@solidxai/core 0.1.13-beta.20 → 0.1.13-beta.21

package/postman/mpin.postman_collection.json

@@ -1,1045 +0,0 @@
-{
-  "info": {
-    "name": "SolidX — MPIN",
-    "_postman_id": "b7c1e2a4-5d38-4f61-9a2b-0c7d5e91f3aa",
-    "description": "End-to-end scenarios for MPIN sign-in (Deliverable C).\n\n## Running it\n\n1. Set `baseUrl`, `username` and `password` in the collection variables.\n2. Ensure `mpinEnabled = true` in settings.\n3. **Set `mpinLockoutDuration` to 5 (seconds)** before running folder 4 — at the default 900s the ladder cannot complete in one pass.\n4. Run the collection top to bottom. Requests chain through collection variables, so no manual copying is needed.\n\nFolders 8 and 9 need settings changed mid-run and are marked manual; they are skipped by a Collection Run.\n\n## Response shapes\n\nSuccess is wrapped by `WrapResponseInterceptor`:\n```\n{ \"statusCode\": 200, \"message\": [], \"error\": \"\", \"data\": { ... } }\n```\nErrors come from `HttpExceptionFilter` and carry a canonical code — the three MPIN failures are all HTTP 401 and are distinguished **only** by `errorCode`:\n```\n{ \"statusCode\": 401, \"errorCode\": \"solidx-mpin-invalid\", \"message\": \"...\" }\n```",
-    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
-  },
-  "variable": [
-    { "key": "baseUrl", "value": "http://localhost:3000/api", "type": "string" },
-    { "key": "username", "value": "sa", "type": "string" },
-    { "key": "password", "value": "", "type": "string" },
-    { "key": "mpin", "value": "482915", "type": "string" },
-    { "key": "newMpin", "value": "739104", "type": "string" },
-    { "key": "wrongMpin", "value": "999919", "type": "string" },
-    { "key": "accessToken", "value": "", "type": "string" },
-    { "key": "refreshToken", "value": "", "type": "string" },
-    { "key": "deviceId", "value": "", "type": "string" },
-    { "key": "credentialRef", "value": "", "type": "string" },
-    { "key": "credentialId", "value": "", "type": "string" },
-    { "key": "lockDeviceId", "value": "", "type": "string" },
-    { "key": "lockCredentialRef", "value": "", "type": "string" },
-    { "key": "changeDeviceId", "value": "", "type": "string" },
-    { "key": "changeCredentialRef", "value": "", "type": "string" },
-    { "key": "revokeDeviceId", "value": "", "type": "string" },
-    { "key": "revokeCredentialRef", "value": "", "type": "string" },
-    { "key": "invalidBody", "value": "", "type": "string" },
-    { "key": "capIteration", "value": "0", "type": "string" },
-    { "key": "capDeviceId", "value": "", "type": "string" },
-    { "key": "mpinMaxDevicesPerUser", "value": "5", "type": "string" }
-  ],
-  "event": [
-    {
-      "listen": "test",
-      "script": {
-        "type": "text/javascript",
-        "exec": [
-          "// Shared helpers, available to every request in the collection.",
-          "pm.expectCode = (expectedStatus, expectedErrorCode) => {",
-          "  pm.test(`HTTP ${expectedStatus}`, () => pm.response.to.have.status(expectedStatus));",
-          "  if (expectedErrorCode) {",
-          "    pm.test(`errorCode = ${expectedErrorCode}`, () => {",
-          "      pm.expect(pm.response.json().errorCode).to.eql(expectedErrorCode);",
-          "    });",
-          "  }",
-          "};"
-        ]
-      }
-    }
-  ],
-  "item": [
-    {
-      "name": "0 · Session",
-      "description": "Obtain a normal session. Everything in folder 1 is bearer-authenticated.",
-      "item": [
-        {
-          "name": "Login (password)",
-          "event": [
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "pm.test('HTTP 200', () => pm.response.to.have.status(200));",
-                  "const body = pm.response.json();",
-                  "const d = body.data || body;",
-                  "const access = d.accessToken || d.access_token;",
-                  "const refresh = d.refreshToken || d.refresh_token;",
-                  "pm.test('access token returned', () => pm.expect(access).to.be.a('string').and.not.empty);",
-                  "pm.collectionVariables.set('accessToken', access);",
-                  "pm.collectionVariables.set('refreshToken', refresh);",
-                  "// One deviceId for the whole run, as a real app would generate once and reuse.",
-                  "pm.collectionVariables.set('deviceId', pm.variables.replaceIn('{{$guid}}'));"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": {
-              "mode": "raw",
-              "raw": "{\n  \"username\": \"{{username}}\",\n  \"password\": \"{{password}}\"\n}"
-            },
-            "url": { "raw": "{{baseUrl}}/iam/authenticate", "host": ["{{baseUrl}}"], "path": ["iam", "authenticate"] }
-          }
-        }
-      ]
-    },
-
-    {
-      "name": "1 · Setup — happy path and validation",
-      "item": [
-        {
-          "name": "Setup MPIN",
-          "event": [
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "pm.test('HTTP 200', () => pm.response.to.have.status(200));",
-                  "const d = pm.response.json().data;",
-                  "pm.test('credentialRef is 64 hex chars', () => pm.expect(d.credentialRef).to.match(/^[0-9a-f]{64}$/));",
-                  "pm.test('the MPIN is never echoed back', () => pm.expect(JSON.stringify(d)).to.not.include(pm.collectionVariables.get('mpin')));",
-                  "pm.collectionVariables.set('credentialRef', d.credentialRef);"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [
-              { "key": "Content-Type", "value": "application/json" },
-              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
-            ],
-            "body": {
-              "mode": "raw",
-              "raw": "{\n  \"deviceId\": \"{{deviceId}}\",\n  \"mpin\": \"{{mpin}}\",\n  \"deviceName\": \"Postman Device\",\n  \"platform\": \"ios\"\n}"
-            },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] },
-            "description": "The handle is returned **once**. Only its SHA-256 is stored, so it can never be re-issued."
-          }
-        },
-        {
-          "name": "Reject · too short",
-          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.expectCode(400, 'solidx-mpin-format-invalid');"] } }],
-          "request": {
-            "method": "POST",
-            "header": [
-              { "key": "Content-Type", "value": "application/json" },
-              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
-            ],
-            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"{{$guid}}\",\n  \"mpin\": \"123\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] }
-          }
-        },
-        {
-          "name": "Reject · non-digits",
-          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.expectCode(400, 'solidx-mpin-format-invalid');"] } }],
-          "request": {
-            "method": "POST",
-            "header": [
-              { "key": "Content-Type", "value": "application/json" },
-              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
-            ],
-            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"{{$guid}}\",\n  \"mpin\": \"abcd12\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] }
-          }
-        },
-        {
-          "name": "Reject · all identical (111111)",
-          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.expectCode(400, 'solidx-mpin-too-predictable');"] } }],
-          "request": {
-            "method": "POST",
-            "header": [
-              { "key": "Content-Type", "value": "application/json" },
-              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
-            ],
-            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"{{$guid}}\",\n  \"mpin\": \"111111\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] }
-          }
-        },
-        {
-          "name": "Reject · sequential (3456)",
-          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.expectCode(400, 'solidx-mpin-too-predictable');"] } }],
-          "request": {
-            "method": "POST",
-            "header": [
-              { "key": "Content-Type", "value": "application/json" },
-              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
-            ],
-            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"{{$guid}}\",\n  \"mpin\": \"3456\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] }
-          }
-        },
-        {
-          "name": "Reject · denylisted (2580)",
-          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.expectCode(400, 'solidx-mpin-too-predictable');"] } }],
-          "request": {
-            "method": "POST",
-            "header": [
-              { "key": "Content-Type", "value": "application/json" },
-              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
-            ],
-            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"{{$guid}}\",\n  \"mpin\": \"2580\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] },
-            "description": "The keypad-column PIN. Caught by the denylist rather than by the identical/sequential rules."
-          }
-        },
-        {
-          "name": "Reject · ANDROID_ID as deviceId",
-          "event": [
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "pm.test('HTTP 400', () => pm.response.to.have.status(400));",
-                  "pm.test('rejected by class-validator, not by MpinService', () => {",
-                  "  // No MPIN-specific errorCode: this never reaches the service.",
-                  "  pm.expect(pm.response.json().errorCode).to.not.match(/^solidx-mpin-/);",
-                  "});"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [
-              { "key": "Content-Type", "value": "application/json" },
-              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
-            ],
-            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"9774d56d682e549c\",\n  \"mpin\": \"{{mpin}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] },
-            "description": "Android's Settings.Secure.ANDROID_ID is 16 hex chars, not a UUID. Clients must generate their own UUID v4."
-          }
-        },
-        {
-          "name": "Numeric MPIN — documents the coercion trap",
-          "event": [
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "// enableImplicitConversion on the global ValidationPipe coerces a JSON",
-                  "// number to a string, so @IsString() does NOT reject this. A client",
-                  "// sending 012345 numerically would emit 12345 and silently store a",
-                  "// SHORTER, DIFFERENT MPIN. Always send a quoted string.",
-                  "pm.test('numeric payload is accepted (coerced) — hence the client rule', () => {",
-                  "  pm.expect(pm.response.code).to.be.oneOf([200, 400]);",
-                  "});",
-                  "if (pm.response.code === 200) {",
-                  "  pm.test('coerced to a string, proving the trap is real', () => {",
-                  "    pm.expect(pm.response.json().data.credentialRef).to.be.a('string');",
-                  "  });",
-                  "}"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [
-              { "key": "Content-Type", "value": "application/json" },
-              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
-            ],
-            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"{{$guid}}\",\n  \"mpin\": 482915\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] }
-          }
-        },
-        {
-          "name": "Re-setup on the same device rotates the handle",
-          "event": [
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "pm.test('HTTP 200', () => pm.response.to.have.status(200));",
-                  "const fresh = pm.response.json().data.credentialRef;",
-                  "pm.test('a NEW handle is issued', () => pm.expect(fresh).to.not.eql(pm.collectionVariables.get('credentialRef')));",
-                  "pm.collectionVariables.set('credentialRef', fresh);"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [
-              { "key": "Content-Type", "value": "application/json" },
-              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
-            ],
-            "body": {
-              "mode": "raw",
-              "raw": "{\n  \"deviceId\": \"{{deviceId}}\",\n  \"mpin\": \"{{mpin}}\",\n  \"deviceName\": \"Postman Device\",\n  \"platform\": \"ios\"\n}"
-            },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] },
-            "description": "Same deviceId upserts the existing row rather than adding a second one. The previous handle is dead from here."
-          }
-        }
-      ]
-    },
-
-    {
-      "name": "2 · Login",
-      "item": [
-        {
-          "name": "Login with MPIN",
-          "event": [
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "pm.test('HTTP 200', () => pm.response.to.have.status(200));",
-                  "const d = pm.response.json().data;",
-                  "pm.test('a fresh token pair is minted', () => {",
-                  "  pm.expect(d.accessToken).to.be.a('string').and.not.empty;",
-                  "  pm.expect(d.refreshToken).to.be.a('string').and.not.empty;",
-                  "});",
-                  "pm.test('refreshToken differs from the session one — not a replay', () => {",
-                  "  pm.expect(d.refreshToken).to.not.eql(pm.collectionVariables.get('refreshToken'));",
-                  "});",
-                  "pm.test('no request body identifier was needed', () => {",
-                  "  pm.expect(pm.request.body.raw).to.not.include('username');",
-                  "  pm.expect(pm.request.body.raw).to.not.include('mobile');",
-                  "});",
-                  "pm.collectionVariables.set('refreshToken', d.refreshToken);",
-                  "pm.collectionVariables.set('accessToken', d.accessToken);"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{credentialRef}}\",\n  \"mpin\": \"{{mpin}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] },
-            "description": "Public route — no Authorization header. The handle identifies the account, so no mobile/email is sent and there is no enumeration surface."
-          }
-        },
-        {
-          "name": "Wrong MPIN",
-          "event": [
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "pm.expectCode(401, 'solidx-mpin-invalid');",
-                  "// Stored so the next request can prove the two are indistinguishable.",
-                  "const b = pm.response.json();",
-                  "pm.collectionVariables.set('invalidBody', JSON.stringify({ statusCode: b.statusCode, errorCode: b.errorCode, message: b.message }));"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{credentialRef}}\",\n  \"mpin\": \"{{wrongMpin}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] }
-          }
-        },
-        {
-          "name": "Unknown handle — must be indistinguishable",
-          "event": [
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "pm.expectCode(401, 'solidx-mpin-invalid');",
-                  "const b = pm.response.json();",
-                  "const now = JSON.stringify({ statusCode: b.statusCode, errorCode: b.errorCode, message: b.message });",
-                  "pm.test('identical to a wrong MPIN — no enumeration oracle', () => {",
-                  "  pm.expect(now).to.eql(pm.collectionVariables.get('invalidBody'));",
-                  "});"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\",\n  \"mpin\": \"{{mpin}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] }
-          }
-        }
-      ]
-    },
-
-    {
-      "name": "3 · The bug that started this",
-      "description": "MPIN must survive logout and refresh-token expiry, because it mints a fresh pair rather than replaying a stored token.",
-      "item": [
-        {
-          "name": "Logout",
-          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.test('HTTP 200', () => pm.response.to.have.status(200));"] } }],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": { "mode": "raw", "raw": "{\n  \"refreshToken\": \"{{refreshToken}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/logout", "host": ["{{baseUrl}}"], "path": ["iam", "logout"] }
-          }
-        },
-        {
-          "name": "Refresh with the logged-out token fails",
-          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.test('HTTP 401 — the session really is gone', () => pm.response.to.have.status(401));"] } }],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": { "mode": "raw", "raw": "{\n  \"refreshToken\": \"{{refreshToken}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/refresh-tokens", "host": ["{{baseUrl}}"], "path": ["iam", "refresh-tokens"] }
-          }
-        },
-        {
-          "name": "MPIN login STILL works after logout",
-          "event": [
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "pm.test('HTTP 200 — the original design failed here', () => pm.response.to.have.status(200));",
-                  "const d = pm.response.json().data;",
-                  "pm.collectionVariables.set('accessToken', d.accessToken);",
-                  "pm.collectionVariables.set('refreshToken', d.refreshToken);"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{credentialRef}}\",\n  \"mpin\": \"{{mpin}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] }
-          }
-        },
-        {
-          "name": "Logout · expired/garbage token is idempotent",
-          "event": [
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "pm.test('HTTP 200 — logout must never 500', () => pm.response.to.have.status(200));",
-                  "pm.test('not a 500 LOGOUT_FAILED', () => pm.expect(pm.response.code).to.not.eql(500));"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": { "mode": "raw", "raw": "{\n  \"refreshToken\": \"not-a-real-token\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/logout", "host": ["{{baseUrl}}"], "path": ["iam", "logout"] },
-            "description": "Deliverable A: verifyAsync uses ignoreExpiration, and an unverifiable token returns success rather than falling into the generic 500."
-          }
-        }
-      ]
-    },
-
-    {
-      "name": "4 · Lockout ladder (destructive)",
-      "description": "Permanently deactivates its credential, so it uses a throwaway device.\n\n**Set `mpinLockoutDuration` to 5 seconds first** — the default 900s makes this unrunnable in one pass.",
-      "item": [
-        {
-          "name": "Setup a throwaway device",
-          "event": [
-            {
-              "listen": "prerequest",
-              "script": { "type": "text/javascript", "exec": ["pm.collectionVariables.set('lockDeviceId', pm.variables.replaceIn('{{$guid}}'));"] }
-            },
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "pm.test('HTTP 200', () => pm.response.to.have.status(200));",
-                  "pm.collectionVariables.set('lockCredentialRef', pm.response.json().data.credentialRef);"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [
-              { "key": "Content-Type", "value": "application/json" },
-              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
-            ],
-            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"{{lockDeviceId}}\",\n  \"mpin\": \"{{mpin}}\",\n  \"deviceName\": \"Lockout Test\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] }
-          }
-        },
-        {
-          "name": "Attempts 1–4 · invalid",
-          "event": [
-            {
-              "listen": "prerequest",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "let i = parseInt(pm.collectionVariables.get('capIteration') || '0');",
-                  "// reuse the counter slot for this loop",
-                  "if (!pm.collectionVariables.get('ladderCount')) pm.collectionVariables.set('ladderCount', '0');"
-                ]
-              }
-            },
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "let n = parseInt(pm.collectionVariables.get('ladderCount')) + 1;",
-                  "pm.collectionVariables.set('ladderCount', String(n));",
-                  "pm.expectCode(401, 'solidx-mpin-invalid');",
-                  "if (n < 4) { postman.setNextRequest('Attempts 1–4 · invalid'); }"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{lockCredentialRef}}\",\n  \"mpin\": \"{{wrongMpin}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] },
-            "description": "Loops four times via setNextRequest."
-          }
-        },
-        {
-          "name": "Attempt 5 · locked",
-          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.expectCode(401, 'solidx-mpin-locked');"] } }],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{lockCredentialRef}}\",\n  \"mpin\": \"{{wrongMpin}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] }
-          }
-        },
-        {
-          "name": "Correct MPIN during lockout still fails",
-          "event": [
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "pm.expectCode(401, 'solidx-mpin-locked');",
-                  "pm.test('locked, not invalid — the PIN was right', () => {",
-                  "  pm.expect(pm.response.json().errorCode).to.not.eql('solidx-mpin-invalid');",
-                  "});"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{lockCredentialRef}}\",\n  \"mpin\": \"{{mpin}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] },
-            "description": "Rejected before the hash comparison, so the lockout window is not consumed and no bcrypt work is done."
-          }
-        },
-        {
-          "name": "Wait for the lockout to expire",
-          "event": [
-            {
-              "listen": "prerequest",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "// Blocking sleep — assumes mpinLockoutDuration was lowered to ~5s.",
-                  "const until = Date.now() + 7000;",
-                  "while (Date.now() < until) { /* wait */ }"
-                ]
-              }
-            },
-            { "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.test('lockout window elapsed', () => true);"] } }
-          ],
-          "request": {
-            "method": "GET",
-            "header": [],
-            "url": { "raw": "{{baseUrl}}/iam/mpin/devices", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "devices"] },
-            "description": "Any cheap call; the point is the pre-request delay."
-          }
-        },
-        {
-          "name": "Attempts 6–9 · counter did NOT reset",
-          "event": [
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "let n = parseInt(pm.collectionVariables.get('ladderCount2') || '0') + 1;",
-                  "pm.collectionVariables.set('ladderCount2', String(n));",
-                  "pm.expectCode(401, 'solidx-mpin-invalid');",
-                  "if (n < 4) { postman.setNextRequest('Attempts 6–9 · counter did NOT reset'); }"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{lockCredentialRef}}\",\n  \"mpin\": \"{{wrongMpin}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] },
-            "description": "failedAttempts is cumulative and resets only on success — never when a lockout expires."
-          }
-        },
-        {
-          "name": "Attempt 10 · terminal, revoked",
-          "event": [
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "pm.expectCode(401, 'solidx-mpin-revoked');",
-                  "pm.test('the attempt that kills it says so — the client must stop retrying', () => {",
-                  "  pm.expect(pm.response.json().errorCode).to.eql('solidx-mpin-revoked');",
-                  "});"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{lockCredentialRef}}\",\n  \"mpin\": \"{{wrongMpin}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] }
-          }
-        },
-        {
-          "name": "Attempt 11 · still revoked (no asymmetry)",
-          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.expectCode(401, 'solidx-mpin-revoked');"] } }],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{lockCredentialRef}}\",\n  \"mpin\": \"{{wrongMpin}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] },
-            "description": "A dead credential reports as dead regardless of the MPIN supplied."
-          }
-        },
-        {
-          "name": "Normal login still works — the ACCOUNT is not locked",
-          "event": [
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "pm.test('HTTP 200 — only the credential died, never the account', () => pm.response.to.have.status(200));",
-                  "const d = pm.response.json().data || {};",
-                  "if (d.accessToken) pm.collectionVariables.set('accessToken', d.accessToken);"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": { "mode": "raw", "raw": "{\n  \"username\": \"{{username}}\",\n  \"password\": \"{{password}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/authenticate", "host": ["{{baseUrl}}"], "path": ["iam", "authenticate"] }
-          }
-        }
-      ]
-    },
-
-    {
-      "name": "5 · Change MPIN",
-      "item": [
-        {
-          "name": "Setup a device for change tests",
-          "event": [
-            { "listen": "prerequest", "script": { "type": "text/javascript", "exec": ["pm.collectionVariables.set('changeDeviceId', pm.variables.replaceIn('{{$guid}}'));"] } },
-            { "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.test('HTTP 200', () => pm.response.to.have.status(200));", "pm.collectionVariables.set('changeCredentialRef', pm.response.json().data.credentialRef);"] } }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [
-              { "key": "Content-Type", "value": "application/json" },
-              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
-            ],
-            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"{{changeDeviceId}}\",\n  \"mpin\": \"{{mpin}}\",\n  \"deviceName\": \"Change Test\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] }
-          }
-        },
-        {
-          "name": "Change MPIN — returns a NEW handle",
-          "event": [
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "pm.test('HTTP 200', () => pm.response.to.have.status(200));",
-                  "const fresh = pm.response.json().data.credentialRef;",
-                  "pm.test('handle rotated — the client MUST store this', () => {",
-                  "  pm.expect(fresh).to.match(/^[0-9a-f]{64}$/);",
-                  "  pm.expect(fresh).to.not.eql(pm.collectionVariables.get('changeCredentialRef'));",
-                  "});",
-                  "pm.collectionVariables.set('oldChangeRef', pm.collectionVariables.get('changeCredentialRef'));",
-                  "pm.collectionVariables.set('changeCredentialRef', fresh);"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [
-              { "key": "Content-Type", "value": "application/json" },
-              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
-            ],
-            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{changeCredentialRef}}\",\n  \"currentMpin\": \"{{mpin}}\",\n  \"newMpin\": \"{{newMpin}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/change", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "change"] },
-            "description": "Discarding this response leaves the app holding a dead handle and MPIN silently broken."
-          }
-        },
-        {
-          "name": "Old handle is dead",
-          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.expectCode(401, 'solidx-mpin-invalid');"] } }],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{oldChangeRef}}\",\n  \"mpin\": \"{{newMpin}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] }
-          }
-        },
-        {
-          "name": "New handle + new MPIN works",
-          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.test('HTTP 200', () => pm.response.to.have.status(200));"] } }],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{changeCredentialRef}}\",\n  \"mpin\": \"{{newMpin}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] }
-          }
-        },
-        {
-          "name": "Change with wrong currentMpin",
-          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.expectCode(401, 'solidx-mpin-invalid');"] } }],
-          "request": {
-            "method": "POST",
-            "header": [
-              { "key": "Content-Type", "value": "application/json" },
-              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
-            ],
-            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{changeCredentialRef}}\",\n  \"currentMpin\": \"{{wrongMpin}}\",\n  \"newMpin\": \"135791\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/change", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "change"] },
-            "description": "Failures here count towards the same lockout ladder as login."
-          }
-        }
-      ]
-    },
-
-    {
-      "name": "6 · Devices and revocation",
-      "item": [
-        {
-          "name": "List my devices",
-          "event": [
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "pm.test('HTTP 200', () => pm.response.to.have.status(200));",
-                  "const rows = pm.response.json().data;",
-                  "pm.test('an array is returned', () => pm.expect(rows).to.be.an('array'));",
-                  "pm.test('NO secrets leak in the list', () => {",
-                  "  const raw = JSON.stringify(rows);",
-                  "  pm.expect(raw).to.not.include('hashedMpin');",
-                  "  pm.expect(raw).to.not.include('hashedCredentialRef');",
-                  "  pm.expect(raw).to.not.include('$2b$');",
-                  "});",
-                  "pm.test('revoked credentials are not listed', () => {",
-                  "  rows.forEach(r => pm.expect(r.isActive).to.eql(true));",
-                  "});",
-                  "if (rows.length) pm.collectionVariables.set('credentialId', rows[0].id);"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "GET",
-            "header": [{ "key": "Authorization", "value": "Bearer {{accessToken}}" }],
-            "url": { "raw": "{{baseUrl}}/iam/mpin/devices", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "devices"] }
-          }
-        },
-        {
-          "name": "Setup a device to revoke",
-          "event": [
-            { "listen": "prerequest", "script": { "type": "text/javascript", "exec": ["pm.collectionVariables.set('revokeDeviceId', pm.variables.replaceIn('{{$guid}}'));"] } },
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "pm.test('HTTP 200', () => pm.response.to.have.status(200));",
-                  "pm.collectionVariables.set('revokeCredentialRef', pm.response.json().data.credentialRef);"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [
-              { "key": "Content-Type", "value": "application/json" },
-              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
-            ],
-            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"{{revokeDeviceId}}\",\n  \"mpin\": \"{{mpin}}\",\n  \"deviceName\": \"To Be Revoked\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] }
-          }
-        },
-        {
-          "name": "Find its row id",
-          "event": [
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "const rows = pm.response.json().data;",
-                  "const row = rows.find(r => r.deviceId === pm.collectionVariables.get('revokeDeviceId'));",
-                  "pm.test('the new device appears in the list', () => pm.expect(row).to.be.an('object'));",
-                  "pm.collectionVariables.set('credentialId', row.id);"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "GET",
-            "header": [{ "key": "Authorization", "value": "Bearer {{accessToken}}" }],
-            "url": { "raw": "{{baseUrl}}/iam/mpin/devices", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "devices"] }
-          }
-        },
-        {
-          "name": "Revoke it",
-          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.test('HTTP 200', () => pm.response.to.have.status(200));"] } }],
-          "request": {
-            "method": "DELETE",
-            "header": [{ "key": "Authorization", "value": "Bearer {{accessToken}}" }],
-            "url": { "raw": "{{baseUrl}}/iam/mpin/devices/{{credentialId}}", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "devices", "{{credentialId}}"] },
-            "description": "A soft delete — the row survives with isActive=false so a login can be answered with MPIN_REVOKED rather than a baffling MPIN_INVALID."
-          }
-        },
-        {
-          "name": "Login with the correct MPIN · revoked",
-          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.expectCode(401, 'solidx-mpin-revoked');"] } }],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{revokeCredentialRef}}\",\n  \"mpin\": \"{{mpin}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] }
-          }
-        },
-        {
-          "name": "Login with a wrong MPIN · also revoked",
-          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.expectCode(401, 'solidx-mpin-revoked');"] } }],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{revokeCredentialRef}}\",\n  \"mpin\": \"{{wrongMpin}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] },
-            "description": "The isActive check runs before the hash comparison, so a dead credential reports consistently. No asymmetry between the attempt that kills it and the next one."
-          }
-        },
-        {
-          "name": "Revoked device no longer listed",
-          "event": [
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "const rows = pm.response.json().data;",
-                  "const still = rows.find(r => r.deviceId === pm.collectionVariables.get('revokeDeviceId'));",
-                  "pm.test('gone from the active list', () => pm.expect(still).to.be.undefined);"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "GET",
-            "header": [{ "key": "Authorization", "value": "Bearer {{accessToken}}" }],
-            "url": { "raw": "{{baseUrl}}/iam/mpin/devices", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "devices"] }
-          }
-        }
-      ]
-    },
-
-    {
-      "name": "7 · Device cap evicts, never rejects",
-      "description": "Simulates repeated reinstalls: every setup uses a FRESH deviceId, as a reinstalled app would. All must succeed; the active count must hold at the cap.",
-      "item": [
-        {
-          "name": "Cap · setup on a fresh device",
-          "event": [
-            {
-              "listen": "prerequest",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "let i = parseInt(pm.collectionVariables.get('capIteration') || '0');",
-                  "pm.collectionVariables.set('capIteration', String(i + 1));",
-                  "pm.collectionVariables.set('capDeviceId', pm.variables.replaceIn('{{$guid}}'));"
-                ]
-              }
-            },
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "const i = parseInt(pm.collectionVariables.get('capIteration'));",
-                  "const cap = parseInt(pm.collectionVariables.get('mpinMaxDevicesPerUser'));",
-                  "pm.test(`reinstall #${i} succeeds — the cap must evict, not reject`, () => pm.response.to.have.status(200));",
-                  "if (i < cap + 2) { postman.setNextRequest('Cap · setup on a fresh device'); }"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [
-              { "key": "Content-Type", "value": "application/json" },
-              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
-            ],
-            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"{{capDeviceId}}\",\n  \"mpin\": \"{{mpin}}\",\n  \"deviceName\": \"Reinstall {{capIteration}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] },
-            "description": "Loops cap+2 times. Rejecting at the cap would mean a user who reinstalls a few times could never set MPIN up again."
-          }
-        },
-        {
-          "name": "Active devices held at the cap",
-          "event": [
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "const rows = pm.response.json().data;",
-                  "const cap = parseInt(pm.collectionVariables.get('mpinMaxDevicesPerUser'));",
-                  "pm.test(`active count <= cap (${cap})`, () => pm.expect(rows.length).to.be.at.most(cap));",
-                  "pm.test('oldest were evicted, newest survive', () => {",
-                  "  pm.expect(rows.some(r => (r.deviceName || '').startsWith('Reinstall'))).to.be.true;",
-                  "});"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "GET",
-            "header": [{ "key": "Authorization", "value": "Bearer {{accessToken}}" }],
-            "url": { "raw": "{{baseUrl}}/iam/mpin/devices", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "devices"] }
-          }
-        }
-      ]
-    },
-
-    {
-      "name": "8 · Feature gate (manual)",
-      "description": "Set `mpinEnabled = false` in settings, then run these. Skipped by an automated run because the setting must change mid-pass.",
-      "item": [
-        {
-          "name": "Login 404s when disabled",
-          "event": [
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "pm.test('HTTP 404 — a disabled feature should look absent', () => pm.response.to.have.status(404));",
-                  "pm.test('not 401/403, which would imply it exists', () => pm.expect(pm.response.code).to.not.be.oneOf([401, 403]));"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{credentialRef}}\",\n  \"mpin\": \"{{mpin}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] }
-          }
-        },
-        {
-          "name": "Setup 404s when disabled",
-          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.test('HTTP 404', () => pm.response.to.have.status(404));"] } }],
-          "request": {
-            "method": "POST",
-            "header": [
-              { "key": "Content-Type", "value": "application/json" },
-              { "key": "Authorization", "value": "Bearer {{accessToken}}" }
-            ],
-            "body": { "mode": "raw", "raw": "{\n  \"deviceId\": \"{{$guid}}\",\n  \"mpin\": \"{{mpin}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/setup", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "setup"] }
-          }
-        }
-      ]
-    },
-
-    {
-      "name": "9 · Session interaction (manual)",
-      "description": "Requires `preventConcurrentLogins = false` (the default). Proves Deliverable B: an MPIN session and a web session coexist.",
-      "item": [
-        {
-          "name": "MPIN login",
-          "event": [
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "pm.test('HTTP 200', () => pm.response.to.have.status(200));",
-                  "pm.collectionVariables.set('mpinRefreshToken', pm.response.json().data.refreshToken);"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": { "mode": "raw", "raw": "{\n  \"credentialRef\": \"{{credentialRef}}\",\n  \"mpin\": \"{{mpin}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/mpin/login", "host": ["{{baseUrl}}"], "path": ["iam", "mpin", "login"] }
-          }
-        },
-        {
-          "name": "Password login as a second 'device'",
-          "event": [{ "listen": "test", "script": { "type": "text/javascript", "exec": ["pm.test('HTTP 200', () => pm.response.to.have.status(200));"] } }],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": { "mode": "raw", "raw": "{\n  \"username\": \"{{username}}\",\n  \"password\": \"{{password}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/authenticate", "host": ["{{baseUrl}}"], "path": ["iam", "authenticate"] }
-          }
-        },
-        {
-          "name": "MPIN session still refreshes — not evicted",
-          "event": [
-            {
-              "listen": "test",
-              "script": {
-                "type": "text/javascript",
-                "exec": [
-                  "pm.test('HTTP 200 — this is the per-device bucket fix', () => pm.response.to.have.status(200));",
-                  "pm.test('before Deliverable B this returned 401', () => pm.expect(pm.response.code).to.eql(200));"
-                ]
-              }
-            }
-          ],
-          "request": {
-            "method": "POST",
-            "header": [{ "key": "Content-Type", "value": "application/json" }],
-            "body": { "mode": "raw", "raw": "{\n  \"refreshToken\": \"{{mpinRefreshToken}}\"\n}" },
-            "url": { "raw": "{{baseUrl}}/iam/refresh-tokens", "host": ["{{baseUrl}}"], "path": ["iam", "refresh-tokens"] }
-          }
-        }
-      ]
-    }
-  ]
-}