@stigmer/server 3.23.1-dev.20260923075205 → 3.25.0

package/dist/domain/platformclient/steps.d.ts

@@ -0,0 +1,51 @@
+import type { DescMessage } from "@bufbuild/protobuf";
+import type { ApiResourceReferenceSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import type { PlatformClient } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+import { PlatformClientSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+import type { PipelineStep } from "../../pipeline/pipeline.js";
+import type { RequestContext } from "../../pipeline/request-context.js";
+import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
+import { TARGET_RESOURCE_KEY } from "../../pipeline/steps/load-target.js";
+import type { SystemManagedMutation } from "./constants.js";
+import type { PlatformClientStore } from "./store.js";
+type ClientStep = PipelineStep<typeof PlatformClientSchema>;
+/** Context key for the plaintext secret the create and rotate responses show once. */
+export declare const CLIENT_SECRET_PLAINTEXT_KEY = "platformClientSecretPlaintext";
+/** Clears the stored hash in place and answers the client — every response goes through it. */
+export declare function redactPlatformClient(client: PlatformClient): PlatformClient;
+/** The plaintext secret a credential step parked, or an ordering fault. */
+export declare function parkedClientSecret<Desc extends DescMessage>(ctx: RequestContext<Desc>): string;
+export declare function newRefuseReservedSlugStep(): ClientStep;
+/** Rejects a create whose slug the organization already holds. */
+export declare function newCheckDuplicateStep(clients: PlatformClientStore): ClientStep;
+/** Generates the credential fields after BuildNewState, parking the plaintext for the response. */
+export declare function newGenerateClientCredentialsStep(): ClientStep;
+/** Saves the new client through the port; a held slug or client_id is ALREADY_EXISTS. */
+export declare function newPersistNewClientStep(clients: PlatformClientStore): ClientStep;
+/** Loads the client by id, else by org-scoped slug (the id written back), into EXISTING_RESOURCE_KEY. */
+export declare function newLoadExistingClientStep(clients: PlatformClientStore): ClientStep;
+/** Restores the credential fields from the stored row after BuildUpdateState. */
+export declare function newPreserveClientCredentialsStep(): ClientStep;
+/** Replaces the row through the port. */
+export declare function newPersistUpdatedClientStep(clients: PlatformClientStore): ClientStep;
+/** Refuses a mutation of a client carrying the system-managed label, read from `key`. */
+export declare function newRefuseSystemManagedStep<Desc extends DescMessage>(verb: SystemManagedMutation, key: typeof EXISTING_RESOURCE_KEY | typeof TARGET_RESOURCE_KEY): PipelineStep<Desc>;
+/** Loads the client named by an ID-wrapper input into TARGET_RESOURCE_KEY. */
+export declare function newLoadTargetClientStep<InputDesc extends DescMessage>(clients: PlatformClientStore): PipelineStep<InputDesc>;
+/** Loads the client an org/slug reference names into TARGET_RESOURCE_KEY, with the cloud's copy. */
+export declare function newLoadClientByReferenceStep(clients: PlatformClientStore): PipelineStep<typeof ApiResourceReferenceSchema>;
+/**
+ * Replaces the loaded client's secret in place (the client_id is
+ * permanent), stamps the update audit as the caller, and parks the
+ * plaintext for the response. The expiry is left as it is: rotating a
+ * secret does not extend a client the owner set to expire.
+ */
+export declare function newRotateClientCredentialsStep<InputDesc extends DescMessage>(): PipelineStep<InputDesc>;
+/** Writes the rotated TARGET_RESOURCE_KEY client through the port. */
+export declare function newPersistTargetClientStep<InputDesc extends DescMessage>(clients: PlatformClientStore): PipelineStep<InputDesc>;
+export declare function newLoadExistingClientForDeleteStep<InputDesc extends DescMessage>(clients: PlatformClientStore): PipelineStep<InputDesc>;
+export declare function newDeleteClientStep<InputDesc extends DescMessage>(clients: PlatformClientStore): PipelineStep<InputDesc>;
+/** The client a load step stashed under `key`, or an ordering fault. */
+export declare function storedClientOf<Desc extends DescMessage>(ctx: RequestContext<Desc>, key: string): PlatformClient;
+export {};
+//# sourceMappingURL=steps.d.ts.map

package/dist/domain/platformclient/steps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/steps.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sDAAsD,CAAC;AAEvG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAC9F,OAAO,EAAE,oBAAoB,EAAE,MAAM,yDAAyD,CAAC;AAe/F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAIxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAS1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAQ5D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,KAAK,UAAU,GAAG,YAAY,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAG5D,sFAAsF;AACtF,eAAO,MAAM,2BAA2B,kCAAkC,CAAC;AAE3E,+FAA+F;AAC/F,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,CAK3E;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,IAAI,SAAS,WAAW,EACzD,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,GACxB,MAAM,CASR;AAMD,wBAAgB,yBAAyB,IAAI,UAAU,CAUtD;AAED,kEAAkE;AAClE,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,mBAAmB,GAC3B,UAAU,CAiBZ;AAED,mGAAmG;AACnG,wBAAgB,gCAAgC,IAAI,UAAU,CAY7D;AAED,yFAAyF;AACzF,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,mBAAmB,GAC3B,UAAU,CAmBZ;AAMD,yGAAyG;AACzG,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,mBAAmB,GAC3B,UAAU,CAyBZ;AAED,iFAAiF;AACjF,wBAAgB,gCAAgC,IAAI,UAAU,CAW7D;AAED,yCAAyC;AACzC,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,mBAAmB,GAC3B,UAAU,CAWZ;AAMD,yFAAyF;AACzF,wBAAgB,0BAA0B,CAAC,IAAI,SAAS,WAAW,EACjE,IAAI,EAAE,qBAAqB,EAC3B,GAAG,EAAE,OAAO,qBAAqB,GAAG,OAAO,mBAAmB,GAC7D,YAAY,CAAC,IAAI,CAAC,CAYpB;AAMD,8EAA8E;AAC9E,wBAAgB,uBAAuB,CAAC,SAAS,SAAS,WAAW,EACnE,OAAO,EAAE,mBAAmB,GAC3B,YAAY,CAAC,SAAS,CAAC,CAWzB;AAED,oGAAoG;AACpG,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,mBAAmB,GAC3B,YAAY,CAAC,OAAO,0BAA0B,CAAC,CA6BjD;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,SAAS,WAAW,KAC1B,YAAY,CAAC,SAAS,CAAC,CAoB3B;AAED,sEAAsE;AACtE,wBAAgB,0BAA0B,CAAC,SAAS,SAAS,WAAW,EACtE,OAAO,EAAE,mBAAmB,GAC3B,YAAY,CAAC,SAAS,CAAC,CAWzB;AAMD,wBAAgB,kCAAkC,CAChD,SAAS,SAAS,WAAW,EAC7B,OAAO,EAAE,mBAAmB,GAAG,YAAY,CAAC,SAAS,CAAC,CAUvD;AAED,wBAAgB,mBAAmB,CAAC,SAAS,SAAS,WAAW,EAC/D,OAAO,EAAE,mBAAmB,GAC3B,YAAY,CAAC,SAAS,CAAC,CAWzB;AAkBD,wEAAwE;AACxE,wBAAgB,cAAc,CAAC,IAAI,SAAS,WAAW,EACrD,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,EACzB,GAAG,EAAE,MAAM,GACV,cAAc,CAWhB"}

package/dist/domain/platformclient/steps.js

@@ -0,0 +1,339 @@
+/**
+ * Platform-client domain steps.
+ *
+ * The domain's persistence is a PORT (store.ts), so the shared steps that
+ * touch storage (CheckDuplicate, LoadExisting, LoadTarget, LoadByReference,
+ * Persist, the delete pair) come here under the SAME names over the port —
+ * the identity-account domain's "own step, same name" precedent — and every
+ * storage-free shared step is reused as it is. The shared context keys are
+ * reused too, so BuildUpdateState finds EXISTING_RESOURCE_KEY and the
+ * reference read's AuthorizeResolvedTarget finds TARGET_RESOURCE_KEY where
+ * they expect them.
+ *
+ * The domain's own rules:
+ *   - RefuseReservedSlug: `system-share-client` is the platform's (the
+ *     cloud keeps each organization's system-managed share client under
+ *     it, created through its driver, never through this chain), refused
+ *     after ResolveSlug so a derived slug is refused too.
+ *   - RefuseSystemManaged: a client carrying the reserved
+ *     `stigmer.ai/system-managed` label is the platform's; update, delete
+ *     and rotate refuse it FAILED_PRECONDITION with the cloud's copy.
+ *   - GenerateClientCredentials, PreserveClientCredentials and
+ *     RotateClientCredentials: the credential fields are the server's
+ *     alone — generated on create (whatever the request carried), kept
+ *     from the stored row on update, replaced (secret only; the client_id
+ *     is permanent) on rotate. The plaintext secret is parked in the
+ *     context for the one response that shows it, never persisted.
+ *   - redactPlatformClient: the stored hash leaves on no response. It is
+ *     cleared rather than marked (OAuthApp's `***REDACTED***` marker exists
+ *     because its secret round-trips on update; this hash never does —
+ *     PreserveClientCredentials restores it from the row).
+ *
+ * Not-found answers use the shared `notFoundError`, which renders exactly
+ * the cloud's `PlatformClient not found: <id>`; the reference read keeps
+ * the cloud's own sentence (constants.ts).
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { create } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { PlatformClientSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+import { PlatformClientSpecSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/spec_pb";
+import { RESERVED_LABEL_TRUE, SYSTEM_MANAGED_LABEL, } from "../../pipeline/apiresource-labels.js";
+import { alreadyExistsError, failedPreconditionError, internalError, invalidArgumentError, notFoundError, } from "../../pipeline/errors.js";
+import { updateAuditFields } from "../../pipeline/steps/build-update-state.js";
+import { RESOURCE_ID_KEY } from "../../pipeline/steps/delete.js";
+import { requireOrgForReference } from "../../pipeline/steps/helpers.js";
+import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
+import { TARGET_RESOURCE_KEY } from "../../pipeline/steps/load-target.js";
+import { idValueOf, metadataOf } from "../../pipeline/steps/shapes.js";
+import { PLATFORM_CLIENT_KIND_NAME, RESERVED_PLATFORM_CLIENT_SLUGS, referenceNotFoundMessage, reservedSlugMessage, systemManagedMessage, } from "./constants.js";
+import { generateClientId, generateClientSecret, hashClientSecret, secretFingerprint, } from "./credentials.js";
+import { DuplicatePlatformClientError } from "./store.js";
+/** Context key for the plaintext secret the create and rotate responses show once. */
+export const CLIENT_SECRET_PLAINTEXT_KEY = "platformClientSecretPlaintext";
+/** Clears the stored hash in place and answers the client — every response goes through it. */
+export function redactPlatformClient(client) {
+    if (client.spec !== undefined) {
+        client.spec.clientSecretHash = "";
+    }
+    return client;
+}
+/** The plaintext secret a credential step parked, or an ordering fault. */
+export function parkedClientSecret(ctx) {
+    const secret = ctx.get(CLIENT_SECRET_PLAINTEXT_KEY);
+    if (typeof secret !== "string" || secret === "") {
+        throw internalError(new Error("no client secret parked — a credential step must run first"), "platform client credentials");
+    }
+    return secret;
+}
+// ---------------------------------------------------------------------------
+// Create
+// ---------------------------------------------------------------------------
+export function newRefuseReservedSlugStep() {
+    return {
+        name: "RefuseReservedSlug",
+        execute(ctx) {
+            const slug = metadataOf(ctx.newState)?.slug ?? "";
+            if (RESERVED_PLATFORM_CLIENT_SLUGS.has(slug)) {
+                throw invalidArgumentError(reservedSlugMessage(slug));
+            }
+        },
+    };
+}
+/** Rejects a create whose slug the organization already holds. */
+export function newCheckDuplicateStep(clients) {
+    return {
+        name: "CheckDuplicate",
+        async execute(ctx) {
+            const metadata = requireMetadata(ctx, "duplicate check");
+            const existing = await clients.findByOrgAndSlug(metadata.org, metadata.slug);
+            if (existing !== undefined) {
+                throw alreadyExistsError(PLATFORM_CLIENT_KIND_NAME, `slug '${metadata.slug}' in org '${metadata.org}' (id: ${existing.metadata?.id ?? ""})`);
+            }
+        },
+    };
+}
+/** Generates the credential fields after BuildNewState, parking the plaintext for the response. */
+export function newGenerateClientCredentialsStep() {
+    return {
+        name: "GenerateClientCredentials",
+        execute(ctx) {
+            const spec = specOf(ctx.newState);
+            const secret = generateClientSecret();
+            spec.clientId = generateClientId();
+            spec.clientSecretHash = hashClientSecret(secret);
+            spec.secretFingerprint = secretFingerprint(secret);
+            ctx.set(CLIENT_SECRET_PLAINTEXT_KEY, secret);
+        },
+    };
+}
+/** Saves the new client through the port; a held slug or client_id is ALREADY_EXISTS. */
+export function newPersistNewClientStep(clients) {
+    return {
+        name: "Persist",
+        async execute(ctx) {
+            try {
+                await clients.save(ctx.newState);
+            }
+            catch (error) {
+                if (error instanceof DuplicatePlatformClientError) {
+                    // The race the duplicate check could not see.
+                    const metadata = requireMetadata(ctx, "persist");
+                    throw alreadyExistsError(PLATFORM_CLIENT_KIND_NAME, `slug '${metadata.slug}' in org '${metadata.org}'`);
+                }
+                throw internalError(error, "failed to save platform client");
+            }
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Update
+// ---------------------------------------------------------------------------
+/** Loads the client by id, else by org-scoped slug (the id written back), into EXISTING_RESOURCE_KEY. */
+export function newLoadExistingClientStep(clients) {
+    return {
+        name: "LoadExisting",
+        async execute(ctx) {
+            const metadata = requireMetadata(ctx, "load existing");
+            let existing;
+            if (metadata.id !== "") {
+                existing = await clients.findById(metadata.id);
+                if (existing === undefined) {
+                    throw notFoundError(PLATFORM_CLIENT_KIND_NAME, metadata.id);
+                }
+            }
+            else if (metadata.slug !== "") {
+                existing = await clients.findByOrgAndSlug(metadata.org, metadata.slug);
+                if (existing === undefined) {
+                    throw notFoundError(PLATFORM_CLIENT_KIND_NAME, metadata.slug);
+                }
+                metadata.id = existing.metadata?.id ?? "";
+            }
+            else {
+                throw invalidArgumentError("resource id or slug is required for update");
+            }
+            ctx.set(EXISTING_RESOURCE_KEY, existing);
+        },
+    };
+}
+/** Restores the credential fields from the stored row after BuildUpdateState. */
+export function newPreserveClientCredentialsStep() {
+    return {
+        name: "PreserveClientCredentials",
+        execute(ctx) {
+            const existing = storedClientOf(ctx, EXISTING_RESOURCE_KEY);
+            const spec = specOf(ctx.newState);
+            spec.clientId = existing.spec?.clientId ?? "";
+            spec.clientSecretHash = existing.spec?.clientSecretHash ?? "";
+            spec.secretFingerprint = existing.spec?.secretFingerprint ?? "";
+        },
+    };
+}
+/** Replaces the row through the port. */
+export function newPersistUpdatedClientStep(clients) {
+    return {
+        name: "Persist",
+        async execute(ctx) {
+            try {
+                await clients.update(ctx.newState);
+            }
+            catch (error) {
+                throw internalError(error, "failed to save platform client");
+            }
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Update, delete and rotate: the platform's own clients
+// ---------------------------------------------------------------------------
+/** Refuses a mutation of a client carrying the system-managed label, read from `key`. */
+export function newRefuseSystemManagedStep(verb, key) {
+    return {
+        name: "RefuseSystemManaged",
+        execute(ctx) {
+            const client = storedClientOf(ctx, key);
+            if (client.metadata?.labels[SYSTEM_MANAGED_LABEL] === RESERVED_LABEL_TRUE) {
+                throw failedPreconditionError(systemManagedMessage(verb));
+            }
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Get, getByReference, rotate
+// ---------------------------------------------------------------------------
+/** Loads the client named by an ID-wrapper input into TARGET_RESOURCE_KEY. */
+export function newLoadTargetClientStep(clients) {
+    return {
+        name: "LoadTarget",
+        async execute(ctx) {
+            const id = idValueOf(ctx.input);
+            if (id === "") {
+                throw invalidArgumentError("resource id is required");
+            }
+            ctx.set(TARGET_RESOURCE_KEY, await readClient(clients, id));
+        },
+    };
+}
+/** Loads the client an org/slug reference names into TARGET_RESOURCE_KEY, with the cloud's copy. */
+export function newLoadClientByReferenceStep(clients) {
+    return {
+        name: "LoadByReference",
+        async execute(ctx) {
+            const ref = ctx.input;
+            if (ref.slug === "") {
+                throw invalidArgumentError("slug is required in reference");
+            }
+            if (ref.kind !== ApiResourceKind.api_resource_kind_unknown &&
+                ref.kind !== ApiResourceKind.platform_client) {
+                throw invalidArgumentError(`kind mismatch: expected platform_client, got ${ApiResourceKind[ref.kind] ?? String(ref.kind)}`);
+            }
+            requireOrgForReference(ApiResourceKind.platform_client, ref.org);
+            const client = await clients.findByOrgAndSlug(ref.org, ref.slug);
+            if (client === undefined) {
+                throw new ConnectError(referenceNotFoundMessage(ref.org, ref.slug), Code.NotFound);
+            }
+            ctx.set(TARGET_RESOURCE_KEY, client);
+        },
+    };
+}
+/**
+ * Replaces the loaded client's secret in place (the client_id is
+ * permanent), stamps the update audit as the caller, and parks the
+ * plaintext for the response. The expiry is left as it is: rotating a
+ * secret does not extend a client the owner set to expire.
+ */
+export function newRotateClientCredentialsStep() {
+    return {
+        name: "RotateClientCredentials",
+        execute(ctx) {
+            const client = storedClientOf(ctx, TARGET_RESOURCE_KEY);
+            const spec = specOf(client);
+            const secret = generateClientSecret();
+            spec.clientSecretHash = hashClientSecret(secret);
+            spec.secretFingerprint = secretFingerprint(secret);
+            // The row is its own "existing": the creation stamp is read before
+            // the fresh audit block replaces it.
+            updateAuditFields(PlatformClientSchema, client, client, ctx.callerIdentity);
+            ctx.set(CLIENT_SECRET_PLAINTEXT_KEY, secret);
+        },
+    };
+}
+/** Writes the rotated TARGET_RESOURCE_KEY client through the port. */
+export function newPersistTargetClientStep(clients) {
+    return {
+        name: "Persist",
+        async execute(ctx) {
+            try {
+                await clients.update(storedClientOf(ctx, TARGET_RESOURCE_KEY));
+            }
+            catch (error) {
+                throw internalError(error, "failed to save platform client");
+            }
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Delete (ApiResourceDeleteInput; the handler sets RESOURCE_ID_KEY)
+// ---------------------------------------------------------------------------
+export function newLoadExistingClientForDeleteStep(clients) {
+    return {
+        name: "LoadExistingForDelete",
+        async execute(ctx) {
+            ctx.set(EXISTING_RESOURCE_KEY, await readClient(clients, requireResourceId(ctx)));
+        },
+    };
+}
+export function newDeleteClientStep(clients) {
+    return {
+        name: "DeleteResource",
+        async execute(ctx) {
+            try {
+                await clients.deleteById(requireResourceId(ctx));
+            }
+            catch (error) {
+                throw internalError(error, "failed to delete platform client");
+            }
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Shared readers
+// ---------------------------------------------------------------------------
+/** The client by id, or the shared NOT_FOUND; any other fault propagates. */
+async function readClient(clients, id) {
+    const client = await clients.findById(id);
+    if (client === undefined) {
+        throw notFoundError(PLATFORM_CLIENT_KIND_NAME, id);
+    }
+    return client;
+}
+/** The client a load step stashed under `key`, or an ordering fault. */
+export function storedClientOf(ctx, key) {
+    const client = ctx.get(key);
+    if (client === undefined) {
+        throw internalError(new Error(`no platform client under '${key}' — its load step must run first`), "platform client chain ordering");
+    }
+    return client;
+}
+function requireMetadata(ctx, operation) {
+    const metadata = metadataOf(ctx.newState);
+    if (metadata === undefined) {
+        throw internalError(new Error("platform client metadata is nil"), operation);
+    }
+    return metadata;
+}
+/** The client's spec, created in place when the caller omitted it (every field defaults). */
+function specOf(client) {
+    if (client.spec === undefined) {
+        client.spec = create(PlatformClientSpecSchema);
+    }
+    return client.spec;
+}
+function requireResourceId(ctx) {
+    const id = ctx.get(RESOURCE_ID_KEY);
+    if (typeof id !== "string" || id === "") {
+        throw internalError(new Error("resource id not found in context (the delete handler sets it)"), "platform client delete ordering");
+    }
+    return id;
+}
+//# sourceMappingURL=steps.js.map

package/dist/domain/platformclient/steps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/platformclient/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAI5C,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yDAAyD,CAAC;AAE/F,OAAO,EAAE,wBAAwB,EAAE,MAAM,0DAA0D,CAAC;AAEpG,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC9B,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAM1D,sFAAsF;AACtF,MAAM,CAAC,MAAM,2BAA2B,GAAG,+BAA+B,CAAC;AAE3E,+FAA+F;AAC/F,MAAM,UAAU,oBAAoB,CAAC,MAAsB;IACzD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAChC,GAAyB;IAEzB,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACpD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAChD,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,4DAA4D,CAAC,EACvE,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,OAAO,CAAC,GAAkB;YACxB,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;YAClD,IAAI,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7C,MAAM,oBAAoB,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,qBAAqB,CACnC,OAA4B;IAE5B,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,OAAO,CAAC,GAAkB;YAC9B,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAC7C,QAAQ,CAAC,GAAG,EACZ,QAAQ,CAAC,IAAI,CACd,CAAC;YACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,kBAAkB,CACtB,yBAAyB,EACzB,SAAS,QAAQ,CAAC,IAAI,aAAa,QAAQ,CAAC,GAAG,UAAU,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CACxF,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,gCAAgC;IAC9C,OAAO;QACL,IAAI,EAAE,2BAA2B;QACjC,OAAO,CAAC,GAAkB;YACxB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,GAAG,gBAAgB,EAAE,CAAC;YACnC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACnD,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,uBAAuB,CACrC,OAA4B;IAE5B,OAAO;QACL,IAAI,EAAE,SAAS;QACf,KAAK,CAAC,OAAO,CAAC,GAAkB;YAC9B,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;oBAClD,8CAA8C;oBAC9C,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBACjD,MAAM,kBAAkB,CACtB,yBAAyB,EACzB,SAAS,QAAQ,CAAC,IAAI,aAAa,QAAQ,CAAC,GAAG,GAAG,CACnD,CAAC;gBACJ,CAAC;gBACD,MAAM,aAAa,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,yGAAyG;AACzG,MAAM,UAAU,yBAAyB,CACvC,OAA4B;IAE5B,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,KAAK,CAAC,OAAO,CAAC,GAAkB;YAC9B,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;YACvD,IAAI,QAAoC,CAAC;YACzC,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACvB,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC/C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,MAAM,aAAa,CAAC,yBAAyB,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;iBAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBAChC,QAAQ,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACvE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,MAAM,aAAa,CAAC,yBAAyB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAChE,CAAC;gBACD,QAAQ,CAAC,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,MAAM,oBAAoB,CACxB,4CAA4C,CAC7C,CAAC;YACJ,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gCAAgC;IAC9C,OAAO;QACL,IAAI,EAAE,2BAA2B;QACjC,OAAO,CAAC,GAAkB;YACxB,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;YAC9C,IAAI,CAAC,gBAAgB,GAAG,QAAQ,CAAC,IAAI,EAAE,gBAAgB,IAAI,EAAE,CAAC;YAC9D,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC,IAAI,EAAE,iBAAiB,IAAI,EAAE,CAAC;QAClE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,2BAA2B,CACzC,OAA4B;IAE5B,OAAO;QACL,IAAI,EAAE,SAAS;QACf,KAAK,CAAC,OAAO,CAAC,GAAkB;YAC9B,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,wDAAwD;AACxD,8EAA8E;AAE9E,yFAAyF;AACzF,MAAM,UAAU,0BAA0B,CACxC,IAA2B,EAC3B,GAA8D;IAE9D,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,OAAO,CAAC,GAAyB;YAC/B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACxC,IACE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,oBAAoB,CAAC,KAAK,mBAAmB,EACrE,CAAC;gBACD,MAAM,uBAAuB,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,8EAA8E;AAC9E,MAAM,UAAU,uBAAuB,CACrC,OAA4B;IAE5B,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,KAAK,CAAC,OAAO,CAAC,GAA8B;YAC1C,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACd,MAAM,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;YACxD,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9D,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,4BAA4B,CAC1C,OAA4B;IAE5B,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,KAAK,CAAC,OAAO,CACX,GAAsD;YAEtD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC;YACtB,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACpB,MAAM,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;YAC9D,CAAC;YACD,IACE,GAAG,CAAC,IAAI,KAAK,eAAe,CAAC,yBAAyB;gBACtD,GAAG,CAAC,IAAI,KAAK,eAAe,CAAC,eAAe,EAC5C,CAAC;gBACD,MAAM,oBAAoB,CACxB,gDAAgD,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAChG,CAAC;YACJ,CAAC;YACD,sBAAsB,CAAC,eAAe,CAAC,eAAe,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACjE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,YAAY,CACpB,wBAAwB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,EAC3C,IAAI,CAAC,QAAQ,CACd,CAAC;YACJ,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B;IAG5C,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,OAAO,CAAC,GAA8B;YACpC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACxD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;YACtC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACnD,mEAAmE;YACnE,qCAAqC;YACrC,iBAAiB,CACf,oBAAoB,EACpB,MAAM,EACN,MAAM,EACN,GAAG,CAAC,cAAc,CACnB,CAAC;YACF,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,0BAA0B,CACxC,OAA4B;IAE5B,OAAO;QACL,IAAI,EAAE,SAAS;QACf,KAAK,CAAC,OAAO,CAAC,GAA8B;YAC1C,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;YACjE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,oEAAoE;AACpE,8EAA8E;AAE9E,MAAM,UAAU,kCAAkC,CAEhD,OAA4B;IAC5B,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,KAAK,CAAC,OAAO,CAAC,GAA8B;YAC1C,GAAG,CAAC,GAAG,CACL,qBAAqB,EACrB,MAAM,UAAU,CAAC,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAClD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAA4B;IAE5B,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,OAAO,CAAC,GAA8B;YAC1C,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,kCAAkC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,6EAA6E;AAC7E,KAAK,UAAU,UAAU,CACvB,OAA4B,EAC5B,EAAU;IAEV,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAC5B,GAAyB,EACzB,GAAW;IAEX,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAA+B,CAAC;IAC1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,6BAA6B,GAAG,kCAAkC,CACnE,EACD,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,GAAkB,EAAE,SAAiB;IAC5D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,iCAAiC,CAAC,EAC5C,SAAS,CACV,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,6FAA6F;AAC7F,SAAS,MAAM,CAAC,MAAsB;IACpC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAyB;IAEzB,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,+DAA+D,CAChE,EACD,iCAAiC,CAClC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/domain/platformclient/store-contract.d.ts

@@ -0,0 +1,8 @@
+import type { PortContractCase, PortContractFixture } from "../../store/port-contract.js";
+import type { PlatformClientStore } from "./store.js";
+/** The runner's fixture over this port — the name a driver's test and the barrel know it by. */
+export type PlatformClientStoreContractFixture = PortContractFixture<PlatformClientStore>;
+export type PlatformClientStoreContractCase = PortContractCase;
+/** The port's cases over `makeFixture`, one fresh fixture per case. */
+export declare function platformClientStoreContract(makeFixture: () => Promise<PlatformClientStoreContractFixture>): ReadonlyArray<PlatformClientStoreContractCase>;
+//# sourceMappingURL=store-contract.d.ts.map

package/dist/domain/platformclient/store-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-contract.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/store-contract.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EACV,gBAAgB,EAEhB,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,gGAAgG;AAChG,MAAM,MAAM,kCAAkC,GAC5C,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;AAE3C,MAAM,MAAM,+BAA+B,GAAG,gBAAgB,CAAC;AA2Q/D,uEAAuE;AACvE,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,MAAM,OAAO,CAAC,kCAAkC,CAAC,GAC7D,aAAa,CAAC,+BAA+B,CAAC,CAEhD"}

package/dist/domain/platformclient/store-contract.js

@@ -0,0 +1,208 @@
+/**
+ * The PlatformClientStore PORT-CONTRACT KIT: every behavior an
+ * implementation of store.ts must satisfy identically, as cases a driver's
+ * test iterates. Open source runs them over its own adapter
+ * (resource-store.ts) on sqlite and Postgres in
+ * __tests__/resource-store.test.ts; a composition runs the SAME cases over
+ * the store it registers as `drivers.platformClientStore` (the cloud's
+ * `cloud.iam_platform_client` store), so "the port holds" is one statement
+ * proven per driver, never restated per repository.
+ *
+ * Shape: declarations over the port-contract runner (store/port-contract.ts),
+ * which owns the fresh fixture per case, the cleanup, and the reason the
+ * kit returns cases instead of calling vitest's `describe`. The
+ * disconnected-store case matters most here: the verifier reads this port
+ * on every request a minted token bears, so an outage that read as "no
+ * client" would revoke every live token instead of failing loudly.
+ *
+ * The duplicate arms check `instanceof DuplicatePlatformClientError` on the
+ * exported class, because that is how the create chain's Persist step
+ * catches it: a driver throwing a lookalike fails here for the reason it
+ * would fail a create.
+ *
+ * Case names are the contract lines, in the port's words. The OSS test pins
+ * the full list, so a case cannot drop out of the kit unnoticed.
+ */
+import assert from "node:assert/strict";
+import { create, equals } from "@bufbuild/protobuf";
+import { PlatformClientSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+import { portContractCases } from "../../store/port-contract.js";
+import { DuplicatePlatformClientError } from "./store.js";
+/** A client as the domain writes it; each fixture names its own id, org, slug and client_id. */
+function platformClient(fields) {
+    return create(PlatformClientSchema, {
+        apiVersion: "iam.stigmer.ai/v1",
+        kind: "PlatformClient",
+        metadata: {
+            id: fields.id,
+            name: fields.slug,
+            slug: fields.slug,
+            org: fields.org,
+        },
+        spec: {
+            clientId: fields.clientId,
+            clientSecretHash: `hash-of-${fields.clientId}`,
+            secretFingerprint: "abcdef",
+            autoProvisionAccounts: true,
+            allowedOrigins: fields.allowedOrigins ?? [],
+        },
+    });
+}
+function assertSameClient(actual, expected, message) {
+    assert.ok(actual !== undefined, `${message}: no client was answered`);
+    assert.ok(equals(PlatformClientSchema, actual, expected), message);
+}
+async function assertDuplicate(write, message) {
+    await assert.rejects(write, (error) => error instanceof DuplicatePlatformClientError, message);
+}
+const ACME_DASHBOARD = platformClient({
+    id: "pcl_contract_acme_dashboard",
+    org: "acme",
+    slug: "dashboard",
+    clientId: "stgm_cid_contract_acme_dashboard",
+});
+const CASES = [
+    [
+        "save then findById, findByClientId and findByOrgAndSlug answer the saved client",
+        async ({ store }) => {
+            await store.save(ACME_DASHBOARD);
+            assertSameClient(await store.findById("pcl_contract_acme_dashboard"), ACME_DASHBOARD, "findById must answer the saved row");
+            assertSameClient(await store.findByClientId("stgm_cid_contract_acme_dashboard"), ACME_DASHBOARD, "findByClientId must answer the saved row");
+            assertSameClient(await store.findByOrgAndSlug("acme", "dashboard"), ACME_DASHBOARD, "findByOrgAndSlug must answer the saved row");
+        },
+    ],
+    [
+        "lookups of a client that is not held answer undefined",
+        async ({ store }) => {
+            await store.save(ACME_DASHBOARD);
+            assert.equal(await store.findById("pcl_contract_nobody"), undefined);
+            assert.equal(await store.findByClientId("stgm_cid_contract_nobody"), undefined);
+            assert.equal(await store.findByOrgAndSlug("acme", "nobody"), undefined);
+            assert.equal(await store.findByOrgAndSlug("globex", "dashboard"), undefined, "a slug is scoped to its organization: another org's lookup must miss");
+        },
+    ],
+    [
+        "save under a held id raises DuplicatePlatformClientError",
+        async ({ store }) => {
+            await store.save(ACME_DASHBOARD);
+            await assertDuplicate(store.save(platformClient({
+                id: "pcl_contract_acme_dashboard",
+                org: "acme",
+                slug: "other",
+                clientId: "stgm_cid_contract_other",
+            })), "a held id must be refused, never overwritten");
+        },
+    ],
+    [
+        "save under a held (org, slug) raises DuplicatePlatformClientError",
+        async ({ store }) => {
+            await store.save(ACME_DASHBOARD);
+            await assertDuplicate(store.save(platformClient({
+                id: "pcl_contract_acme_second",
+                org: "acme",
+                slug: "dashboard",
+                clientId: "stgm_cid_contract_acme_second",
+            })), "a held (org, slug) must be refused");
+        },
+    ],
+    [
+        "save under a held client_id raises DuplicatePlatformClientError",
+        async ({ store }) => {
+            await store.save(ACME_DASHBOARD);
+            await assertDuplicate(store.save(platformClient({
+                id: "pcl_contract_acme_third",
+                org: "acme",
+                slug: "third",
+                clientId: "stgm_cid_contract_acme_dashboard",
+            })), "a held client_id must be refused: the mint resolves a client by it");
+        },
+    ],
+    [
+        "the same slug in another organization is a different client",
+        async ({ store }) => {
+            await store.save(ACME_DASHBOARD);
+            const globex = platformClient({
+                id: "pcl_contract_globex_dashboard",
+                org: "globex",
+                slug: "dashboard",
+                clientId: "stgm_cid_contract_globex_dashboard",
+            });
+            await store.save(globex);
+            assertSameClient(await store.findByOrgAndSlug("globex", "dashboard"), globex, "each organization answers its own client for the shared slug");
+        },
+    ],
+    [
+        "update replaces the row in place",
+        async ({ store }) => {
+            await store.save(ACME_DASHBOARD);
+            const edited = platformClient({
+                id: "pcl_contract_acme_dashboard",
+                org: "acme",
+                slug: "dashboard",
+                clientId: "stgm_cid_contract_acme_dashboard",
+                allowedOrigins: ["https://app.acme.example"],
+            });
+            await store.update(edited);
+            assertSameClient(await store.findById("pcl_contract_acme_dashboard"), edited, "findById must answer the replaced row");
+            assertSameClient(await store.findByClientId("stgm_cid_contract_acme_dashboard"), edited, "findByClientId must answer the replaced row");
+        },
+    ],
+    [
+        "update of an unknown id writes nothing",
+        async ({ store }) => {
+            await store.update(ACME_DASHBOARD);
+            assert.equal(await store.findById("pcl_contract_acme_dashboard"), undefined, "update must replace, never create");
+        },
+    ],
+    [
+        "deleteById frees the id, the client_id and the slug; deleting an unknown id resolves",
+        async ({ store }) => {
+            await store.save(ACME_DASHBOARD);
+            await store.deleteById("pcl_contract_acme_dashboard");
+            assert.equal(await store.findById("pcl_contract_acme_dashboard"), undefined);
+            assert.equal(await store.findByClientId("stgm_cid_contract_acme_dashboard"), undefined, "a deleted client's client_id must stop resolving: the mint and the verifier read it");
+            assert.equal(await store.findByOrgAndSlug("acme", "dashboard"), undefined);
+            await store.save(ACME_DASHBOARD);
+            await store.deleteById("pcl_contract_nobody");
+        },
+    ],
+    [
+        "findByOrg answers every client of the organization and no other",
+        async ({ store }) => {
+            await store.save(ACME_DASHBOARD);
+            await store.save(platformClient({
+                id: "pcl_contract_acme_mobile",
+                org: "acme",
+                slug: "mobile",
+                clientId: "stgm_cid_contract_acme_mobile",
+            }));
+            await store.save(platformClient({
+                id: "pcl_contract_globex_dashboard",
+                org: "globex",
+                slug: "dashboard",
+                clientId: "stgm_cid_contract_globex_dashboard",
+            }));
+            const ids = (await store.findByOrg("acme"))
+                .map((client) => client.metadata?.id ?? "")
+                .sort();
+            assert.deepEqual(ids, [
+                "pcl_contract_acme_dashboard",
+                "pcl_contract_acme_mobile",
+            ]);
+            assert.deepEqual(await store.findByOrg("initech"), []);
+        },
+    ],
+    [
+        "a disconnected store is an infrastructure fault, never 'not found'",
+        async (fixture) => {
+            await fixture.disconnect();
+            await assert.rejects(fixture.store.findById("pcl_contract_acme_dashboard"), "an id read on a disconnected store must reject: on the verifier's path 'not found' revokes every token");
+            await assert.rejects(fixture.store.findByClientId("stgm_cid_contract_acme_dashboard"), "a client_id read on a disconnected store must reject, never read as undefined");
+        },
+    ],
+];
+/** The port's cases over `makeFixture`, one fresh fixture per case. */
+export function platformClientStoreContract(makeFixture) {
+    return portContractCases(CASES, makeFixture);
+}
+//# sourceMappingURL=store-contract.js.map

package/dist/domain/platformclient/store-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-contract.js","sourceRoot":"","sources":["../../../src/domain/platformclient/store-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAGpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yDAAyD,CAAC;AAE/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAMjE,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAS1D,gGAAgG;AAChG,SAAS,cAAc,CAAC,MAMvB;IACC,OAAO,MAAM,CAAC,oBAAoB,EAAE;QAClC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE;YACR,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,EAAE,MAAM,CAAC,GAAG;SAChB;QACD,IAAI,EAAE;YACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,gBAAgB,EAAE,WAAW,MAAM,CAAC,QAAQ,EAAE;YAC9C,iBAAiB,EAAE,QAAQ;YAC3B,qBAAqB,EAAE,IAAI;YAC3B,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;SAC5C;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAkC,EAClC,QAAwB,EACxB,OAAe;IAEf,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,EAAE,GAAG,OAAO,0BAA0B,CAAC,CAAC;IACtE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAAoB,EACpB,OAAe;IAEf,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,EACL,CAAC,KAAc,EAAE,EAAE,CAAC,KAAK,YAAY,4BAA4B,EACjE,OAAO,CACR,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,cAAc,CAAC;IACpC,EAAE,EAAE,6BAA6B;IACjC,GAAG,EAAE,MAAM;IACX,IAAI,EAAE,WAAW;IACjB,QAAQ,EAAE,kCAAkC;CAC7C,CAAC,CAAC;AAEH,MAAM,KAAK,GAAgE;IACzE;QACE,iFAAiF;QACjF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,gBAAgB,CACd,MAAM,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EACnD,cAAc,EACd,oCAAoC,CACrC,CAAC;YACF,gBAAgB,CACd,MAAM,KAAK,CAAC,cAAc,CAAC,kCAAkC,CAAC,EAC9D,cAAc,EACd,0CAA0C,CAC3C,CAAC;YACF,gBAAgB,CACd,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,EACjD,cAAc,EACd,4CAA4C,CAC7C,CAAC;QACJ,CAAC;KACF;IACD;QACE,uDAAuD;QACvD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,CAAC,CAAC;YACrE,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,cAAc,CAAC,0BAA0B,CAAC,EACtD,SAAS,CACV,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;YACxE,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,EACnD,SAAS,EACT,sEAAsE,CACvE,CAAC;QACJ,CAAC;KACF;IACD;QACE,0DAA0D;QAC1D,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,eAAe,CACnB,KAAK,CAAC,IAAI,CACR,cAAc,CAAC;gBACb,EAAE,EAAE,6BAA6B;gBACjC,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,OAAO;gBACb,QAAQ,EAAE,yBAAyB;aACpC,CAAC,CACH,EACD,8CAA8C,CAC/C,CAAC;QACJ,CAAC;KACF;IACD;QACE,mEAAmE;QACnE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,eAAe,CACnB,KAAK,CAAC,IAAI,CACR,cAAc,CAAC;gBACb,EAAE,EAAE,0BAA0B;gBAC9B,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,+BAA+B;aAC1C,CAAC,CACH,EACD,oCAAoC,CACrC,CAAC;QACJ,CAAC;KACF;IACD;QACE,iEAAiE;QACjE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,eAAe,CACnB,KAAK,CAAC,IAAI,CACR,cAAc,CAAC;gBACb,EAAE,EAAE,yBAAyB;gBAC7B,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,OAAO;gBACb,QAAQ,EAAE,kCAAkC;aAC7C,CAAC,CACH,EACD,oEAAoE,CACrE,CAAC;QACJ,CAAC;KACF;IACD;QACE,6DAA6D;QAC7D,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,cAAc,CAAC;gBAC5B,EAAE,EAAE,+BAA+B;gBACnC,GAAG,EAAE,QAAQ;gBACb,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,oCAAoC;aAC/C,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,gBAAgB,CACd,MAAM,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,EACnD,MAAM,EACN,8DAA8D,CAC/D,CAAC;QACJ,CAAC;KACF;IACD;QACE,kCAAkC;QAClC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,cAAc,CAAC;gBAC5B,EAAE,EAAE,6BAA6B;gBACjC,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,kCAAkC;gBAC5C,cAAc,EAAE,CAAC,0BAA0B,CAAC;aAC7C,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,gBAAgB,CACd,MAAM,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EACnD,MAAM,EACN,uCAAuC,CACxC,CAAC;YACF,gBAAgB,CACd,MAAM,KAAK,CAAC,cAAc,CAAC,kCAAkC,CAAC,EAC9D,MAAM,EACN,6CAA6C,CAC9C,CAAC;QACJ,CAAC;KACF;IACD;QACE,wCAAwC;QACxC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACnC,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EACnD,SAAS,EACT,mCAAmC,CACpC,CAAC;QACJ,CAAC;KACF;IACD;QACE,sFAAsF;QACtF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,KAAK,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC;YACtD,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EACnD,SAAS,CACV,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,cAAc,CAAC,kCAAkC,CAAC,EAC9D,SAAS,EACT,qFAAqF,CACtF,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,EACjD,SAAS,CACV,CAAC;YACF,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,KAAK,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;QAChD,CAAC;KACF;IACD;QACE,iEAAiE;QACjE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,KAAK,CAAC,IAAI,CACd,cAAc,CAAC;gBACb,EAAE,EAAE,0BAA0B;gBAC9B,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,+BAA+B;aAC1C,CAAC,CACH,CAAC;YACF,MAAM,KAAK,CAAC,IAAI,CACd,cAAc,CAAC;gBACb,EAAE,EAAE,+BAA+B;gBACnC,GAAG,EAAE,QAAQ;gBACb,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,oCAAoC;aAC/C,CAAC,CACH,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;iBACxC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;iBAC1C,IAAI,EAAE,CAAC;YACV,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE;gBACpB,6BAA6B;gBAC7B,0BAA0B;aAC3B,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QACzD,CAAC;KACF;IACD;QACE,oEAAoE;QACpE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EACrD,wGAAwG,CACzG,CAAC;YACF,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,kCAAkC,CAAC,EAChE,+EAA+E,CAChF,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAEF,uEAAuE;AACvE,MAAM,UAAU,2BAA2B,CACzC,WAA8D;IAE9D,OAAO,iBAAiB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC"}