId', pm.variables.replaceIn('{{$guid}}'));"] }
+            },
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('HTTP 200', () => pm.response.to.have.status(200));",
+                  "pm.collectionVariables.set('lockCredentialRef', pm.response.json().data.credentialRef);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              { "key": "Content-Type", "value": "application/json" },
+              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
+            ],
+            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"{{lockDeviceId}}\",\n  \"mpin\": \"{{mpin}}\",\n  \"deviceName\": \"Lockout Test\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] }
+          }
+        },
+        {
+          "name": "Attempts 1–4 · invalid",
+          "event": [
+            {
+              "listen": "prerequest",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "let i = parseInt(pm.collectionVariables.get('capIteration') || '0');",
+                  "// reuse the counter slot for this loop",
+                  "if (!pm.collectionVariables.get('ladderCount')) pm.collectionVariables.set('ladderCount', '0');"
+                ]
+              }
+            },
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "let n = parseInt(pm.collectionVariables.get('ladderCount')) + 1;",
+                  "pm.collectionVariables.set('ladderCount', String(n));",
+                  "pm.expectCode(401, 'solidx-mpin-invalid');",
+                  "if (n < 4) { postman.setNextRequest('Attempts 1–4 · invalid'); }"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{lockCredentialRef}}\",\n  \"mpin\": \"{{wrongMpin}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] },
+            "description": "Loops four times via setNextRequest."
+          }
+        },
+        {
+          "name": "Attempt 5 · locked",
+          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.expectCode(401, 'solidx-mpin-locked');"] } }],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{lockCredentialRef}}\",\n  \"mpin\": \"{{wrongMpin}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] }
+          }
+        },
+        {
+          "name": "Correct MPIN during lockout still fails",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.expectCode(401, 'solidx-mpin-locked');",
+                  "pm.test('locked, not invalid — the PIN was right', () => {",
+                  "  pm.expect(pm.response.json().errorCode).to.not.eql('solidx-mpin-invalid');",
+                  "});"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{lockCredentialRef}}\",\n  \"mpin\": \"{{mpin}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] },
+            "description": "Rejected before the hash comparison, so the lockout window is not consumed and no bcrypt work is done."
+          }
+        },
+        {
+          "name": "Wait for the lockout to expire",
+          "event": [
+            {
+              "listen": "prerequest",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "// Blocking sleep — assumes mpinLockoutDuration was lowered to ~5s.",
+                  "const until = Date.now() + 7000;",
+                  "while (Date.now() < until) { /* wait */ }"
+                ]
+              }
+            },
+            { "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.test('lockout window elapsed', () => true);"] } }
+          ],
+          "request": {
+            "method": "GET",
+            "header": [],
+            "url": { "raw": "{{baseUrl}}/iam/mpin/devices", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "devices"] },
+            "description": "Any cheap call; the point is the pre-request delay."
+          }
+        },
+        {
+          "name": "Attempts 6–9 · counter did NOT reset",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "let n = parseInt(pm.collectionVariables.get('ladderCount2') || '0') + 1;",
+                  "pm.collectionVariables.set('ladderCount2', String(n));",
+                  "pm.expectCode(401, 'solidx-mpin-invalid');",
+                  "if (n < 4) { postman.setNextRequest('Attempts 6–9 · counter did NOT reset'); }"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{lockCredentialRef}}\",\n  \"mpin\": \"{{wrongMpin}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] },
+            "description": "failedAttempts is cumulative and resets only on success — never when a lockout expires."
+          }
+        },
+        {
+          "name": "Attempt 10 · terminal, revoked",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.expectCode(401, 'solidx-mpin-revoked');",
+                  "pm.test('the attempt that kills it says so — the client must stop retrying', () => {",
+                  "  pm.expect(pm.response.json().errorCode).to.eql('solidx-mpin-revoked');",
+                  "});"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{lockCredentialRef}}\",\n  \"mpin\": \"{{wrongMpin}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] }
+          }
+        },
+        {
+          "name": "Attempt 11 · still revoked (no asymmetry)",
+          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.expectCode(401, 'solidx-mpin-revoked');"] } }],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{lockCredentialRef}}\",\n  \"mpin\": \"{{wrongMpin}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] },
+            "description": "A dead credential reports as dead regardless of the MPIN supplied."
+          }
+        },
+        {
+          "name": "Normal login still works — the ACCOUNT is not locked",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('HTTP 200 — only the credential died, never the account', () => pm.response.to.have.status(200));",
+                  "const d = pm.response.json().data || {};",
+                  "if (d.accessToken) pm.collectionVariables.set('accessToken', d.accessToken);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": { "mode": "raw", "raw": "{\n  \"username\": \"{{username}}\",\n  \"password\": \"{{password}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/authenticate", "host": ["{{baseUrl}}"], "path": ["iam", "authenticate"] }
+          }
+        }
+      ]
+    },
+
+    {
+      "name": "5 · Change MPIN",
+      "item": [
+        {
+          "name": "Setup a device for change tests",
+          "event": [
+            { "listen": "prerequest", "script": { "type": "text/javascript", "exec": ["pm.collectionVariables.set('changeDeviceId', pm.variables.replaceIn('{{$guid}}'));"] } },
+            { "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.test('HTTP 200', () => pm.response.to.have.status(200));", "pm.collectionVariables.set('changeCredentialRef', pm.response.json().data.credentialRef);"] } }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              { "key": "Content-Type", "value": "application/json" },
+              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
+            ],
+            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"{{changeDeviceId}}\",\n  \"mpin\": \"{{mpin}}\",\n  \"deviceName\": \"Change Test\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] }
+          }
+        },
+        {
+          "name": "Change MPIN — returns a NEW handle",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('HTTP 200', () => pm.response.to.have.status(200));",
+                  "const fresh = pm.response.json().data.credentialRef;",
+                  "pm.test('handle rotated — the client MUST store this', () => {",
+                  "  pm.expect(fresh).to.match(/^[0-9a-f]{64}$/);",
+                  "  pm.expect(fresh).to.not.eql(pm.collectionVariables.get('changeCredentialRef'));",
+                  "});",
+                  "pm.collectionVariables.set('oldChangeRef', pm.collectionVariables.get('changeCredentialRef'));",
+                  "pm.collectionVariables.set('changeCredentialRef', fresh);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              { "key": "Content-Type", "value": "application/json" },
+              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
+            ],
+            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{changeCredentialRef}}\",\n  \"currentMpin\": \"{{mpin}}\",\n  \"newMpin\": \"{{newMpin}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/change", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "change"] },
+            "description": "Discarding this response leaves the app holding a dead handle and MPIN silently broken."
+          }
+        },
+        {
+          "name": "Old handle is dead",
+          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.expectCode(401, 'solidx-mpin-invalid');"] } }],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{oldChangeRef}}\",\n  \"mpin\": \"{{newMpin}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] }
+          }
+        },
+        {
+          "name": "New handle + new MPIN works",
+          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.test('HTTP 200', () => pm.response.to.have.status(200));"] } }],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{changeCredentialRef}}\",\n  \"mpin\": \"{{newMpin}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] }
+          }
+        },
+        {
+          "name": "Change with wrong currentMpin",
+          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.expectCode(401, 'solidx-mpin-invalid');"] } }],
+          "request": {
+            "method": "POST",
+            "header": [
+              { "key": "Content-Type", "value": "application/json" },
+              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
+            ],
+            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{changeCredentialRef}}\",\n  \"currentMpin\": \"{{wrongMpin}}\",\n  \"newMpin\": \"135791\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/change", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "change"] },
+            "description": "Failures here count towards the same lockout ladder as login."
+          }
+        }
+      ]
+    },
+
+    {
+      "name": "6 · Devices and revocation",
+      "item": [
+        {
+          "name": "List my devices",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('HTTP 200', () => pm.response.to.have.status(200));",
+                  "const rows = pm.response.json().data;",
+                  "pm.test('an array is returned', () => pm.expect(rows).to.be.an('array'));",
+                  "pm.test('NO secrets leak in the list', () => {",
+                  "  const raw = JSON.stringify(rows);",
+                  "  pm.expect(raw).to.not.include('hashedMpin');",
+                  "  pm.expect(raw).to.not.include('hashedCredentialRef');",
+                  "  pm.expect(raw).to.not.include('$2b$');",
+                  "});",
+                  "pm.test('revoked credentials are not listed', () => {",
+                  "  rows.forEach(r => pm.expect(r.isActive).to.eql(true));",
+                  "});",
+                  "if (rows.length) pm.collectionVariables.set('credentialId', rows[0].id);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "GET",
+            "header": [{ "key": "Authorization", "value": "Bearer {{accessToken}}" }],
+            "url": { "raw": "{{baseUrl}}/iam/mpin/devices", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "devices"] }
+          }
+        },
+        {
+          "name": "Setup a device to revoke",
+          "event": [
+            { "listen": "prerequest", "script": { "type": "text/javascript", "exec": ["pm.collectionVariables.set('revokeDeviceId', pm.variables.replaceIn('{{$guid}}'));"] } },
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('HTTP 200', () => pm.response.to.have.status(200));",
+                  "pm.collectionVariables.set('revokeCredentialRef', pm.response.json().data.credentialRef);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              { "key": "Content-Type", "value": "application/json" },
+              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
+            ],
+            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"{{revokeDeviceId}}\",\n  \"mpin\": \"{{mpin}}\",\n  \"deviceName\": \"To Be Revoked\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] }
+          }
+        },
+        {
+          "name": "Find its row id",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "const rows = pm.response.json().data;",
+                  "const row = rows.find(r => r.deviceId === pm.collectionVariables.get('revokeDeviceId'));",
+                  "pm.test('the new device appears in the list', () => pm.expect(row).to.be.an('object'));",
+                  "pm.collectionVariables.set('credentialId', row.id);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "GET",
+            "header": [{ "key": "Authorization", "value": "Bearer {{accessToken}}" }],
+            "url": { "raw": "{{baseUrl}}/iam/mpin/devices", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "devices"] }
+          }
+        },
+        {
+          "name": "Revoke it",
+          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.test('HTTP 200', () => pm.response.to.have.status(200));"] } }],
+          "request": {
+            "method": "DELETE",
+            "header": [{ "key": "Authorization", "value": "Bearer {{accessToken}}" }],
+            "url": { "raw": "{{baseUrl}}/iam/mpin/devices/{{credentialId}}", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "devices", "{{credentialId}}"] },
+            "description": "A soft delete — the row survives with isActive=false so a login can be answered with MPIN_REVOKED rather than a baffling MPIN_INVALID."
+          }
+        },
+        {
+          "name": "Login with the correct MPIN · revoked",
+          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.expectCode(401, 'solidx-mpin-revoked');"] } }],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{revokeCredentialRef}}\",\n  \"mpin\": \"{{mpin}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] }
+          }
+        },
+        {
+          "name": "Login with a wrong MPIN · also revoked",
+          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.expectCode(401, 'solidx-mpin-revoked');"] } }],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{revokeCredentialRef}}\",\n  \"mpin\": \"{{wrongMpin}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] },
+            "description": "The isActive check runs before the hash comparison, so a dead credential reports consistently. No asymmetry between the attempt that kills it and the next one."
+          }
+        },
+        {
+          "name": "Revoked device no longer listed",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "const rows = pm.response.json().data;",
+                  "const still = rows.find(r => r.deviceId === pm.collectionVariables.get('revokeDeviceId'));",
+                  "pm.test('gone from the active list', () => pm.expect(still).to.be.undefined);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "GET",
+            "header": [{ "key": "Authorization", "value": "Bearer {{accessToken}}" }],
+            "url": { "raw": "{{baseUrl}}/iam/mpin/devices", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "devices"] }
+          }
+        }
+      ]
+    },
+
+    {
+      "name": "7 · Device cap evicts, never rejects",
+      "description": "Simulates repeated reinstalls: every setup uses a FRESH deviceId, as a reinstalled app would. All must succeed; the active count must hold at the cap.",
+      "item": [
+        {
+          "name": "Cap · setup on a fresh device",
+          "event": [
+            {
+              "listen": "prerequest",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "let i = parseInt(pm.collectionVariables.get('capIteration') || '0');",
+                  "pm.collectionVariables.set('capIteration', String(i + 1));",
+                  "pm.collectionVariables.set('capDeviceId', pm.variables.replaceIn('{{$guid}}'));"
+                ]
+              }
+            },
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "const i = parseInt(pm.collectionVariables.get('capIteration'));",
+                  "const cap = parseInt(pm.collectionVariables.get('mpinMaxDevicesPerUser'));",
+                  "pm.test(`reinstall #${i} succeeds — the cap must evict, not reject`, () => pm.response.to.have.status(200));",
+                  "if (i < cap + 2) { postman.setNextRequest('Cap · setup on a fresh device'); }"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              { "key": "Content-Type", "value": "application/json" },
+              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
+            ],
+            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"{{capDeviceId}}\",\n  \"mpin\": \"{{mpin}}\",\n  \"deviceName\": \"Reinstall {{capIteration}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] },
+            "description": "Loops cap+2 times. Rejecting at the cap would mean a user who reinstalls a few times could never set MPIN up again."
+          }
+        },
+        {
+          "name": "Active devices held at the cap",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "const rows = pm.response.json().data;",
+                  "const cap = parseInt(pm.collectionVariables.get('mpinMaxDevicesPerUser'));",
+                  "pm.test(`active count <= cap (${cap})`, () => pm.expect(rows.length).to.be.at.most(cap));",
+                  "pm.test('oldest were evicted, newest survive', () => {",
+                  "  pm.expect(rows.some(r => (r.deviceName || '').startsWith('Reinstall'))).to.be.true;",
+                  "});"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "GET",
+            "header": [{ "key": "Authorization", "value": "Bearer {{accessToken}}" }],
+            "url": { "raw": "{{baseUrl}}/iam/mpin/devices", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "devices"] }
+          }
+        }
+      ]
+    },
+
+    {
+      "name": "8 · Feature gate (manual)",
+      "description": "Set `mpinEnabled = false` in settings, then run these. Skipped by an automated run because the setting must change mid-pass.",
+      "item": [
+        {
+          "name": "Login 404s when disabled",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('HTTP 404 — a disabled feature should look absent', () => pm.response.to.have.status(404));",
+                  "pm.test('not 401/403, which would imply it exists', () => pm.expect(pm.response.code).to.not.be.oneOf([401, 403]));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{credentialRef}}\",\n  \"mpin\": \"{{mpin}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] }
+          }
+        },
+        {
+          "name": "Setup 404s when disabled",
+          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.test('HTTP 404', () => pm.response.to.have.status(404));"] } }],
+          "request": {
+            "method": "POST",
+            "header": [
+              { "key": "Content-Type", "value": "application/json" },
+              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
+            ],
+            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"{{$guid}}\",\n  \"mpin\": \"{{mpin}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] }
+          }
+        }
+      ]
+    },
+
+    {
+      "name": "9 · Session interaction (manual)",
+      "description": "Requires `preventConcurrentLogins = false` (the default). Proves Deliverable B: an MPIN session and a web session coexist.",
+      "item": [
+        {
+          "name": "MPIN login",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('HTTP 200', () => pm.response.to.have.status(200));",
+                  "pm.collectionVariables.set('mpinRefreshToken', pm.response.json().data.refreshToken);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{credentialRef}}\",\n  \"mpin\": \"{{mpin}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] }
+          }
+        },
+        {
+          "name": "Password login as a second 'device'",
+          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.test('HTTP 200', () => pm.response.to.have.status(200));"] } }],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": { "mode": "raw", "raw": "{\n  \"username\": \"{{username}}\",\n  \"password\": \"{{password}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/authenticate", "host": ["{{baseUrl}}"], "path": ["iam", "authenticate"] }
+          }
+        },
+        {
+          "name": "MPIN session still refreshes — not evicted",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('HTTP 200 — this is the per-device bucket fix', () => pm.response.to.have.status(200));",
+                  "pm.test('before Deliverable B this returned 401', () => pm.expect(pm.response.code).to.eql(200));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [{ "key": "Content-Type", "value": "application/json" }],
+            "body": { "mode": "raw", "raw": "{\n  \"refreshToken\": \"{{mpinRefreshToken}}\"\n}" },
+            "url": { "raw": "{{baseUrl}}/iam/refresh-tokens", "host": ["{{baseUrl}}"], "path": ["iam", "refresh-tokens"] }
+          }
+        }
+      ]
+    }
+  ]
+}