@stigmer/server 3.14.0-dev.20260910084630

package/dist/domain/agentshare/steps.d.ts

@@ -0,0 +1,84 @@
+import { ConnectError } from "@connectrpc/connect";
+import { AgentShareSchema } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/api_pb";
+import type { AgentShare } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/api_pb";
+import type { SharedAgentProfile } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/io_pb";
+import type { PipelineStep } from "../../pipeline/pipeline.js";
+import type { Store } from "../../store/interface.js";
+type AgentShareDesc = typeof AgentShareSchema;
+/**
+ * The single refusal for every anonymous/member resolution miss: share
+ * missing, share disabled, dangling agent_ref, stale pin, wrong or absent
+ * link token — Go sharedNotFound. The message deliberately says "Agent":
+ * the visitor asked for an agent's chat page, and the share resource is an
+ * internal modeling detail a public error must not teach. One constructor
+ * guarantees the byte-identical-errors contract by construction.
+ */
+export declare function sharedNotFound(slug: string): ConnectError;
+/**
+ * The link-token predicate — Go sharingLinkTokenAllowed, the mirror of the
+ * cloud edition's SharingLinkTokenPolicy:
+ *   - No live token: allowed (a stale ?k= on an unlocked link is harmless).
+ *   - Live token set: the presented token must match exactly; a missing or
+ *     rotated-away token refuses (surfacing as the uniform NotFound).
+ *
+ * Comparison is constant-time. Node's timingSafeEqual THROWS on unequal
+ * lengths where Go's subtle.ConstantTimeCompare returns 0, so the length
+ * guard restores Go's semantics; the length of a token is not secret (all
+ * server-minted tokens are 27 chars).
+ */
+export declare function sharingLinkTokenAllowed(presented: string, live: string): boolean;
+/**
+ * Fresh server-side entropy for status.share_link_token — Go
+ * generateShareLinkToken: 20 crypto-random bytes, unpadded url-safe base64
+ * (Node's "base64url" = Go's base64.RawURLEncoding), 27 characters.
+ */
+export declare function generateShareLinkToken(): string;
+/** Scans shares for an org+slug match — Go findShareByOrgAndSlug. */
+export declare function findShareByOrgAndSlug(store: Store, org: string, slug: string): Promise<AgentShare | undefined>;
+/**
+ * ResolveShareDefaults — Go resolveShareDefaultsStep:
+ *   1. Requires metadata.org (URL + billing identity, never inferred).
+ *   2. Normalizes spec.agent_ref.org (empty means same-org) and loads the
+ *      referenced agent — a nonexistent agent is refused with the same
+ *      NOT_FOUND a direct agent lookup would produce.
+ *   3. For a CROSS-ORG share, enforces the decision-013 contract.
+ *   4. Defaults metadata.slug (and name) from the agent when the caller
+ *      provided neither — the canonical share keeps the agent's hosted URL.
+ *      Runs before ResolveSlug, which skips already-set slugs.
+ */
+export declare function newResolveShareDefaultsStep(store: Store): PipelineStep<AgentShareDesc>;
+/**
+ * StampAgentPin — Go stampAgentPinStep: writes status.agent_id, the
+ * server-owned rebind pin (decision 013). agent_ref is org+slug and slugs
+ * are reusable after delete, so without the pin a stale share would
+ * silently attach its audience, link token, and bound credentials to
+ * whatever agent later claims the slug.
+ *
+ * Runs AFTER BuildNewState, which clears client-provided status — the pin
+ * is system-managed and must survive that wipe, exactly like the audit
+ * fields. Reads the agent ResolveShareDefaults already loaded.
+ */
+export declare function newStampAgentPinStep(): PipelineStep<AgentShareDesc>;
+/**
+ * ValidateShareUpdate — Go validateShareUpdateStep: spec.agent_ref must
+ * keep referencing the same agent, and the cross-org public-audience rule
+ * must hold on update too (update replaces the spec wholesale and must not
+ * open a side door to an org-audience cross-org share). Runs after
+ * LoadExisting. metadata.slug/org immutability needs no step — the generic
+ * BuildUpdateState preserves both, and status (including the pin and link
+ * token) wholesale.
+ */
+export declare function newValidateShareUpdateStep(): PipelineStep<AgentShareDesc>;
+/**
+ * Projects a share and its referenced agent to the trimmed public profile
+ * — Go buildSharedAgentProfile, the single projection shared by the
+ * anonymous and member paths. URL identity (org, slug) comes from the
+ * SHARE; display fields and default_instance_id from the AGENT. Three
+ * misses all fail closed with the uniform refusal, indistinguishable from
+ * absence: a dangling agent_ref, a stale agent-id pin (the rebind guard),
+ * and a cross-org agent no longer visibility_public (withdrawing public
+ * visibility must kill every external channel).
+ */
+export declare function buildSharedAgentProfile(store: Store, share: AgentShare): Promise<SharedAgentProfile>;
+export {};
+//# sourceMappingURL=steps.d.ts.map

package/dist/domain/agentshare/steps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/agentshare/steps.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAInD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yDAAyD,CAAC;AAC3F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yDAAyD,CAAC;AAG1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wDAAwD,CAAC;AAcjG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAI/D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAUtD,KAAK,cAAc,GAAG,OAAO,gBAAgB,CAAC;AAU9C;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAEzD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAahF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAiCD,qEAAqE;AACrE,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAmBjC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,KAAK,GAAG,YAAY,CAAC,cAAc,CAAC,CA0CtF;AAkHD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,IAAI,YAAY,CAAC,cAAc,CAAC,CAkBnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,IAAI,YAAY,CAAC,cAAc,CAAC,CAmCzE;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,kBAAkB,CAAC,CA4B7B"}

package/dist/domain/agentshare/steps.js

@@ -0,0 +1,363 @@
+/**
+ * AgentShare domain steps — ports pkg/domain/agentshare/controller/steps.go
+ * and the get_shared_profile.go helpers: share defaults + the cross-org
+ * public-dependency contract (decision 013), the agent-id rebind pin, the
+ * update immutability rules, the uniform-NotFound profile resolution
+ * helpers, and the constant-time link-token predicate.
+ *
+ * OD-1 (deliberate exclusion): Go's boot migration
+ * (pkg/domain/agentshare/migration/bootstrap_shares.go — protowire
+ * decoding of the REMOVED Agent.spec.sharing fields into AgentShare rows)
+ * is NOT ported. It exists only for self-hosters upgrading a SQLite file
+ * across the decision-011 promotion; a TS server adopting such a database
+ * arrives at cutover (D4 #24), by which time the Go binary has already
+ * run the backfill on every upgraded installation. Ratified in the D4
+ * breakdown (entry #12) and disclosed in the PR.
+ *
+ * Proven by agentshare.conformance.test.ts (CONFORMANCE_TARGET=local)
+ * and __tests__/agentshare.test.ts.
+ */
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { create, fromBinary } from "@bufbuild/protobuf";
+import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import { AgentShareSchema } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/api_pb";
+import { AgentShareStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/status_pb";
+import { SharedAgentProfileSchema } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/io_pb";
+import { AgentShareAudience } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/spec_pb";
+import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
+import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { failedPreconditionError, internalError, invalidArgumentError, notFoundError, } from "../../pipeline/errors.js";
+import { findResourceBySlug } from "../../pipeline/steps/helpers.js";
+import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
+import { AGENT_REF_SLUG_REQUIRED_MESSAGE, ORG_REQUIRED_MESSAGE, SHARE_LINK_TOKEN_BYTES, agentRefImmutableMessage, crossOrgAudienceMessage, crossOrgBlockersMessage, } from "./constants.js";
+/**
+ * Context key for the agent resolved from spec.agent_ref during
+ * create/apply, so later steps never re-load it — Go referencedAgentKey.
+ * Module-private: only ResolveShareDefaults writes it and StampAgentPin
+ * reads it, both in this file.
+ */
+const REFERENCED_AGENT_KEY = "agentShareReferencedAgent";
+/**
+ * The single refusal for every anonymous/member resolution miss: share
+ * missing, share disabled, dangling agent_ref, stale pin, wrong or absent
+ * link token — Go sharedNotFound. The message deliberately says "Agent":
+ * the visitor asked for an agent's chat page, and the share resource is an
+ * internal modeling detail a public error must not teach. One constructor
+ * guarantees the byte-identical-errors contract by construction.
+ */
+export function sharedNotFound(slug) {
+    return notFoundError("Agent", slug);
+}
+/**
+ * The link-token predicate — Go sharingLinkTokenAllowed, the mirror of the
+ * cloud edition's SharingLinkTokenPolicy:
+ *   - No live token: allowed (a stale ?k= on an unlocked link is harmless).
+ *   - Live token set: the presented token must match exactly; a missing or
+ *     rotated-away token refuses (surfacing as the uniform NotFound).
+ *
+ * Comparison is constant-time. Node's timingSafeEqual THROWS on unequal
+ * lengths where Go's subtle.ConstantTimeCompare returns 0, so the length
+ * guard restores Go's semantics; the length of a token is not secret (all
+ * server-minted tokens are 27 chars).
+ */
+export function sharingLinkTokenAllowed(presented, live) {
+    if (live === "") {
+        return true;
+    }
+    if (presented === "") {
+        return false;
+    }
+    const presentedBytes = Buffer.from(presented);
+    const liveBytes = Buffer.from(live);
+    if (presentedBytes.length !== liveBytes.length) {
+        return false;
+    }
+    return timingSafeEqual(presentedBytes, liveBytes);
+}
+/**
+ * Fresh server-side entropy for status.share_link_token — Go
+ * generateShareLinkToken: 20 crypto-random bytes, unpadded url-safe base64
+ * (Node's "base64url" = Go's base64.RawURLEncoding), 27 characters.
+ */
+export function generateShareLinkToken() {
+    return randomBytes(SHARE_LINK_TOKEN_BYTES).toString("base64url");
+}
+/**
+ * Scans agents for an org+slug match — Go findAgentByOrgAndSlug. Full-scan
+ * lookup matches the store's local/OSS posture; malformed rows are
+ * skipped, as Go does. Module-private: consumed by the defaults resolver
+ * and the profile projection, both in this file.
+ */
+async function findAgentByOrgAndSlug(store, org, slug) {
+    let rows;
+    try {
+        rows = await store.listResources(ApiResourceKind.agent);
+    }
+    catch (error) {
+        throw internalError(error, "failed to list agent resources");
+    }
+    for (const data of rows) {
+        let agent;
+        try {
+            agent = fromBinary(AgentSchema, data);
+        }
+        catch {
+            continue;
+        }
+        if (agent.metadata?.slug === slug && agent.metadata.org === org) {
+            return agent;
+        }
+    }
+    return undefined;
+}
+/** Scans shares for an org+slug match — Go findShareByOrgAndSlug. */
+export async function findShareByOrgAndSlug(store, org, slug) {
+    let rows;
+    try {
+        rows = await store.listResources(ApiResourceKind.agent_share);
+    }
+    catch (error) {
+        throw internalError(error, "failed to list agent share resources");
+    }
+    for (const data of rows) {
+        let share;
+        try {
+            share = fromBinary(AgentShareSchema, data);
+        }
+        catch {
+            continue;
+        }
+        if (share.metadata?.slug === slug && share.metadata.org === org) {
+            return share;
+        }
+    }
+    return undefined;
+}
+/**
+ * ResolveShareDefaults — Go resolveShareDefaultsStep:
+ *   1. Requires metadata.org (URL + billing identity, never inferred).
+ *   2. Normalizes spec.agent_ref.org (empty means same-org) and loads the
+ *      referenced agent — a nonexistent agent is refused with the same
+ *      NOT_FOUND a direct agent lookup would produce.
+ *   3. For a CROSS-ORG share, enforces the decision-013 contract.
+ *   4. Defaults metadata.slug (and name) from the agent when the caller
+ *      provided neither — the canonical share keeps the agent's hosted URL.
+ *      Runs before ResolveSlug, which skips already-set slugs.
+ */
+export function newResolveShareDefaultsStep(store) {
+    return {
+        name: "ResolveShareDefaults",
+        async execute(ctx) {
+            const share = ctx.newState;
+            const metadata = share.metadata;
+            if ((metadata?.org ?? "") === "") {
+                throw invalidArgumentError(ORG_REQUIRED_MESSAGE);
+            }
+            const agentRef = share.spec?.agentRef;
+            if ((agentRef?.slug ?? "") === "") {
+                throw invalidArgumentError(AGENT_REF_SLUG_REQUIRED_MESSAGE);
+            }
+            // Empty ref org means same-org (the platform-wide relative-reference
+            // convention); make it absolute before anything compares orgs.
+            if (agentRef.org === "") {
+                agentRef.org = metadata.org;
+            }
+            const agent = await findAgentByOrgAndSlug(store, agentRef.org, agentRef.slug);
+            if (agent === undefined) {
+                throw notFoundError("Agent", agentRef.slug);
+            }
+            if (agentRef.org !== metadata.org) {
+                await validateCrossOrgShare(store, share, agent);
+            }
+            ctx.set(REFERENCED_AGENT_KEY, agent);
+            // Canonical-share default: no slug and no name means "share this
+            // agent under its own slug". A caller-provided name still flows
+            // through ResolveSlug for a deliberately distinct link.
+            if (metadata.slug === "" && metadata.name === "") {
+                metadata.slug = agent.metadata?.slug ?? "";
+                metadata.name = agent.metadata?.name ?? "";
+            }
+        },
+    };
+}
+/**
+ * The cross-org share contract (decision 013) — Go validateCrossOrgShare:
+ *   - The agent must be marketplace-public; a non-public agent is refused
+ *     with the same NOT_FOUND as a missing one (no existence probe for
+ *     private slugs).
+ *   - The audience must be public — org-audience semantics don't carry
+ *     across the org boundary.
+ *   - Every declared dependency must itself be public; the refusal names
+ *     every blocker (sorted) so the sharing org knows exactly what to ask
+ *     the agent's org to publish.
+ * Runtime re-enforcement is cloud-side; this create-time sweep is the
+ * fail-loud half, mirrored in both editions.
+ */
+async function validateCrossOrgShare(store, share, agent) {
+    const agentMeta = agent.metadata;
+    if (agentMeta?.visibility !== ApiResourceVisibility.visibility_public) {
+        throw notFoundError("Agent", agentMeta?.slug ?? "");
+    }
+    // protobuf-es strips the shared enum prefix: proto
+    // agent_share_audience_org generates as AgentShareAudience.org.
+    if (share.spec?.audience === AgentShareAudience.org) {
+        throw failedPreconditionError(crossOrgAudienceMessage(agentMeta.org));
+    }
+    const blockers = await findNonPublicDependencies(store, agent);
+    if (blockers.length > 0) {
+        throw failedPreconditionError(crossOrgBlockersMessage(agentMeta.org, agentMeta.slug, blockers));
+    }
+}
+/**
+ * Sweeps the agent's declared blueprint dependencies — skill_refs
+ * (including every sub-agent's) and mcp_server_usages — and returns a
+ * deterministic "kind org/slug" entry for each that is missing or not
+ * visibility_public — Go findNonPublicDependencies. A reference with an
+ * empty org is relative to the AGENT's org (defensive parity with the
+ * cloud edition's referenceMatches; agent writes normalize refs to
+ * absolute form).
+ */
+async function findNonPublicDependencies(store, agent) {
+    const spec = agent.spec;
+    const agentOrg = agent.metadata?.org ?? "";
+    const seen = new Set();
+    const deps = [];
+    const add = (kind, ref) => {
+        if (ref === undefined || ref.slug === "") {
+            return;
+        }
+        const org = ref.org !== "" ? ref.org : agentOrg;
+        const key = `${kind}|${org}|${ref.slug}`;
+        if (!seen.has(key)) {
+            seen.add(key);
+            deps.push({ kind, org, slug: ref.slug });
+        }
+    };
+    for (const ref of spec?.skillRefs ?? []) {
+        add(ApiResourceKind.skill, ref);
+    }
+    for (const sub of spec?.subAgents ?? []) {
+        for (const ref of sub.skillRefs) {
+            add(ApiResourceKind.skill, ref);
+        }
+    }
+    for (const usage of spec?.mcpServerUsages ?? []) {
+        add(ApiResourceKind.mcp_server, usage.mcpServerRef);
+    }
+    const blockers = [];
+    for (const dep of deps) {
+        let visibility;
+        try {
+            // Per-kind resolution, exactly Go's switch — skill and mcp_server
+            // are the only dependency kinds an agent blueprint declares.
+            const resolved = dep.kind === ApiResourceKind.skill
+                ? await findResourceBySlug(store, dep.kind, SkillSchema, dep.slug, dep.org)
+                : await findResourceBySlug(store, dep.kind, McpServerSchema, dep.slug, dep.org);
+            visibility = resolved?.metadata?.visibility;
+        }
+        catch (error) {
+            throw internalError(error, `failed to resolve ${ApiResourceKind[dep.kind]} ${dep.org}/${dep.slug} while validating cross-org share`);
+        }
+        if (visibility !== ApiResourceVisibility.visibility_public) {
+            blockers.push(`${ApiResourceKind[dep.kind]} ${dep.org}/${dep.slug}`);
+        }
+    }
+    blockers.sort();
+    return blockers;
+}
+/**
+ * StampAgentPin — Go stampAgentPinStep: writes status.agent_id, the
+ * server-owned rebind pin (decision 013). agent_ref is org+slug and slugs
+ * are reusable after delete, so without the pin a stale share would
+ * silently attach its audience, link token, and bound credentials to
+ * whatever agent later claims the slug.
+ *
+ * Runs AFTER BuildNewState, which clears client-provided status — the pin
+ * is system-managed and must survive that wipe, exactly like the audit
+ * fields. Reads the agent ResolveShareDefaults already loaded.
+ */
+export function newStampAgentPinStep() {
+    return {
+        name: "StampAgentPin",
+        execute(ctx) {
+            const agent = ctx.get(REFERENCED_AGENT_KEY);
+            if (agent === undefined) {
+                throw internalError(new Error("referenced agent not found in context"), "referenced agent not found in context (ResolveShareDefaults must run first)");
+            }
+            const share = ctx.newState;
+            const status = share.status ?? create(AgentShareStatusSchema);
+            status.agentId = agent.metadata?.id ?? "";
+            share.status = status;
+        },
+    };
+}
+/**
+ * ValidateShareUpdate — Go validateShareUpdateStep: spec.agent_ref must
+ * keep referencing the same agent, and the cross-org public-audience rule
+ * must hold on update too (update replaces the spec wholesale and must not
+ * open a side door to an org-audience cross-org share). Runs after
+ * LoadExisting. metadata.slug/org immutability needs no step — the generic
+ * BuildUpdateState preserves both, and status (including the pin and link
+ * token) wholesale.
+ */
+export function newValidateShareUpdateStep() {
+    return {
+        name: "ValidateShareUpdate",
+        execute(ctx) {
+            const existing = ctx.get(EXISTING_RESOURCE_KEY);
+            if (existing === undefined) {
+                throw internalError(new Error("existing agent share not found in context"), "existing agent share not found in context");
+            }
+            const inputRef = ctx.input.spec?.agentRef;
+            const existingRef = existing.spec?.agentRef;
+            // Normalize the input ref's org the same way create does (empty
+            // means the share's own org) before comparing.
+            const inputOrg = (inputRef?.org ?? "") !== "" ? inputRef.org : (existing.metadata?.org ?? "");
+            if ((inputRef?.slug ?? "") !== (existingRef?.slug ?? "") ||
+                inputOrg !== (existingRef?.org ?? "")) {
+                throw failedPreconditionError(agentRefImmutableMessage(existingRef?.org ?? "", existingRef?.slug ?? ""));
+            }
+            const isCrossOrg = (existingRef?.org ?? "") !== (existing.metadata?.org ?? "");
+            if (isCrossOrg && ctx.input.spec?.audience === AgentShareAudience.org) {
+                throw failedPreconditionError(crossOrgAudienceMessage(existingRef?.org ?? ""));
+            }
+        },
+    };
+}
+/**
+ * Projects a share and its referenced agent to the trimmed public profile
+ * — Go buildSharedAgentProfile, the single projection shared by the
+ * anonymous and member paths. URL identity (org, slug) comes from the
+ * SHARE; display fields and default_instance_id from the AGENT. Three
+ * misses all fail closed with the uniform refusal, indistinguishable from
+ * absence: a dangling agent_ref, a stale agent-id pin (the rebind guard),
+ * and a cross-org agent no longer visibility_public (withdrawing public
+ * visibility must kill every external channel).
+ */
+export async function buildSharedAgentProfile(store, share) {
+    const ref = share.spec?.agentRef;
+    const agent = await findAgentByOrgAndSlug(store, ref?.org ?? "", ref?.slug ?? "");
+    if (agent === undefined) {
+        throw sharedNotFound(share.metadata?.slug ?? "");
+    }
+    const pin = share.status?.agentId ?? "";
+    if (pin !== "" && pin !== (agent.metadata?.id ?? "")) {
+        throw sharedNotFound(share.metadata?.slug ?? "");
+    }
+    const isCrossOrg = (share.metadata?.org ?? "") !== (agent.metadata?.org ?? "");
+    if (isCrossOrg &&
+        agent.metadata?.visibility !== ApiResourceVisibility.visibility_public) {
+        throw sharedNotFound(share.metadata?.slug ?? "");
+    }
+    return create(SharedAgentProfileSchema, {
+        org: share.metadata?.org ?? "",
+        slug: share.metadata?.slug ?? "",
+        name: agent.metadata?.name ?? "",
+        description: agent.spec?.description ?? "",
+        iconUrl: agent.spec?.iconUrl ?? "",
+        defaultInstanceId: agent.status?.defaultInstanceId ?? "",
+    });
+}
+//# sourceMappingURL=steps.js.map

package/dist/domain/agentshare/steps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/agentshare/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGxD,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AAEjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yDAAyD,CAAC;AAE3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,4DAA4D,CAAC;AACpG,OAAO,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAElG,OAAO,EAAE,kBAAkB,EAAE,MAAM,0DAA0D,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAE/F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E,OAAO,EACL,+BAA+B,EAC/B,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAIxB;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAiB,EAAE,IAAY;IACrE,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,cAAc,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,WAAW,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,qBAAqB,CAClC,KAAY,EACZ,GAAW,EACX,IAAY;IAEZ,IAAI,IAAkB,CAAC;IACvB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;IAC/D,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,KAAY,CAAC;QACjB,IAAI,CAAC;YACH,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,EAAE,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YAChE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAY,EACZ,GAAW,EACX,IAAY;IAEZ,IAAI,IAAkB,CAAC;IACvB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,sCAAsC,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,KAAiB,CAAC;QACtB,IAAI,CAAC;YACH,KAAK,GAAG,UAAU,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,EAAE,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YAChE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAY;IACtD,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,KAAK,CAAC,OAAO,CAAC,GAAmC;YAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;YAEhC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;gBACjC,MAAM,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;YACnD,CAAC;YAED,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC;YACtC,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;gBAClC,MAAM,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;YAC9D,CAAC;YAED,qEAAqE;YACrE,+DAA+D;YAC/D,IAAI,QAAS,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;gBACzB,QAAS,CAAC,GAAG,GAAG,QAAS,CAAC,GAAG,CAAC;YAChC,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,QAAS,CAAC,GAAG,EAAE,QAAS,CAAC,IAAI,CAAC,CAAC;YAChF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,aAAa,CAAC,OAAO,EAAE,QAAS,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;YAED,IAAI,QAAS,CAAC,GAAG,KAAK,QAAS,CAAC,GAAG,EAAE,CAAC;gBACpC,MAAM,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YACnD,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;YAErC,iEAAiE;YACjE,gEAAgE;YAChE,wDAAwD;YACxD,IAAI,QAAS,CAAC,IAAI,KAAK,EAAE,IAAI,QAAS,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACnD,QAAS,CAAC,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;gBAC5C,QAAS,CAAC,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;YAC9C,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,qBAAqB,CAClC,KAAY,EACZ,KAAiB,EACjB,KAAY;IAEZ,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC;IAEjC,IAAI,SAAS,EAAE,UAAU,KAAK,qBAAqB,CAAC,iBAAiB,EAAE,CAAC;QACtE,MAAM,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,mDAAmD;IACnD,gEAAgE;IAChE,IAAI,KAAK,CAAC,IAAI,EAAE,QAAQ,KAAK,kBAAkB,CAAC,GAAG,EAAE,CAAC;QACpD,MAAM,uBAAuB,CAAC,uBAAuB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC/D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,uBAAuB,CAC3B,uBAAuB,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,yBAAyB,CACtC,KAAY,EACZ,KAAY;IAEZ,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IAQ3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,CAAC,IAAqB,EAAE,GAAqC,EAAQ,EAAE;QACjF,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACzC,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;QAChD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;QACxC,GAAG,CAAC,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAChC,GAAG,CAAC,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,eAAe,IAAI,EAAE,EAAE,CAAC;QAChD,GAAG,CAAC,eAAe,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,UAA6C,CAAC;QAClD,IAAI,CAAC;YACH,kEAAkE;YAClE,6DAA6D;YAC7D,MAAM,QAAQ,GACZ,GAAG,CAAC,IAAI,KAAK,eAAe,CAAC,KAAK;gBAChC,CAAC,CAAC,MAAM,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC;gBAC3E,CAAC,CAAC,MAAM,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YACpF,UAAU,GAAG,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,aAAa,CACjB,KAAK,EACL,qBAAqB,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,mCAAmC,CACzG,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,KAAK,qBAAqB,CAAC,iBAAiB,EAAE,CAAC;YAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,OAAO,CAAC,GAAmC;YACzC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAsB,CAAC;YACjE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,uCAAuC,CAAC,EAClD,6EAA6E,CAC9E,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAC9D,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YAC1C,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,OAAO,CAAC,GAAmC;YACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAA2B,CAAC;YAC1E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,2CAA2C,CAAC,EACtD,2CAA2C,CAC5C,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC1C,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;YAE5C,gEAAgE;YAChE,+CAA+C;YAC/C,MAAM,QAAQ,GACZ,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;YAEhF,IACE,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC;gBACpD,QAAQ,KAAK,CAAC,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,EACrC,CAAC;gBACD,MAAM,uBAAuB,CAC3B,wBAAwB,CAAC,WAAW,EAAE,GAAG,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,CAC1E,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAAG,CAAC,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;YAC/E,IAAI,UAAU,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,KAAK,kBAAkB,CAAC,GAAG,EAAE,CAAC;gBACtE,MAAM,uBAAuB,CAAC,uBAAuB,CAAC,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAY,EACZ,KAAiB;IAEjB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IAClF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;IACxC,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACrD,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAC/E,IACE,UAAU;QACV,KAAK,CAAC,QAAQ,EAAE,UAAU,KAAK,qBAAqB,CAAC,iBAAiB,EACtE,CAAC;QACD,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,MAAM,CAAC,wBAAwB,EAAE;QACtC,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;QAC9B,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE;QAChC,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE;QAChC,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE;QAC1C,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE;QAClC,iBAAiB,EAAE,KAAK,CAAC,MAAM,EAAE,iBAAiB,IAAI,EAAE;KACzD,CAAC,CAAC;AACL,CAAC"}

package/dist/domain/apikey/controller.d.ts

@@ -0,0 +1,43 @@
+/**
+ * ApiKey controller (O3, 20260827.06) — the shared apikey contract served
+ * by OSS for the first time (DD-003 owner ruling: issuance + verification
+ * wholly OSS; the cloud Java domain retires against this module). Unlike
+ * the ported Class-A domains there is no Go provenance: the behavioral
+ * reference is the cloud Java handler family
+ * (domain/iam/apikey/request/handler/*), inventoried verbatim in the
+ * sub-project's T01 records.
+ *
+ * Chains mirror the Java pipelines with two deliberate differences:
+ *   - PreserveKeyMaterial on update (ruling Q9 — the Java handler
+ *     documents hash/fingerprint immutability but does not enforce it;
+ *     see steps.ts for the security rationale).
+ *   - findAll returns every key (the permissive single-team posture,
+ *     ruling Q5) where the cloud filters through FGA can_view; for a
+ *     caller who owns the org's keys the results converge.
+ *
+ * Kind mechanics per kind_meta: id prefix `key`, is_versioned false (no
+ * version surface), not_search_indexed true (no IndexSearch steps).
+ *
+ * Proven by apikey.conformance.test.ts (local + cloud targets) and
+ * __tests__/apikey.test.ts (key material, plaintext-once, update
+ * immutability — the pins conformance cannot express cross-edition).
+ */
+import type { ConnectRouter } from "@connectrpc/connect";
+import type { Logger } from "../../boot/logger.js";
+import type { Authorizer } from "../../extensions/authorizer.js";
+import type { ListReadScope } from "../../extensions/list-read-scope.js";
+import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
+import type { Store } from "../../store/interface.js";
+export interface ApiKeyControllerDeps {
+    readonly store: Store;
+    readonly logger: Logger;
+    /** The composed authorization seam — the Authorize step at position 1 of every chain calls it (O2, DD-007 §3). */
+    readonly authorizer: Authorizer;
+    /** The composed tuple-lifecycle driver — undefined = the shared steps no-op (C2). */
+    readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
+    /** The composed list read scope — findAll narrows through it; undefined = every stored key (20260830.01). */
+    readonly listReadScope: ListReadScope | undefined;
+}
+/** Registers both apikey services on the router (routes stage). */
+export declare function registerApiKeyServices(router: ConnectRouter, deps: ApiKeyControllerDeps): void;
+//# sourceMappingURL=controller.d.ts.map

package/dist/domain/apikey/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/apikey/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAgBzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAgCjG,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAQtD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kHAAkH;IAClH,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,qFAAqF;IACrF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC5E,6GAA6G;IAC7G,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;CACnD;AAED,mEAAmE;AACnE,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,oBAAoB,GACzB,IAAI,CAWN"}