@stigmer/server 3.24.0 → 3.25.0

package/dist/domain/platformclient/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/platformclient/controller.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAMtH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yDAAyD,CAAC;AAE/F,OAAO,EAAE,+BAA+B,EAAE,MAAM,6DAA6D,CAAC;AAC9G,OAAO,EACL,kCAAkC,EAClC,qBAAqB,GACtB,MAAM,wDAAwD,CAAC;AAOhE,OAAO,EAAE,6BAA6B,EAAE,MAAM,2DAA2D,CAAC;AAK1G,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE9E,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,8BAA8B,GAC/B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,gCAAgC,EAChC,4BAA4B,EAC5B,kCAAkC,EAClC,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,EAC3B,gCAAgC,EAChC,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EAC9B,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,GACf,MAAM,YAAY,CAAC;AAiBpB,6EAA6E;AAC7E,MAAM,UAAU,8BAA8B,CAC5C,MAAqB,EACrB,IAAkC;IAElC,MAAM,CAAC,OAAO,CAAC,+BAA+B,EAAE;QAC9C,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC;QACxD,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC;QACxD,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACtD,YAAY,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;KACvD,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,6BAA6B,EAAE;QAC5C,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC5D,SAAS,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACvD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,MAAsB,EACtB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,oBAAoB,EACpB,MAAM,EACN,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,uBAAuB,EACvB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,+BAA+B,CAAC,MAAM,CAAC,MAAM,EAC7C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;SAC5C,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,CAAC;SACrC,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC9C,OAAO,CAAC,gCAAgC,EAAE,CAAC;SAC3C,OAAO,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;SAC9C,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,kCAAkC,EAAE;QAChD,cAAc,EAAE,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC;QACrD,YAAY,EAAE,kBAAkB,CAAC,MAAM,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,MAAsB,EACtB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,oBAAoB,EACpB,MAAM,EACN,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,uBAAuB,EACvB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,+BAA+B,CAAC,MAAM,CAAC,MAAM,EAC7C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;SAChD,OAAO,CACN,0BAA0B,CACxB,SAAS,EACT,qBAAqB,CACtB,CACF;SACA,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,CAAC;SACrC,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC9C,OAAO,CAAC,gCAAgC,EAAE,CAAC;SAC3C,OAAO,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;SAClD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,KAA6B,EAC7B,GAAmB;IAGnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,+BAA+B,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EACnD,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,oEAAoE;IACpE,gDAAgD;IAChD,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,WAAW,CAAc,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC;SACjE,OAAO,CACN,gBAAgB,CACd,+BAA+B,CAAC,MAAM,CAAC,MAAM,EAC7C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kCAAkC,CAAc,IAAI,CAAC,OAAO,CAAC,CAAC;SACtE,OAAO,CACN,0BAA0B,CAAc,SAAS,EAAE,qBAAqB,CAAC,CAC1E;SACA,OAAO,CAAC,mBAAmB,CAAc,IAAI,CAAC,OAAO,CAAC,CAAC;SACvD,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,oBAAoB,CAAC,cAAc,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,EAAoB,EACpB,GAAmB;IAInB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,+BAA+B,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EACzD,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAc,8BAA8B,EAAE,IAAI,CAAC,MAAM,CAAC;SACxE,OAAO,CACN,gBAAgB,CACd,+BAA+B,CAAC,MAAM,CAAC,YAAY,EACnD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,uBAAuB,CAAc,IAAI,CAAC,OAAO,CAAC,CAAC;SAC3D,OAAO,CACN,0BAA0B,CAAc,SAAS,EAAE,mBAAmB,CAAC,CACxE;SACA,OAAO,CAAC,8BAA8B,EAAe,CAAC;SACtD,OAAO,CAAC,0BAA0B,CAAc,IAAI,CAAC,OAAO,CAAC,CAAC;SAC9D,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,kCAAkC,EAAE;QAChD,cAAc,EAAE,oBAAoB,CAClC,cAAc,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAC5C;QACD,YAAY,EAAE,kBAAkB,CAAC,MAAM,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,GAAG,CAChB,IAAkC,EAClC,EAAiB,EACjB,GAAmB;IAGnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,6BAA6B,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAC9C,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAW,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC;SAC3D,OAAO,CACN,gBAAgB,CACd,6BAA6B,CAAC,MAAM,CAAC,GAAG,EACxC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,uBAAuB,CAAW,IAAI,CAAC,OAAO,CAAC,CAAC;SACxD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,oBAAoB,CAAC,cAAc,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,cAAc,CAC3B,IAAkC,EAClC,GAAyB,EACzB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,6BAA6B,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EACzD,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,iCAAiC,EAAE,IAAI,CAAC,MAAM,CAAC;SAC9C,OAAO,CACN,gBAAgB,CACd,6BAA6B,CAAC,MAAM,CAAC,cAAc,EACnD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;SACnD,OAAO,CACN,8BAA8B,CAC5B,IAAI,CAAC,UAAU,EACf,oBAAoB,CAAC,6BAA6B,CAAC,MAAM,CAAC,GAAG,CAAC,CAC/D,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,oBAAoB,CAAC,cAAc,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,SAAS,CACtB,IAAkC,EAClC,KAAoC,EACpC,GAAmB;IAEnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,6BAA6B,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EACpD,KAAK,EACL,MAAM,EACN,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,4BAA4B,EAAE,IAAI,CAAC,MAAM,CAAC;SACzC,OAAO,CACN,gBAAgB,CACd,6BAA6B,CAAC,MAAM,CAAC,SAAS,EAC9C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,IAAI,UAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAC3C,IAAI,CAAC,aAAa,EAClB,MAAM,EACN,eAAe,CAAC,eAAe,EAC/B,UAAU,EACV,KAAK,CAAC,GAAG,CACV,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC;SACzB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACb,oBAAoB,CAClB,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EACrC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CACtC,CACF;SACA,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,qBAAqB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AACpD,CAAC"}

package/dist/domain/platformclient/credentials.d.ts

@@ -0,0 +1,13 @@
+export declare const CLIENT_ID_PREFIX = "stgm_cid_";
+export declare const CLIENT_SECRET_PREFIX = "stgm_cs_";
+/** Characters of the secret kept for display. */
+export declare const SECRET_FINGERPRINT_LENGTH = 6;
+export declare function generateClientId(): string;
+export declare function generateClientSecret(): string;
+/** SHA-256 over the whole prefixed secret, base64url — the stored form. */
+export declare function hashClientSecret(secret: string): string;
+/** The secret's last six characters (the whole secret when shorter). */
+export declare function secretFingerprint(secret: string): string;
+/** Whether `secret` hashes to `storedHash`, compared in constant time. */
+export declare function secretMatchesHash(secret: string, storedHash: string): boolean;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/domain/platformclient/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/credentials.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAC5C,eAAO,MAAM,oBAAoB,aAAa,CAAC;AAQ/C,iDAAiD;AACjD,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAE3C,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAK7C;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,wEAAwE;AACxE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIxD;AAED,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAS7E"}

package/dist/domain/platformclient/credentials.js

@@ -0,0 +1,56 @@
+/**
+ * PlatformClient credential material — byte-compatible with every client
+ * Stigmer Cloud has issued since the Java service, because the rows (and
+ * the secrets integrators hold) move under this code unchanged:
+ *
+ *   - client_id: "stgm_cid_" + 32 random bytes, base64url (43 characters).
+ *     Public by design — safe in logs and client-side code — so its
+ *     existence is no secret and the mint may answer an unknown id and a
+ *     wrong secret with the same copy at different speeds.
+ *   - client_secret: "stgm_cs_" + 48 random bytes, base64url (64
+ *     characters): 384 bits, returned once and never stored.
+ *   - the stored hash: SHA-256 over the whole prefixed secret, base64url
+ *     (43 characters). A slow KDF defends low-entropy passwords, not
+ *     384-bit random tokens — ApiKey's precedent (domain/apikey/keymaterial.ts).
+ *   - the fingerprint: the secret's last six characters, for display.
+ *
+ * The comparison hashes the presented secret and compares the two hashes in
+ * constant time, so neither the secret nor the stored hash leaks through
+ * timing.
+ */
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+export const CLIENT_ID_PREFIX = "stgm_cid_";
+export const CLIENT_SECRET_PREFIX = "stgm_cs_";
+/** Random bytes behind a client_id. */
+const CLIENT_ID_BYTES = 32;
+/** Random bytes behind a client_secret: 384 bits. */
+const CLIENT_SECRET_BYTES = 48;
+/** Characters of the secret kept for display. */
+export const SECRET_FINGERPRINT_LENGTH = 6;
+export function generateClientId() {
+    return CLIENT_ID_PREFIX + randomBytes(CLIENT_ID_BYTES).toString("base64url");
+}
+export function generateClientSecret() {
+    return (CLIENT_SECRET_PREFIX +
+        randomBytes(CLIENT_SECRET_BYTES).toString("base64url"));
+}
+/** SHA-256 over the whole prefixed secret, base64url — the stored form. */
+export function hashClientSecret(secret) {
+    return createHash("sha256").update(secret, "utf8").digest("base64url");
+}
+/** The secret's last six characters (the whole secret when shorter). */
+export function secretFingerprint(secret) {
+    return secret.length <= SECRET_FINGERPRINT_LENGTH
+        ? secret
+        : secret.slice(-SECRET_FINGERPRINT_LENGTH);
+}
+/** Whether `secret` hashes to `storedHash`, compared in constant time. */
+export function secretMatchesHash(secret, storedHash) {
+    if (storedHash === "") {
+        return false;
+    }
+    const presented = Buffer.from(hashClientSecret(secret), "utf8");
+    const stored = Buffer.from(storedHash, "utf8");
+    return (presented.length === stored.length && timingSafeEqual(presented, stored));
+}
+//# sourceMappingURL=credentials.js.map

package/dist/domain/platformclient/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/domain/platformclient/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAC5C,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAE/C,uCAAuC;AACvC,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,qDAAqD;AACrD,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,iDAAiD;AACjD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAE3C,MAAM,UAAU,gBAAgB;IAC9B,OAAO,gBAAgB,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO,CACL,oBAAoB;QACpB,WAAW,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CACvD,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACzE,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,MAAM,CAAC,MAAM,IAAI,yBAAyB;QAC/C,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,yBAAyB,CAAC,CAAC;AAC/C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,UAAkB;IAClE,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,OAAO,CACL,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CACzE,CAAC;AACJ,CAAC"}

package/dist/domain/platformclient/mint.d.ts

@@ -0,0 +1,23 @@
+import type { MintUserTokenRequest, MintUserTokenResponse } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/token_pb";
+import type { Logger } from "../../boot/logger.js";
+import { type PlatformTokenKeyRing } from "../../platformtoken/key-ring.js";
+import type { IamPolicyGrantPath } from "../iampolicy/grant-path.js";
+import type { CreateAccount } from "../identityaccount/provisioning.js";
+import type { IdentityAccountStore } from "../identityaccount/store.js";
+import type { PlatformClientStore } from "./store.js";
+export interface PlatformClientMintDeps {
+    readonly clients: PlatformClientStore;
+    /** The any-mode subject lookup: an existing end user is found whatever wrote it. */
+    readonly accounts: Pick<IdentityAccountStore, "findByIdpId">;
+    /** The identity-account domain's one create path (identityaccount/controller.ts). */
+    readonly createAccount: CreateAccount;
+    readonly grantPath: Pick<IamPolicyGrantPath, "grant">;
+    /** The composed ring; undefined when the server trusts every request. */
+    readonly keys: PlatformTokenKeyRing | undefined;
+    readonly logger: Logger;
+    readonly now: () => Date;
+}
+export declare function mintUserToken(deps: PlatformClientMintDeps, request: MintUserTokenRequest): Promise<MintUserTokenResponse>;
+/** `stgm_pc|<org>|<user_id>`, each part non-blank and free of the separator. */
+export declare function platformClientSubject(org: string, externalUserId: string): string;
+//# sourceMappingURL=mint.d.ts.map

package/dist/domain/platformclient/mint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mint.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/mint.ts"],"names":[],"mappings":"AAwDA,OAAO,KAAK,EACV,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,2DAA2D,CAAC;AAInE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAKnD,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAMrE,OAAO,KAAK,EACV,aAAa,EAEd,MAAM,oCAAoC,CAAC;AAE5C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAiBxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAQtD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,aAAa,CAAC,CAAC;IAC7D,qFAAqF;IACrF,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACtD,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC;CAC1B;AASD,wBAAsB,aAAa,CACjC,IAAI,EAAE,sBAAsB,EAC5B,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAmDhC;AA8LD,gFAAgF;AAChF,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,GACrB,MAAM,CAIR"}

package/dist/domain/platformclient/mint.js

@@ -0,0 +1,254 @@
+/**
+ * The PlatformClient mint: `mintUserToken`, the public RPC a platform's
+ * backend calls with its client_id + client_secret and one of its users,
+ * answered with a short-lived Stigmer user token for that user.
+ *
+ * The contract is the cloud's, refusal for refusal and in the same order
+ * (constants.ts carries the copy): the credentials, then the secret's
+ * expiry (unset means never), then the `org_id` confirmation (a token is
+ * always scoped to the client's owning organization), then the user.
+ *
+ * The user is keyed `stgm_pc|<org>|<user_id>`, so every client of one
+ * organization resolves one user to one account, and that account's id is
+ * derived from the subject (identityaccount/constants.ts accountIdFor). An
+ * account that exists is used as it is — its roles and profile stay what
+ * they are, whatever the client's settings say now — and must have been
+ * provisioned by a platform client: the subject namespace is reserved in
+ * both directions. An account that does not exist is provisioned when the
+ * client allows it, in this order:
+ *
+ *   1. The account's input is built and validated, so nothing below runs
+ *      for a user the create chain would refuse.
+ *   2. When the client auto-grants, the role (viewer by default; never
+ *      owner) is granted on the owning organization to the DERIVED account
+ *      id, before the account row exists. The grant path is idempotent.
+ *   3. The account is created through the identity-account domain's one
+ *      create path, in `platform_client` mode. A concurrent first mint that
+ *      won the race is read back.
+ *
+ * Granting first is what makes every failure retry-safe with nothing to
+ * undo: a failed grant has written nothing; a failed create leaves one
+ * policy row naming an account that does not exist yet, which the next
+ * mint for that user completes. Creating first would need a rollback, and
+ * a rollback that fails leaves an account that can never receive its role
+ * (the existing-account arm never grants).
+ *
+ * Who acts: the request is public and tokenless, so the chain stamped the
+ * trusted-local operator on it — this module never reads that caller. The
+ * account and the policy are written as the CLIENT (`serverActingFor`, an
+ * `internal` caller naming the client's id), so the audit says which
+ * platform client brought the user in. End users are not people on the
+ * install: the membership rules never run for them (the create path is
+ * called directly, and identity-account provisioning's hook is not), and
+ * the boot reconciliation skips their mode (iampolicy/membership.ts).
+ *
+ * The email and name in the token and on the account are the platform's
+ * assertion; nothing on the server derives authority from either.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { create } from "@bufbuild/protobuf";
+import { timestampDate } from "@bufbuild/protobuf/wkt";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
+import { IdentityAccountSpecSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/spec_pb";
+import { MintUserTokenResponseSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/token_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { internalError } from "../../pipeline/errors.js";
+import { serverActingFor } from "../../pipeline/interceptors/auth.js";
+import { validator } from "../../pipeline/steps/validation.js";
+import { canSign, } from "../../platformtoken/key-ring.js";
+import { signPlatformToken } from "../../platformtoken/envelope.js";
+import { organizationRole } from "../iampolicy/specs.js";
+import { PLATFORM_CLIENT_SUBJECT_PREFIX, accountIdFor, } from "../identityaccount/constants.js";
+import { resolveCreateRace } from "../identityaccount/provisioning.js";
+import { BEARER_TOKEN_TYPE, EXPIRED_CLIENT_SECRET_MESSAGE, INVALID_CLIENT_CREDENTIALS_MESSAGE, MINTING_DISABLED_MESSAGE, MINTING_REQUIRES_AUTHENTICATION_MESSAGE, OWNER_AUTO_GRANT_MESSAGE, PROVISIONING_FAILED_MESSAGE, USER_TOKEN_CLAIMS, blankSubjectPartMessage, foreignAccountMessage, noAccountMessage, organizationMismatchMessage, subjectSeparatorMessage, } from "./constants.js";
+import { secretMatchesHash } from "./credentials.js";
+/** The separator of the composite subject; neither part may contain it. */
+const SUBJECT_SEPARATOR = "|";
+/** The role an auto-grant gives when the client leaves it unspecified (the proto's default). */
+const DEFAULT_AUTO_GRANT_ROLE = IamRole.viewer;
+export async function mintUserToken(deps, request) {
+    const keys = deps.keys;
+    if (keys === undefined) {
+        throw new ConnectError(MINTING_REQUIRES_AUTHENTICATION_MESSAGE, Code.FailedPrecondition);
+    }
+    if (!canSign(keys)) {
+        throw new ConnectError(MINTING_DISABLED_MESSAGE, Code.FailedPrecondition);
+    }
+    const client = await authenticateClient(deps, request);
+    const owningOrg = client.metadata?.org ?? "";
+    // A confirmation, never a selector: a token is scoped to the owning org.
+    if (request.orgId !== "" && request.orgId !== owningOrg) {
+        throw new ConnectError(organizationMismatchMessage(owningOrg), Code.InvalidArgument);
+    }
+    const user = {
+        externalUserId: request.userId,
+        email: request.userEmail,
+        name: request.userName,
+    };
+    const accountId = await resolveOrProvisionAccount(deps, client, owningOrg, user);
+    const signed = signPlatformToken(keys, {
+        [USER_TOKEN_CLAIMS.subject]: accountId,
+        [USER_TOKEN_CLAIMS.externalUserId]: user.externalUserId,
+        [USER_TOKEN_CLAIMS.email]: user.email,
+        [USER_TOKEN_CLAIMS.name]: user.name,
+        [USER_TOKEN_CLAIMS.org]: owningOrg,
+        [USER_TOKEN_CLAIMS.platformClientId]: client.metadata?.id ?? "",
+    }, { now: deps.now() });
+    return create(MintUserTokenResponseSchema, {
+        accessToken: signed.token,
+        tokenType: BEARER_TOKEN_TYPE,
+        expiresIn: keys.ttlSeconds,
+    });
+}
+/**
+ * The client the credentials name, or UNAUTHENTICATED with one copy for an
+ * unknown client_id and a wrong secret alike; then the secret's expiry.
+ */
+async function authenticateClient(deps, request) {
+    let client;
+    try {
+        client = await deps.clients.findByClientId(request.clientId);
+    }
+    catch (error) {
+        throw internalError(error, "failed to authenticate platform client");
+    }
+    if (client === undefined ||
+        !secretMatchesHash(request.clientSecret, client.spec?.clientSecretHash ?? "")) {
+        throw new ConnectError(INVALID_CLIENT_CREDENTIALS_MESSAGE, Code.Unauthenticated);
+    }
+    const spec = client.spec;
+    if (spec?.neverExpires !== true &&
+        spec?.expiresAt !== undefined &&
+        deps.now().getTime() > timestampDate(spec.expiresAt).getTime()) {
+        throw new ConnectError(EXPIRED_CLIENT_SECRET_MESSAGE, Code.FailedPrecondition);
+    }
+    return client;
+}
+/** The account id for the user: the existing platform-client account, or one provisioned now. */
+async function resolveOrProvisionAccount(deps, client, org, user) {
+    const idpId = platformClientSubject(org, user.externalUserId);
+    const existing = await findAccount(deps, idpId);
+    if (existing !== undefined) {
+        return platformClientAccountId(existing, user, org);
+    }
+    const spec = client.spec;
+    if (spec?.autoProvisionAccounts !== true) {
+        throw new ConnectError(noAccountMessage(user.externalUserId, org), Code.FailedPrecondition);
+    }
+    const input = accountInput(idpId, org, user);
+    const actor = serverActingFor(client.metadata?.id ?? "");
+    if (spec.autoGrantOnOrg) {
+        await grantAutoRole(deps, client, org, accountIdFor(idpId), actor);
+    }
+    try {
+        const created = await deps.createAccount(input, actor);
+        return created.metadata?.id ?? "";
+    }
+    catch (error) {
+        const winner = await resolveCreateRace(error, () => deps.accounts.findByIdpId(idpId));
+        return platformClientAccountId(winner, user, org);
+    }
+}
+/** The account under the subject, any mode; a store fault is INTERNAL, never "no account". */
+async function findAccount(deps, idpId) {
+    try {
+        return await deps.accounts.findByIdpId(idpId);
+    }
+    catch (error) {
+        throw internalError(error, "failed to resolve platform client user");
+    }
+}
+/**
+ * The account's id, when a platform client provisioned it: a row under a
+ * `stgm_pc|` subject in any other mode is refused rather than minted for.
+ */
+function platformClientAccountId(account, user, org) {
+    if (account.spec?.provisioningMode !==
+        IdentityAccountProvisioningMode.platform_client) {
+        throw new ConnectError(foreignAccountMessage(user.externalUserId, org), Code.FailedPrecondition);
+    }
+    return account.metadata?.id ?? "";
+}
+/**
+ * The account the create path will write, validated now so no grant is
+ * written for a user the chain would refuse. The cloud's shape: named by
+ * the email, else the external id; first and last name split from the
+ * display name at its first space, else the email's local part.
+ */
+function accountInput(idpId, org, user) {
+    const input = {
+        name: user.email !== "" ? user.email : user.externalUserId,
+        spec: create(IdentityAccountSpecSchema, {
+            idpId,
+            email: user.email,
+            ...splitName(user.name, user.email),
+        }),
+        provisioning: { mode: "platform_client", org },
+    };
+    const result = validator().validate(IdentityAccountSchema, create(IdentityAccountSchema, {
+        apiVersion: "iam.stigmer.ai/v1",
+        kind: "IdentityAccount",
+        metadata: { name: input.name, org },
+        spec: input.spec,
+    }));
+    if (result.kind === "invalid") {
+        throw new ConnectError(result.error.message, Code.InvalidArgument);
+    }
+    if (result.kind === "error") {
+        throw new ConnectError(`validation could not run: ${result.error.message}`, Code.Internal);
+    }
+    return input;
+}
+/**
+ * Grants the client's auto-grant role on the owning organization to the
+ * derived account id, as the client. Owner is refused here too: the
+ * contract refuses it on every write since this release, and a row stored
+ * before that must still never make an end user an owner.
+ */
+async function grantAutoRole(deps, client, org, accountId, actor) {
+    const configured = client.spec?.autoGrantRole ?? IamRole.iam_role_unspecified;
+    if (configured === IamRole.owner) {
+        throw new ConnectError(OWNER_AUTO_GRANT_MESSAGE, Code.InvalidArgument);
+    }
+    const role = configured === IamRole.iam_role_unspecified
+        ? DEFAULT_AUTO_GRANT_ROLE
+        : configured;
+    try {
+        await deps.grantPath.grant(organizationRole(accountId, role, org), actor);
+    }
+    catch (error) {
+        deps.logger.error("platform client auto-grant failed; nothing was provisioned", {
+            accountId,
+            platformClientId: client.metadata?.id ?? "",
+            error: error instanceof Error ? error.message : String(error),
+        });
+        throw new ConnectError(PROVISIONING_FAILED_MESSAGE, Code.Internal);
+    }
+}
+/** `stgm_pc|<org>|<user_id>`, each part non-blank and free of the separator. */
+export function platformClientSubject(org, externalUserId) {
+    requireSubjectPart("org", org);
+    requireSubjectPart("externalUserId", externalUserId);
+    return `${PLATFORM_CLIENT_SUBJECT_PREFIX}${org}${SUBJECT_SEPARATOR}${externalUserId}`;
+}
+function requireSubjectPart(part, value) {
+    if (value.trim() === "") {
+        throw new ConnectError(blankSubjectPartMessage(part), Code.InvalidArgument);
+    }
+    if (value.includes(SUBJECT_SEPARATOR)) {
+        throw new ConnectError(subjectSeparatorMessage(part, value), Code.InvalidArgument);
+    }
+}
+/** The cloud's name split: the display name at its first space, else the email's local part. */
+function splitName(name, email) {
+    if (name !== "") {
+        const space = name.indexOf(" ");
+        return space > 0
+            ? { firstName: name.slice(0, space), lastName: name.slice(space + 1) }
+            : { firstName: name, lastName: "" };
+    }
+    const at = email.indexOf("@");
+    return { firstName: at >= 0 ? email.slice(0, at) : email, lastName: "" };
+}
+//# sourceMappingURL=mint.js.map

package/dist/domain/platformclient/mint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mint.js","sourceRoot":"","sources":["../../../src/domain/platformclient/mint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AAEjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAC5G,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AAMtG,OAAO,EAAE,2BAA2B,EAAE,MAAM,2DAA2D,CAAC;AACxG,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAIpE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,EACL,OAAO,GAER,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EACL,8BAA8B,EAC9B,YAAY,GACb,MAAM,iCAAiC,CAAC;AAKzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAEvE,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,kCAAkC,EAClC,wBAAwB,EACxB,uCAAuC,EACvC,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,EAChB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,gGAAgG;AAChG,MAAM,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC;AAsB/C,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAA4B,EAC5B,OAA6B;IAE7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,YAAY,CACpB,uCAAuC,EACvC,IAAI,CAAC,kBAAkB,CACxB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IAC7C,yEAAyE;IACzE,IAAI,OAAO,CAAC,KAAK,KAAK,EAAE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,IAAI,YAAY,CACpB,2BAA2B,CAAC,SAAS,CAAC,EACtC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAY;QACpB,cAAc,EAAE,OAAO,CAAC,MAAM;QAC9B,KAAK,EAAE,OAAO,CAAC,SAAS;QACxB,IAAI,EAAE,OAAO,CAAC,QAAQ;KACvB,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAC/C,IAAI,EACJ,MAAM,EACN,SAAS,EACT,IAAI,CACL,CAAC;IAEF,MAAM,MAAM,GAAG,iBAAiB,CAC9B,IAAI,EACJ;QACE,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,SAAS;QACtC,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,cAAc;QACvD,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK;QACrC,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;QACnC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,SAAS;QAClC,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;KAChE,EACD,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CACpB,CAAC;IACF,OAAO,MAAM,CAAC,2BAA2B,EAAE;QACzC,WAAW,EAAE,MAAM,CAAC,KAAK;QACzB,SAAS,EAAE,iBAAiB;QAC5B,SAAS,EAAE,IAAI,CAAC,UAAU;KAC3B,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,kBAAkB,CAC/B,IAA4B,EAC5B,OAA6B;IAE7B,IAAI,MAAkC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,wCAAwC,CAAC,CAAC;IACvE,CAAC;IACD,IACE,MAAM,KAAK,SAAS;QACpB,CAAC,iBAAiB,CAChB,OAAO,CAAC,YAAY,EACpB,MAAM,CAAC,IAAI,EAAE,gBAAgB,IAAI,EAAE,CACpC,EACD,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,kCAAkC,EAClC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IACE,IAAI,EAAE,YAAY,KAAK,IAAI;QAC3B,IAAI,EAAE,SAAS,KAAK,SAAS;QAC7B,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAC9D,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,kBAAkB,CACxB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iGAAiG;AACjG,KAAK,UAAU,yBAAyB,CACtC,IAA4B,EAC5B,MAAsB,EACtB,GAAW,EACX,IAAa;IAEb,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,uBAAuB,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,IAAI,EAAE,qBAAqB,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,YAAY,CACpB,gBAAgB,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,EAC1C,IAAI,CAAC,kBAAkB,CACxB,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzD,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,CACjD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CACjC,CAAC;QACF,OAAO,uBAAuB,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,KAAK,UAAU,WAAW,CACxB,IAA4B,EAC5B,KAAa;IAEb,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,wCAAwC,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAC9B,OAAwB,EACxB,IAAa,EACb,GAAW;IAEX,IACE,OAAO,CAAC,IAAI,EAAE,gBAAgB;QAC9B,+BAA+B,CAAC,eAAe,EAC/C,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,EAC/C,IAAI,CAAC,kBAAkB,CACxB,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CACnB,KAAa,EACb,GAAW,EACX,IAAa;IAEb,MAAM,KAAK,GAAuB;QAChC,IAAI,EAAE,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc;QAC1D,IAAI,EAAE,MAAM,CAAC,yBAAyB,EAAE;YACtC,KAAK;YACL,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;SACpC,CAAC;QACF,YAAY,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE;KAC/C,CAAC;IACF,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC,QAAQ,CACjC,qBAAqB,EACrB,MAAM,CAAC,qBAAqB,EAAE;QAC5B,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE;QACnC,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,CACH,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,YAAY,CACpB,6BAA6B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACnD,IAAI,CAAC,QAAQ,CACd,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAC1B,IAA4B,EAC5B,MAAsB,EACtB,GAAW,EACX,SAAiB,EACjB,KAAqB;IAErB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,aAAa,IAAI,OAAO,CAAC,oBAAoB,CAAC;IAC9E,IAAI,UAAU,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GACR,UAAU,KAAK,OAAO,CAAC,oBAAoB;QACzC,CAAC,CAAC,uBAAuB;QACzB,CAAC,CAAC,UAAU,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,4DAA4D,EAC5D;YACE,SAAS;YACT,gBAAgB,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;YAC3C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;QACF,MAAM,IAAI,YAAY,CAAC,2BAA2B,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CACnC,GAAW,EACX,cAAsB;IAEtB,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/B,kBAAkB,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IACrD,OAAO,GAAG,8BAA8B,GAAG,GAAG,GAAG,iBAAiB,GAAG,cAAc,EAAE,CAAC;AACxF,CAAC;AAED,SAAS,kBAAkB,CACzB,IAA8B,EAC9B,KAAa;IAEb,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,YAAY,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,YAAY,CACpB,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,EACpC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,SAAS,SAAS,CAChB,IAAY,EACZ,KAAa;IAEb,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,KAAK,GAAG,CAAC;YACd,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE;YACtE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC3E,CAAC"}

package/dist/domain/platformclient/origin-guard.d.ts

@@ -0,0 +1,9 @@
+import type { Logger } from "../../boot/logger.js";
+import type { CallerGuard } from "../../extensions/caller-guards.js";
+import type { PlatformClientStore } from "./store.js";
+export interface PlatformClientOriginGuardDeps {
+    readonly clients: Pick<PlatformClientStore, "findById">;
+    readonly logger: Logger;
+}
+export declare function newPlatformClientOriginGuard(deps: PlatformClientOriginGuardDeps): CallerGuard;
+//# sourceMappingURL=origin-guard.d.ts.map

package/dist/domain/platformclient/origin-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin-guard.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/origin-guard.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAYrE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAKtD,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,6BAA6B,GAClC,WAAW,CAmCb"}

package/dist/domain/platformclient/origin-guard.js

@@ -0,0 +1,81 @@
+/**
+ * The PlatformClient origin guard: a request bearing a user token minted by
+ * a client that lists `allowed_origins` must come from one of them. The
+ * check needs the request's headers, which a verifier never sees, so it is
+ * a caller guard (extensions/caller-guards.ts) — open source's own,
+ * composed before any extension's.
+ *
+ * The rule, the cloud's since the Java service (spec.proto's field doc):
+ *   - no `Origin` header, or a blank one: allowed — only browsers send
+ *     Origin, and the control is a browser-context defense against a
+ *     leaked token replayed from another site's page. The guard reads no
+ *     client for such a request, so server-to-server callers pay nothing;
+ *   - an empty `allowed_origins`: allowed (open mode);
+ *   - otherwise the origin must match an entry case-insensitively (RFC 6454
+ *     comparison), and the opaque origin "null" never matches.
+ * A refusal is PERMISSION_DENIED with the cloud's copy, logged with the
+ * procedure, the client and the origin.
+ *
+ * Only the untyped user token is the guard's: the claims are read from the
+ * token the verifier chain already verified on this request (the pattern
+ * caller-guards.ts prescribes), and any other credential — an API key, an
+ * OIDC token, a typed platform token — passes untouched. Liveness is not
+ * re-checked here beyond the one read the origin needs: the verifier
+ * refused a deleted client already, and a client deleted since is refused
+ * the same way, fail closed.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { TOKEN_TYPE_CLAIM, decodeVerifiedPlatformTokenPayload, stringClaim, } from "../../platformtoken/envelope.js";
+import { DELETED_CLIENT_MESSAGE, USER_TOKEN_CLAIMS, originRefusalMessage, } from "./constants.js";
+/** The opaque-origin serialization, which never matches a listed origin. */
+const OPAQUE_ORIGIN = "null";
+export function newPlatformClientOriginGuard(deps) {
+    return {
+        name: "platform-client-origin",
+        async guard(caller, method, headers) {
+            const origin = headers.get("origin") ?? "";
+            if (origin.trim() === "") {
+                return;
+            }
+            const platformClientId = mintingClientOf(caller);
+            if (platformClientId === undefined) {
+                return;
+            }
+            const procedure = `/${method.parent.typeName}/${method.name}`;
+            const client = await deps.clients.findById(platformClientId);
+            if (client === undefined) {
+                throw new ConnectError(DELETED_CLIENT_MESSAGE, Code.Unauthenticated);
+            }
+            if (originAllowed(origin, client.spec?.allowedOrigins ?? [])) {
+                return;
+            }
+            deps.logger.warn("origin refusal: origin not in allowed_origins", {
+                procedure,
+                platformClientId,
+                origin,
+            });
+            throw new ConnectError(originRefusalMessage(origin), Code.PermissionDenied);
+        },
+    };
+}
+/** The minting client of an untyped platform user token; undefined for every other credential. */
+function mintingClientOf(caller) {
+    const payload = decodeVerifiedPlatformTokenPayload(caller.rawToken);
+    if (payload === undefined ||
+        stringClaim(payload, TOKEN_TYPE_CLAIM) !== undefined) {
+        return undefined;
+    }
+    return stringClaim(payload, USER_TOKEN_CLAIMS.platformClientId);
+}
+/** The cloud's origin rule for a non-blank Origin (see the header). */
+function originAllowed(origin, allowed) {
+    if (allowed.length === 0) {
+        return true;
+    }
+    if (origin === OPAQUE_ORIGIN) {
+        return false;
+    }
+    const presented = origin.toLowerCase();
+    return allowed.some((entry) => entry.toLowerCase() === presented);
+}
+//# sourceMappingURL=origin-guard.js.map

package/dist/domain/platformclient/origin-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin-guard.js","sourceRoot":"","sources":["../../../src/domain/platformclient/origin-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAMzD,OAAO,EACL,gBAAgB,EAChB,kCAAkC,EAClC,WAAW,GACZ,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAGxB,4EAA4E;AAC5E,MAAM,aAAa,GAAG,MAAM,CAAC;AAO7B,MAAM,UAAU,4BAA4B,CAC1C,IAAmC;IAEnC,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,KAAK,CAAC,KAAK,CACT,MAAsB,EACtB,MAAkB,EAClB,OAAgB;YAEhB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC3C,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnC,OAAO;YACT,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;YAC7D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,YAAY,CAAC,sBAAsB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,cAAc,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC7D,OAAO;YACT,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;gBAChE,SAAS;gBACT,gBAAgB;gBAChB,MAAM;aACP,CAAC,CAAC;YACH,MAAM,IAAI,YAAY,CACpB,oBAAoB,CAAC,MAAM,CAAC,EAC5B,IAAI,CAAC,gBAAgB,CACtB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,SAAS,eAAe,CAAC,MAAsB;IAC7C,MAAM,OAAO,GAAG,kCAAkC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpE,IACE,OAAO,KAAK,SAAS;QACrB,WAAW,CAAC,OAAO,EAAE,gBAAgB,CAAC,KAAK,SAAS,EACpD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,EAAE,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;AAClE,CAAC;AAED,uEAAuE;AACvE,SAAS,aAAa,CACpB,MAAc,EACd,OAA8B;IAE9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACvC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,CAAC;AACpE,CAAC"}

package/dist/domain/platformclient/resource-store.d.ts

@@ -0,0 +1,4 @@
+import type { Store } from "../../store/interface.js";
+import type { PlatformClientStore } from "./store.js";
+export declare function newResourcePlatformClientStore(store: Store): PlatformClientStore;
+//# sourceMappingURL=resource-store.d.ts.map

package/dist/domain/platformclient/resource-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-store.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/resource-store.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAItD,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,KAAK,GACX,mBAAmB,CA0GrB"}

package/dist/domain/platformclient/resource-store.js

@@ -0,0 +1,117 @@
+/**
+ * The open-source PlatformClientStore: the port (store.ts) over the
+ * generic Store, rows of the `resources` table by kind. The composition
+ * root installs it when no extension registers `drivers.platformClientStore`.
+ *
+ * `findById` is a primary-key read, the one lookup on a per-request path
+ * (the verifier's liveness read, the origin guard). The other three scan
+ * the kind: `findByClientId` through Store.findByField (ApiKey's lookup,
+ * domain/apikey/lookup.ts: a decode-and-scan per mint, watched by
+ * stigmer#987), `findByOrg` by listing the kind, and `findByOrgAndSlug`
+ * over that listing — an exact pair, unlike the shared slug helper, whose
+ * empty org matches every organization. A
+ * PlatformClient census is a handful of rows per organization, and none of
+ * the three sits on a per-request path.
+ *
+ * `save` and `update` are read-then-write because the generic Store's
+ * saveResource is an upsert with neither a create-only nor an update-only
+ * form — the identity-account adapter's posture, with its reasoning
+ * (domain/identityaccount/resource-store.ts): `save` refuses a held id,
+ * (org, slug) or client_id; `update` writes nothing for an unknown id; the
+ * residual window between the read and the write is the platform-wide
+ * CheckDuplicate-then-upsert window, not this adapter's to close.
+ *
+ * Store faults follow the ratified mapping: a typed ResourceNotFoundError
+ * reads as `undefined`; anything else propagates — an outage must never
+ * read as "no client", which on the verifier's path would revoke every
+ * live token.
+ */
+import { fromBinary } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { PlatformClientSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+import { ResourceNotFoundError } from "../../store/interface.js";
+import { DuplicatePlatformClientError } from "./store.js";
+const KIND = ApiResourceKind.platform_client;
+export function newResourcePlatformClientStore(store) {
+    async function readById(id) {
+        try {
+            return await store.getResource(KIND, id, PlatformClientSchema);
+        }
+        catch (error) {
+            if (error instanceof ResourceNotFoundError) {
+                return undefined;
+            }
+            throw error;
+        }
+    }
+    async function readByClientId(clientId) {
+        if (clientId === "") {
+            return undefined;
+        }
+        try {
+            return await store.findByField(KIND, "spec.clientId", clientId, PlatformClientSchema);
+        }
+        catch (error) {
+            if (error instanceof ResourceNotFoundError) {
+                return undefined;
+            }
+            throw error;
+        }
+    }
+    /** Every client of the organization; a row that does not decode is skipped, as every scan does. */
+    async function listOrg(org) {
+        const clients = [];
+        for (const data of await store.listResources(KIND)) {
+            let client;
+            try {
+                client = fromBinary(PlatformClientSchema, data);
+            }
+            catch {
+                continue;
+            }
+            if ((client.metadata?.org ?? "") === org) {
+                clients.push(client);
+            }
+        }
+        return clients;
+    }
+    /** The exact (org, slug) pair — an empty org is no wildcard here. */
+    async function readByOrgAndSlug(org, slug) {
+        if (org === "" || slug === "") {
+            return undefined;
+        }
+        return (await listOrg(org)).find((client) => (client.metadata?.slug ?? "") === slug);
+    }
+    return {
+        async save(client) {
+            const id = client.metadata?.id ?? "";
+            const org = client.metadata?.org ?? "";
+            const slug = client.metadata?.slug ?? "";
+            if ((await readById(id)) !== undefined) {
+                throw new DuplicatePlatformClientError(`platform client '${id}' already exists`);
+            }
+            if ((await readByOrgAndSlug(org, slug)) !== undefined) {
+                throw new DuplicatePlatformClientError(`platform client '${org}/${slug}' already exists`);
+            }
+            if ((await readByClientId(client.spec?.clientId ?? "")) !== undefined) {
+                throw new DuplicatePlatformClientError("a platform client already holds this client_id");
+            }
+            await store.saveResource(KIND, id, PlatformClientSchema, client);
+        },
+        async update(client) {
+            const id = client.metadata?.id ?? "";
+            if ((await readById(id)) === undefined) {
+                return;
+            }
+            await store.saveResource(KIND, id, PlatformClientSchema, client);
+        },
+        async deleteById(id) {
+            await store.deleteResource(KIND, id);
+        },
+        findById: readById,
+        findByClientId: readByClientId,
+        findByOrgAndSlug: readByOrgAndSlug,
+        findByOrg: listOrg,
+    };
+}
+//# sourceMappingURL=resource-store.js.map

package/dist/domain/platformclient/resource-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-store.js","sourceRoot":"","sources":["../../../src/domain/platformclient/resource-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yDAAyD,CAAC;AAE/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAG1D,MAAM,IAAI,GAAG,eAAe,CAAC,eAAe,CAAC;AAE7C,MAAM,UAAU,8BAA8B,CAC5C,KAAY;IAEZ,KAAK,UAAU,QAAQ,CAAC,EAAU;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,oBAAoB,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,UAAU,cAAc,CAC3B,QAAgB;QAEhB,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,WAAW,CAC5B,IAAI,EACJ,eAAe,EACf,QAAQ,EACR,oBAAoB,CACrB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,mGAAmG;IACnG,KAAK,UAAU,OAAO,CAAC,GAAW;QAChC,MAAM,OAAO,GAAqB,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,IAAI,MAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,UAAU,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,qEAAqE;IACrE,KAAK,UAAU,gBAAgB,CAC7B,GAAW,EACX,IAAY;QAEZ,IAAI,GAAG,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAC9B,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,KAAK,IAAI,CACnD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,4BAA4B,CACpC,oBAAoB,EAAE,kBAAkB,CACzC,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACtD,MAAM,IAAI,4BAA4B,CACpC,oBAAoB,GAAG,IAAI,IAAI,kBAAkB,CAClD,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACtE,MAAM,IAAI,4BAA4B,CACpC,gDAAgD,CACjD,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAC;QACnE,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,OAAO;YACT,CAAC;YACD,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAC;QACnE,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE;YACjB,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC;QAED,QAAQ,EAAE,QAAQ;QAElB,cAAc,EAAE,cAAc;QAE9B,gBAAgB,EAAE,gBAAgB;QAElC,SAAS,EAAE,OAAO;KACnB,CAAC;AACJ,CAAC"}