@stigmer/server 3.24.0 → 3.25.0

package/dist/domain/identityaccount/store-contract.js

@@ -83,6 +83,27 @@ function federatedAccount(overrides) {
         },
     });
 }
+/**
+ * A platform-client end user as the mint provisions it: the reserved
+ * composite subject, mode `platform_client`, the owning organization, and
+ * the derived id of its subject (the id every subject lookup reads).
+ */
+function platformClientAccount(overrides) {
+    return create(IdentityAccountSchema, {
+        apiVersion: "iam.stigmer.ai/v1",
+        kind: "IdentityAccount",
+        metadata: {
+            id: accountIdFor(overrides.idpId),
+            name: overrides.email,
+            org: "acme",
+        },
+        spec: {
+            idpId: overrides.idpId,
+            email: overrides.email,
+            provisioningMode: IdentityAccountProvisioningMode.platform_client,
+        },
+    });
+}
 /** A direct account with no subject — the row no lookup could ever reach. */
 function subjectlessDirectAccount() {
     return create(IdentityAccountSchema, {
@@ -232,6 +253,18 @@ const CASES = [
             assert.equal((await store.findByIdpId("auth0|fed"))?.spec?.provisioningMode, IdentityAccountProvisioningMode.federated, "the any-mode subject lookup must answer the federated account");
         },
     ],
+    [
+        "findDirectByIdpId and findDirectByEmail never answer a platform-client account, while findByIdpId (any mode) does",
+        async ({ store }) => {
+            await store.save(platformClientAccount({
+                idpId: "stgm_pc|acme|user-7",
+                email: "pat@example.com",
+            }));
+            assert.equal(await store.findDirectByIdpId("stgm_pc|acme|user-7"), undefined, "the direct-subject lookup must not resolve to an account a platform client provisioned");
+            assert.equal(await store.findDirectByEmail("pat@example.com"), undefined, "the direct-email lookup must not answer an email a platform asserted");
+            assert.equal((await store.findByIdpId("stgm_pc|acme|user-7"))?.spec?.provisioningMode, IdentityAccountProvisioningMode.platform_client, "the any-mode subject lookup — the mint's — must answer the platform-client account");
+        },
+    ],
     [
         "findByIds answers one row per distinct id, in first-occurrence order; an empty request answers an empty list",
         async ({ store }) => {

package/dist/domain/identityaccount/store-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"store-contract.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/store-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AACjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAE5G,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAMjE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AASnD,0FAA0F;AAC1F,SAAS,aAAa,CAAC,SAItB;IACC,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE;YACR,EAAE,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC;YACjC,IAAI,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK;SACzC;QACD,IAAI,EAAE;YACJ,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE;YAC5B,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,EAAE;YACpC,gBAAgB,EAAE,+BAA+B,CAAC,MAAM;SACzD;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,SAGzB;IACC,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE;QACtE,IAAI,EAAE;YACJ,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,gBAAgB,EAAE,+BAA+B,CAAC,SAAS;YAC3D,mBAAmB,EAAE;gBACnB,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,eAAe,CAAC,iBAAiB;gBACvC,IAAI,EAAE,WAAW;aAClB;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,SAAS,wBAAwB;IAC/B,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,EAAE,EAAE,gCAAgC,EAAE,IAAI,EAAE,aAAa,EAAE;QACvE,IAAI,EAAE;YACJ,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,+BAA+B,CAAC,MAAM;SACzD;KACF,CAAC,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,SAAS,IAAI,CAAC,OAAwB;IACpC,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,oCAAoC,CAAC,CAAC;IAC9D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,UAAU,CAAC,QAAwC;IAC1D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,KAAK,GAAiE;IAC1E;QACE,4CAA4C;QAC5C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC;gBAC5B,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,mBAAmB;aAC3B,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAClD,MAAM,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,EAAE,wCAAwC,CAAC,CAAC;YACzE,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,CAAC,EAC7C,0DAA0D,CAC3D,CAAC;QACJ,CAAC;KACF;IACD;QACE,kFAAkF;QAClF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,aAAa,CAAC;gBAC3B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAClB,qBAAqB,EACrB,qFAAqF,CACtF,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,CACV,QAAQ,EAAE,IAAI,EAAE,SAAS,EACzB,OAAO,EACP,6DAA6D,CAC9D,CAAC;QACJ,CAAC;KACF;IACD;QACE,4FAA4F;QAC5F,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACzD,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,QAAQ,EAAE,EAAE,EACjB,YAAY,CAAC,aAAa,CAAC,EAC3B,gEAAgE,CACjE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAC7C,SAAS,EACT,4DAA4D,CAC7D,CAAC;QACJ,CAAC;KACF;IACD;QACE,wDAAwD;QACxD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EACpD,YAAY,EACZ,yDAAyD,CAC1D,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,EACvC,SAAS,EACT,sEAAsE,CACvE,CAAC;QACJ,CAAC;KACF;IACD;QACE,wEAAwE;QACxE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CACd,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAClE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAChE,YAAY,EACZ,oEAAoE,CACrE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EACjD,SAAS,EACT,kEAAkE,CACnE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,EACnD,SAAS,EACT,yCAAyC,CAC1C,CAAC;QACJ,CAAC;KACF;IACD;QACE,mDAAmD;QACnD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC;gBAC5B,KAAK,EAAE,aAAa;gBACpB,SAAS,EAAE,OAAO;aACnB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,MAAM,CAChB,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAC9D,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACpD,MAAM,CAAC,KAAK,CACV,OAAO,EAAE,IAAI,EAAE,SAAS,EACxB,SAAS,EACT,uDAAuD,CACxD,CAAC;YACF,MAAM,CAAC,KAAK,CACV,OAAO,EAAE,QAAQ,EAAE,EAAE,EACrB,IAAI,CAAC,OAAO,CAAC,EACb,4CAA4C,CAC7C,CAAC;QACJ,CAAC;KACF;IACD;QACE,yEAAyE;QACzE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACxD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACtC,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EACnC,SAAS,EACT,8CAA8C,CAC/C,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAC5C,SAAS,EACT,mDAAmD,CACpD,CAAC;YACF,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EACnB,wDAAwD,CACzD,CAAC;QACJ,CAAC;KACF;IACD;QACE,2EAA2E;QAC3E,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACpD,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC;gBACV,gCAAgC;gBAChC,IAAI,CAAC,KAAK,CAAC;aACZ,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CACd,UAAU,CAAC,KAAK,CAAC,EACjB,CAAC,YAAY,EAAE,aAAa,CAAC,EAC7B,wEAAwE,CACzE,CAAC;QACJ,CAAC;KACF;IACD;QACE,oEAAoE;QACpE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAC/C,6EAA6E,CAC9E,CAAC;YACF,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EACpD,yEAAyE,CAC1E,CAAC;QACJ,CAAC;KACF;IACD;QACE,+HAA+H;QAC/H,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;gBACvC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;gBAClE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;aACnE,CAAC,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBACjC,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,MAAM,YAAY,qBAAqB,EAC9C,oEAAoE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAC5F,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,CAAC,EAAE,CACP,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,EACvD,+CAA+C,CAChD,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CACV,MAAM,EAAE,QAAQ,EAAE,EAAE,EACpB,YAAY,CAAC,YAAY,CAAC,EAC1B,4CAA4C,CAC7C,CAAC;QACJ,CAAC;KACF;IACD;QACE,6GAA6G;QAC7G,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CACd,gBAAgB,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CACnE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAC1C,SAAS,EACT,mEAAmE,CACpE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAChD,SAAS,EACT,iEAAiE,CAClE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAC9D,+BAA+B,CAAC,SAAS,EACzC,+DAA+D,CAChE,CAAC;QACJ,CAAC;KACF;IACD;QACE,8GAA8G;QAC9G,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,MAAM,CAAC,SAAS,CACd,UAAU,CACR,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CACtE,EACD,CAAC,WAAW,EAAE,YAAY,CAAC,EAC3B,uDAAuD,CACxD,CAAC;YACF,MAAM,CAAC,SAAS,CACd,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EACzB,EAAE,EACF,wDAAwD,CACzD,CAAC;QACJ,CAAC;KACF;IACD;QACE,oDAAoD;QACpD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EACjC,SAAS,EACT,0EAA0E,CAC3E,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAC5C,SAAS,EACT,+EAA+E,CAChF,CAAC;QACJ,CAAC;KACF;IACD;QACE,sCAAsC;QACtC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EAC9C,0DAA0D,CAC3D,CAAC;QACJ,CAAC;KACF;IACD;QACE,oDAAoD;QACpD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,EACtC,qFAAqF,CACtF,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAEF,uEAAuE;AACvE,MAAM,UAAU,4BAA4B,CAC1C,WAA+D;IAE/D,OAAO,iBAAiB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"store-contract.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/store-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AACjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAE5G,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAMjE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AASnD,0FAA0F;AAC1F,SAAS,aAAa,CAAC,SAItB;IACC,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE;YACR,EAAE,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC;YACjC,IAAI,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK;SACzC;QACD,IAAI,EAAE;YACJ,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE;YAC5B,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,EAAE;YACpC,gBAAgB,EAAE,+BAA+B,CAAC,MAAM;SACzD;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,SAGzB;IACC,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE;QACtE,IAAI,EAAE;YACJ,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,gBAAgB,EAAE,+BAA+B,CAAC,SAAS;YAC3D,mBAAmB,EAAE;gBACnB,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,eAAe,CAAC,iBAAiB;gBACvC,IAAI,EAAE,WAAW;aAClB;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,SAG9B;IACC,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE;YACR,EAAE,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC;YACjC,IAAI,EAAE,SAAS,CAAC,KAAK;YACrB,GAAG,EAAE,MAAM;SACZ;QACD,IAAI,EAAE;YACJ,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,gBAAgB,EAAE,+BAA+B,CAAC,eAAe;SAClE;KACF,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,SAAS,wBAAwB;IAC/B,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,EAAE,EAAE,gCAAgC,EAAE,IAAI,EAAE,aAAa,EAAE;QACvE,IAAI,EAAE;YACJ,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,+BAA+B,CAAC,MAAM;SACzD;KACF,CAAC,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,SAAS,IAAI,CAAC,OAAwB;IACpC,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,oCAAoC,CAAC,CAAC;IAC9D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,UAAU,CAAC,QAAwC;IAC1D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,KAAK,GAAiE;IAC1E;QACE,4CAA4C;QAC5C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC;gBAC5B,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,mBAAmB;aAC3B,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAClD,MAAM,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,EAAE,wCAAwC,CAAC,CAAC;YACzE,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,CAAC,EAC7C,0DAA0D,CAC3D,CAAC;QACJ,CAAC;KACF;IACD;QACE,kFAAkF;QAClF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,aAAa,CAAC;gBAC3B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAClB,qBAAqB,EACrB,qFAAqF,CACtF,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,CACV,QAAQ,EAAE,IAAI,EAAE,SAAS,EACzB,OAAO,EACP,6DAA6D,CAC9D,CAAC;QACJ,CAAC;KACF;IACD;QACE,4FAA4F;QAC5F,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACzD,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,QAAQ,EAAE,EAAE,EACjB,YAAY,CAAC,aAAa,CAAC,EAC3B,gEAAgE,CACjE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAC7C,SAAS,EACT,4DAA4D,CAC7D,CAAC;QACJ,CAAC;KACF;IACD;QACE,wDAAwD;QACxD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EACpD,YAAY,EACZ,yDAAyD,CAC1D,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,EACvC,SAAS,EACT,sEAAsE,CACvE,CAAC;QACJ,CAAC;KACF;IACD;QACE,wEAAwE;QACxE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CACd,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAClE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAChE,YAAY,EACZ,oEAAoE,CACrE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EACjD,SAAS,EACT,kEAAkE,CACnE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,EACnD,SAAS,EACT,yCAAyC,CAC1C,CAAC;QACJ,CAAC;KACF;IACD;QACE,mDAAmD;QACnD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC;gBAC5B,KAAK,EAAE,aAAa;gBACpB,SAAS,EAAE,OAAO;aACnB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,MAAM,CAChB,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAC9D,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACpD,MAAM,CAAC,KAAK,CACV,OAAO,EAAE,IAAI,EAAE,SAAS,EACxB,SAAS,EACT,uDAAuD,CACxD,CAAC;YACF,MAAM,CAAC,KAAK,CACV,OAAO,EAAE,QAAQ,EAAE,EAAE,EACrB,IAAI,CAAC,OAAO,CAAC,EACb,4CAA4C,CAC7C,CAAC;QACJ,CAAC;KACF;IACD;QACE,yEAAyE;QACzE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACxD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACtC,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EACnC,SAAS,EACT,8CAA8C,CAC/C,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAC5C,SAAS,EACT,mDAAmD,CACpD,CAAC;YACF,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EACnB,wDAAwD,CACzD,CAAC;QACJ,CAAC;KACF;IACD;QACE,2EAA2E;QAC3E,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACpD,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC;gBACV,gCAAgC;gBAChC,IAAI,CAAC,KAAK,CAAC;aACZ,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CACd,UAAU,CAAC,KAAK,CAAC,EACjB,CAAC,YAAY,EAAE,aAAa,CAAC,EAC7B,wEAAwE,CACzE,CAAC;QACJ,CAAC;KACF;IACD;QACE,oEAAoE;QACpE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAC/C,6EAA6E,CAC9E,CAAC;YACF,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EACpD,yEAAyE,CAC1E,CAAC;QACJ,CAAC;KACF;IACD;QACE,+HAA+H;QAC/H,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;gBACvC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;gBAClE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;aACnE,CAAC,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBACjC,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,MAAM,YAAY,qBAAqB,EAC9C,oEAAoE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAC5F,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,CAAC,EAAE,CACP,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,EACvD,+CAA+C,CAChD,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CACV,MAAM,EAAE,QAAQ,EAAE,EAAE,EACpB,YAAY,CAAC,YAAY,CAAC,EAC1B,4CAA4C,CAC7C,CAAC;QACJ,CAAC;KACF;IACD;QACE,6GAA6G;QAC7G,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CACd,gBAAgB,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CACnE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAC1C,SAAS,EACT,mEAAmE,CACpE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAChD,SAAS,EACT,iEAAiE,CAClE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAC9D,+BAA+B,CAAC,SAAS,EACzC,+DAA+D,CAChE,CAAC;QACJ,CAAC;KACF;IACD;QACE,mHAAmH;QACnH,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CACd,qBAAqB,CAAC;gBACpB,KAAK,EAAE,qBAAqB;gBAC5B,KAAK,EAAE,iBAAiB;aACzB,CAAC,CACH,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,EACpD,SAAS,EACT,wFAAwF,CACzF,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAChD,SAAS,EACT,sEAAsE,CACvE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EACxE,+BAA+B,CAAC,eAAe,EAC/C,oFAAoF,CACrF,CAAC;QACJ,CAAC;KACF;IACD;QACE,8GAA8G;QAC9G,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,MAAM,CAAC,SAAS,CACd,UAAU,CACR,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CACtE,EACD,CAAC,WAAW,EAAE,YAAY,CAAC,EAC3B,uDAAuD,CACxD,CAAC;YACF,MAAM,CAAC,SAAS,CACd,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EACzB,EAAE,EACF,wDAAwD,CACzD,CAAC;QACJ,CAAC;KACF;IACD;QACE,oDAAoD;QACpD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EACjC,SAAS,EACT,0EAA0E,CAC3E,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAC5C,SAAS,EACT,+EAA+E,CAChF,CAAC;QACJ,CAAC;KACF;IACD;QACE,sCAAsC;QACtC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EAC9C,0DAA0D,CAC3D,CAAC;QACJ,CAAC;KACF;IACD;QACE,oDAAoD;QACpD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,EACtC,qFAAqF,CACtF,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAEF,uEAAuE;AACvE,MAAM,UAAU,4BAA4B,CAC1C,WAA+D;IAE/D,OAAO,iBAAiB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC"}

package/dist/domain/identityaccount/store.d.ts

@@ -22,12 +22,14 @@
  *     with an empty `idp_id` is refused, since no lookup could reach it;
  *   - `update` replaces, never creates: an unknown id writes nothing;
  *   - `deleteById` of an unknown id resolves;
- *   - `findDirectByIdpId` answers only non-federated accounts (the
- *     platform's own subjects) — a customer's federated IdP may mint the
- *     same `auth0|…` shape and the platform lane must never resolve to it;
+ *   - `findDirectByIdpId` answers only the platform's own subjects —
+ *     never a federated account (a customer's federated IdP may mint the
+ *     same `auth0|…` shape and the platform lane must never resolve to it)
+ *     and never a platform-client end user (its subject is the mint's);
  *   - `findDirectByEmail` answers direct accounts only, by exact match:
  *     federation legitimately duplicates emails, so the email axis is
- *     non-unique;
+ *     non-unique, and a platform-client account's email is one its
+ *     platform asserted, so no email lookup may answer it;
  *   - `findByIds` answers one row per distinct id, in first-occurrence
  *     order, and skips unknown ids;
  *   - a typed not-found reads as `undefined`; any other storage failure
@@ -56,7 +58,7 @@ export interface IdentityAccountStore {
     findById(id: string): Promise<IdentityAccount | undefined>;
     /** Any provisioning mode — the getByIdpId RPC's lookup. */
     findByIdpId(idpId: string): Promise<IdentityAccount | undefined>;
-    /** Non-federated accounts only — the verifiers' and whoAmI's lookup. */
+    /** The platform's own subjects only (no federated, no platform-client) — the verifiers' and whoAmI's lookup. */
     findDirectByIdpId(idpId: string): Promise<IdentityAccount | undefined>;
     /** Direct accounts only, exact match — the getByEmail RPC's lookup. */
     findDirectByEmail(email: string): Promise<IdentityAccount | undefined>;

package/dist/domain/identityaccount/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAEhG;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAED,MAAM,WAAW,oBAAoB;IACnC,kGAAkG;IAClG,IAAI,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,iGAAiG;IACjG,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,wDAAwD;IACxD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IAC3D,2DAA2D;IAC3D,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IACjE,wEAAwE;IACxE,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IACvE,uEAAuE;IACvE,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IACvE,kGAAkG;IAClG,SAAS,CACP,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,GACzB,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;CAC5C"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAEhG;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAED,MAAM,WAAW,oBAAoB;IACnC,kGAAkG;IAClG,IAAI,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,iGAAiG;IACjG,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,wDAAwD;IACxD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IAC3D,2DAA2D;IAC3D,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IACjE,gHAAgH;IAChH,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IACvE,uEAAuE;IACvE,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IACvE,kGAAkG;IAClG,SAAS,CACP,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,GACzB,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;CAC5C"}

package/dist/domain/identityaccount/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/store.ts"],"names":[],"mappings":"AAsCA;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/store.ts"],"names":[],"mappings":"AAwCA;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF"}

package/dist/domain/platform/controller.d.ts

@@ -81,6 +81,16 @@ export interface PlatformControllerDeps {
      * states its installed release and answers exactly as a bundle would.
      */
     readonly version: string;
+    /**
+     * The resolved require-authentication posture (compose.ts: the OSS
+     * issuer OR a unit's declaration), reported so a console can tell a
+     * server that verifies its callers from one that trusts every request —
+     * the features that hand out credentials only a verifying server
+     * honours (PlatformClient token minting) are unavailable on the latter.
+     * Always set on the wire, true or false: the field's absence is how a
+     * client recognises a server that predates it.
+     */
+    readonly authenticationRequired: boolean;
     /**
      * What license this server holds (extensions/license-status.ts). The
      * composition root installs the built-in `absent` provider when no unit

package/dist/domain/platform/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/platform/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAKzE,OAAO,EAML,aAAa,EACd,MAAM,uDAAuD,CAAC;AAS/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAEhF,OAAO,KAAK,EACV,wBAAwB,EAEzB,MAAM,gDAAgD,CAAC;AAGxD,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;IACrD;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,yEAAyE;AACzE,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,sBAAsB,GAC3B,IAAI,CASN"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/platform/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAKzE,OAAO,EAML,aAAa,EACd,MAAM,uDAAuD,CAAC;AAS/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAEhF,OAAO,KAAK,EACV,wBAAwB,EAEzB,MAAM,gDAAgD,CAAC;AAGxD,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;IACrD;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,yEAAyE;AACzE,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,sBAAsB,GAC3B,IAAI,CASN"}

package/dist/domain/platform/controller.js

@@ -13,11 +13,12 @@ export function registerPlatformServices(router, deps) {
         getRunnerScopedToken: (input, ctx) => getRunnerScopedToken(deps, input, ctx),
     });
 }
-/** Go GetServerInfo: the server edition and release version. */
+/** Go GetServerInfo: the server edition, release version and authentication posture. */
 function getServerInfo(deps) {
     return create(GetServerInfoOutputSchema, {
         edition: deps.edition,
         version: deps.version,
+        authenticationRequired: deps.authenticationRequired,
     });
 }
 /**

package/dist/domain/platform/controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/platform/controller.ts"],"names":[],"mappings":"AAiDA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AACjF,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,EACpC,gCAAgC,EAChC,yBAAyB,EACzB,uBAAuB,GAExB,MAAM,uDAAuD,CAAC;AAW/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAKvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AA+C7E,yEAAyE;AACzE,MAAM,UAAU,wBAAwB,CACtC,MAAqB,EACrB,IAA4B;IAE5B,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE;QACtC,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC;QACxC,gBAAgB,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;QAC9C,wBAAwB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CACxC,wBAAwB,CAAC,IAAI,EAAE,GAAG,CAAC;QACrC,oBAAoB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACnC,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED,gEAAgE;AAChE,SAAS,aAAa,CAAC,IAA4B;IACjD,OAAO,MAAM,CAAC,yBAAyB,EAAE;QACvC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,gBAAgB,CAC7B,IAA4B;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,4BAA4B,EAAE;QAClD,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,iBAAiB,CAAC,GAAG,CAAC;KAClC,CAAC,CAAC;IACH,QAAQ,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,YAAY,CAAC,MAAM;YACtB,OAAO,MAAM,CAAC;QAChB,KAAK,YAAY,CAAC,OAAO;YACvB,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC5B,OAAO,MAAM,CAAC;QAChB,KAAK,YAAY,CAAC,KAAK,CAAC;QACxB,KAAK,YAAY,CAAC,QAAQ,CAAC;QAC3B,KAAK,YAAY,CAAC,KAAK,CAAC;QACxB,KAAK,YAAY,CAAC,OAAO;YACvB,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC5B,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,OAAO,MAAM,CAAC;QAChB,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,MAAM,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,wBAAwB,CACrC,IAA4B,EAC5B,GAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,CAAC,oCAAoC,EAAE;QAC1D,eAAe,EAAE,IAAI,CAAC,gBAAgB;QACtC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IACH,MAAM,oBAAoB,GACxB,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC5E,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,iBAAiB,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC;YACzD,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;YAC5B,MAAM,CAAC,iCAAiC;gBACtC,WAAW,CAAC,WAAW,CAAC,gBAAgB,CAAC;QAC7C,CAAC;QACD,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,oBAAoB,GAAG,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC;YAChE,MAAM,CAAC,sBAAsB,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC;YAC9D,MAAM,CAAC,6BAA6B;gBAClC,WAAW,CAAC,WAAW,CAAC,kBAAkB,IAAI,EAAE,CAAC;YACnD,MAAM,CAAC,+BAA+B;gBACpC,WAAW,CAAC,WAAW,CAAC,cAAc,IAAI,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wEAAwE,EACxE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAA4B,EAC5B,KAAgC,EAChC,GAAmB;IAEnB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,IAAI,CAC/D,IAAI,CAAC,iBAAiB,CACvB,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAC3B,iBAAiB,CAAC,KAAK,CAAC,EACxB,gBAAgB,CAAC,GAAG,CAAC,CACtB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC,gCAAgC,EAAE;YAC9C,iBAAiB,EAAE,MAAM,CAAC,KAAK;YAC/B,SAAS,EAAE,QAAQ;YACnB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAmB,CAAC;IACxB,QAAQ,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,kBAAkB;YACrB,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;YAChC,MAAM;QACR,KAAK,qBAAqB;YACxB,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;YAChC,MAAM;QACR,KAAK,WAAW,CAAC;QACjB,KAAK,SAAS,CAAC;QACf,KAAK,SAAS;YACZ,iEAAiE;YACjE,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC,KAAK,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,IACE,WAAW,KAAK,EAAE;QAClB,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,2BAA2B,CAAC,EAC9D,CAAC;QACD,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CACxC,2BAA2B,EAC3B,WAAW,EACX,CAAC,CACF,CAAC;QACF,OAAO,MAAM,CAAC,gCAAgC,EAAE;YAC9C,iBAAiB,EAAE,MAAM,CAAC,KAAK;YAC/B,SAAS,EAAE,QAAQ;YACnB,gBAAgB,EAAE,MAAM,CAAC,UAAU;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2DAA2D,EAC3D;YACE,WAAW;YACX,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;QACF,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,KAAgC;IAEhC,QAAQ,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,kBAAkB;YACrB,OAAO,EAAE,GAAG,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACpE,KAAK,qBAAqB;YACxB,OAAO,EAAE,GAAG,EAAE,oBAAoB,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACvE,KAAK,WAAW;YACd,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACvE,KAAK,SAAS;YACZ,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QAC5B,KAAK,SAAS;YACZ,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC,KAAK,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/platform/controller.ts"],"names":[],"mappings":"AAiDA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AACjF,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,EACpC,gCAAgC,EAChC,yBAAyB,EACzB,uBAAuB,GAExB,MAAM,uDAAuD,CAAC;AAW/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAKvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAyD7E,yEAAyE;AACzE,MAAM,UAAU,wBAAwB,CACtC,MAAqB,EACrB,IAA4B;IAE5B,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE;QACtC,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC;QACxC,gBAAgB,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;QAC9C,wBAAwB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CACxC,wBAAwB,CAAC,IAAI,EAAE,GAAG,CAAC;QACrC,oBAAoB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACnC,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED,wFAAwF;AACxF,SAAS,aAAa,CAAC,IAA4B;IACjD,OAAO,MAAM,CAAC,yBAAyB,EAAE;QACvC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,gBAAgB,CAC7B,IAA4B;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,4BAA4B,EAAE;QAClD,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,iBAAiB,CAAC,GAAG,CAAC;KAClC,CAAC,CAAC;IACH,QAAQ,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,YAAY,CAAC,MAAM;YACtB,OAAO,MAAM,CAAC;QAChB,KAAK,YAAY,CAAC,OAAO;YACvB,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC5B,OAAO,MAAM,CAAC;QAChB,KAAK,YAAY,CAAC,KAAK,CAAC;QACxB,KAAK,YAAY,CAAC,QAAQ,CAAC;QAC3B,KAAK,YAAY,CAAC,KAAK,CAAC;QACxB,KAAK,YAAY,CAAC,OAAO;YACvB,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC5B,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,OAAO,MAAM,CAAC;QAChB,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,MAAM,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,wBAAwB,CACrC,IAA4B,EAC5B,GAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,CAAC,oCAAoC,EAAE;QAC1D,eAAe,EAAE,IAAI,CAAC,gBAAgB;QACtC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IACH,MAAM,oBAAoB,GACxB,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC5E,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,iBAAiB,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC;YACzD,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;YAC5B,MAAM,CAAC,iCAAiC;gBACtC,WAAW,CAAC,WAAW,CAAC,gBAAgB,CAAC;QAC7C,CAAC;QACD,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,oBAAoB,GAAG,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC;YAChE,MAAM,CAAC,sBAAsB,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC;YAC9D,MAAM,CAAC,6BAA6B;gBAClC,WAAW,CAAC,WAAW,CAAC,kBAAkB,IAAI,EAAE,CAAC;YACnD,MAAM,CAAC,+BAA+B;gBACpC,WAAW,CAAC,WAAW,CAAC,cAAc,IAAI,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wEAAwE,EACxE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAA4B,EAC5B,KAAgC,EAChC,GAAmB;IAEnB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,IAAI,CAC/D,IAAI,CAAC,iBAAiB,CACvB,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAC3B,iBAAiB,CAAC,KAAK,CAAC,EACxB,gBAAgB,CAAC,GAAG,CAAC,CACtB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC,gCAAgC,EAAE;YAC9C,iBAAiB,EAAE,MAAM,CAAC,KAAK;YAC/B,SAAS,EAAE,QAAQ;YACnB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAmB,CAAC;IACxB,QAAQ,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,kBAAkB;YACrB,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;YAChC,MAAM;QACR,KAAK,qBAAqB;YACxB,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;YAChC,MAAM;QACR,KAAK,WAAW,CAAC;QACjB,KAAK,SAAS,CAAC;QACf,KAAK,SAAS;YACZ,iEAAiE;YACjE,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC,KAAK,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,IACE,WAAW,KAAK,EAAE;QAClB,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,2BAA2B,CAAC,EAC9D,CAAC;QACD,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CACxC,2BAA2B,EAC3B,WAAW,EACX,CAAC,CACF,CAAC;QACF,OAAO,MAAM,CAAC,gCAAgC,EAAE;YAC9C,iBAAiB,EAAE,MAAM,CAAC,KAAK;YAC/B,SAAS,EAAE,QAAQ;YACnB,gBAAgB,EAAE,MAAM,CAAC,UAAU;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2DAA2D,EAC3D;YACE,WAAW;YACX,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;QACF,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,KAAgC;IAEhC,QAAQ,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,kBAAkB;YACrB,OAAO,EAAE,GAAG,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACpE,KAAK,qBAAqB;YACxB,OAAO,EAAE,GAAG,EAAE,oBAAoB,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACvE,KAAK,WAAW;YACd,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACvE,KAAK,SAAS;YACZ,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QAC5B,KAAK,SAAS;YACZ,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC,KAAK,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/domain/platformclient/constants.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The platform-client domain's pinned vocabulary: reserved names, the
+ * user-token claim names and every refusal sentence.
+ *
+ * Most copy is wire contract inherited from Stigmer Cloud, which has
+ * answered integrators with these exact sentences since the Java service:
+ * the mint's credential, expiry, organization and provisioning refusals,
+ * the system-managed and reserved-slug refusals, and the minting client's
+ * liveness and origin refusals on every request its tokens bear (pinned
+ * cross-edition by platformclient-enforcement.conformance.test.ts). The
+ * sentences open source adds — a server that cannot mint, the guest
+ * method's edition refusal, the mismatched-account guard — follow the
+ * house style (single-quoted handles).
+ */
+/** The kind's name as the shared error constructors render it. */
+export declare const PLATFORM_CLIENT_KIND_NAME = "PlatformClient";
+/**
+ * The slug of an organization's system-managed share client: the client
+ * an edition that hosts shared-agent pages names in the tokens it signs
+ * for guests and schedule fires, so every platform token names a real
+ * client. A user client holding it would be adopted by those lanes.
+ */
+export declare const SYSTEM_SHARE_CLIENT_SLUG = "system-share-client";
+/**
+ * Slugs the platform keeps for its own clients: the create chain refuses
+ * them, and newSystemManagedPlatformClient builds only under them.
+ */
+export declare const RESERVED_PLATFORM_CLIENT_SLUGS: ReadonlySet<string>;
+/** The claims the PlatformClient user token carries beside the envelope's. */
+export declare const USER_TOKEN_CLAIMS: {
+    readonly subject: "sub";
+    readonly externalUserId: "ext_user_id";
+    readonly email: "email";
+    readonly name: "name";
+    readonly org: "org";
+    readonly platformClientId: "platform_client_id";
+};
+/** The mint response's token_type. */
+export declare const BEARER_TOKEN_TYPE = "Bearer";
+export declare function reservedSlugMessage(slug: string): string;
+/** The three mutations a system-managed client refuses. */
+export type SystemManagedMutation = "updated" | "deleted" | "rotated";
+export declare function systemManagedMessage(verb: SystemManagedMutation): string;
+export declare function referenceNotFoundMessage(org: string, slug: string): string;
+export declare const INVALID_CLIENT_CREDENTIALS_MESSAGE = "Invalid client_id or client_secret";
+export declare const EXPIRED_CLIENT_SECRET_MESSAGE = "PlatformClient secret has expired. Use rotateSecret to generate a new one.";
+export declare function organizationMismatchMessage(owningOrg: string): string;
+export declare function noAccountMessage(externalUserId: string, org: string): string;
+export declare const OWNER_AUTO_GRANT_MESSAGE = "auto_grant_role cannot be 'owner'; organization ownership must be assigned explicitly.";
+export declare const PROVISIONING_FAILED_MESSAGE = "Account provisioning failed. No partial account was left behind; the request is safe to retry.";
+export declare function blankSubjectPartMessage(part: "org" | "externalUserId"): string;
+export declare function subjectSeparatorMessage(part: "org" | "externalUserId", value: string): string;
+export declare function foreignAccountMessage(externalUserId: string, org: string): string;
+export declare const MINTING_REQUIRES_AUTHENTICATION_MESSAGE = "mintUserToken requires a server that authenticates its callers: this server trusts every request, so nothing would verify the token \u2014 configure an identity provider (STIGMER_OIDC_ISSUER) to enable PlatformClient token minting";
+export declare const MINTING_DISABLED_MESSAGE = "mintUserToken is disabled: this server's platform-token key ring holds no signing key";
+export declare const GUEST_MINT_UNIMPLEMENTED_MESSAGE = "PlatformClientTokenController.mintGuestToken is not implemented: guest tokens for shared agents are served by the Cloud edition";
+export declare const TOKEN_NAMES_NO_CLIENT_MESSAGE = "platform token names no platform client";
+export declare const DELETED_CLIENT_MESSAGE = "The platform client that minted this token has been deleted, so the token is no longer accepted. Mint a new user token from an active platform client.";
+export declare function originRefusalMessage(origin: string): string;
+//# sourceMappingURL=constants.d.ts.map

package/dist/domain/platformclient/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,kEAAkE;AAClE,eAAO,MAAM,yBAAyB,mBAAmB,CAAC;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,CAE7D,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB;;;;;;;CAOpB,CAAC;AAEX,sCAAsC;AACtC,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,2DAA2D;AAC3D,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAEtE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,MAAM,CAExE;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,eAAO,MAAM,kCAAkC,uCACT,CAAC;AAEvC,eAAO,MAAM,6BAA6B,+EACoC,CAAC;AAE/E,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,eAAO,MAAM,wBAAwB,2FACqD,CAAC;AAE3F,eAAO,MAAM,2BAA2B,mGAC0D,CAAC;AAEnG,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,KAAK,GAAG,gBAAgB,GAC7B,MAAM,CAER;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,KAAK,GAAG,gBAAgB,EAC9B,KAAK,EAAE,MAAM,GACZ,MAAM,CAER;AAED,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,MAAM,GACV,MAAM,CAER;AAED,eAAO,MAAM,uCAAuC,2OACiL,CAAC;AAEtO,eAAO,MAAM,wBAAwB,0FACoD,CAAC;AAE1F,eAAO,MAAM,gCAAgC,oIACsF,CAAC;AAEpI,eAAO,MAAM,6BAA6B,4CACC,CAAC;AAE5C,eAAO,MAAM,sBAAsB,2JACuH,CAAC;AAE3J,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3D"}

package/dist/domain/platformclient/constants.js

@@ -0,0 +1,78 @@
+/**
+ * The platform-client domain's pinned vocabulary: reserved names, the
+ * user-token claim names and every refusal sentence.
+ *
+ * Most copy is wire contract inherited from Stigmer Cloud, which has
+ * answered integrators with these exact sentences since the Java service:
+ * the mint's credential, expiry, organization and provisioning refusals,
+ * the system-managed and reserved-slug refusals, and the minting client's
+ * liveness and origin refusals on every request its tokens bear (pinned
+ * cross-edition by platformclient-enforcement.conformance.test.ts). The
+ * sentences open source adds — a server that cannot mint, the guest
+ * method's edition refusal, the mismatched-account guard — follow the
+ * house style (single-quoted handles).
+ */
+/** The kind's name as the shared error constructors render it. */
+export const PLATFORM_CLIENT_KIND_NAME = "PlatformClient";
+/**
+ * The slug of an organization's system-managed share client: the client
+ * an edition that hosts shared-agent pages names in the tokens it signs
+ * for guests and schedule fires, so every platform token names a real
+ * client. A user client holding it would be adopted by those lanes.
+ */
+export const SYSTEM_SHARE_CLIENT_SLUG = "system-share-client";
+/**
+ * Slugs the platform keeps for its own clients: the create chain refuses
+ * them, and newSystemManagedPlatformClient builds only under them.
+ */
+export const RESERVED_PLATFORM_CLIENT_SLUGS = new Set([
+    SYSTEM_SHARE_CLIENT_SLUG,
+]);
+/** The claims the PlatformClient user token carries beside the envelope's. */
+export const USER_TOKEN_CLAIMS = {
+    subject: "sub",
+    externalUserId: "ext_user_id",
+    email: "email",
+    name: "name",
+    org: "org",
+    platformClientId: "platform_client_id",
+};
+/** The mint response's token_type. */
+export const BEARER_TOKEN_TYPE = "Bearer";
+export function reservedSlugMessage(slug) {
+    return `The slug '${slug}' is reserved for the platform's system-managed resources and cannot be used. If you did not provide a slug explicitly, it was derived from the resource name — choose a different name or provide an explicit slug.`;
+}
+export function systemManagedMessage(verb) {
+    return `This platform client is system-managed and cannot be ${verb}`;
+}
+export function referenceNotFoundMessage(org, slug) {
+    return `PlatformClient '${org}/${slug}' not found`;
+}
+export const INVALID_CLIENT_CREDENTIALS_MESSAGE = "Invalid client_id or client_secret";
+export const EXPIRED_CLIENT_SECRET_MESSAGE = "PlatformClient secret has expired. Use rotateSecret to generate a new one.";
+export function organizationMismatchMessage(owningOrg) {
+    return `org_id must be empty or the PlatformClient's owning organization ('${owningOrg}'); cross-organization minting is not supported`;
+}
+export function noAccountMessage(externalUserId, org) {
+    return `User '${externalUserId}' has no Stigmer account in organization '${org}'. Enable auto_provision_accounts on the PlatformClient or create the account first.`;
+}
+export const OWNER_AUTO_GRANT_MESSAGE = "auto_grant_role cannot be 'owner'; organization ownership must be assigned explicitly.";
+export const PROVISIONING_FAILED_MESSAGE = "Account provisioning failed. No partial account was left behind; the request is safe to retry.";
+export function blankSubjectPartMessage(part) {
+    return `${part} must not be null or blank`;
+}
+export function subjectSeparatorMessage(part, value) {
+    return `${part} must not contain the separator character '|': ${value}`;
+}
+export function foreignAccountMessage(externalUserId, org) {
+    return `User '${externalUserId}' in organization '${org}' resolves to an account no platform client provisioned — refusing to mint a token for it`;
+}
+export const MINTING_REQUIRES_AUTHENTICATION_MESSAGE = "mintUserToken requires a server that authenticates its callers: this server trusts every request, so nothing would verify the token — configure an identity provider (STIGMER_OIDC_ISSUER) to enable PlatformClient token minting";
+export const MINTING_DISABLED_MESSAGE = "mintUserToken is disabled: this server's platform-token key ring holds no signing key";
+export const GUEST_MINT_UNIMPLEMENTED_MESSAGE = "PlatformClientTokenController.mintGuestToken is not implemented: guest tokens for shared agents are served by the Cloud edition";
+export const TOKEN_NAMES_NO_CLIENT_MESSAGE = "platform token names no platform client";
+export const DELETED_CLIENT_MESSAGE = "The platform client that minted this token has been deleted, so the token is no longer accepted. Mint a new user token from an active platform client.";
+export function originRefusalMessage(origin) {
+    return `Request origin '${origin}' is not in this platform client's allowed_origins. Add it to the PlatformClient's allowed_origins to permit browser requests from this origin.`;
+}
+//# sourceMappingURL=constants.js.map

package/dist/domain/platformclient/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/platformclient/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,kEAAkE;AAClE,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAE9D;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC;IACzE,wBAAwB;CACzB,CAAC,CAAC;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,OAAO,EAAE,KAAK;IACd,cAAc,EAAE,aAAa;IAC7B,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;IACV,gBAAgB,EAAE,oBAAoB;CAC9B,CAAC;AAEX,sCAAsC;AACtC,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,aAAa,IAAI,sNAAsN,CAAC;AACjP,CAAC;AAKD,MAAM,UAAU,oBAAoB,CAAC,IAA2B;IAC9D,OAAO,wDAAwD,IAAI,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAW,EAAE,IAAY;IAChE,OAAO,mBAAmB,GAAG,IAAI,IAAI,aAAa,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,MAAM,kCAAkC,GAC7C,oCAAoC,CAAC;AAEvC,MAAM,CAAC,MAAM,6BAA6B,GACxC,4EAA4E,CAAC;AAE/E,MAAM,UAAU,2BAA2B,CAAC,SAAiB;IAC3D,OAAO,sEAAsE,SAAS,iDAAiD,CAAC;AAC1I,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,cAAsB,EAAE,GAAW;IAClE,OAAO,SAAS,cAAc,6CAA6C,GAAG,sFAAsF,CAAC;AACvK,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GACnC,wFAAwF,CAAC;AAE3F,MAAM,CAAC,MAAM,2BAA2B,GACtC,gGAAgG,CAAC;AAEnG,MAAM,UAAU,uBAAuB,CACrC,IAA8B;IAE9B,OAAO,GAAG,IAAI,4BAA4B,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAA8B,EAC9B,KAAa;IAEb,OAAO,GAAG,IAAI,kDAAkD,KAAK,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,cAAsB,EACtB,GAAW;IAEX,OAAO,SAAS,cAAc,sBAAsB,GAAG,2FAA2F,CAAC;AACrJ,CAAC;AAED,MAAM,CAAC,MAAM,uCAAuC,GAClD,mOAAmO,CAAC;AAEtO,MAAM,CAAC,MAAM,wBAAwB,GACnC,uFAAuF,CAAC;AAE1F,MAAM,CAAC,MAAM,gCAAgC,GAC3C,iIAAiI,CAAC;AAEpI,MAAM,CAAC,MAAM,6BAA6B,GACxC,yCAAyC,CAAC;AAE5C,MAAM,CAAC,MAAM,sBAAsB,GACjC,wJAAwJ,CAAC;AAE3J,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,OAAO,mBAAmB,MAAM,iJAAiJ,CAAC;AACpL,CAAC"}

package/dist/domain/platformclient/controller.d.ts

@@ -0,0 +1,59 @@
+/**
+ * PlatformClient controller — the command and query sides, served by open
+ * source in every edition (the token side is token-controller.ts). A
+ * PlatformClient is an organization's inbound credential pair: its backend
+ * presents client_id + client_secret to mint short-lived user tokens for
+ * its own product's users (mint.ts). The inbound counterpart to OAuthApp,
+ * whose controller this one follows chain for chain.
+ *
+ * Every chain opens with Authorize and runs over the PlatformClientStore
+ * port (store.ts), so the cloud serves these same chains over its own
+ * table. What the domain adds to the OAuthApp shape:
+ *   - the credential steps: generated on create and shown once in
+ *     PlatformClientCreateResponse, kept from the row on update, replaced
+ *     by rotateSecret (the client_id is permanent);
+ *   - `system-share-client` refused on create, and the platform's
+ *     system-managed clients refused on update, delete and rotate;
+ *   - the reference rule on `environment_refs` (NormalizeReferences, then
+ *     ValidateReferences) on create and update, which every chain that
+ *     stores a spec reference runs; it reads the environments from the
+ *     resource Store, not from the port, because a driver may keep client
+ *     rows in a table of its own while environments stay in the Store;
+ *   - the stored hash cleared on EVERY response, deletes and rotations
+ *     included — the model promises it is never returned
+ *     (fga/model/iam/platform_client.fga), and no reader needs it;
+ *   - getByReference loads, then authorizes the loaded client exactly as
+ *     `get` would (AuthorizeResolvedTarget), and listByOrg narrows through
+ *     the list read scope, so a member who may not `get` a client does not
+ *     see it listed either: the model gives organization members no access
+ *     to a credential.
+ *
+ * There is no apply and no updateVisibility: clients are created through
+ * the console or the API and are always organization-private.
+ *
+ * Proven by platformclient.conformance.test.ts (local targets and the
+ * cloud) and __tests__/controller.test.ts.
+ */
+import type { ConnectRouter } from "@connectrpc/connect";
+import type { Logger } from "../../boot/logger.js";
+import type { Authorizer } from "../../extensions/authorizer.js";
+import type { ListReadScope } from "../../extensions/list-read-scope.js";
+import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
+import type { Store } from "../../store/interface.js";
+import type { PlatformClientStore } from "./store.js";
+export interface PlatformClientControllerDeps {
+    /** The composed store — a driver's, or the OSS adapter over the generic Store. */
+    readonly clients: PlatformClientStore;
+    /** The resource store the reference rule reads the environments `environment_refs` names from. */
+    readonly store: Store;
+    readonly logger: Logger;
+    /** The composed authorization seam — the Authorize step at position 1 of every chain calls it. */
+    readonly authorizer: Authorizer;
+    /** The composed tuple-lifecycle driver — undefined = the shared steps no-op. */
+    readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
+    /** The composed list read scope — listByOrg narrows through it; undefined = every client of the org. */
+    readonly listReadScope: ListReadScope | undefined;
+}
+/** Registers the command and query services on the router (routes stage). */
+export declare function registerPlatformClientServices(router: ConnectRouter, deps: PlatformClientControllerDeps): void;
+//# sourceMappingURL=controller.d.ts.map

package/dist/domain/platformclient/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAwBzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AA6BjG,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAoBtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,WAAW,4BAA4B;IAC3C,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,kGAAkG;IAClG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kGAAkG;IAClG,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,gFAAgF;IAChF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC5E,wGAAwG;IACxG,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;CACnD;AAED,6EAA6E;AAC7E,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,4BAA4B,GACjC,IAAI,CAYN"}

package/dist/domain/platformclient/controller.js

@@ -0,0 +1,191 @@
+import { create } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { PlatformClientSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+import { PlatformClientCommandController } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/command_pb";
+import { PlatformClientCreateResponseSchema, PlatformClientsSchema, } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/io_pb";
+import { PlatformClientQueryController } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/query_pb";
+import { restrictListByReadScope } from "../../extensions/list-read-scope.js";
+import { internalError } from "../../pipeline/errors.js";
+import { apiResourceKindKey } from "../../pipeline/interceptors/apiresource.js";
+import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
+import { newPipeline } from "../../pipeline/pipeline.js";
+import { RequestContext } from "../../pipeline/request-context.js";
+import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import { loadedTargetAsMethod, newAuthorizeResolvedTargetStep, } from "../../pipeline/steps/authorize-resolved-target.js";
+import { newCleanupIamPoliciesStep, newCreateAuthorizationTuplesStep, } from "../../pipeline/steps/authorization-tuples.js";
+import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
+import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
+import { RESOURCE_ID_KEY } from "../../pipeline/steps/delete.js";
+import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
+import { compareCreatedAtDesc } from "../../pipeline/steps/helpers.js";
+import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
+import { TARGET_RESOURCE_KEY } from "../../pipeline/steps/load-target.js";
+import { newNormalizeReferencesStep, newValidateReferencesStep, } from "../../pipeline/steps/references.js";
+import { newResolveSlugStep } from "../../pipeline/steps/slug.js";
+import { newValidateVisibilityStep } from "../../pipeline/steps/validate-visibility.js";
+import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
+import { newCheckDuplicateStep, newDeleteClientStep, newGenerateClientCredentialsStep, newLoadClientByReferenceStep, newLoadExistingClientForDeleteStep, newLoadExistingClientStep, newLoadTargetClientStep, newPersistNewClientStep, newPersistTargetClientStep, newPersistUpdatedClientStep, newPreserveClientCredentialsStep, newRefuseReservedSlugStep, newRefuseSystemManagedStep, newRotateClientCredentialsStep, parkedClientSecret, redactPlatformClient, storedClientOf, } from "./steps.js";
+/** Registers the command and query services on the router (routes stage). */
+export function registerPlatformClientServices(router, deps) {
+    router.service(PlatformClientCommandController, {
+        create: (client, ctx) => createClient(deps, client, ctx),
+        update: (client, ctx) => updateClient(deps, client, ctx),
+        delete: (input, ctx) => deleteClient(deps, input, ctx),
+        rotateSecret: (id, ctx) => rotateSecret(deps, id, ctx),
+    });
+    router.service(PlatformClientQueryController, {
+        get: (id, ctx) => get(deps, id, ctx),
+        getByReference: (ref, ctx) => getByReference(deps, ref, ctx),
+        listByOrg: (input, ctx) => listByOrg(deps, input, ctx),
+    });
+}
+function kindOf(ctx) {
+    return ctx.values.get(apiResourceKindKey);
+}
+/**
+ * Create — OAuthApp's chain with the reserved-slug refusal after the slug
+ * resolves, the reference rule where every sibling chain runs it, and the
+ * credentials generated only once the row is known to be storable; the
+ * response carries the redacted client and the one look at its secret.
+ */
+async function createClient(deps, client, ctx) {
+    const reqCtx = new RequestContext(PlatformClientSchema, client, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("platformclient-create", deps.logger)
+        .addStep(newAuthorizeStep(PlatformClientCommandController.method.create, deps.authorizer))
+        .addStep(newResolveSlugStep())
+        .addStep(newValidateProtoStep())
+        .addStep(newValidateVisibilityStep())
+        .addStep(newRefuseReservedSlugStep())
+        .addStep(newCheckDuplicateStep(deps.clients))
+        .addStep(newBuildNewStateStep())
+        .addStep(newGuardReservedLabelsStep(deps.authorizer))
+        .addStep(newNormalizeReferencesStep())
+        .addStep(newValidateReferencesStep(deps.store))
+        .addStep(newGenerateClientCredentialsStep())
+        .addStep(newPersistNewClientStep(deps.clients))
+        .addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle, deps.logger))
+        .build()
+        .execute(reqCtx);
+    return create(PlatformClientCreateResponseSchema, {
+        platformClient: redactPlatformClient(reqCtx.newState),
+        clientSecret: parkedClientSecret(reqCtx),
+    });
+}
+/**
+ * Update — full spec replacement from the request (BuildUpdateState),
+ * addressed by id or org-scoped slug; the platform's own clients refused
+ * before any state is built; the reference rule as on create; the
+ * credential fields kept from the row.
+ */
+async function updateClient(deps, client, ctx) {
+    const reqCtx = new RequestContext(PlatformClientSchema, client, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("platformclient-update", deps.logger)
+        .addStep(newAuthorizeStep(PlatformClientCommandController.method.update, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newResolveSlugStep())
+        .addStep(newLoadExistingClientStep(deps.clients))
+        .addStep(newRefuseSystemManagedStep("updated", EXISTING_RESOURCE_KEY))
+        .addStep(newBuildUpdateStateStep())
+        .addStep(newGuardReservedLabelsStep(deps.authorizer))
+        .addStep(newNormalizeReferencesStep())
+        .addStep(newValidateReferencesStep(deps.store))
+        .addStep(newPreserveClientCredentialsStep())
+        .addStep(newPersistUpdatedClientStep(deps.clients))
+        .build()
+        .execute(reqCtx);
+    return redactPlatformClient(reqCtx.newState);
+}
+/**
+ * Delete — the platform's own clients refused before the delete; the
+ * client's policies cleaned up after. The client's outstanding tokens stop
+ * at their next request (the verifier's liveness read); the end-user
+ * accounts it provisioned stay, because an account belongs to the
+ * organization, not to one of its clients.
+ */
+async function deleteClient(deps, input, ctx) {
+    const reqCtx = new RequestContext(PlatformClientCommandController.method.delete.input, input, callerIdentityOf(ctx), kindOf(ctx));
+    // ApiResourceDeleteInput carries resource_id, not the `value` field
+    // ExtractResourceId reads (OAuthApp's pattern).
+    reqCtx.set(RESOURCE_ID_KEY, input.resourceId);
+    await newPipeline("platformclient-delete", deps.logger)
+        .addStep(newAuthorizeStep(PlatformClientCommandController.method.delete, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadExistingClientForDeleteStep(deps.clients))
+        .addStep(newRefuseSystemManagedStep("deleted", EXISTING_RESOURCE_KEY))
+        .addStep(newDeleteClientStep(deps.clients))
+        .addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle, deps.logger))
+        .build()
+        .execute(reqCtx);
+    return redactPlatformClient(storedClientOf(reqCtx, EXISTING_RESOURCE_KEY));
+}
+/**
+ * RotateSecret — a new secret for the loaded client (the client_id stays),
+ * shown once in the response. Tokens already minted stay valid until they
+ * expire; deleting the client is what revokes them.
+ */
+async function rotateSecret(deps, id, ctx) {
+    const reqCtx = new RequestContext(PlatformClientCommandController.method.rotateSecret.input, id, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("platformclient-rotate-secret", deps.logger)
+        .addStep(newAuthorizeStep(PlatformClientCommandController.method.rotateSecret, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadTargetClientStep(deps.clients))
+        .addStep(newRefuseSystemManagedStep("rotated", TARGET_RESOURCE_KEY))
+        .addStep(newRotateClientCredentialsStep())
+        .addStep(newPersistTargetClientStep(deps.clients))
+        .build()
+        .execute(reqCtx);
+    return create(PlatformClientCreateResponseSchema, {
+        platformClient: redactPlatformClient(storedClientOf(reqCtx, TARGET_RESOURCE_KEY)),
+        clientSecret: parkedClientSecret(reqCtx),
+    });
+}
+async function get(deps, id, ctx) {
+    const reqCtx = new RequestContext(PlatformClientQueryController.method.get.input, id, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("platformclient-get", deps.logger)
+        .addStep(newAuthorizeStep(PlatformClientQueryController.method.get, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadTargetClientStep(deps.clients))
+        .build()
+        .execute(reqCtx);
+    return redactPlatformClient(storedClientOf(reqCtx, TARGET_RESOURCE_KEY));
+}
+/** GetByReference — load by org/slug, then authorize the loaded client as `get` would. */
+async function getByReference(deps, ref, ctx) {
+    const reqCtx = new RequestContext(PlatformClientQueryController.method.getByReference.input, ref, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("platformclient-get-by-reference", deps.logger)
+        .addStep(newAuthorizeStep(PlatformClientQueryController.method.getByReference, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadClientByReferenceStep(deps.clients))
+        .addStep(newAuthorizeResolvedTargetStep(deps.authorizer, loadedTargetAsMethod(PlatformClientQueryController.method.get)))
+        .build()
+        .execute(reqCtx);
+    return redactPlatformClient(storedClientOf(reqCtx, TARGET_RESOURCE_KEY));
+}
+/**
+ * ListByOrg — the organization's clients the caller may view, newest
+ * first, each redacted. The annotation admits anyone who can view the
+ * organization; the list read scope then keeps only the clients a `get`
+ * would return.
+ */
+async function listByOrg(deps, input, ctx) {
+    const caller = callerIdentityOf(ctx);
+    const reqCtx = new RequestContext(PlatformClientQueryController.method.listByOrg.input, input, caller, kindOf(ctx));
+    await newPipeline("platformclient-list-by-org", deps.logger)
+        .addStep(newAuthorizeStep(PlatformClientQueryController.method.listByOrg, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .build()
+        .execute(reqCtx);
+    let candidates;
+    try {
+        candidates = await deps.clients.findByOrg(input.org);
+    }
+    catch (error) {
+        throw internalError(error, "failed to list platform clients");
+    }
+    const visible = await restrictListByReadScope(deps.listReadScope, caller, ApiResourceKind.platform_client, candidates, input.org);
+    const entries = [...visible]
+        .sort((a, b) => compareCreatedAtDesc(a.status?.audit?.specAudit?.createdAt, b.status?.audit?.specAudit?.createdAt))
+        .map(redactPlatformClient);
+    return create(PlatformClientsSchema, { entries });
+}
+//# sourceMappingURL=controller.js.map