@stigmer/server 3.15.0 → 3.15.2-dev.20260913223433

package/dist/transport/console/handler.d.ts

@@ -7,13 +7,30 @@ import type { ConsoleAssets } from "./assets.js";
  * of RPC path shapes belongs to this module.
  */
 export declare function consoleLaneEligible(request: LaneRequest): boolean;
+/**
+ * How the console this lane serves signs in — the server's authentication
+ * posture as the console needs to hear it (20260913.02 sp.console-login).
+ * A modeled state, never a nullable: "no issuer configured" and "forgot to
+ * wire the posture" must stay distinguishable at the call site.
+ *
+ * Under `oidc`, `consoleClientId` is the PUBLIC client the operator
+ * registered for the browser's PKCE flow, or "" when they have not
+ * (Q-CL-1): the lane publishes that truth as-is and the console refuses
+ * with copy that names the knob (Q-CL-2), while the composition root has
+ * already WARNed at wiring time. Emitting `disabled` instead would send
+ * the console into every RPC tokenless, to fail with a worse message.
+ */
+export type ConsoleSignInPosture = {
+    readonly posture: "trusted-local";
+} | {
+    readonly posture: "oidc";
+    readonly issuer: string;
+    readonly audience: string;
+    readonly consoleClientId: string;
+};
 export interface ConsoleLaneOptions {
     readonly assets: ConsoleAssets;
-    /**
-     * Fallback port for the synthesized apiUrl when a request carries no
-     * Host/:authority (technically possible on HTTP/1.0-style clients).
-     */
-    readonly grpcPort: number;
+    readonly signIn: ConsoleSignInPosture;
     readonly logger: Logger;
 }
 export declare function createConsoleLane(options: ConsoleLaneOptions): LaneHandler;

package/dist/transport/console/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/transport/console/handler.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAgB,MAAM,aAAa,CAAC;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAkBjD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAYjE;AAQD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CA8C1E"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/transport/console/handler.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAgB,MAAM,aAAa,CAAC;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAkBjD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAYjE;AAQD;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GACrC;IACE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,CAAC;AAEN,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAiD1E"}

package/dist/transport/console/handler.js

@@ -6,6 +6,13 @@
  * nginx-equivalence-gated); this module owns the HTTP half: the lane
  * guard, header policy, config synthesis, and file streaming.
  *
+ * /config.json is also how the served console learns to sign in
+ * (20260913.02 sp.console-login; stigmer#924): the composition root hands
+ * the lane the server's authentication posture (ConsoleSignInPosture) and
+ * the lane publishes it in the console's own vocabulary — the OIDC
+ * issuer, audience and the console's PKCE client id under the posture,
+ * `disabled` under trusted local.
+ *
  * Lane guard (consoleLaneEligible): the lane claims GET/HEAD only — RPC
  * traffic is POST on service-qualified paths, and OPTIONS preflights keep
  * flowing to the RPC lane's CORS handling — and it never claims:
@@ -63,14 +70,17 @@ function isServiceShapedPath(pathname) {
     return segments.length === 2 && (segments[0] ?? "").includes(".");
 }
 export function createConsoleLane(options) {
-    const { assets, grpcPort, logger } = options;
+    const { assets, signIn, logger } = options;
+    // The console's runtime config is a pure function of the posture: one
+    // body, built once, served on every request.
+    const configJsonBody = JSON.stringify(consoleRuntimeConfig(signIn));
     return (request, response) => {
         const url = request.url ?? "";
         const queryStart = url.indexOf("?");
         const rawPath = queryStart === -1 ? url : url.slice(0, queryStart);
         const query = queryStart === -1 ? "" : url.slice(queryStart);
         if (rawPath === CONFIG_JSON_PATH) {
-            serveConfigJson(request, response, grpcPort);
+            serveConfigJson(request, response, configJsonBody);
             return;
         }
         let pathname;
@@ -108,29 +118,48 @@ export function createConsoleLane(options) {
 }
 /**
  * The runtime config the cloud container's entrypoint.sh generates from
- * env — synthesized here from the server's own knowledge instead (DD-012:
- * the nginx entrypoint script is not ported). apiUrl derives from the
- * request's own Host so the answer is correct wherever the browser
- * reached us from (localhost, a LAN address, a self-host name) — the
- * console cannot express "same origin" itself (its config loader maps
- * empty fields to a localhost default). TLS-terminating proxies
- * (x-forwarded-proto) are out of scope until a tier serves TLS.
+ * env, synthesized here from the server's own knowledge instead (DD-012:
+ * the nginx entrypoint script is not ported). The field names are the
+ * console's loader's (client-apps/web/src/config/runtime-config.ts).
+ *
+ * `apiUrl` is the empty string, which the console reads as "my own
+ * origin" — the rule its `appUrl` already follows (20260913.02 Q-CL-3).
+ * This lane and the RPC lane share one port, so the console can never
+ * need a different origin, and it makes the answer right behind a
+ * TLS-terminating proxy without trusting x-forwarded-proto: the earlier
+ * Host-derived `http://<host>` sent an https-loaded console to an http
+ * API and died on mixed content.
+ *
+ * Every value here is public metadata: an OIDC issuer URL, an audience
+ * string and a PKCE client id are what a browser is handed by design.
  */
-function serveConfigJson(request, response, grpcPort) {
-    // HTTP/1.1 carries Host; Node maps HTTP/2's :authority into the same
-    // headers view (and Http2ServerRequest.authority falls back to it).
-    const host = request.headers.host ?? request.headers[":authority"];
-    const apiUrl = typeof host === "string" && host !== ""
-        ? `http://${host}`
-        : `http://localhost:${grpcPort}`;
-    const body = JSON.stringify({
-        apiUrl,
-        appUrl: "",
-        authMode: "disabled",
-        oidcIssuer: "",
-        oidcClientId: "",
-        oidcAudience: "",
-    });
+function consoleRuntimeConfig(signIn) {
+    switch (signIn.posture) {
+        case "trusted-local":
+            return {
+                apiUrl: "",
+                appUrl: "",
+                authMode: "disabled",
+                oidcIssuer: "",
+                oidcClientId: "",
+                oidcAudience: "",
+            };
+        case "oidc":
+            return {
+                apiUrl: "",
+                appUrl: "",
+                authMode: "oidc",
+                oidcIssuer: signIn.issuer,
+                oidcClientId: signIn.consoleClientId,
+                oidcAudience: signIn.audience,
+            };
+        default: {
+            const exhaustive = signIn;
+            throw new Error(`unhandled sign-in posture ${String(exhaustive)}`);
+        }
+    }
+}
+function serveConfigJson(request, response, body) {
     response.statusCode = 200;
     response.setHeader("Content-Type", "application/json");
     response.setHeader("Cache-Control", CONFIG_JSON_CACHE_CONTROL);

package/dist/transport/console/handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../src/transport/console/handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAK7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAEtD,2EAA2E;AAC3E,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAExC,yFAAyF;AACzF,MAAM,yBAAyB,GAAG,qCAAqC,CAAC;AAExE,mEAAmE;AACnE,MAAM,uBAAuB,GAAG,qCAAqC,CAAC;AAEtE,2GAA2G;AAC3G,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAErD,4EAA4E;AAC5E,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAEzC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAoB;IACtD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,IAAI,QAAQ,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,0EAA0E;AAC1E,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IACzE,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACpE,CAAC;AAYD,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAE7C,OAAO,CAAC,OAAoB,EAAE,QAAsB,EAAQ,EAAE;QAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAE7D,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;YACjC,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,kEAAkE;YAClE,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACjE,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;YACxB,KAAK,UAAU;gBACb,mEAAmE;gBACnE,iEAAiE;gBACjE,8DAA8D;gBAC9D,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;gBAC1B,QAAQ,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,UAAU,CAAC,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC;gBACjE,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACf,OAAO;YACT,KAAK,MAAM;gBACT,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBACnE,OAAO;YACT,KAAK,UAAU;gBACb,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBACjD,OAAO;YACT,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,UAAU,GAAU,UAAU,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CACtB,OAAoB,EACpB,QAAsB,EACtB,QAAgB;IAEhB,qEAAqE;IACrE,oEAAoE;IACpE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACnE,MAAM,MAAM,GACV,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE;QACrC,CAAC,CAAC,UAAU,IAAI,EAAE;QAClB,CAAC,CAAC,oBAAoB,QAAQ,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,MAAM;QACN,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,EAAE;QACd,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,EAAE;KACjB,CAAC,CAAC;IACH,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IACvD,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IAC/D,QAAQ,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,QAAQ,CAAC,GAAG,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,aAAa,CACpB,OAAoB,EACpB,QAAsB,EACtB,MAAqB,EACrB,MAAc;IAEd,+DAA+D;IAC/D,mEAAmE;IACnE,iDAAiD;IACjD,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACtC,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,SAAS,CAChB,OAAoB,EACpB,QAAsB,EACtB,MAAqB,EACrB,IAAY,EACZ,UAAkB,EAClB,MAAc;IAEd,sEAAsE;IACtE,sEAAsE;IACtE,wEAAwE;IACxE,gCAAgC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAE5E,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,KAAK,CAC7D,CAAC,KAAc,EAAE,EAAE;QACjB,2DAA2D;QAC3D,gEAAgE;QAChE,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE;YAChD,IAAI;YACJ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1B,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;QAC5B,CAAC;QACD,QAAQ,CAAC,GAAG,EAAE,CAAC;IACjB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,OAAoB,EACpB,QAAsB,EACtB,IAAY,EACZ,QAAgB,EAChB,UAAkB;IAElB,wEAAwE;IACxE,4DAA4D;IAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClC,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;IACtE,QAAQ,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,QAAQ,CAAC,GAAG,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3B,QAAQ,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,UAAkB;IACtD,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACtC,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,aAAa,GAAqC;IACtD,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,gCAAgC;IACvC,MAAM,EAAE,gCAAgC;IACxC,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,2BAA2B;IACnC,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EAAE,iBAAiB;IACzB,cAAc,EAAE,2BAA2B;CAC5C,CAAC;AAEF,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,OAAO,aAAa,CAAC,SAAS,CAAC,IAAI,0BAA0B,CAAC;AAChE,CAAC"}
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../src/transport/console/handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAK7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAEtD,2EAA2E;AAC3E,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAExC,yFAAyF;AACzF,MAAM,yBAAyB,GAAG,qCAAqC,CAAC;AAExE,mEAAmE;AACnE,MAAM,uBAAuB,GAAG,qCAAqC,CAAC;AAEtE,2GAA2G;AAC3G,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAErD,4EAA4E;AAC5E,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAEzC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAoB;IACtD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,IAAI,QAAQ,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,0EAA0E;AAC1E,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IACzE,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACpE,CAAC;AA8BD,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3C,sEAAsE;IACtE,6CAA6C;IAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;IAEpE,OAAO,CAAC,OAAoB,EAAE,QAAsB,EAAQ,EAAE;QAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAE7D,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;YACjC,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,kEAAkE;YAClE,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACjE,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;YACxB,KAAK,UAAU;gBACb,mEAAmE;gBACnE,iEAAiE;gBACjE,8DAA8D;gBAC9D,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;gBAC1B,QAAQ,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,UAAU,CAAC,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC;gBACjE,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACf,OAAO;YACT,KAAK,MAAM;gBACT,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBACnE,OAAO;YACT,KAAK,UAAU;gBACb,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBACjD,OAAO;YACT,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,UAAU,GAAU,UAAU,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,oBAAoB,CAAC,MAA4B;IAQxD,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,KAAK,eAAe;YAClB,OAAO;gBACL,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,UAAU;gBACpB,UAAU,EAAE,EAAE;gBACd,YAAY,EAAE,EAAE;gBAChB,YAAY,EAAE,EAAE;aACjB,CAAC;QACJ,KAAK,MAAM;YACT,OAAO;gBACL,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM,CAAC,MAAM;gBACzB,YAAY,EAAE,MAAM,CAAC,eAAe;gBACpC,YAAY,EAAE,MAAM,CAAC,QAAQ;aAC9B,CAAC;QACJ,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,MAAM,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,OAAoB,EACpB,QAAsB,EACtB,IAAY;IAEZ,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IACvD,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IAC/D,QAAQ,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,QAAQ,CAAC,GAAG,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,aAAa,CACpB,OAAoB,EACpB,QAAsB,EACtB,MAAqB,EACrB,MAAc;IAEd,+DAA+D;IAC/D,mEAAmE;IACnE,iDAAiD;IACjD,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACtC,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,SAAS,CAChB,OAAoB,EACpB,QAAsB,EACtB,MAAqB,EACrB,IAAY,EACZ,UAAkB,EAClB,MAAc;IAEd,sEAAsE;IACtE,sEAAsE;IACtE,wEAAwE;IACxE,gCAAgC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAE5E,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,KAAK,CAC7D,CAAC,KAAc,EAAE,EAAE;QACjB,2DAA2D;QAC3D,gEAAgE;QAChE,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE;YAChD,IAAI;YACJ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1B,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;QAC5B,CAAC;QACD,QAAQ,CAAC,GAAG,EAAE,CAAC;IACjB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,OAAoB,EACpB,QAAsB,EACtB,IAAY,EACZ,QAAgB,EAChB,UAAkB;IAElB,wEAAwE;IACxE,4DAA4D;IAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClC,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;IACtE,QAAQ,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,QAAQ,CAAC,GAAG,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3B,QAAQ,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,UAAkB;IACtD,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACtC,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,aAAa,GAAqC;IACtD,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,gCAAgC;IACvC,MAAM,EAAE,gCAAgC;IACxC,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,2BAA2B;IACnC,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EAAE,iBAAiB;IACzB,cAAc,EAAE,2BAA2B;CAC5C,CAAC;AAEF,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,OAAO,aAAa,CAAC,SAAS,CAAC,IAAI,0BAA0B,CAAC;AAChE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/server",
-  "version": "3.15.0",
+  "version": "3.15.2-dev.20260913223433",
   "description": "The Stigmer OSS control plane as a composable library: composeServer, the extension registry and the driver seams a composition builds on. The self-contained deployable of the same server is @stigmer/server-slim.",
   "license": "Apache-2.0",
   "type": "module",
@@ -62,9 +62,9 @@
     "@connectrpc/connect-node": "^2.0.0",
     "@kubernetes/client-node": "2.0.0",
     "@opentelemetry/api": "^1.9.0",
-    "@stigmer/protos": "3.15.0",
-    "@stigmer/temporal-codecs": "3.15.0",
-    "@stigmer/zip-structure": "3.15.0",
+    "@stigmer/protos": "3.15.2-dev.20260913223433",
+    "@stigmer/temporal-codecs": "3.15.2-dev.20260913223433",
+    "@stigmer/zip-structure": "3.15.2-dev.20260913223433",
     "@temporalio/activity": "1.16.2",
     "@temporalio/client": "1.16.2",
     "@temporalio/common": "1.16.2",

package/src/boot/__tests__/auth-enabled-composition.test.ts

@@ -21,9 +21,17 @@
  *      the issuer's userinfo profile; from then on the verifier resolves
  *      the subject to the account id and API keys minted before OR after
  *      provisioning answer whoAmI with the owner's account; no operator
- *      account exists under the posture.
+ *      account exists under the posture;
+ *   7. (20260913.02, sp.console-login) the console the server serves is
+ *      told the posture through /config.json — the issuer and audience
+ *      this composition runs under, with the console client id the
+ *      operator did NOT register here left empty — and the composition
+ *      root WARNs at wiring time that the served console cannot sign in
+ *      (Q-CL-2), the STIGMER_OAUTH_REDIRECT_URI precedent. Proven through
+ *      compose.ts with STIGMER_CONSOLE_DIR at a fixture export, not
+ *      through the lane alone (handler.test.ts covers that).
  */
-import { mkdtempSync, rmSync } from "node:fs";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { createServer } from "node:http";
@@ -75,6 +83,9 @@ let port: number;
 // the raw sub. The identity-account arms prove that stamp resolves to the
 // owner's account once one exists (20260911.11 A1's derived id).
 let keyMintedBeforeProvisioning: string;
+// Every WARN the composition root logged while wiring — the console
+// sign-in arm (7) reads it.
+const warnings: string[] = [];
 
 function bearer(token: string): Interceptor {
   return (next) => (request) => {
@@ -177,6 +188,10 @@ beforeAll(async () => {
   issuer = `http://127.0.0.1:${address.port}`;
 
   dir = mkdtempSync(path.join(tmpdir(), "auth-enabled-test-"));
+  // The smallest export the console lane discovers: the app shell alone.
+  const consoleDir = path.join(dir, "console");
+  mkdirSync(consoleDir, { recursive: true });
+  writeFileSync(path.join(consoleDir, "index.html"), "<html>app shell</html>");
   server = await composeServer({
     config: loadConfig({
       STIGMER_MODEL_REGISTRY_REFRESH: "off",
@@ -186,8 +201,18 @@ beforeAll(async () => {
       ARTIFACT_LOCAL_BASE_PATH: path.join(dir, "artifacts"),
       STIGMER_OIDC_ISSUER: issuer,
       STIGMER_OIDC_AUDIENCE: AUDIENCE,
+      STIGMER_CONSOLE_DIR: consoleDir,
+    }),
+    logger: createLogger({
+      level: "warn",
+      pretty: false,
+      write: (line) => {
+        const entry = JSON.parse(line) as { level?: string; message?: string };
+        if (entry.level === "warn" && entry.message !== undefined) {
+          warnings.push(entry.message);
+        }
+      },
     }),
-    logger: createLogger({ level: "error", pretty: false, write: () => {} }),
     portOverride: 0,
     host: "127.0.0.1",
   });
@@ -236,6 +261,27 @@ describe("the require-authentication posture on the wire", () => {
   });
 });
 
+describe("the console the server serves is told the posture (20260913.02, sp.console-login)", () => {
+  it("/config.json carries the issuer and audience this composition verifies against, with the unregistered console client id empty", async () => {
+    const response = await fetch(`http://127.0.0.1:${port}/config.json`);
+    expect(response.status).toBe(200);
+    expect(await response.json()).toEqual({
+      apiUrl: "",
+      appUrl: "",
+      authMode: "oidc",
+      oidcIssuer: issuer,
+      oidcClientId: "",
+      oidcAudience: AUDIENCE,
+    });
+  });
+
+  it("the composition root WARNs at wiring time that the served console cannot sign in without STIGMER_OIDC_CONSOLE_CLIENT_ID (Q-CL-2)", () => {
+    expect(warnings).toContainEqual(
+      expect.stringContaining("STIGMER_OIDC_CONSOLE_CLIENT_ID"),
+    );
+  });
+});
+
 describe("the full credential loop (OIDC login → API key → revocation)", () => {
   let apiKeyPlaintext: string;
   let apiKeyId: string;

package/src/boot/__tests__/config.test.ts

@@ -59,15 +59,53 @@ describe("loadConfig", () => {
   });
 
   it("reads an explicit ARTIFACT_HTTP_HOST (the container override)", () => {
-    expect(
-      loadConfig({ ARTIFACT_HTTP_HOST: "0.0.0.0" }).artifactHttpHost,
-    ).toBe("0.0.0.0");
+    expect(loadConfig({ ARTIFACT_HTTP_HOST: "0.0.0.0" }).artifactHttpHost).toBe(
+      "0.0.0.0",
+    );
     // Empty string is absent, per the Go getEnvString leniency.
     expect(loadConfig({ ARTIFACT_HTTP_HOST: "" }).artifactHttpHost).toBe(
       "127.0.0.1",
     );
   });
 
+  // 20260913.02 (sp.console-login, Q-CL-1): the console's public PKCE client
+  // id is lenient on purpose — a CLI-only self-host that set the issuer
+  // before this knob existed must keep booting on upgrade, and the served
+  // console reports the gap itself (Q-CL-2).
+  describe("STIGMER_OIDC_CONSOLE_CLIENT_ID (the console's sign-in client)", () => {
+    const OIDC = {
+      STIGMER_OIDC_ISSUER: "https://auth.example.com/realms/main",
+      STIGMER_OIDC_AUDIENCE: "https://stigmer.example.com/",
+    };
+
+    it("is empty when absent, and the issuer alone still boots", () => {
+      expect(loadConfig(OIDC).oidcConsoleClientId).toBe("");
+    });
+
+    it("reads the explicit value", () => {
+      expect(
+        loadConfig({
+          ...OIDC,
+          STIGMER_OIDC_CONSOLE_CLIENT_ID: "stigmer-console",
+        }).oidcConsoleClientId,
+      ).toBe("stigmer-console");
+    });
+
+    it("treats an empty string as absent (Go's getEnvString)", () => {
+      expect(
+        loadConfig({ ...OIDC, STIGMER_OIDC_CONSOLE_CLIENT_ID: "" })
+          .oidcConsoleClientId,
+      ).toBe("");
+    });
+
+    it("is carried even without an issuer — the posture, not this knob, decides whether it is used", () => {
+      expect(
+        loadConfig({ STIGMER_OIDC_CONSOLE_CLIENT_ID: "stigmer-console" })
+          .oidcConsoleClientId,
+      ).toBe("stigmer-console");
+    });
+  });
+
   it("disables the model-registry refresh only for the literal 'off'", () => {
     expect(
       loadConfig({ STIGMER_MODEL_REGISTRY_REFRESH: "off" })

package/src/boot/compose.ts

@@ -161,7 +161,10 @@ import { newWorkflowExecutionEngineStateProvider } from "../temporal/workflowexe
 import { newWorkflowExecutionWorkerFactory } from "../temporal/workflowexecution/worker.js";
 import { HealthState, registerHealthService } from "../transport/health.js";
 import { resolveConsoleAssets } from "../transport/console/assets.js";
-import { createConsoleLane } from "../transport/console/handler.js";
+import {
+  createConsoleLane,
+  type ConsoleSignInPosture,
+} from "../transport/console/handler.js";
 import { createRegistryLanes } from "../transport/registry/lanes.js";
 import { createUnifiedPortServer } from "../transport/server.js";
 import type { ServerConfig } from "./config.js";
@@ -762,11 +765,36 @@ export async function composeServer(
   } else {
     logger.debug("no web console export bundled; console lane disabled");
   }
+  // The console is told how to sign in (20260913.02 sp.console-login): the
+  // OSS issuer arm of the posture, in the console's vocabulary. A composed
+  // unit's own `requireAuthentication` is NOT expressed here — a
+  // composition whose verifiers resolve its users serves its console its
+  // own way (the cloud's container does); the Enterprise console story is
+  // P4's. Issuer set but no console client registered is WARN-degrade, the
+  // STIGMER_OAUTH_REDIRECT_URI posture: the CLI and SDKs keep working with
+  // API keys, and the served console refuses with copy naming the knob.
+  const consoleSignIn: ConsoleSignInPosture = authEnabled
+    ? {
+        posture: "oidc",
+        issuer: config.oidcIssuer,
+        audience: config.oidcAudience,
+        consoleClientId: config.oidcConsoleClientId,
+      }
+    : { posture: "trusted-local" };
+  if (
+    consoleAssets !== undefined &&
+    consoleSignIn.posture === "oidc" &&
+    consoleSignIn.consoleClientId === ""
+  ) {
+    logger.warn(
+      "STIGMER_OIDC_ISSUER is set but STIGMER_OIDC_CONSOLE_CLIENT_ID is not — the web console this server serves cannot sign in; register a public PKCE client for the console at the issuer and set it",
+    );
+  }
   const consoleLane =
     consoleAssets !== undefined
       ? createConsoleLane({
           assets: consoleAssets,
-          grpcPort: options.portOverride ?? config.grpcPort,
+          signIn: consoleSignIn,
           logger,
         })
       : undefined;

package/src/boot/config.ts

@@ -170,6 +170,20 @@ export interface ServerConfig {
    * OIDC is boot-fatal, the R2/operator-identity loud-fail precedent.
    */
   readonly oidcAudience: string;
+  /**
+   * The OAuth client the served web console signs in with
+   * (STIGMER_OIDC_CONSOLE_CLIENT_ID; 20260913.02 sp.console-login, Q-CL-1):
+   * a PUBLIC client the operator registers at the issuer for the browser's
+   * Authorization Code + PKCE flow — a public identifier, never a secret.
+   * Deliberately lenient beside the two boot-fatal OIDC fields: a
+   * self-host that set the issuer before this knob existed, and uses the
+   * CLI and SDKs with API keys, must keep booting on upgrade. Empty means
+   * the console cannot sign in; the composition root WARNs and the served
+   * console says so itself (Q-CL-2). Named for the console on purpose — a
+   * future CLI or desktop sign-in against a self-host is a different
+   * client type (loopback/native) and should not be tempted to reuse it.
+   */
+  readonly oidcConsoleClientId: string;
   /**
    * Sandbox provisioner driver (SANDBOX_PROVISIONER_TYPE; §6d, O6). ""
    * — the default — is the external-runner posture: no provisioner is
@@ -329,6 +343,7 @@ export function loadConfig(env: NodeJS.ProcessEnv = process.env): ServerConfig {
     oauthRedirectUri: envString(env, "STIGMER_OAUTH_REDIRECT_URI", ""),
     consoleDir: envString(env, "STIGMER_CONSOLE_DIR", ""),
     ...loadOidcConfig(env),
+    oidcConsoleClientId: envString(env, "STIGMER_OIDC_CONSOLE_CLIENT_ID", ""),
     sandboxProvisionerType: envString(env, "SANDBOX_PROVISIONER_TYPE", ""),
     sandboxBackendEndpoint: envString(
       env,

package/src/domain/agentchannel/controller.ts

@@ -599,28 +599,25 @@ function newLoadChannelsByAgentStep(
           continue;
         }
       }
-      // 20260830.01 census lane 19: the scope narrows the decoded scan;
-      // the org/agent filters below are contract parity in both editions.
-      const visible = await restrictListByReadScope(
+      // 20260830.01 census lane 19: the org/agent filters are contract
+      // parity in both editions and run FIRST; the scope narrows the
+      // agent's channels last (the scope is the last per-row predicate,
+      // stigmer-cloud 20260913.04 T02).
+      const channels = await restrictListByReadScope(
         listReadScope,
         ctx.callerIdentity,
         ApiResourceKind.agent_channel,
-        decoded,
+        decoded.filter((channel) => {
+          const ref = channel.spec?.agentRef;
+          return (
+            (ref?.org ?? "") === agentOrg &&
+            (ref?.slug ?? "") === agentSlug &&
+            (req.org === "" || (channel.metadata?.org ?? "") === req.org)
+          );
+        }),
         "",
       );
 
-      const channels: AgentChannel[] = [];
-      for (const channel of visible) {
-        const ref = channel.spec?.agentRef;
-        if ((ref?.org ?? "") !== agentOrg || (ref?.slug ?? "") !== agentSlug) {
-          continue;
-        }
-        if (req.org !== "" && (channel.metadata?.org ?? "") !== req.org) {
-          continue;
-        }
-        channels.push(channel);
-      }
-
       ctx.set(
         CHANNEL_LIST_KEY,
         create(AgentChannelListSchema, {
@@ -702,27 +699,22 @@ function newListByOrgAndLabelsStep(
           continue;
         }
       }
-      // 20260830.01 census lane 18: the scope narrows the decoded scan;
-      // the org equality below already serves the Java handler's org arm.
-      const visible = await restrictListByReadScope(
+      // 20260830.01 census lane 18: the org and label filters serve the
+      // Java handler's arms in both editions and run FIRST; the scope
+      // narrows the org's rows last (the scope is the last per-row
+      // predicate, stigmer-cloud 20260913.04 T02).
+      const channels = await restrictListByReadScope(
         listReadScope,
         ctx.callerIdentity,
         ApiResourceKind.agent_channel,
-        decoded,
+        decoded.filter(
+          (channel) =>
+            (channel.metadata?.org ?? "") === org &&
+            matchesAllLabels(channel.metadata?.labels ?? {}, filterLabels),
+        ),
         "",
       );
 
-      const channels: AgentChannel[] = [];
-      for (const channel of visible) {
-        if ((channel.metadata?.org ?? "") !== org) {
-          continue;
-        }
-        if (!matchesAllLabels(channel.metadata?.labels ?? {}, filterLabels)) {
-          continue;
-        }
-        channels.push(channel);
-      }
-
       channels.sort((a, b) =>
         compareCreatedAtDesc(
           a.status?.audit?.specAudit?.createdAt,

package/src/domain/agentexecution/controller.ts

@@ -130,6 +130,7 @@ import {
   newApplyPhaseFilterStep,
   newBuildExecutionListResponseStep,
   newQueryAllExecutionsStep,
+  newRestrictByReadScopeStep,
   newQueryExecutionsBySessionStep,
   newValidateListBySessionRequestStep,
   newValidateListRequestStep,
@@ -320,7 +321,9 @@ async function createExecution(
     .addStep(newValidateThinkingModeStep(deps.modelRegistry))
     .addStep(newResolveDefaultAgentStep(deps.store, deps.logger))
     .addStep(newEnsureSessionOrAgentResolvedStep(deps.logger))
-    .addStep(newAuthorizeRunTargetStep(deps.authorizer, agentExecutionRunTarget))
+    .addStep(
+      newAuthorizeRunTargetStep(deps.authorizer, agentExecutionRunTarget),
+    )
     .addStep(newResolveSlugStep())
     .addStep(newBuildNewStateStep())
     // Vouches the runner-stamped workflow lineage labels (or refuses a
@@ -549,10 +552,9 @@ async function list(
       ),
     )
     .addStep(newValidateListRequestStep())
-    .addStep(
-      newQueryAllExecutionsStep(deps.store, deps.logger, deps.listReadScope),
-    )
+    .addStep(newQueryAllExecutionsStep(deps.store, deps.logger))
     .addStep(newApplyPhaseFilterStep(deps.logger))
+    .addStep(newRestrictByReadScopeStep(deps.listReadScope))
     .addStep(newBuildExecutionListResponseStep())
     .build()
     .execute(reqCtx);
@@ -582,7 +584,11 @@ async function listBySession(
     )
     .addStep(newValidateListBySessionRequestStep())
     .addStep(
-      newQueryExecutionsBySessionStep(deps.store, deps.logger, deps.listReadScope),
+      newQueryExecutionsBySessionStep(
+        deps.store,
+        deps.logger,
+        deps.listReadScope,
+      ),
     )
     .addStep(newBuildExecutionListResponseStep())
     .build()