@stigmer/server 3.24.0 → 3.26.0

package/src/domain/artifact/controller.ts

@@ -80,6 +80,8 @@ import {
 } from "../../pipeline/steps/load-target.js";
 import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
 import type { Store } from "../../store/interface.js";
+import type { ListIndexRow } from "../../store/list-index.js";
+import { artifactListIndex } from "./list-index.js";
 import {
   ARTIFACT_KIND,
   DEFAULT_MAX_CONTENT_BYTES,
@@ -457,36 +459,44 @@ async function listByExecution(
     .addStep({
       name: "QueryArtifactsByExecution",
       async execute(stepCtx): Promise<void> {
+        // The execution's artifacts through the list index's source key,
+        // whole and newest first: an execution's artifacts are returned as
+        // one (the request's paging fields are not read).
         const input = stepCtx.input;
-        let data: Uint8Array[];
+        let rows: ListIndexRow[];
         try {
-          data = await deps.store.listResources(ApiResourceKind.artifact);
+          rows = await deps.store.queryResources(artifactListIndex, {
+            anyKey: [
+              ...(input.workflowExecutionId === ""
+                ? []
+                : [
+                    {
+                      name: "workflow_execution" as const,
+                      value: input.workflowExecutionId,
+                    },
+                  ]),
+              ...(input.agentExecutionId === ""
+                ? []
+                : [
+                    {
+                      name: "agent_execution" as const,
+                      value: input.agentExecutionId,
+                    },
+                  ]),
+            ],
+          });
         } catch (error) {
           throw internalError(error, "failed to list artifacts");
         }
 
         const artifacts: Artifact[] = [];
-        for (const bytes of data) {
-          let artifact: Artifact;
+        for (const row of rows) {
           try {
-            artifact = fromBinary(ArtifactSchema, bytes);
+            artifacts.push(fromBinary(ArtifactSchema, row.data));
           } catch (error) {
             deps.logger.warn("failed to unmarshal artifact, skipping", {
               error: error instanceof Error ? error.message : String(error),
             });
-            continue;
-          }
-          const source = artifact.spec?.source;
-          if (
-            input.workflowExecutionId !== "" &&
-            source?.workflowExecutionId === input.workflowExecutionId
-          ) {
-            artifacts.push(artifact);
-          } else if (
-            input.agentExecutionId !== "" &&
-            source?.agentExecutionId === input.agentExecutionId
-          ) {
-            artifacts.push(artifact);
           }
         }
 

package/src/domain/artifact/list-index.ts

@@ -0,0 +1,22 @@
+/**
+ * The artifact list index (store/list-index.ts): an artifact names the
+ * execution that produced it, agent or workflow, and
+ * `listByExecution` reads the one the request names.
+ *
+ * A change to `keys` bumps `revision` (boot/__tests__/list-indexes.test.ts
+ * pins the pair).
+ */
+import { ArtifactSchema } from "@stigmer/protos/ai/stigmer/agentic/artifact/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+
+import { declareListIndex, field } from "../../store/list-index.js";
+
+export const artifactListIndex = declareListIndex({
+  kind: ApiResourceKind.artifact,
+  schema: ArtifactSchema,
+  revision: 1,
+  keys: {
+    agent_execution: field("spec.source.agent_execution_id"),
+    workflow_execution: field("spec.source.workflow_execution_id"),
+  },
+});

package/src/domain/iampolicy/__tests__/membership.test.ts

@@ -639,6 +639,13 @@ describe("membership rules", () => {
         IdentityAccountProvisioningMode.machine;
       expect(isPersonAccount(machineMode)).toBe(false);
     });
+
+    it("a platform-client end user is not: the mint grants it its client's role and nothing else", () => {
+      const endUser = account("stgm_pc|acme|user-7", OPERATOR_EMAIL);
+      endUser.spec!.provisioningMode =
+        IdentityAccountProvisioningMode.platform_client;
+      expect(isPersonAccount(endUser)).toBe(false);
+    });
   });
 
   describe("ensureRolesForExistingAccounts", () => {

package/src/domain/iampolicy/membership.ts

@@ -195,14 +195,20 @@ export function isPersonStamp(stamp: string): boolean {
  * `user`-class gate, for the reconciliation, which has a row and no
  * caller. A machine account (`is_machine_account`, or the `machine`
  * provisioning mode) earns no role, exactly as a `machine`-class caller
- * earns none at the hook.
+ * earns none at the hook. Nor does a platform-client end user: it is a
+ * person on its platform's product, not on this install — the mint grants
+ * it exactly its client's auto-grant role on the owning organization and
+ * never runs these rules, and the reconciliation must not either, or every
+ * product user would become a member of every organization (and the
+ * operator-email arm would read an email the platform asserted).
  */
 export function isPersonAccount(account: IdentityAccount): boolean {
   const spec = account.spec;
   return (
     spec !== undefined &&
     !spec.isMachineAccount &&
-    spec.provisioningMode !== IdentityAccountProvisioningMode.machine
+    spec.provisioningMode !== IdentityAccountProvisioningMode.machine &&
+    spec.provisioningMode !== IdentityAccountProvisioningMode.platform_client
   );
 }
 

package/src/domain/identityaccount/__tests__/platform-client-accounts.test.ts

@@ -0,0 +1,124 @@
+/**
+ * Pins the identity-account create path's platform-client arm over the OSS
+ * adapter on sqlite:
+ *   - `platform_client` provisioning writes the mode, the owning
+ *     organization and the derived id, with the actor the caller named;
+ *   - the `stgm_pc|` subject namespace is reserved in both directions: a
+ *     direct account refuses it INVALID_ARGUMENT before anything is written,
+ *     and a platform-client account without it is the caller's bug;
+ *   - the direct lookups never answer the platform-client account, while the
+ *     any-mode lookup (the mint's) does.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { create } from "@bufbuild/protobuf";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
+import { IdentityAccountSpecSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/spec_pb";
+
+import { silentLogger } from "../../../extensions/__tests__/composed-support.js";
+import { serverActingFor } from "../../../pipeline/interceptors/auth.js";
+import { newPermissiveSingleTeamAuthorizer } from "../../../pipeline/steps/authorize.js";
+import { tempStore } from "../../../store/sqlite/__tests__/support.js";
+import type { TempStore } from "../../../store/sqlite/__tests__/support.js";
+import { accountIdFor, reservedSubjectMessage } from "../constants.js";
+import { newCreateAccountPath } from "../controller.js";
+import type { CreateAccount } from "../provisioning.js";
+import { newResourceIdentityAccountStore } from "../resource-store.js";
+import type { IdentityAccountStore } from "../store.js";
+
+let temp: TempStore;
+let accounts: IdentityAccountStore;
+let createAccount: CreateAccount;
+
+beforeEach(() => {
+  temp = tempStore();
+  accounts = newResourceIdentityAccountStore(temp.store);
+  createAccount = newCreateAccountPath(
+    {
+      accounts,
+      logger: silentLogger,
+      authorizer: newPermissiveSingleTeamAuthorizer(),
+      authorizationLifecycle: undefined,
+    },
+    ApiResourceKind.identity_account,
+  );
+});
+
+afterEach(() => {
+  temp.cleanup();
+});
+
+const SUBJECT = "stgm_pc|acme|user-7";
+const CLIENT = serverActingFor("pcl_dashboard");
+
+async function refusal(promise: Promise<unknown>): Promise<ConnectError> {
+  try {
+    await promise;
+  } catch (error) {
+    if (error instanceof ConnectError) return error;
+    throw error;
+  }
+  throw new Error("expected a ConnectError refusal");
+}
+
+describe("the create path's platform-client arm", () => {
+  it("writes the mode, the owning organization and the derived id, stamped as the client", async () => {
+    const account = await createAccount(
+      {
+        name: "pat@example.com",
+        spec: create(IdentityAccountSpecSchema, {
+          idpId: SUBJECT,
+          email: "pat@example.com",
+        }),
+        provisioning: { mode: "platform_client", org: "acme" },
+      },
+      CLIENT,
+    );
+    expect(account.metadata?.id).toBe(accountIdFor(SUBJECT));
+    expect(account.metadata?.org).toBe("acme");
+    expect(account.spec?.provisioningMode).toBe(
+      IdentityAccountProvisioningMode.platform_client,
+    );
+    expect(account.status?.audit?.specAudit?.createdBy?.id).toBe(
+      "pcl_dashboard",
+    );
+
+    expect(await accounts.findDirectByIdpId(SUBJECT)).toBeUndefined();
+    expect(await accounts.findDirectByEmail("pat@example.com")).toBeUndefined();
+    expect((await accounts.findByIdpId(SUBJECT))?.metadata?.id).toBe(
+      accountIdFor(SUBJECT),
+    );
+  });
+
+  it("refuses a direct account under the reserved subject prefix, writing nothing", async () => {
+    const denied = await refusal(
+      createAccount(
+        {
+          name: "impostor",
+          spec: create(IdentityAccountSpecSchema, { idpId: SUBJECT }),
+          provisioning: { mode: "direct" },
+        },
+        CLIENT,
+      ),
+    );
+    expect(denied.code).toBe(Code.InvalidArgument);
+    expect(denied.rawMessage).toBe(reservedSubjectMessage(SUBJECT));
+    expect(await accounts.findByIdpId(SUBJECT)).toBeUndefined();
+  });
+
+  it("refuses a platform-client account without the reserved prefix as a server fault", async () => {
+    const denied = await refusal(
+      createAccount(
+        {
+          name: "stray",
+          spec: create(IdentityAccountSpecSchema, { idpId: "auth0|stray" }),
+          provisioning: { mode: "platform_client", org: "acme" },
+        },
+        CLIENT,
+      ),
+    );
+    expect(denied.code).toBe(Code.Internal);
+  });
+});

package/src/domain/identityaccount/__tests__/resource-store.test.ts

@@ -54,6 +54,7 @@ const CONTRACT_CASE_NAMES = [
   "a disconnected store is an infrastructure fault, never 'not found'",
   "two concurrent saves of one subject end in fulfilments and DuplicateAccountErrors only, and the winner is readable by subject",
   "findDirectByIdpId and findDirectByEmail never answer a federated account, while findByIdpId (any mode) does",
+  "findDirectByIdpId and findDirectByEmail never answer a platform-client account, while findByIdpId (any mode) does",
   "findByIds answers one row per distinct id, in first-occurrence order; an empty request answers an empty list",
   "update of an unknown id is a no-op: no row appears",
   "deleteById of an unknown id resolves",

package/src/domain/identityaccount/constants.ts

@@ -110,6 +110,26 @@ export function isMachineSubject(idpId: string): boolean {
   return idpId.endsWith(MACHINE_ACCOUNT_SUFFIX);
 }
 
+/**
+ * The subject namespace of PlatformClient end users:
+ * `stgm_pc|<org>|<external_user_id>` (the composite every client of one
+ * organization resolves a user to; domain/platformclient/mint.ts builds
+ * it). Reserved in both directions, because derived account ids make every
+ * subject one namespace: a direct account may not take a `stgm_pc|`
+ * subject (an issuer emitting one would otherwise provision an account the
+ * mint then resolves), and the mint refuses a `stgm_pc|` account in any
+ * other mode.
+ */
+export const PLATFORM_CLIENT_SUBJECT_PREFIX = "stgm_pc|";
+
+export function isPlatformClientSubject(idpId: string): boolean {
+  return idpId.startsWith(PLATFORM_CLIENT_SUBJECT_PREFIX);
+}
+
+export function reservedSubjectMessage(idpId: string): string {
+  return `subject '${idpId}' uses the '${PLATFORM_CLIENT_SUBJECT_PREFIX}' prefix reserved for accounts a platform client provisions`;
+}
+
 // ---------------------------------------------------------------------------
 // Byte-pinned copy (the cloud handlers' sentences, moved as-is).
 // ---------------------------------------------------------------------------

package/src/domain/identityaccount/controller.ts

@@ -108,6 +108,7 @@ import {
 import type {
   AccountCreatedHook,
   CreateAccount,
+  AccountProvisioning,
   CreateAccountInput,
   DirectAccountProvisioner,
 } from "./provisioning.js";
@@ -230,6 +231,7 @@ async function runCreateChain(
   account: IdentityAccount,
   caller: CallerIdentity,
   kind: ApiResourceKind,
+  provisioning: AccountProvisioning,
 ): Promise<IdentityAccount> {
   const reqCtx = new RequestContext(
     IdentityAccountSchema,
@@ -254,7 +256,7 @@ async function runCreateChain(
     .addStep(newCheckDuplicateStep(deps.accounts))
     .addStep(newBuildNewStateStep())
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
-    .addStep(newAssignBackendFieldsStep())
+    .addStep(newAssignBackendFieldsStep(provisioning))
     .addStep(newPersistNewAccountStep(deps.accounts))
     .addStep(
       newCreateAuthorizationTuplesStep(
@@ -270,7 +272,9 @@ async function runCreateChain(
 /**
  * The create path as its in-process callers see it (provisioning.ts
  * `CreateAccount`): the input becomes the resource envelope the chain
- * expects, tagged with the kind this controller serves.
+ * expects, tagged with the kind this controller serves. A platform-client
+ * account carries its owning organization, as the cloud has always
+ * written it; a direct account belongs to no organization.
  */
 export function newCreateAccountPath(
   deps: CreateAccountPathDeps,
@@ -282,11 +286,17 @@ export function newCreateAccountPath(
       create(IdentityAccountSchema, {
         apiVersion: "iam.stigmer.ai/v1",
         kind: "IdentityAccount",
-        metadata: { name: input.name },
+        metadata: {
+          name: input.name,
+          ...(input.provisioning.mode === "platform_client"
+            ? { org: input.provisioning.org }
+            : {}),
+        },
         spec: input.spec,
       }),
       caller,
       kind,
+      input.provisioning,
     );
 }
 
@@ -303,7 +313,9 @@ function createRpc(
 ): Promise<IdentityAccount> {
   const caller = callerIdentityOf(ctx);
   guardInternalRpc(caller);
-  return runCreateChain(deps, account, caller, kindOf(ctx));
+  // The RPC creates the platform's own accounts only: a platform-client
+  // account is the mint's to provision, never a wire caller's.
+  return runCreateChain(deps, account, caller, kindOf(ctx), { mode: "direct" });
 }
 
 function guardInternalRpc(caller: CallerIdentity): void {

package/src/domain/identityaccount/operator.ts

@@ -83,6 +83,7 @@ export async function ensureOperatorAccount(
             email: operator.email,
           }),
         ),
+        provisioning: { mode: "direct" },
       },
       caller,
     );

package/src/domain/identityaccount/provisioning.ts

@@ -74,11 +74,27 @@ export class UserInfoFetchError extends Error {
   }
 }
 
+/**
+ * How the account being created was provisioned — the one input that
+ * decides its backend-assigned fields (steps.ts AssignBackendFields):
+ *   - `direct`: the platform's own subject (a first sign-in, the boot
+ *     operator, a machine account created over the RPC). Its subject may
+ *     not use the `stgm_pc|` prefix platform-client accounts reserve.
+ *   - `platform_client`: an end user a PlatformClient's mint provisioned
+ *     (domain/platformclient/mint.ts). Its subject is the reserved
+ *     composite, and it belongs to the client's owning organization, which
+ *     only this arm carries.
+ */
+export type AccountProvisioning =
+  | { readonly mode: "direct" }
+  | { readonly mode: "platform_client"; readonly org: string };
+
 /** What a caller of the create path supplies: the rest is the chain's. */
 export interface CreateAccountInput {
   /** `metadata.name`; the chain defaults an empty one. */
   readonly name: string;
   readonly spec: IdentityAccountSpec;
+  readonly provisioning: AccountProvisioning;
 }
 
 /**
@@ -152,6 +168,7 @@ export function newDirectAccountProvisioner(
             pictureUrl: profile.pictureUrl,
           }),
         ),
+        provisioning: { mode: "direct" },
       };
 
       try {

package/src/domain/identityaccount/resource-store.ts

@@ -144,14 +144,18 @@ export function newResourceIdentityAccountStore(
 }
 
 /**
- * Non-federated: the platform's own subject. A federated account carries
- * its identity_provider_ref; open source never writes one (its create
- * path assigns `direct`), so this is the port's contract stated, not a
- * branch the OSS store expects to take.
+ * The platform's own subject: neither federated nor a platform-client end
+ * user. A federated account carries its identity_provider_ref (open source
+ * never writes one, so that arm is the port's contract stated); a
+ * platform-client account is the mint's, whose email and name the platform
+ * asserted, so no direct lookup — a verifier's subject resolve, getByEmail —
+ * may answer it.
  */
 function isDirect(account: IdentityAccount): boolean {
+  const mode = account.spec?.provisioningMode;
   return (
     account.spec?.identityProviderRef === undefined &&
-    account.spec?.provisioningMode !== IdentityAccountProvisioningMode.federated
+    mode !== IdentityAccountProvisioningMode.federated &&
+    mode !== IdentityAccountProvisioningMode.platform_client
   );
 }

package/src/domain/identityaccount/steps.ts

@@ -26,7 +26,8 @@
  *     subject, never its slug (the guideline's "domains with different
  *     uniqueness rules bring their own step under the same name").
  *   - AssignBackendFields: `is_machine_account` from the `@clients`
- *     suffix and `provisioning_mode direct` on create (the spec's
+ *     suffix and the provisioning mode the path was given (`direct`, or
+ *     `platform_client` for the mint's end users) on create (the spec's
  *     "assigned by backend" fields); on update, every backend-assigned
  *     field and the email are preserved from the existing row (A9: the
  *     cloud's writable surface — first/last name, picture, preferences —
@@ -63,11 +64,15 @@ import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
 import { TARGET_RESOURCE_KEY } from "../../pipeline/steps/load-target.js";
 import { idValueOf, metadataOf } from "../../pipeline/steps/shapes.js";
 import {
+  PLATFORM_CLIENT_SUBJECT_PREFIX,
   accountIdFor,
   accountNotFoundMessage,
   idpIdImmutableMessage,
   isMachineSubject,
+  isPlatformClientSubject,
+  reservedSubjectMessage,
 } from "./constants.js";
+import type { AccountProvisioning } from "./provisioning.js";
 import { DuplicateAccountError } from "./store.js";
 import type { IdentityAccountStore } from "./store.js";
 
@@ -158,11 +163,61 @@ export function assignDirectBackendFields(
   return spec;
 }
 
-export function newAssignBackendFieldsStep(): AccountStep {
+/**
+ * The backend-assigned fields of a PLATFORM-CLIENT account: the machine
+ * flag from the subject's shape (the cloud's rule for every mode), mode
+ * `platform_client`, no provider ref — the PlatformClient admits the user
+ * at mint time and is no ongoing authentication authority.
+ */
+function assignPlatformClientBackendFields(
+  spec: IdentityAccountSpec,
+): IdentityAccountSpec {
+  spec.isMachineAccount = isMachineSubject(spec.idpId);
+  spec.provisioningMode = IdentityAccountProvisioningMode.platform_client;
+  spec.identityProviderRef = undefined;
+  return spec;
+}
+
+/**
+ * AssignBackendFields on create, by how the account was provisioned. The
+ * `stgm_pc|` subject namespace is reserved in both directions: a direct
+ * account refuses it (INVALID_ARGUMENT, before anything is written), and a
+ * platform-client account must carry it — its absence is the mint's bug,
+ * never a client's input.
+ */
+export function newAssignBackendFieldsStep(
+  provisioning: AccountProvisioning,
+): AccountStep {
   return {
     name: "AssignBackendFields",
     execute(ctx: AccountContext): void {
-      assignDirectBackendFields(specOf(ctx));
+      const spec = specOf(ctx);
+      switch (provisioning.mode) {
+        case "direct":
+          if (isPlatformClientSubject(spec.idpId)) {
+            throw invalidArgumentError(reservedSubjectMessage(spec.idpId));
+          }
+          assignDirectBackendFields(spec);
+          return;
+        case "platform_client":
+          if (!isPlatformClientSubject(spec.idpId)) {
+            throw internalError(
+              new Error(
+                `a platform-client account's subject must carry the '${PLATFORM_CLIENT_SUBJECT_PREFIX}' prefix`,
+              ),
+              "assign backend fields",
+            );
+          }
+          assignPlatformClientBackendFields(spec);
+          return;
+        default: {
+          const exhaustive: never = provisioning;
+          throw internalError(
+            new Error(`unknown provisioning ${JSON.stringify(exhaustive)}`),
+            "assign backend fields",
+          );
+        }
+      }
     },
   };
 }

package/src/domain/identityaccount/store-contract.ts

@@ -109,6 +109,31 @@ function federatedAccount(overrides: {
   });
 }
 
+/**
+ * A platform-client end user as the mint provisions it: the reserved
+ * composite subject, mode `platform_client`, the owning organization, and
+ * the derived id of its subject (the id every subject lookup reads).
+ */
+function platformClientAccount(overrides: {
+  idpId: string;
+  email: string;
+}): IdentityAccount {
+  return create(IdentityAccountSchema, {
+    apiVersion: "iam.stigmer.ai/v1",
+    kind: "IdentityAccount",
+    metadata: {
+      id: accountIdFor(overrides.idpId),
+      name: overrides.email,
+      org: "acme",
+    },
+    spec: {
+      idpId: overrides.idpId,
+      email: overrides.email,
+      provisioningMode: IdentityAccountProvisioningMode.platform_client,
+    },
+  });
+}
+
 /** A direct account with no subject — the row no lookup could ever reach. */
 function subjectlessDirectAccount(): IdentityAccount {
   return create(IdentityAccountSchema, {
@@ -357,6 +382,32 @@ const CASES: ReadonlyArray<PortContractDeclaration<IdentityAccountStore>> = [
       );
     },
   ],
+  [
+    "findDirectByIdpId and findDirectByEmail never answer a platform-client account, while findByIdpId (any mode) does",
+    async ({ store }) => {
+      await store.save(
+        platformClientAccount({
+          idpId: "stgm_pc|acme|user-7",
+          email: "pat@example.com",
+        }),
+      );
+      assert.equal(
+        await store.findDirectByIdpId("stgm_pc|acme|user-7"),
+        undefined,
+        "the direct-subject lookup must not resolve to an account a platform client provisioned",
+      );
+      assert.equal(
+        await store.findDirectByEmail("pat@example.com"),
+        undefined,
+        "the direct-email lookup must not answer an email a platform asserted",
+      );
+      assert.equal(
+        (await store.findByIdpId("stgm_pc|acme|user-7"))?.spec?.provisioningMode,
+        IdentityAccountProvisioningMode.platform_client,
+        "the any-mode subject lookup — the mint's — must answer the platform-client account",
+      );
+    },
+  ],
   [
     "findByIds answers one row per distinct id, in first-occurrence order; an empty request answers an empty list",
     async ({ store }) => {

package/src/domain/identityaccount/store.ts

@@ -22,12 +22,14 @@
  *     with an empty `idp_id` is refused, since no lookup could reach it;
  *   - `update` replaces, never creates: an unknown id writes nothing;
  *   - `deleteById` of an unknown id resolves;
- *   - `findDirectByIdpId` answers only non-federated accounts (the
- *     platform's own subjects) — a customer's federated IdP may mint the
- *     same `auth0|…` shape and the platform lane must never resolve to it;
+ *   - `findDirectByIdpId` answers only the platform's own subjects —
+ *     never a federated account (a customer's federated IdP may mint the
+ *     same `auth0|…` shape and the platform lane must never resolve to it)
+ *     and never a platform-client end user (its subject is the mint's);
  *   - `findDirectByEmail` answers direct accounts only, by exact match:
  *     federation legitimately duplicates emails, so the email axis is
- *     non-unique;
+ *     non-unique, and a platform-client account's email is one its
+ *     platform asserted, so no email lookup may answer it;
  *   - `findByIds` answers one row per distinct id, in first-occurrence
  *     order, and skips unknown ids;
  *   - a typed not-found reads as `undefined`; any other storage failure
@@ -59,7 +61,7 @@ export interface IdentityAccountStore {
   findById(id: string): Promise<IdentityAccount | undefined>;
   /** Any provisioning mode — the getByIdpId RPC's lookup. */
   findByIdpId(idpId: string): Promise<IdentityAccount | undefined>;
-  /** Non-federated accounts only — the verifiers' and whoAmI's lookup. */
+  /** The platform's own subjects only (no federated, no platform-client) — the verifiers' and whoAmI's lookup. */
   findDirectByIdpId(idpId: string): Promise<IdentityAccount | undefined>;
   /** Direct accounts only, exact match — the getByEmail RPC's lookup. */
   findDirectByEmail(email: string): Promise<IdentityAccount | undefined>;

package/src/domain/platform/__tests__/platform.test.ts

@@ -17,7 +17,8 @@
  *     with the token fields empty (minting a proxy token is cloud-only);
  *   - getServerInfo reports the build stamp by default and the release a
  *     library consumer states through ComposeOptions.version otherwise
- *     (stigmer#1168: unbundled, the stamp is always "dev");
+ *     (stigmer#1168: unbundled, the stamp is always "dev"), and a
+ *     trusted-local server's posture as an explicit false;
  *   - getLicenseStatus answers `absent` with no claims and no key when no
  *     provider is composed, and the composed provider's report verbatim
  *     when one is — both stamped with the ONE instant the controller
@@ -138,6 +139,9 @@ describe("platform domain (composed server)", () => {
     // Unbundled runs report Go's unstamped default; release bundles stamp
     // the esbuild define (scripts/bundle-slim.mjs).
     expect(first.version).toBe("dev");
+    // A server that trusts every request says so on the wire: an explicit
+    // false, never an absent field a console would read as "unknown".
+    expect(first.authenticationRequired).toBe(false);
 
     const second = await client.getServerInfo({});
     expect(second.edition).toBe(first.edition);
@@ -285,6 +289,7 @@ describe("platform domain (keyless runner-token service)", () => {
         ),
         edition: ServerEdition.oss,
         version: "dev",
+        authenticationRequired: false,
         licenseStatus: ABSENT_LICENSE_STATUS,
         now: () => new Date(),
         logger: silentLogger,
@@ -320,6 +325,7 @@ describe("platform domain (license status)", () => {
         ),
         edition: ServerEdition.enterprise,
         version: "dev",
+        authenticationRequired: false,
         licenseStatus: provider,
         now: () => instant,
         logger: silentLogger,