@stigmer/server 3.24.0 → 3.25.0

package/dist/domain/platformclient/store.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The PlatformClientStore PORT: the storage contract the platform-client
+ * domain writes and reads through, so the cloud serves the same chains
+ * over its own `cloud.iam_platform_client` table by registering an
+ * implementation as `drivers.platformClientStore` (the identity-account
+ * and IamPolicy precedent: a port for an IAM kind whose rows an edition
+ * keeps in its own table). Open source's implementation is
+ * resource-store.ts over the generic Store.
+ *
+ * The methods are exactly the lookups the domain asks: by id (every
+ * chain, and the verifier's liveness read), by client_id (the mint), by
+ * org-scoped slug (getByReference, update addressed by slug, the
+ * duplicate check), by organization (listByOrg). A port carries nothing
+ * only one edition calls.
+ *
+ * Contract every implementation must satisfy — proven by the port-contract
+ * kit (store-contract.ts, exported), which the OSS adapter's test iterates
+ * on both drivers and a composition's driver test iterates too:
+ *   - `save` is create-only in effect: a held id, a held (org, slug) or a
+ *     held client_id raises DuplicatePlatformClientError, never a silent
+ *     overwrite;
+ *   - `update` replaces by id and never creates: an unknown id writes
+ *     nothing;
+ *   - `deleteById` of an unknown id resolves;
+ *   - `findByOrg` answers every client of the organization and no other,
+ *     in no promised order (the chain sorts);
+ *   - a typed not-found reads as `undefined`; any other storage failure
+ *     propagates as the infrastructure fault it is (the ratified
+ *     store-fault mapping — an outage must never read as "no client", which
+ *     on the verifier's path would revoke every live token).
+ */
+import type { PlatformClient } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+/**
+ * Raised by `save` when the id, the (org, slug) pair or the client_id is
+ * already held, so the create chain answers ALREADY_EXISTS. `cause`
+ * carries a driver's own error (the cloud's SQLSTATE 23505) for the logs;
+ * the message is the port's.
+ */
+export declare class DuplicatePlatformClientError extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+export interface PlatformClientStore {
+    /** Insert; a held id, (org, slug) or client_id raises DuplicatePlatformClientError. */
+    save(client: PlatformClient): Promise<void>;
+    /** Full-row replace by id; an unknown id writes nothing. */
+    update(client: PlatformClient): Promise<void>;
+    /** Removes the row; no error when it does not exist. */
+    deleteById(id: string): Promise<void>;
+    findById(id: string): Promise<PlatformClient | undefined>;
+    /** The client holding this public identifier — the mint's lookup. */
+    findByClientId(clientId: string): Promise<PlatformClient | undefined>;
+    findByOrgAndSlug(org: string, slug: string): Promise<PlatformClient | undefined>;
+    /** Every client of the organization, in no promised order. */
+    findByOrg(org: string): Promise<ReadonlyArray<PlatformClient>>;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/domain/platformclient/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAE9F;;;;;GAKG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAED,MAAM,WAAW,mBAAmB;IAClC,uFAAuF;IACvF,IAAI,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,4DAA4D;IAC5D,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,wDAAwD;IACxD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAC1D,qEAAqE;IACrE,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACtE,gBAAgB,CACd,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACvC,8DAA8D;IAC9D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;CAChE"}

package/dist/domain/platformclient/store.js

@@ -0,0 +1,13 @@
+/**
+ * Raised by `save` when the id, the (org, slug) pair or the client_id is
+ * already held, so the create chain answers ALREADY_EXISTS. `cause`
+ * carries a driver's own error (the cloud's SQLSTATE 23505) for the logs;
+ * the message is the port's.
+ */
+export class DuplicatePlatformClientError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "DuplicatePlatformClientError";
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/domain/platformclient/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/domain/platformclient/store.ts"],"names":[],"mappings":"AAiCA;;;;;GAKG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF"}

package/dist/domain/platformclient/system-managed.d.ts

@@ -0,0 +1,18 @@
+import type { PlatformClient } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+export interface SystemManagedPlatformClientInput {
+    /** The owning organization. */
+    readonly org: string;
+    /** A reserved slug (RESERVED_PLATFORM_CLIENT_SLUGS); anything else throws. */
+    readonly slug: string;
+    /** The display name a console would show. */
+    readonly name: string;
+    /** The creation instant stamped on both audit slots; defaults to the wall clock. */
+    readonly now?: Date;
+}
+/**
+ * A new system-managed client, ready for a store's `save`. Throws on an
+ * empty organization or a slug that is not reserved — an edition's
+ * programming error, never a request's.
+ */
+export declare function newSystemManagedPlatformClient(input: SystemManagedPlatformClientInput): PlatformClient;
+//# sourceMappingURL=system-managed.d.ts.map

package/dist/domain/platformclient/system-managed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-managed.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/system-managed.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAsB9F,MAAM,WAAW,gCAAgC;IAC/C,+BAA+B;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,gCAAgC,GACtC,cAAc,CAuChB"}

package/dist/domain/platformclient/system-managed.js

@@ -0,0 +1,80 @@
+/**
+ * The one builder of a system-managed PlatformClient: the row an edition
+ * creates for itself, never through the create chain, so the tokens it
+ * signs on the platform's own behalf (a guest's, a schedule fire's) name a
+ * client that exists. Stigmer Cloud keeps one per organization under
+ * SYSTEM_SHARE_CLIENT_SLUG and persists it through its store driver.
+ *
+ * The domain already owns what such a client is — the create chain refuses
+ * its reserved slug (RefuseReservedSlug) and every mutation refuses its
+ * label (RefuseSystemManaged) — so the row is built here too, and the
+ * rules that make it safe hold by construction:
+ *   - it lives only under a reserved slug, which no user can create, so a
+ *     user client can never be mistaken for one;
+ *   - it carries the reserved `stigmer.ai/system-managed` label, so update,
+ *     delete and rotate refuse it;
+ *   - its credentials are real (a `client_id` unique like any other, a
+ *     hash, a fingerprint), but the secret is discarded here: nobody ever
+ *     authenticates as the platform's own client;
+ *   - its id is spelled like every other (`pcl_` + ULID, generateId);
+ *   - its audit names no actor, because no caller made it: the platform did.
+ *
+ * Who decides when one exists, and where it is stored, is the edition's:
+ * this function writes nothing. It writes no authorization tuples either —
+ * nothing authorizes against a system-managed client, and with none it
+ * stays out of every list and reference read a person makes.
+ */
+import { create } from "@bufbuild/protobuf";
+import { timestampFromDate } from "@bufbuild/protobuf/wkt";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceAuditInfoSchema, ApiResourceAuditSchema, } from "@stigmer/protos/ai/stigmer/commons/apiresource/status_pb";
+import { PlatformClientSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+import { RESERVED_LABEL_TRUE, SYSTEM_MANAGED_LABEL, } from "../../pipeline/apiresource-labels.js";
+import { defaultVisibilityFor, getIdPrefix, } from "../../pipeline/apiresource-meta.js";
+import { generateId } from "../../pipeline/steps/defaults.js";
+import { PLATFORM_CLIENT_KIND_NAME, RESERVED_PLATFORM_CLIENT_SLUGS, } from "./constants.js";
+import { generateClientId, generateClientSecret, hashClientSecret, secretFingerprint, } from "./credentials.js";
+/**
+ * A new system-managed client, ready for a store's `save`. Throws on an
+ * empty organization or a slug that is not reserved — an edition's
+ * programming error, never a request's.
+ */
+export function newSystemManagedPlatformClient(input) {
+    if (input.org === "") {
+        throw new Error("a system-managed platform client needs an organization");
+    }
+    if (!RESERVED_PLATFORM_CLIENT_SLUGS.has(input.slug)) {
+        throw new Error(`'${input.slug}' is not a reserved platform-client slug; a system-managed client lives only under one (${[...RESERVED_PLATFORM_CLIENT_SLUGS].join(", ")})`);
+    }
+    const secret = generateClientSecret();
+    const created = timestampFromDate(input.now ?? new Date());
+    const audit = create(ApiResourceAuditInfoSchema, {
+        createdAt: created,
+        updatedAt: created,
+        event: "created",
+    });
+    return create(PlatformClientSchema, {
+        apiVersion: "iam.stigmer.ai/v1",
+        kind: PLATFORM_CLIENT_KIND_NAME,
+        metadata: {
+            id: generateId(getIdPrefix(ApiResourceKind.platform_client)),
+            org: input.org,
+            name: input.name,
+            slug: input.slug,
+            labels: { [SYSTEM_MANAGED_LABEL]: RESERVED_LABEL_TRUE },
+            visibility: defaultVisibilityFor(ApiResourceKind.platform_client),
+        },
+        spec: {
+            clientId: generateClientId(),
+            clientSecretHash: hashClientSecret(secret),
+            secretFingerprint: secretFingerprint(secret),
+        },
+        status: {
+            audit: create(ApiResourceAuditSchema, {
+                specAudit: audit,
+                statusAudit: audit,
+            }),
+        },
+    });
+}
+//# sourceMappingURL=system-managed.js.map

package/dist/domain/platformclient/system-managed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-managed.js","sourceRoot":"","sources":["../../../src/domain/platformclient/system-managed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yDAAyD,CAAC;AAG/F,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,WAAW,GACZ,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAC9D,OAAO,EACL,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAa1B;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAAuC;IAEvC,IAAI,KAAK,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,IAAI,KAAK,CAAC,IAAI,2FAA2F,CAAC,GAAG,8BAA8B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3J,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,0BAA0B,EAAE;QAC/C,SAAS,EAAE,OAAO;QAClB,SAAS,EAAE,OAAO;QAClB,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,oBAAoB,EAAE;QAClC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE;YACR,EAAE,EAAE,UAAU,CAAC,WAAW,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;YAC5D,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,EAAE,CAAC,oBAAoB,CAAC,EAAE,mBAAmB,EAAE;YACvD,UAAU,EAAE,oBAAoB,CAAC,eAAe,CAAC,eAAe,CAAC;SAClE;QACD,IAAI,EAAE;YACJ,QAAQ,EAAE,gBAAgB,EAAE;YAC5B,gBAAgB,EAAE,gBAAgB,CAAC,MAAM,CAAC;YAC1C,iBAAiB,EAAE,iBAAiB,CAAC,MAAM,CAAC;SAC7C;QACD,MAAM,EAAE;YACN,KAAK,EAAE,MAAM,CAAC,sBAAsB,EAAE;gBACpC,SAAS,EAAE,KAAK;gBAChB,WAAW,EAAE,KAAK;aACnB,CAAC;SACH;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/domain/platformclient/token-controller.d.ts

@@ -0,0 +1,11 @@
+import type { ConnectRouter } from "@connectrpc/connect";
+import type { GuestTokenMinting } from "../../extensions/guest-token-minting.js";
+import type { PlatformClientMintDeps } from "./mint.js";
+export interface PlatformClientTokenControllerDeps {
+    readonly mint: PlatformClientMintDeps;
+    /** The composed capability; undefined = mintGuestToken refuses UNIMPLEMENTED. */
+    readonly guestTokenMinting: GuestTokenMinting | undefined;
+}
+/** Registers the token service on the router (routes stage). */
+export declare function registerPlatformClientTokenService(router: ConnectRouter, deps: PlatformClientTokenControllerDeps): void;
+//# sourceMappingURL=token-controller.d.ts.map

package/dist/domain/platformclient/token-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-controller.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/token-controller.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAGjF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAExD,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,iFAAiF;IACjF,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,GAAG,SAAS,CAAC;CAC3D;AAED,gEAAgE;AAChE,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,iCAAiC,GACtC,IAAI,CAaN"}

package/dist/domain/platformclient/token-controller.js

@@ -0,0 +1,32 @@
+/**
+ * PlatformClientTokenController — the two public token RPCs, registered in
+ * every composition so the service has one owner (the routes stage refuses
+ * an extension that registers it again, boot/route-shadowing.ts):
+ *
+ *   - mintUserToken: the PlatformClient mint (mint.ts). Public on the wire
+ *     — the client authenticates with its credentials in the body, not a
+ *     bearer token — so there is no annotation to evaluate; the mint never
+ *     reads the chain's caller.
+ *   - mintGuestToken: the credential-free mint for anonymous visitors of a
+ *     shared agent's hosted page, dispatched to the composed guest-token
+ *     capability (extensions/guest-token-minting.ts). Without one — open
+ *     source hosts no shared-agent pages — it answers UNIMPLEMENTED with
+ *     the edition sentence, the identityFederation absent shape.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { PlatformClientTokenController } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/token_pb";
+import { GUEST_MINT_UNIMPLEMENTED_MESSAGE } from "./constants.js";
+import { mintUserToken } from "./mint.js";
+/** Registers the token service on the router (routes stage). */
+export function registerPlatformClientTokenService(router, deps) {
+    router.service(PlatformClientTokenController, {
+        mintUserToken: (request) => mintUserToken(deps.mint, request),
+        mintGuestToken: (request, ctx) => {
+            if (deps.guestTokenMinting === undefined) {
+                throw new ConnectError(GUEST_MINT_UNIMPLEMENTED_MESSAGE, Code.Unimplemented);
+            }
+            return deps.guestTokenMinting.mintGuestToken(request, ctx.requestHeader);
+        },
+    });
+}
+//# sourceMappingURL=token-controller.js.map

package/dist/domain/platformclient/token-controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-controller.js","sourceRoot":"","sources":["../../../src/domain/platformclient/token-controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,6BAA6B,EAAE,MAAM,2DAA2D,CAAC;AAG1G,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAS1C,gEAAgE;AAChE,MAAM,UAAU,kCAAkC,CAChD,MAAqB,EACrB,IAAuC;IAEvC,MAAM,CAAC,OAAO,CAAC,6BAA6B,EAAE;QAC5C,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QAC7D,cAAc,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;YAC/B,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACzC,MAAM,IAAI,YAAY,CACpB,gCAAgC,EAChC,IAAI,CAAC,aAAa,CACnB,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/domain/platformclient/verifier.d.ts

@@ -0,0 +1,10 @@
+import type { IdentityVerifier } from "../../extensions/identity.js";
+import type { PlatformTokenKeyRing } from "../../platformtoken/key-ring.js";
+import type { PlatformClientStore } from "./store.js";
+export interface PlatformClientTokenVerifierDeps {
+    readonly keys: PlatformTokenKeyRing;
+    readonly clients: Pick<PlatformClientStore, "findById">;
+    readonly now?: () => Date;
+}
+export declare function newPlatformClientTokenVerifier(deps: PlatformClientTokenVerifierDeps): IdentityVerifier;
+//# sourceMappingURL=verifier.d.ts.map

package/dist/domain/platformclient/verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/verifier.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AAOtC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAM5E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,+BAA+B,GACpC,gBAAgB,CA8ClB"}

package/dist/domain/platformclient/verifier.js

@@ -0,0 +1,76 @@
+/**
+ * The PlatformClient user-token verifier: open source's one platform-token
+ * lane. It claims a token with `iss: "stigmer"` and NO `token_type` — the
+ * user token the mint signs — and passes every other token on:
+ *   - a token that is not a platform token is another verifier's (the
+ *     OIDC verifier's, an API key's);
+ *   - a typed platform token (guest, schedule, channel, the sandbox
+ *     family) belongs to the edition that mints it; open source verifies
+ *     only its own vocabulary, and on a server with no verifier for that
+ *     lane the chain refuses it as unclaimed.
+ * A platform token whose signature, expiry, audience or subject fails is
+ * refused here with the envelope's pinned copy, whichever lane it names —
+ * the refusal the cloud's verifier has always answered for it.
+ *
+ * Liveness is the verifier's (not a guard's), so every lane that
+ * authenticates — the serving chain and the extension HTTP edges that run
+ * the verifier chain without guards — refuses a deleted client's tokens on
+ * the next request, with the cloud's copy. A store fault propagates as the
+ * infrastructure fault it is, never as a revocation.
+ *
+ * Composed between `apikey` and `oidc`, only under an authentication
+ * posture (compose.ts): the OIDC verifier claims every JWT-shaped token and
+ * throws on one it cannot verify, so a platform token must be claimed
+ * before it gets there (stigmer#1137's lesson).
+ *
+ * The identity is the account the token was minted for: `sub` IS the
+ * account id (the mint signs it), so no account read is needed; class
+ * `user`, issuer "stigmer", the token carried (the memory-capture gate and
+ * the origin guard read its `platform_client_id`), and the email and name
+ * the platform asserted, for display only.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { PLATFORM_TOKEN_ISSUER, platformTokenRefusalError, stringClaim, verifyPlatformToken, } from "../../platformtoken/envelope.js";
+import { DELETED_CLIENT_MESSAGE, TOKEN_NAMES_NO_CLIENT_MESSAGE, USER_TOKEN_CLAIMS, } from "./constants.js";
+export function newPlatformClientTokenVerifier(deps) {
+    return {
+        name: "platform-client",
+        async verify(token) {
+            const result = verifyPlatformToken(deps.keys, token, deps.now?.());
+            switch (result.outcome) {
+                case "foreign":
+                    return null;
+                case "refused":
+                    throw platformTokenRefusalError(result.refusal);
+                case "verified":
+                    break;
+                default: {
+                    const exhaustive = result;
+                    throw new Error(`unknown verification ${JSON.stringify(exhaustive)}`);
+                }
+            }
+            const verified = result.token;
+            if (verified.tokenType !== undefined) {
+                return null;
+            }
+            const platformClientId = stringClaim(verified.payload, USER_TOKEN_CLAIMS.platformClientId);
+            if (platformClientId === undefined) {
+                throw new ConnectError(TOKEN_NAMES_NO_CLIENT_MESSAGE, Code.Unauthenticated);
+            }
+            if ((await deps.clients.findById(platformClientId)) === undefined) {
+                throw new ConnectError(DELETED_CLIENT_MESSAGE, Code.Unauthenticated);
+            }
+            const email = stringClaim(verified.payload, USER_TOKEN_CLAIMS.email);
+            const displayName = stringClaim(verified.payload, USER_TOKEN_CLAIMS.name);
+            return {
+                identityId: verified.subject,
+                callerClass: "user",
+                issuer: PLATFORM_TOKEN_ISSUER,
+                rawToken: token,
+                ...(email !== undefined ? { email } : {}),
+                ...(displayName !== undefined ? { displayName } : {}),
+            };
+        },
+    };
+}
+//# sourceMappingURL=verifier.js.map

package/dist/domain/platformclient/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../src/domain/platformclient/verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAMzD,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,WAAW,EACX,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AASxB,MAAM,UAAU,8BAA8B,CAC5C,IAAqC;IAErC,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACnE,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;gBACvB,KAAK,SAAS;oBACZ,OAAO,IAAI,CAAC;gBACd,KAAK,SAAS;oBACZ,MAAM,yBAAyB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClD,KAAK,UAAU;oBACb,MAAM;gBACR,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,UAAU,GAAU,MAAM,CAAC;oBACjC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;gBACxE,CAAC;YACH,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC;YAC9B,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,gBAAgB,GAAG,WAAW,CAClC,QAAQ,CAAC,OAAO,EAChB,iBAAiB,CAAC,gBAAgB,CACnC,CAAC;YACF,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBAClE,MAAM,IAAI,YAAY,CAAC,sBAAsB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACrE,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC1E,OAAO;gBACL,UAAU,EAAE,QAAQ,CAAC,OAAO;gBAC5B,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,qBAAqB;gBAC7B,QAAQ,EAAE,KAAK;gBACf,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/encryption/key-manager.d.ts

@@ -13,11 +13,28 @@ export interface KeyLoaderOptions {
     readonly homeDir?: string;
 }
 /**
- * Go GetOrCreateNamedKey: env var → key file → auto-generate. Throws only
- * on unusable EXPLICIT configuration (bad env value) or when no key can be
- * produced at all.
+ * What one kind of key is, for the ladder. `fromEnv` receives the env
+ * value already strictly Base64-decoded and THROWS when the bytes are not
+ * a usable key (explicit configuration is never silently ignored);
+ * `fromFile` answers `undefined` for content it does not accept, so the
+ * ladder falls through exactly as it does for a wrong-sized raw key.
+ */
+export interface KeyCodec<Key> {
+    fromEnv(envVar: string, decoded: Buffer): Key;
+    fromFile(content: Buffer): Key | undefined;
+    generate(): Key;
+    toFile(key: Key): Buffer;
+}
+/** The 32 raw bytes the encryption and runner-token keys are. */
+export declare const RAW_32_BYTE_KEY: KeyCodec<Buffer>;
+/**
+ * Go GetOrCreateNamedKey: env var → key file → auto-generate, for a 32-byte
+ * raw key. Throws only on unusable EXPLICIT configuration (bad env value)
+ * or when no key can be produced at all.
  */
 export declare function getOrCreateNamedKey(envVar: string, fileName: string, options?: KeyLoaderOptions): Buffer;
+/** The ladder over any codec: env var → key file → auto-generate. */
+export declare function getOrCreateKey<Key>(codec: KeyCodec<Key>, envVar: string, fileName: string, options?: KeyLoaderOptions): Key;
 /** Path to a named key file under <home>/.stigmer. */
 export declare function namedKeyFilePath(fileName: string, options?: KeyLoaderOptions): string;
 //# sourceMappingURL=key-manager.d.ts.map

package/dist/encryption/key-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"key-manager.d.ts","sourceRoot":"","sources":["../../src/encryption/key-manager.ts"],"names":[],"mappings":"AAgCA,yEAAyE;AACzE,eAAO,MAAM,QAAQ,KAAK,CAAC;AAE3B,0DAA0D;AAC1D,eAAO,MAAM,YAAY,aAAa,CAAC;AAEvC,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,MAAQ,CAAC;AAE1C,wDAAwD;AACxD,eAAO,MAAM,mBAAmB,MAAQ,CAAC;AAEzC,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,gBAAqB,GAC7B,MAAM,CA2BR;AAoBD,sDAAsD;AACtD,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,gBAAqB,GAC7B,MAAM,CAGR"}
+{"version":3,"file":"key-manager.d.ts","sourceRoot":"","sources":["../../src/encryption/key-manager.ts"],"names":[],"mappings":"AAsCA,yEAAyE;AACzE,eAAO,MAAM,QAAQ,KAAK,CAAC;AAE3B,0DAA0D;AAC1D,eAAO,MAAM,YAAY,aAAa,CAAC;AAEvC,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,MAAQ,CAAC;AAE1C,wDAAwD;AACxD,eAAO,MAAM,mBAAmB,MAAQ,CAAC;AAEzC,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ,CAAC,GAAG;IAC3B,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC;IAC3C,QAAQ,IAAI,GAAG,CAAC;IAChB,MAAM,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC;CAC1B;AAED,iEAAiE;AACjE,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAkB5C,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,gBAAqB,GAC7B,MAAM,CAER;AAED,qEAAqE;AACrE,wBAAgB,cAAc,CAAC,GAAG,EAChC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,gBAAqB,GAC7B,GAAG,CA6BL;AAeD,sDAAsD;AACtD,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,gBAAqB,GAC7B,MAAM,CAGR"}

package/dist/encryption/key-manager.js

@@ -1,20 +1,26 @@
 /**
  * Named-key loader — ports pkg/encryption/keymanager.go.
  *
- * One convention for every 32-byte key the server holds (sub-project
- * DD-002): env var (Base64) → ~/.stigmer/<file> (raw bytes, 0600) →
- * auto-generate and persist. The loader is generalized over the env var
- * and file name so sibling key material (the runner-token signing key,
- * oss#535) rides the same ladder instead of growing a divergent loader.
+ * One convention for every key the server holds: env var (Base64) →
+ * ~/.stigmer/<file> (0600) → auto-generate and persist. The
+ * loader is generalized over the env var, the file name and a KeyCodec so
+ * sibling key material rides the same ladder instead of growing a
+ * divergent loader: the runner-token signing key (oss#535) and the
+ * encryption key are 32 raw bytes (RAW_32_BYTE_KEY); the platform-token
+ * signing key is an RSA private key (platformtoken/key-ring.ts). The codec
+ * says what a key IS — how an env value and a file decode, how one is
+ * generated and written — and nothing about the ladder, which stays one.
  *
- * Ladder semantics, exactly Go's:
+ * Ladder semantics, exactly Go's, for every codec:
  *   - An EXPLICITLY configured env key that is unusable (bad Base64, wrong
- *     length) is an ERROR, never a degrade — silently ignoring deliberate
- *     configuration would be worse than refusing to boot.
+ *     length, not the key type the codec holds) is an ERROR, never a
+ *     degrade — silently ignoring deliberate configuration would be worse
+ *     than refusing to boot.
  *   - A key file that fails its load checks (permissions other than 0600,
- *     wrong size) is never adopted; the ladder FALLS THROUGH to
- *     auto-generate, which overwrites the file's content — Go's shipped
- *     behavior (loadKeyFromFile error → generate → save), ported as-is.
+ *     content the codec does not accept) is never adopted; the ladder
+ *     FALLS THROUGH to auto-generate, which overwrites the file's content —
+ *     Go's shipped behavior (loadKeyFromFile error → generate → save),
+ *     ported as-is.
  *   - Auto-generation persists for future boots; a persist FAILURE is a
  *     stderr warning only — the key is still usable for this process.
  *
@@ -37,28 +43,52 @@ export const KEY_FILE_DIR = ".stigmer";
 export const KEY_FILE_PERMISSIONS = 0o600;
 /** Key directory permissions — Go KeyDirPermissions. */
 export const KEY_DIR_PERMISSIONS = 0o700;
+/** The 32 raw bytes the encryption and runner-token keys are. */
+export const RAW_32_BYTE_KEY = {
+    fromEnv(envVar, decoded) {
+        if (decoded.length !== KEY_SIZE) {
+            throw new Error(`${envVar} must be exactly 32 bytes (256 bits) when decoded, got ${decoded.length} bytes`);
+        }
+        return decoded;
+    },
+    fromFile(content) {
+        return content.length === KEY_SIZE ? content : undefined;
+    },
+    generate() {
+        return randomBytes(KEY_SIZE);
+    },
+    toFile(key) {
+        return key;
+    },
+};
 /**
- * Go GetOrCreateNamedKey: env var → key file → auto-generate. Throws only
- * on unusable EXPLICIT configuration (bad env value) or when no key can be
- * produced at all.
+ * Go GetOrCreateNamedKey: env var → key file → auto-generate, for a 32-byte
+ * raw key. Throws only on unusable EXPLICIT configuration (bad env value)
+ * or when no key can be produced at all.
  */
 export function getOrCreateNamedKey(envVar, fileName, options = {}) {
+    return getOrCreateKey(RAW_32_BYTE_KEY, envVar, fileName, options);
+}
+/** The ladder over any codec: env var → key file → auto-generate. */
+export function getOrCreateKey(codec, envVar, fileName, options = {}) {
     const env = options.env ?? process.env;
-    // 1. Environment variable (highest priority) — Base64-encoded 32 bytes.
+    // 1. Environment variable (highest priority) — Base64-encoded.
     const envValue = env[envVar];
     if (envValue !== undefined && envValue !== "") {
-        return decodeEnvKey(envVar, envValue);
+        return codec.fromEnv(envVar, decodeEnvBase64(envVar, envValue));
     }
-    // 2. Local key file — raw 32 bytes, refused on insecure permissions.
+    // 2. Local key file — refused on insecure permissions or content the
+    //    codec does not accept.
     const keyPath = namedKeyFilePath(fileName, options);
-    const fromFile = loadKeyFromFile(keyPath);
+    const content = readKeyFile(keyPath);
+    const fromFile = content === undefined ? undefined : codec.fromFile(content);
     if (fromFile !== undefined) {
         return fromFile;
     }
     // 3. Auto-generate (local development); persist for future boots.
-    const key = randomBytes(KEY_SIZE);
+    const key = codec.generate();
     try {
-        saveKeyToFile(keyPath, key);
+        saveKeyToFile(keyPath, codec.toFile(key));
     }
     catch (error) {
         // Warn but don't fail — the key is still usable (Go's posture).
@@ -66,20 +96,17 @@ export function getOrCreateNamedKey(envVar, fileName, options = {}) {
     }
     return key;
 }
-/** Strict Base64 decode + length check for an env-configured key. */
-function decodeEnvKey(envVar, value) {
-    const key = Buffer.from(value, "base64");
+/** Strict Base64 decode for an env-configured key. */
+function decodeEnvBase64(envVar, value) {
+    const decoded = Buffer.from(value, "base64");
     // Node's base64 decoder is lenient (skips invalid characters, accepts
     // missing padding) and never throws; Go's StdEncoding errors on any
     // non-canonical input. Round-tripping — Buffer always re-emits the
     // canonical padded form — restores Go's strictness.
-    if (key.toString("base64") !== value) {
+    if (decoded.toString("base64") !== value) {
         throw new Error(`invalid Base64 encoding in ${envVar}`);
     }
-    if (key.length !== KEY_SIZE) {
-        throw new Error(`${envVar} must be exactly 32 bytes (256 bits) when decoded, got ${key.length} bytes`);
-    }
-    return key;
+    return decoded;
 }
 /** Path to a named key file under <home>/.stigmer. */
 export function namedKeyFilePath(fileName, options = {}) {
@@ -87,13 +114,13 @@ export function namedKeyFilePath(fileName, options = {}) {
     return path.join(home, KEY_FILE_DIR, fileName);
 }
 /**
- * Reads raw key bytes, mirroring Go loadKeyFromFile: missing file →
- * undefined (fall through the ladder); present-but-wrong (insecure
- * permissions, wrong size) also falls through — exactly Go's behavior,
- * where any load error falls to auto-generate. The 0600 check is skipped
- * on Windows, where POSIX modes are not meaningful.
+ * Reads a key file's bytes, mirroring Go loadKeyFromFile: missing file →
+ * undefined (fall through the ladder); present with insecure permissions
+ * also falls through — exactly Go's behavior, where any load error falls
+ * to auto-generate. The 0600 check is skipped on Windows, where POSIX
+ * modes are not meaningful.
  */
-function loadKeyFromFile(keyPath) {
+function readKeyFile(keyPath) {
     let stat;
     try {
         stat = fs.statSync(keyPath);
@@ -107,24 +134,19 @@ function loadKeyFromFile(keyPath) {
             return undefined;
         }
     }
-    let key;
     try {
-        key = fs.readFileSync(keyPath);
+        return fs.readFileSync(keyPath);
     }
     catch {
         return undefined;
     }
-    if (key.length !== KEY_SIZE) {
-        return undefined;
-    }
-    return key;
 }
 /** Writes the key with secure permissions (dir 0700, file 0600). */
-function saveKeyToFile(keyPath, key) {
+function saveKeyToFile(keyPath, content) {
     fs.mkdirSync(path.dirname(keyPath), {
         recursive: true,
         mode: KEY_DIR_PERMISSIONS,
     });
-    fs.writeFileSync(keyPath, key, { mode: KEY_FILE_PERMISSIONS });
+    fs.writeFileSync(keyPath, content, { mode: KEY_FILE_PERMISSIONS });
 }
 //# sourceMappingURL=key-manager.js.map

package/dist/encryption/key-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"key-manager.js","sourceRoot":"","sources":["../../src/encryption/key-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,yEAAyE;AACzE,MAAM,CAAC,MAAM,QAAQ,GAAG,EAAE,CAAC;AAE3B,0DAA0D;AAC1D,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC;AAEvC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C,wDAAwD;AACxD,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AASzC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,QAAgB,EAChB,UAA4B,EAAE;IAE9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEvC,wEAAwE;IACxE,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,qEAAqE;IACrE,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,kEAAkE;IAClE,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gEAAgE;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kCAAkC,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CACzG,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qEAAqE;AACrE,SAAS,YAAY,CAAC,MAAc,EAAE,KAAa;IACjD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACzC,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,oDAAoD;IACpD,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,0DAA0D,GAAG,CAAC,MAAM,QAAQ,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,UAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAC/B,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,SAAS,aAAa,CAAC,OAAe,EAAE,GAAW;IACjD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAClC,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,mBAAmB;KAC1B,CAAC,CAAC;IACH,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;AACjE,CAAC"}
+{"version":3,"file":"key-manager.js","sourceRoot":"","sources":["../../src/encryption/key-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,yEAAyE;AACzE,MAAM,CAAC,MAAM,QAAQ,GAAG,EAAE,CAAC;AAE3B,0DAA0D;AAC1D,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC;AAEvC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C,wDAAwD;AACxD,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAuBzC,iEAAiE;AACjE,MAAM,CAAC,MAAM,eAAe,GAAqB;IAC/C,OAAO,CAAC,MAAM,EAAE,OAAO;QACrB,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,0DAA0D,OAAO,CAAC,MAAM,QAAQ,CAC1F,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,QAAQ,CAAC,OAAO;QACd,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,CAAC;IACD,QAAQ;QACN,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,CAAC,GAAG;QACR,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,QAAgB,EAChB,UAA4B,EAAE;IAE9B,OAAO,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,cAAc,CAC5B,KAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,UAA4B,EAAE;IAE9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEvC,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,qEAAqE;IACrE,4BAA4B;IAC5B,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,kEAAkE;IAClE,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gEAAgE;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kCAAkC,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CACzG,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sDAAsD;AACtD,SAAS,eAAe,CAAC,MAAc,EAAE,KAAa;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7C,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,oDAAoD;IACpD,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,UAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAC/B,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,SAAS,aAAa,CAAC,OAAe,EAAE,OAAe;IACrD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAClC,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,mBAAmB;KAC1B,CAAC,CAAC;IACH,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;AACrE,CAAC"}

package/dist/extensions/caller-guards.d.ts

@@ -10,9 +10,14 @@
  * allowed_origins, oss#375). Java separates the two classes the same way.
  *
  * List point — guards concatenate in unit order and run in composed
- * order; the first throw wins. OSS composes zero guards, so with none
- * registered the serving chain behaves byte-identically to before the
- * point existed (the conformance rosters pin that).
+ * order; the first throw wins. Open source's own guards run first (the
+ * verifier list's "OSS entries first" rule): today the PlatformClient
+ * origin guard (domain/platformclient/origin-guard.ts), composed only
+ * under an authentication posture, where PlatformClient tokens exist.
+ * Liveness is not a guard in open source: the PlatformClient verifier
+ * refuses a deleted client's tokens itself, so verifier-only lanes (the
+ * extension HTTP edges) refuse them too. With no posture and no unit
+ * guards, the serving chain runs no guard at all.
  *
  * The in-process exemption is STRUCTURAL, not policed: guards are a
  * parameter of the serving chain's identity source only

package/dist/extensions/caller-guards.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caller-guards.d.ts","sourceRoot":"","sources":["../../src/extensions/caller-guards.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;;OAQG;IACH,KAAK,CACH,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB"}
+{"version":3,"file":"caller-guards.d.ts","sourceRoot":"","sources":["../../src/extensions/caller-guards.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;;OAQG;IACH,KAAK,CACH,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB"}