@stigmer/server 3.14.0-dev.20260910084630

package/dist/domain/apikey/controller.js

@@ -0,0 +1,154 @@
+import { create, fromBinary } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiKeySchema } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/api_pb";
+import { ApiKeyCommandController } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/command_pb";
+import { ApiKeyQueryController } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/query_pb";
+import { ApiKeysSchema } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/io_pb";
+import { restrictListByReadScope } from "../../extensions/list-read-scope.js";
+import { internalError } from "../../pipeline/errors.js";
+import { apiResourceKindKey } from "../../pipeline/interceptors/apiresource.js";
+import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
+import { newPipeline } from "../../pipeline/pipeline.js";
+import { RequestContext } from "../../pipeline/request-context.js";
+import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
+import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
+import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
+import { newDeleteResourceStep, newExtractResourceIdStep, newLoadExistingForDeleteStep, } from "../../pipeline/steps/delete.js";
+import { newCheckDuplicateStep } from "../../pipeline/steps/duplicate.js";
+import { EXISTING_RESOURCE_KEY, newLoadExistingStep, } from "../../pipeline/steps/load-existing.js";
+import { TARGET_RESOURCE_KEY, newLoadTargetStep, } from "../../pipeline/steps/load-target.js";
+import { newCleanupIamPoliciesStep, newCreateAuthorizationTuplesStep, } from "../../pipeline/steps/authorization-tuples.js";
+import { newPersistStep } from "../../pipeline/steps/persist.js";
+import { newResolveSlugStep } from "../../pipeline/steps/slug.js";
+import { newValidateVisibilityStep } from "../../pipeline/steps/validate-visibility.js";
+import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
+import { newGenerateApiKeyStep, newLoadByKeyHashStep, newPreserveKeyMaterialStep, newReplaceHashWithPlainTextStep, } from "./steps.js";
+/** Registers both apikey services on the router (routes stage). */
+export function registerApiKeyServices(router, deps) {
+    router.service(ApiKeyCommandController, {
+        create: (apiKey, ctx) => createApiKey(deps, apiKey, ctx),
+        update: (apiKey, ctx) => update(deps, apiKey, ctx),
+        delete: (apiKeyId, ctx) => deleteApiKey(deps, apiKeyId, ctx),
+    });
+    router.service(ApiKeyQueryController, {
+        get: (apiKeyId, ctx) => get(deps, apiKeyId, ctx),
+        getByKeyHash: (apiKeyHash, ctx) => getByKeyHash(deps, apiKeyHash, ctx),
+        findAll: (empty, ctx) => findAll(deps, empty, ctx),
+    });
+}
+function kindOf(ctx) {
+    return ctx.values.get(apiResourceKindKey);
+}
+/**
+ * Create — the Java ApiKeyCreateHandler chain: the canonical create steps,
+ * GenerateApiKey after BuildNewState, ReplaceHashWithPlainText after
+ * Persist (the response's one plaintext look; the store keeps the hash).
+ */
+async function createApiKey(deps, apiKey, ctx) {
+    const reqCtx = new RequestContext(ApiKeySchema, apiKey, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("apikey-create", deps.logger)
+        .addStep(newAuthorizeStep(ApiKeyCommandController.method.create, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newValidateVisibilityStep())
+        .addStep(newResolveSlugStep())
+        .addStep(newCheckDuplicateStep(deps.store))
+        .addStep(newBuildNewStateStep())
+        .addStep(newGuardReservedLabelsStep(deps.authorizer))
+        .addStep(newGenerateApiKeyStep())
+        .addStep(newPersistStep(deps.store))
+        .addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle, deps.logger))
+        .addStep(newReplaceHashWithPlainTextStep())
+        .build()
+        .execute(reqCtx);
+    return reqCtx.newState;
+}
+/**
+ * Update — the canonical update chain plus PreserveKeyMaterial (ruling
+ * Q9): expiry fields are the only client-mutable spec surface.
+ */
+async function update(deps, apiKey, ctx) {
+    const reqCtx = new RequestContext(ApiKeySchema, apiKey, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("apikey-update", deps.logger)
+        .addStep(newAuthorizeStep(ApiKeyCommandController.method.update, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newResolveSlugStep())
+        .addStep(newLoadExistingStep(deps.store))
+        .addStep(newBuildUpdateStateStep())
+        .addStep(newPreserveKeyMaterialStep())
+        .addStep(newPersistStep(deps.store))
+        .build()
+        .execute(reqCtx);
+    return reqCtx.newState;
+}
+/** Delete — returns the pre-delete resource (the canonical delete chain). */
+async function deleteApiKey(deps, apiKeyId, ctx) {
+    const reqCtx = new RequestContext(ApiKeyCommandController.method.delete.input, apiKeyId, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("apikey-delete", deps.logger)
+        .addStep(newAuthorizeStep(ApiKeyCommandController.method.delete, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newExtractResourceIdStep())
+        .addStep(newLoadExistingForDeleteStep(deps.store, ApiKeySchema))
+        .addStep(newDeleteResourceStep(deps.store))
+        .addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle, deps.logger))
+        .build()
+        .execute(reqCtx);
+    const deleted = reqCtx.get(EXISTING_RESOURCE_KEY);
+    if (deleted === undefined) {
+        throw internalError(new Error("delete pipeline completed without a loaded resource"), "deleted api key not found in context");
+    }
+    return deleted;
+}
+/** Get — LoadTarget by id; NotFound when absent. */
+async function get(deps, apiKeyId, ctx) {
+    const reqCtx = new RequestContext(ApiKeyQueryController.method.get.input, apiKeyId, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("apikey-get", deps.logger)
+        .addStep(newAuthorizeStep(ApiKeyQueryController.method.get, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadTargetStep(deps.store, ApiKeySchema))
+        .build()
+        .execute(reqCtx);
+    return reqCtx.get(TARGET_RESOURCE_KEY);
+}
+/**
+ * GetByKeyHash — the verifier-facing lookup, also served on the wire
+ * (Java ApiKeyGetByKeyHashHandler; the cloud gates it behind a
+ * platform-admin FGA check inside the handler — OSS's permissive
+ * single-team posture serves it openly, ruling Q5).
+ */
+async function getByKeyHash(deps, apiKeyHash, ctx) {
+    const reqCtx = new RequestContext(ApiKeyQueryController.method.getByKeyHash.input, apiKeyHash, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("apikey-get-by-key-hash", deps.logger)
+        .addStep(newAuthorizeStep(ApiKeyQueryController.method.getByKeyHash, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadByKeyHashStep(deps.store))
+        .build()
+        .execute(reqCtx);
+    return reqCtx.get(TARGET_RESOURCE_KEY);
+}
+/**
+ * FindAll — every stored key under the scope-less single-team posture
+ * (ruling Q5); with a composed ListReadScope (20260830.01, census lane
+ * 9) the list narrows to the caller's can_view keys — the Java
+ * ApiKeyFindAllHandler baseline (no guest arm, no org intersection).
+ * Stored hashes ride the response exactly as the cloud's do — the
+ * plaintext exists nowhere.
+ */
+async function findAll(deps, empty, ctx) {
+    const identity = callerIdentityOf(ctx);
+    const reqCtx = new RequestContext(ApiKeyQueryController.method.findAll.input, empty, identity, kindOf(ctx));
+    await newPipeline("apikey-find-all", deps.logger)
+        .addStep(newAuthorizeStep(ApiKeyQueryController.method.findAll, deps.authorizer))
+        .build()
+        .execute(reqCtx);
+    let rows;
+    try {
+        rows = await deps.store.listResources(ApiResourceKind.api_key);
+    }
+    catch (error) {
+        throw internalError(error, "failed to list api keys");
+    }
+    const entries = await restrictListByReadScope(deps.listReadScope, identity, ApiResourceKind.api_key, rows.map((row) => fromBinary(ApiKeySchema, row)), "");
+    return create(ApiKeysSchema, { entries });
+}
+//# sourceMappingURL=controller.js.map

package/dist/domain/apikey/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/apikey/controller.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGxD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,YAAY,EAAE,MAAM,iDAAiD,CAAC;AAE/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAC9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAU/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE9E,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,+BAA+B,GAChC,MAAM,YAAY,CAAC;AAapB,mEAAmE;AACnE,MAAM,UAAU,sBAAsB,CACpC,MAAqB,EACrB,IAA0B;IAE1B,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE;QACtC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC;QACxD,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC;QAClD,MAAM,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC;KAC7D,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE;QACpC,GAAG,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC;QAChD,YAAY,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC;QACtE,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACnD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,IAA0B,EAC1B,MAAc,EACd,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,YAAY,EACZ,MAAM,EACN,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAsB,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC;SACjE,OAAO,CACN,gBAAgB,CAAC,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CACzE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,qBAAqB,EAAE,CAAC;SAChC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,OAAO,CAAC,+BAA+B,EAAE,CAAC;SAC1C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,MAAM,CACnB,IAA0B,EAC1B,MAAc,EACd,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,YAAY,EACZ,MAAM,EACN,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAsB,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC;SACjE,OAAO,CACN,gBAAgB,CAAC,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CACzE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,0BAA0B,EAAE,CAAC;SACrC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,YAAY,CACzB,IAA0B,EAC1B,QAAkB,EAClB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAC3C,QAAQ,EACR,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,eAAe,EACf,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CACzE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,EAAE,CAAC;SACnC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;SAC/D,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,qDAAqD,CAAC,EAChE,sCAAsC,CACvC,CAAC;IACJ,CAAC;IACD,OAAO,OAAiB,CAAC;AAC3B,CAAC;AAED,oDAAoD;AACpD,KAAK,UAAU,GAAG,CAChB,IAA0B,EAC1B,QAAkB,EAClB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EACtC,QAAQ,EACR,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,YAAY,EACZ,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,qBAAqB,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CACpE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;SACpD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAW,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,IAA0B,EAC1B,UAAsB,EACtB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAC/C,UAAU,EACV,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,wBAAwB,EACxB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,qBAAqB,CAAC,MAAM,CAAC,YAAY,EACzC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACzC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAW,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,OAAO,CACpB,IAA0B,EAC1B,KAAY,EACZ,GAAmB;IAEnB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAC1C,KAAK,EACL,QAAQ,EACR,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,iBAAiB,EACjB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CACxE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,IAAI,IAAkB,CAAC;IACvB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAC3C,IAAI,CAAC,aAAa,EAClB,QAAQ,EACR,eAAe,CAAC,OAAO,EACvB,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,EAChD,EAAE,CACH,CAAC;IACF,OAAO,MAAM,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5C,CAAC"}

package/dist/domain/apikey/keymaterial.d.ts

@@ -0,0 +1,23 @@
+/** The plaintext prefix — Java ApiKeyConstants.API_KEY_PREFIX. */
+export declare const API_KEY_PREFIX = "stk_";
+/** Random bytes per key — Java ApiKeyGenerator.TOKEN_BYTES (256 bits). */
+export declare const API_KEY_TOKEN_BYTES = 32;
+/** Fingerprint length — Java ApiKeyFingerprintExtractor (last 6 chars). */
+export declare const API_KEY_FINGERPRINT_LENGTH = 6;
+/** A fresh plaintext API key: `stk_` + Base64URL(32 random bytes). */
+export declare function generateApiKeyPlaintext(): string;
+/**
+ * The storage hash of a plaintext key — Java ApiKeyHasher.hash. Throws on
+ * an empty input exactly as the Java hasher does (a programming error at
+ * the call site, never a client-visible arm).
+ */
+export declare function hashApiKey(plaintext: string): string;
+/** The display fingerprint — Java ApiKeyFingerprintExtractor.extract. */
+export declare function fingerprintOf(plaintext: string): string;
+/**
+ * Whether a presented bearer token is an API key — the `stk_` prefix,
+ * case-insensitive (Java OpaqueTokenAuthenticationProvider's
+ * startsWithIgnoreCase claim rule).
+ */
+export declare function isApiKeyToken(token: string): boolean;
+//# sourceMappingURL=keymaterial.d.ts.map

package/dist/domain/apikey/keymaterial.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keymaterial.d.ts","sourceRoot":"","sources":["../../../src/domain/apikey/keymaterial.ts"],"names":[],"mappings":"AAuBA,kEAAkE;AAClE,eAAO,MAAM,cAAc,SAAS,CAAC;AAErC,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC,2EAA2E;AAC3E,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C,sEAAsE;AACtE,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAKpD;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD"}

package/dist/domain/apikey/keymaterial.js

@@ -0,0 +1,59 @@
+/**
+ * API-key material — generation, hashing, fingerprinting (O3, 20260827.06;
+ * DD-003 owner ruling: apikey wholly OSS). Ports the cloud Java library
+ * (api-authentication/apikey/library: ApiKeyGenerator, ApiKeyHasher,
+ * ApiKeyFingerprintExtractor) byte-format-for-byte-format — every value
+ * this module produces is cross-edition wire/storage contract:
+ *
+ *   - plaintext: `stk_` + Base64URL(32 SecureRandom bytes), no padding
+ *     ("stk" = stigmer-key; 256 bits of entropy).
+ *   - stored hash: SHA-256 of the UTF-8 plaintext, Base64URL, no padding
+ *     (NOT hex — spec.proto's "SHA-256/Bcrypt" aside is stale; the Java
+ *     hasher is plain SHA-256 and stored hashes must keep matching after
+ *     the cloud converges onto this module).
+ *   - fingerprint: the LAST 6 characters of the plaintext (the whole
+ *     plaintext when shorter — the Java extractor's degenerate arm).
+ *
+ * Prefix claim is case-insensitive (Java startsWithIgnoreCase): the
+ * verifier chain uses it to decide "this is an API key" vs "let the next
+ * verifier look" — a recognized-but-invalid key must then throw, never
+ * pass (extensions/identity.ts contract).
+ */
+import { createHash, randomBytes } from "node:crypto";
+/** The plaintext prefix — Java ApiKeyConstants.API_KEY_PREFIX. */
+export const API_KEY_PREFIX = "stk_";
+/** Random bytes per key — Java ApiKeyGenerator.TOKEN_BYTES (256 bits). */
+export const API_KEY_TOKEN_BYTES = 32;
+/** Fingerprint length — Java ApiKeyFingerprintExtractor (last 6 chars). */
+export const API_KEY_FINGERPRINT_LENGTH = 6;
+/** A fresh plaintext API key: `stk_` + Base64URL(32 random bytes). */
+export function generateApiKeyPlaintext() {
+    return API_KEY_PREFIX + randomBytes(API_KEY_TOKEN_BYTES).toString("base64url");
+}
+/**
+ * The storage hash of a plaintext key — Java ApiKeyHasher.hash. Throws on
+ * an empty input exactly as the Java hasher does (a programming error at
+ * the call site, never a client-visible arm).
+ */
+export function hashApiKey(plaintext) {
+    if (plaintext === "") {
+        throw new Error("token must not be null or empty");
+    }
+    return createHash("sha256").update(plaintext, "utf8").digest("base64url");
+}
+/** The display fingerprint — Java ApiKeyFingerprintExtractor.extract. */
+export function fingerprintOf(plaintext) {
+    if (plaintext.length <= API_KEY_FINGERPRINT_LENGTH) {
+        return plaintext;
+    }
+    return plaintext.slice(-API_KEY_FINGERPRINT_LENGTH);
+}
+/**
+ * Whether a presented bearer token is an API key — the `stk_` prefix,
+ * case-insensitive (Java OpaqueTokenAuthenticationProvider's
+ * startsWithIgnoreCase claim rule).
+ */
+export function isApiKeyToken(token) {
+    return token.slice(0, API_KEY_PREFIX.length).toLowerCase() === API_KEY_PREFIX;
+}
+//# sourceMappingURL=keymaterial.js.map

package/dist/domain/apikey/keymaterial.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keymaterial.js","sourceRoot":"","sources":["../../../src/domain/apikey/keymaterial.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,kEAAkE;AAClE,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAErC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAE5C,sEAAsE;AACtE,MAAM,UAAU,uBAAuB;IACrC,OAAO,cAAc,GAAG,WAAW,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC5E,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,IAAI,SAAS,CAAC,MAAM,IAAI,0BAA0B,EAAE,CAAC;QACnD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,0BAA0B,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC;AAChF,CAAC"}

package/dist/domain/apikey/lookup.d.ts

@@ -0,0 +1,10 @@
+import type { ApiKey } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/api_pb";
+import type { Store } from "../../store/interface.js";
+/**
+ * The ApiKey resource whose spec.key_hash equals `keyHash`, or undefined
+ * when none exists. Store faults other than the typed not-found rethrow
+ * (the ratified store-fault mapping — an infrastructure fault must never
+ * read as "unknown key").
+ */
+export declare function findApiKeyByHash(store: Store, keyHash: string): Promise<ApiKey | undefined>;
+//# sourceMappingURL=lookup.d.ts.map

package/dist/domain/apikey/lookup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lookup.d.ts","sourceRoot":"","sources":["../../../src/domain/apikey/lookup.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iDAAiD,CAAC;AAI9E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAc7B"}

package/dist/domain/apikey/lookup.js

@@ -0,0 +1,36 @@
+/**
+ * API-key lookup by stored hash — the ONE read path shared by the
+ * getByKeyHash RPC and the identity chassis's apikey verifier (O3,
+ * 20260827.06). The verifier deliberately calls this module, never the
+ * RPC: an in-process auth hop for every request would be the cloud
+ * edition's chicken-and-egg machinery (inProcessChannelAsSystem) ported
+ * without its reason — the OSS store is right here.
+ *
+ * Lookup rides Store.findByField ("spec.keyHash"), the sanctioned
+ * secondary-lookup surface: indexability is guaranteed at the interface
+ * and physical indexing is the driver's concern (D2 §3). No cache, on
+ * purpose — a direct read makes key deletion take effect on the very next
+ * request, where the cloud's Redis introspector holds revoked keys for up
+ * to its 1h TTL (server-internal posture, not wire contract).
+ */
+import { ApiKeySchema } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ResourceNotFoundError } from "../../store/interface.js";
+/**
+ * The ApiKey resource whose spec.key_hash equals `keyHash`, or undefined
+ * when none exists. Store faults other than the typed not-found rethrow
+ * (the ratified store-fault mapping — an infrastructure fault must never
+ * read as "unknown key").
+ */
+export async function findApiKeyByHash(store, keyHash) {
+    try {
+        return await store.findByField(ApiResourceKind.api_key, "spec.keyHash", keyHash, ApiKeySchema);
+    }
+    catch (error) {
+        if (error instanceof ResourceNotFoundError) {
+            return undefined;
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=lookup.js.map

package/dist/domain/apikey/lookup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lookup.js","sourceRoot":"","sources":["../../../src/domain/apikey/lookup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,iDAAiD,CAAC;AAE/E,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAGjE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAY,EACZ,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,WAAW,CAC5B,eAAe,CAAC,OAAO,EACvB,cAAc,EACd,OAAO,EACP,YAAY,CACb,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/domain/apikey/steps.d.ts

@@ -0,0 +1,41 @@
+import type { ApiKeySchema } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/api_pb";
+import type { ApiKeyHashSchema } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/io_pb";
+import type { PipelineStep } from "../../pipeline/pipeline.js";
+import type { Store } from "../../store/interface.js";
+/**
+ * Context key parking the plaintext between GenerateApiKey and
+ * ReplaceHashWithPlainText — the Java handler's API_KEY_PLAINTEXT
+ * Context.Key, name kept verbatim.
+ */
+export declare const API_KEY_PLAINTEXT_KEY = "API_KEY_PLAINTEXT";
+type ApiKeyDesc = typeof ApiKeySchema;
+/** Mints the key material onto newState.spec; parks the plaintext. */
+export declare function newGenerateApiKeyStep(): PipelineStep<ApiKeyDesc>;
+/**
+ * Swaps the plaintext into the response's spec.key_hash after Persist —
+ * the store row keeps the hash; the client gets its one look. The
+ * INTERNAL copy is the Java step's, byte-pinned.
+ */
+export declare function newReplaceHashWithPlainTextStep(): PipelineStep<ApiKeyDesc>;
+/**
+ * Restores key material from the stored resource after BuildUpdateState —
+ * expiry fields (expires_at, never_expires) remain the only client-mutable
+ * spec surface (ruling Q9; the module header carries the security
+ * rationale).
+ */
+export declare function newPreserveKeyMaterialStep(): PipelineStep<ApiKeyDesc>;
+/**
+ * Java ApiKeyGetByKeyHashHandler's NOT_FOUND copy — byte-pinned
+ * cross-edition contract (no id in the message, deliberately: the input
+ * IS the hash and echoing hashes into error copy invites log scraping).
+ */
+export declare const API_KEY_NOT_FOUND_BY_HASH_MESSAGE = "ApiKey not found";
+/**
+ * Loads the key whose spec.key_hash equals the input hash into the
+ * TargetResource slot (Java ApiKeyGetByKeyHashHandler: the input is used
+ * as-is — already hashed — and the stored resource returns unmodified,
+ * hash in place; the secret is only ever visible in the create response).
+ */
+export declare function newLoadByKeyHashStep(store: Store): PipelineStep<typeof ApiKeyHashSchema>;
+export {};
+//# sourceMappingURL=steps.d.ts.map

package/dist/domain/apikey/steps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/apikey/steps.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iDAAiD,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAGvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAI/D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAQtD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD,KAAK,UAAU,GAAG,OAAO,YAAY,CAAC;AAEtC,sEAAsE;AACtE,wBAAgB,qBAAqB,IAAI,YAAY,CAAC,UAAU,CAAC,CAiBhE;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,IAAI,YAAY,CAAC,UAAU,CAAC,CAqB1E;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,IAAI,YAAY,CAAC,UAAU,CAAC,CAsBrE;AAED;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,qBAAqB,CAAC;AAEpE;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,KAAK,GACX,YAAY,CAAC,OAAO,gBAAgB,CAAC,CAWvC"}

package/dist/domain/apikey/steps.js

@@ -0,0 +1,123 @@
+/**
+ * ApiKey domain steps (O3, 20260827.06) — the three steps the canonical
+ * chains do not provide, mirroring the cloud Java handlers' domain steps:
+ *
+ *   - GenerateApiKey (Java ApiKeyCreateHandler.GenerateApiKey): mints the
+ *     plaintext AFTER BuildNewState, stores hash + fingerprint on the
+ *     spec, and parks the plaintext under the context key for the
+ *     response step. The client can never choose key material — whatever
+ *     spec.key_hash/fingerprint the request carried is overwritten.
+ *   - ReplaceHashWithPlainText (Java ApiKeyCreateHandler): AFTER Persist,
+ *     swaps the plaintext into spec.key_hash of the RESPONSE only. This
+ *     is the ONLY time the plaintext ever leaves the server; the store
+ *     and audit rows hold the hash. The INTERNAL copy is byte-pinned to
+ *     the Java step's.
+ *   - PreserveKeyMaterial (O3 gate ruling Q9): update keeps spec.key_hash
+ *     and spec.fingerprint from the STORED resource, so only the expiry
+ *     fields are client-mutable. Ruling Q9's original impersonation
+ *     rationale was corrected by stigmer-cloud#544's execution: the Java
+ *     pipeline's computed-field clearing already strips both fields from
+ *     every update request (forgery never persisted) — but nothing
+ *     restored them, so every Java update persisted EMPTY key material
+ *     and bricked the key. Both editions now strip-and-restore: this
+ *     step here, ApiKeyUpdateHandler.PreserveKeyMaterial there. The
+ *     shared contract is pinned by the apikey conformance suite's
+ *     update-immutability arm.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { internalError } from "../../pipeline/errors.js";
+import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
+import { TARGET_RESOURCE_KEY } from "../../pipeline/steps/load-target.js";
+import { fingerprintOf, generateApiKeyPlaintext, hashApiKey, } from "./keymaterial.js";
+import { findApiKeyByHash } from "./lookup.js";
+/**
+ * Context key parking the plaintext between GenerateApiKey and
+ * ReplaceHashWithPlainText — the Java handler's API_KEY_PLAINTEXT
+ * Context.Key, name kept verbatim.
+ */
+export const API_KEY_PLAINTEXT_KEY = "API_KEY_PLAINTEXT";
+/** Mints the key material onto newState.spec; parks the plaintext. */
+export function newGenerateApiKeyStep() {
+    return {
+        name: "GenerateApiKey",
+        execute(ctx) {
+            const resource = ctx.newState;
+            if (resource.spec === undefined) {
+                throw internalError(new Error("spec is nil after BuildNewState"), "generate api key");
+            }
+            const plaintext = generateApiKeyPlaintext();
+            resource.spec.keyHash = hashApiKey(plaintext);
+            resource.spec.fingerprint = fingerprintOf(plaintext);
+            ctx.set(API_KEY_PLAINTEXT_KEY, plaintext);
+        },
+    };
+}
+/**
+ * Swaps the plaintext into the response's spec.key_hash after Persist —
+ * the store row keeps the hash; the client gets its one look. The
+ * INTERNAL copy is the Java step's, byte-pinned.
+ */
+export function newReplaceHashWithPlainTextStep() {
+    return {
+        name: "ReplaceHashWithPlainText",
+        execute(ctx) {
+            const plaintext = ctx.get(API_KEY_PLAINTEXT_KEY);
+            if (typeof plaintext !== "string" || plaintext === "") {
+                throw internalError(new Error("plaintext API key not found in context"), "Failed to retrieve generated API key");
+            }
+            const resource = ctx.newState;
+            if (resource.spec === undefined) {
+                throw internalError(new Error("spec is nil after Persist"), "replace hash with plaintext");
+            }
+            resource.spec.keyHash = plaintext;
+        },
+    };
+}
+/**
+ * Restores key material from the stored resource after BuildUpdateState —
+ * expiry fields (expires_at, never_expires) remain the only client-mutable
+ * spec surface (ruling Q9; the module header carries the security
+ * rationale).
+ */
+export function newPreserveKeyMaterialStep() {
+    return {
+        name: "PreserveKeyMaterial",
+        execute(ctx) {
+            const existing = ctx.get(EXISTING_RESOURCE_KEY);
+            if (existing === undefined) {
+                throw internalError(new Error("existing resource not in context - LoadExisting must run first"), "preserve key material");
+            }
+            const resource = ctx.newState;
+            if (resource.spec === undefined || existing.spec === undefined) {
+                throw internalError(new Error("spec is nil on update"), "preserve key material");
+            }
+            resource.spec.keyHash = existing.spec.keyHash;
+            resource.spec.fingerprint = existing.spec.fingerprint;
+        },
+    };
+}
+/**
+ * Java ApiKeyGetByKeyHashHandler's NOT_FOUND copy — byte-pinned
+ * cross-edition contract (no id in the message, deliberately: the input
+ * IS the hash and echoing hashes into error copy invites log scraping).
+ */
+export const API_KEY_NOT_FOUND_BY_HASH_MESSAGE = "ApiKey not found";
+/**
+ * Loads the key whose spec.key_hash equals the input hash into the
+ * TargetResource slot (Java ApiKeyGetByKeyHashHandler: the input is used
+ * as-is — already hashed — and the stored resource returns unmodified,
+ * hash in place; the secret is only ever visible in the create response).
+ */
+export function newLoadByKeyHashStep(store) {
+    return {
+        name: "LoadByKeyHash",
+        async execute(ctx) {
+            const found = await findApiKeyByHash(store, ctx.input.value);
+            if (found === undefined) {
+                throw new ConnectError(API_KEY_NOT_FOUND_BY_HASH_MESSAGE, Code.NotFound);
+            }
+            ctx.set(TARGET_RESOURCE_KEY, found);
+        },
+    };
+}
+//# sourceMappingURL=steps.js.map

package/dist/domain/apikey/steps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/apikey/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAMzD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE1E,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,UAAU,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAIzD,sEAAsE;AACtE,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,OAAO,CAAC,GAA+B;YACrC,MAAM,QAAQ,GAAW,GAAG,CAAC,QAAQ,CAAC;YACtC,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,iCAAiC,CAAC,EAC5C,kBAAkB,CACnB,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B;IAC7C,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,OAAO,CAAC,GAA+B;YACrC,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACjD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBACtD,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,wCAAwC,CAAC,EACnD,sCAAsC,CACvC,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAW,GAAG,CAAC,QAAQ,CAAC;YACtC,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,2BAA2B,CAAC,EACtC,6BAA6B,CAC9B,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,OAAO,CAAC,GAA+B;YACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAuB,CAAC;YACtE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,gEAAgE,CAAC,EAC3E,uBAAuB,CACxB,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAW,GAAG,CAAC,QAAQ,CAAC;YACtC,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC/D,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,uBAAuB,CAAC,EAClC,uBAAuB,CACxB,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,kBAAkB,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAY;IAEZ,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,KAAK,CAAC,OAAO,CAAC,GAA4C;YACxD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC7D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,YAAY,CAAC,iCAAiC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3E,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/apikey/verifier.d.ts

@@ -0,0 +1,8 @@
+import type { IdentityVerifier } from "../../extensions/identity.js";
+import type { Store } from "../../store/interface.js";
+/** Java classifyAuthError's fallback arm — the unknown/revoked-key copy. */
+export declare const INVALID_TOKEN_MESSAGE = "invalid token";
+/** Java classifyAuthError's "expired" arm. */
+export declare const TOKEN_EXPIRED_MESSAGE = "token has expired";
+export declare function newApiKeyIdentityVerifier(store: Store): IdentityVerifier;
+//# sourceMappingURL=verifier.d.ts.map

package/dist/domain/apikey/verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../src/domain/apikey/verifier.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAItD,4EAA4E;AAC5E,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAErD,8CAA8C;AAC9C,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,KAAK,GAAG,gBAAgB,CAgCxE"}

package/dist/domain/apikey/verifier.js

@@ -0,0 +1,68 @@
+/**
+ * The API-token identity verifier (O3, 20260827.06) — the first OSS entry
+ * on the chassis's verifier chain, the TS rendering of the cloud's
+ * OpaqueTokenAuthenticationProvider + RedisApiKeyIntrospector pair minus
+ * the cache (lookup.ts carries the no-cache rationale: instant
+ * revocation).
+ *
+ * Claim rule: the `stk_` prefix, case-insensitive (the Java provider's
+ * startsWithIgnoreCase). Everything else passes to the next verifier.
+ * A recognized token that fails verification THROWS (identity.ts
+ * contract) with the wire copy the Java interceptor's classifyAuthError
+ * produces for the introspector's failures, byte-pinned:
+ *
+ *   - unknown/revoked key → "invalid token" (Java: the introspector's
+ *     "revoked or unknown" description classifies to the fallback arm);
+ *   - expired key → "token has expired" (the "expired" keyword arm).
+ *
+ * Identity: the key authenticates AS ITS OWNING USER (the verified Java
+ * posture — an API-key principal is indistinguishable downstream from a
+ * JWT login). The owner is the key's creator,
+ * status.audit.spec_audit.created_by (the Java owner extractor's actual
+ * read), whose actor row also carries the email/displayName the audit
+ * seam wants. Expiry is "expires_at set and past"; never_expires is
+ * deliberately not read — Java parity (never-expiring keys leave
+ * expires_at unset).
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { timestampDate } from "@bufbuild/protobuf/wkt";
+import { hashApiKey, isApiKeyToken } from "./keymaterial.js";
+import { findApiKeyByHash } from "./lookup.js";
+/** Java classifyAuthError's fallback arm — the unknown/revoked-key copy. */
+export const INVALID_TOKEN_MESSAGE = "invalid token";
+/** Java classifyAuthError's "expired" arm. */
+export const TOKEN_EXPIRED_MESSAGE = "token has expired";
+export function newApiKeyIdentityVerifier(store) {
+    return {
+        name: "apikey",
+        async verify(token) {
+            if (!isApiKeyToken(token)) {
+                return null;
+            }
+            const key = await findApiKeyByHash(store, hashApiKey(token));
+            if (key === undefined) {
+                throw new ConnectError(INVALID_TOKEN_MESSAGE, Code.Unauthenticated);
+            }
+            const expiresAt = key.spec?.expiresAt;
+            if (expiresAt !== undefined && timestampDate(expiresAt) <= new Date()) {
+                throw new ConnectError(TOKEN_EXPIRED_MESSAGE, Code.Unauthenticated);
+            }
+            const owner = key.status?.audit?.specAudit?.createdBy;
+            if (owner === undefined || owner.id === "") {
+                // A key without creator attribution cannot authenticate as anyone —
+                // fail closed with the fallback copy (unreachable for keys created
+                // through the pipeline; guards hand-seeded or corrupted rows).
+                throw new ConnectError(INVALID_TOKEN_MESSAGE, Code.Unauthenticated);
+            }
+            return {
+                identityId: owner.id,
+                callerClass: "user",
+                issuer: "",
+                rawToken: token,
+                ...(owner.email !== "" ? { email: owner.email } : {}),
+                ...(owner.displayName !== "" ? { displayName: owner.displayName } : {}),
+            };
+        },
+    };
+}
+//# sourceMappingURL=verifier.js.map

package/dist/domain/apikey/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../src/domain/apikey/verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAOvD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAErD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAEzD,MAAM,UAAU,yBAAyB,CAAC,KAAY;IACpD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;YACtC,IAAI,SAAS,KAAK,SAAS,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;gBACtE,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;YACtD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC3C,oEAAoE;gBACpE,mEAAmE;gBACnE,+DAA+D;gBAC/D,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,KAAK,CAAC,EAAE;gBACpB,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,KAAK;gBACf,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/artifact/constants.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Artifact domain constants — byte-pinned values and wire copy from
+ * pkg/domain/artifact. The error formats are asserted by the conformance
+ * suite (get NotFound copy, deleted-blob copy) and shown verbatim by
+ * clients — never reword.
+ */
+/** Go kind string on the built resource. */
+export declare const ARTIFACT_KIND = "Artifact";
+/**
+ * Go maxContentBytes (50 MB): the domain-level content cap →
+ * ResourceExhausted. Sits BEHIND the transport's 10MB message cap, so it
+ * is not wire-assertable from the reference client — the arm stays
+ * unit-level in both editions (the wave-2 S1 amendment).
+ */
+export declare const MAX_CONTENT_BYTES: number;
+/** Go defaultTTLDays: expires_at defaults ~30 days out. */
+export declare const DEFAULT_TTL_DAYS = 30;
+/** Go permanentTTLMarker: retention.ttl_days = -1 means never expires. */
+export declare const PERMANENT_TTL_MARKER = -1;
+/**
+ * Go DefaultMaxContentBytes (512 KB): getContent's default/implicit cap,
+ * matching AgentExecutionController.GetArtifactContent so the two
+ * content-read endpoints behave identically from a client's perspective.
+ */
+export declare const DEFAULT_MAX_CONTENT_BYTES: bigint;
+/**
+ * Go downloadURLExpiration (7 days — the R2 maximum). Reported as
+ * ttl_seconds UNCONDITIONALLY, even by the local backend whose URLs never
+ * expire — the ratified P3 wire pin.
+ */
+export declare const DOWNLOAD_URL_EXPIRATION_MS: number;
+/** Go: status.Errorf(codes.NotFound, "Artifact not found: %s", id). */
+export declare function artifactNotFoundMessage(artifactId: string): string;
+/** Go: "artifact blob has been deleted: %s" (FailedPrecondition). */
+export declare function artifactBlobDeletedMessage(artifactId: string): string;
+//# sourceMappingURL=constants.d.ts.map

package/dist/domain/artifact/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/artifact/constants.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,4CAA4C;AAC5C,eAAO,MAAM,aAAa,aAAa,CAAC;AAExC;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,QAAmB,CAAC;AAElD,2DAA2D;AAC3D,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,QAAe,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,QAA0B,CAAC;AAElE,uEAAuE;AACvE,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,qEAAqE;AACrE,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAErE"}