@stigmer/server 3.24.0 → 3.26.0

package/src/extensions/__tests__/platform-client-composed.test.ts

@@ -0,0 +1,288 @@
+/**
+ * The PlatformClient lane on a composed server in the authentication
+ * posture with the built-in Authorizer (a unit that vouches for tokens,
+ * declares the posture and registers no Authorizer — the open-source OIDC
+ * self-host's shape), with the key ring supplied so the run is hermetic:
+ *   - the founder creates a client; an anonymous mint answers a token; the
+ *     token authenticates as the end user's derived account, which holds the
+ *     auto-grant role on the owning organization and sees that one alone;
+ *   - the platform-client verifier sits ahead of the unit's verifier and
+ *     claims only its lane: the founder's tokens still pass, and a TYPED
+ *     platform token (a lane open source does not speak) is refused as
+ *     unclaimed;
+ *   - the origin guard refuses an unlisted Origin with the cloud's copy and
+ *     passes a request without one;
+ *   - deleting the client refuses its token on the next request with the
+ *     cloud's liveness copy;
+ *   - an outsider cannot read the client by reference.
+ */
+import { generateKeyPairSync } from "node:crypto";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { Code, ConnectError, createClient } from "@connectrpc/connect";
+import type { Interceptor, Transport } from "@connectrpc/connect";
+import { createGrpcTransport } from "@connectrpc/connect-node";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IdentityAccountCommandController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/command_pb";
+import { IdentityAccountQueryController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/query_pb";
+import { PlatformClientCommandController } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/command_pb";
+import { PlatformClientQueryController } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/query_pb";
+import { PlatformClientTokenController } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/token_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { OrganizationCommandController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/command_pb";
+import { OrganizationQueryController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/query_pb";
+
+import { loadConfig } from "../../boot/config.js";
+import { composeServer } from "../../boot/compose.js";
+import type { ComposedServer } from "../../boot/compose.js";
+import { accountIdFor } from "../../domain/identityaccount/constants.js";
+import {
+  DELETED_CLIENT_MESSAGE,
+  originRefusalMessage,
+} from "../../domain/platformclient/constants.js";
+import { signPlatformToken } from "../../platformtoken/envelope.js";
+import { platformTokenKeyRingFromPem } from "../../platformtoken/key-ring.js";
+import type { SigningPlatformTokenKeyRing } from "../../platformtoken/key-ring.js";
+import type { ServerExtension } from "../registry.js";
+import {
+  baseConfig,
+  bearer,
+  fakeJwt,
+  fakeVerifier,
+  silentLogger,
+  transportFor,
+} from "./composed-support.js";
+
+const FOUNDER = "fake|pc-founder";
+const OUTSIDER = "fake|pc-outsider";
+const ORG = "pc-org";
+
+const { privateKey, publicKey } = generateKeyPairSync("rsa", {
+  modulusLength: 2048,
+});
+const built = platformTokenKeyRingFromPem({
+  privateKeyPem: privateKey.export({ format: "pem", type: "pkcs8" }).toString(),
+  publicKeyPems: [publicKey.export({ format: "pem", type: "spki" }).toString()],
+});
+if (built.signer === undefined) throw new Error("fixture ring must sign");
+const RING: SigningPlatformTokenKeyRing = { ...built, signer: built.signer };
+
+/** Stamps the lowercase `origin` header a browser attaches to a cross-origin call. */
+function browserOrigin(origin: string): Interceptor {
+  return (next) => (request) => {
+    request.header.set("origin", origin);
+    return next(request);
+  };
+}
+
+async function refusal(promise: Promise<unknown>): Promise<ConnectError> {
+  try {
+    await promise;
+  } catch (error) {
+    if (error instanceof ConnectError) return error;
+    throw error;
+  }
+  throw new Error("expected a ConnectError refusal");
+}
+
+describe("PlatformClient on a composed server (authentication posture, built-in Authorizer)", () => {
+  let dir: string;
+  let server: ComposedServer;
+  let port: number;
+
+  const asFounder = (): Transport =>
+    transportFor(port, fakeJwt(FOUNDER, "founder@example.com"));
+  const asOutsider = (): Transport =>
+    transportFor(port, fakeJwt(OUTSIDER, "outsider@example.com"));
+  const presenting = (token: string, origin?: string): Transport =>
+    createGrpcTransport({
+      baseUrl: `http://127.0.0.1:${port}`,
+      interceptors: [
+        bearer(token),
+        ...(origin !== undefined ? [browserOrigin(origin)] : []),
+      ],
+    });
+
+  beforeAll(async () => {
+    dir = mkdtempSync(path.join(tmpdir(), "platform-client-composed-"));
+    const unit: ServerExtension = {
+      name: "fake-oidc-only",
+      requireAuthentication: true,
+      identityVerifiers: [fakeVerifier],
+      drivers: { platformTokenKeys: RING },
+    };
+    server = await composeServer({
+      config: loadConfig(baseConfig(dir)),
+      logger: silentLogger,
+      extensions: [unit],
+      portOverride: 0,
+      host: "127.0.0.1",
+    });
+    port = await server.start();
+
+    await createClient(
+      IdentityAccountCommandController,
+      asFounder(),
+    ).provisionMyAccount({});
+    await createClient(OrganizationCommandController, asFounder()).create({
+      apiVersion: "tenancy.stigmer.ai/v1",
+      kind: "Organization",
+      metadata: { name: ORG, slug: ORG, org: "" },
+      spec: { description: ORG },
+    });
+    await createClient(
+      IdentityAccountCommandController,
+      asOutsider(),
+    ).provisionMyAccount({});
+  });
+
+  afterAll(async () => {
+    await server?.shutdown();
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  async function createPlatformClient(allowedOrigins: string[] = []) {
+    const created = await createClient(
+      PlatformClientCommandController,
+      asFounder(),
+    ).create({
+      apiVersion: "iam.stigmer.ai/v1",
+      kind: "PlatformClient",
+      metadata: {
+        name: `client-${Math.random().toString(36).slice(2, 8)}`,
+        org: ORG,
+      },
+      spec: {
+        autoProvisionAccounts: true,
+        autoGrantOnOrg: true,
+        autoGrantRole: IamRole.member,
+        allowedOrigins,
+      },
+    });
+    return {
+      id: created.platformClient?.metadata?.id ?? "",
+      slug: created.platformClient?.metadata?.slug ?? "",
+      clientId: created.platformClient?.spec?.clientId ?? "",
+      clientSecret: created.clientSecret,
+    };
+  }
+
+  async function mint(
+    client: { clientId: string; clientSecret: string },
+    userId: string,
+  ) {
+    const minted = await createClient(
+      PlatformClientTokenController,
+      transportFor(port),
+    ).mintUserToken({
+      clientId: client.clientId,
+      clientSecret: client.clientSecret,
+      userId,
+      userEmail: `${userId}@product.example`,
+      userName: "Product User",
+    });
+    return minted.accessToken;
+  }
+
+  it("mints for the end user's derived account, which sees its owning organization alone", async () => {
+    const client = await createPlatformClient();
+    const token = await mint(client, "user-1");
+
+    const me = await createClient(
+      IdentityAccountQueryController,
+      presenting(token),
+    ).whoAmI({});
+    expect(me.metadata?.id).toBe(accountIdFor(`stgm_pc|${ORG}|user-1`));
+
+    const mine = await createClient(
+      OrganizationQueryController,
+      presenting(token),
+    ).findMyOrganizations({});
+    expect(
+      mine.entries.map((organization) => organization.metadata?.slug),
+    ).toEqual([ORG]);
+  });
+
+  it("claims only its lane: the unit's tokens still pass, and a typed platform token is refused as unclaimed", async () => {
+    await createClient(
+      OrganizationQueryController,
+      asFounder(),
+    ).findMyOrganizations({});
+
+    const guest = signPlatformToken(RING, {
+      sub: "ida_guest",
+      token_type: "guest",
+    }).token;
+    const refused = await refusal(
+      createClient(
+        OrganizationQueryController,
+        presenting(guest),
+      ).findMyOrganizations({}),
+    );
+    expect(refused.code).toBe(Code.Unauthenticated);
+  });
+
+  it("refuses an unlisted Origin with the cloud's copy and passes a request without one", async () => {
+    const client = await createPlatformClient(["https://app.example"]);
+    const token = await mint(client, "user-2");
+
+    const denied = await refusal(
+      createClient(
+        OrganizationQueryController,
+        presenting(token, "https://evil.example"),
+      ).findMyOrganizations({}),
+    );
+    expect(denied.code).toBe(Code.PermissionDenied);
+    expect(denied.rawMessage).toBe(
+      originRefusalMessage("https://evil.example"),
+    );
+
+    await createClient(
+      OrganizationQueryController,
+      presenting(token),
+    ).findMyOrganizations({});
+    await createClient(
+      OrganizationQueryController,
+      presenting(token, "https://app.example"),
+    ).findMyOrganizations({});
+  });
+
+  it("refuses a deleted client's token on the next request with the liveness copy", async () => {
+    const client = await createPlatformClient();
+    const token = await mint(client, "user-3");
+    await createClient(
+      OrganizationQueryController,
+      presenting(token),
+    ).findMyOrganizations({});
+
+    await createClient(PlatformClientCommandController, asFounder()).delete({
+      resourceId: client.id,
+    });
+
+    const denied = await refusal(
+      createClient(
+        OrganizationQueryController,
+        presenting(token),
+      ).findMyOrganizations({}),
+    );
+    expect(denied.code).toBe(Code.Unauthenticated);
+    expect(denied.rawMessage).toBe(DELETED_CLIENT_MESSAGE);
+  });
+
+  it("an outsider cannot read the client by reference", async () => {
+    const client = await createPlatformClient();
+    const denied = await refusal(
+      createClient(PlatformClientQueryController, asOutsider()).getByReference({
+        org: ORG,
+        slug: client.slug,
+        kind: ApiResourceKind.platform_client,
+      }),
+    );
+    expect(denied.code).toBe(Code.PermissionDenied);
+    expect(denied.rawMessage).toBe("unauthorized to view platform client");
+  });
+});

package/src/extensions/__tests__/registry.test.ts

@@ -193,7 +193,10 @@ describe("resolveExtensions — merge semantics", () => {
       "g2",
       "g3",
     ]);
-    expect(resolved.services).toEqual([registerA, registerB]);
+    expect(resolved.services).toEqual([
+      { unit: "alpha", register: registerA },
+      { unit: "beta", register: registerB },
+    ]);
     expect(resolved.workers).toEqual([workerFactory]);
     expect(resolved.statusObservers).toEqual([observerA]);
     expect(resolved.responseDecorators).toEqual([decoratorB]);

package/src/extensions/__tests__/tier-truthfulness.test.ts

@@ -218,6 +218,14 @@ describe("tier truthfulness against the empty composition", () => {
     );
     expect(served.has("iampolicy")).toBe(true);
   });
+
+  it("platform_client is open_source and served in the empty composition — the mint refuses without a posture, the kind does not", () => {
+    const served = servedKindSegments(server.routes);
+    expect(getKindMeta(ApiResourceKind.platform_client).tier).toBe(
+      ResourceTier.open_source,
+    );
+    expect(served.has("platformclient")).toBe(true);
+  });
 });
 
 describe("the check bites (mutation proofs over the same function)", () => {

package/src/extensions/caller-guards.ts

@@ -10,9 +10,14 @@
  * allowed_origins, oss#375). Java separates the two classes the same way.
  *
  * List point — guards concatenate in unit order and run in composed
- * order; the first throw wins. OSS composes zero guards, so with none
- * registered the serving chain behaves byte-identically to before the
- * point existed (the conformance rosters pin that).
+ * order; the first throw wins. Open source's own guards run first (the
+ * verifier list's "OSS entries first" rule): today the PlatformClient
+ * origin guard (domain/platformclient/origin-guard.ts), composed only
+ * under an authentication posture, where PlatformClient tokens exist.
+ * Liveness is not a guard in open source: the PlatformClient verifier
+ * refuses a deleted client's tokens itself, so verifier-only lanes (the
+ * extension HTTP edges) refuse them too. With no posture and no unit
+ * guards, the serving chain runs no guard at all.
  *
  * The in-process exemption is STRUCTURAL, not policed: guards are a
  * parameter of the serving chain's identity source only

package/src/extensions/drivers.ts

@@ -35,6 +35,11 @@
  *     it reaches a URL a user supplied: the MCP endpoint it probes at save
  *     time and the login server it reaches on Sign in) — landed with the
  *     save-time OAuth completion for URL-only MCP servers, 2026-09-19
+ *   - platform-client store + platform-token keys + guest-token minting
+ *     (PlatformClient served in every edition: the port the cloud's
+ *     `cloud.iam_platform_client` driver fills, the RS256 key ring every
+ *     self-signed token rides, and the one token method only an edition
+ *     that hosts shared-agent pages serves) — landed 2026-09-23
  *
  * Merge rules (enforced by resolveExtensions, DD-006 §2b): the two
  * provider kinds are single-instance points — a second declaring unit is
@@ -50,12 +55,15 @@ import type { ArtifactStorageDriverFactory } from "../artifactstorage/artifact-s
 import type { ChannelRuntime } from "../domain/agentchannel/channel-runtime.js";
 import type { IdentityAccountStore } from "../domain/identityaccount/store.js";
 import type { IamPolicyStore } from "../domain/iampolicy/store.js";
+import type { PlatformClientStore } from "../domain/platformclient/store.js";
 import type { SecretCodec } from "../encryption/codec.js";
 import type { ModelCatalogProvider } from "../domain/workflow/registry/model-catalog-provider.js";
 import type { VisitorErrorPolicy } from "../pipeline/interceptors/error-boundary.js";
+import type { PlatformTokenKeyRing } from "../platformtoken/key-ring.js";
 import type { RunnerCredentialProvider } from "../runnerauth/runner-credential-provider.js";
 import type { SandboxProvisionerFactory } from "../sandbox/provisioner.js";
 import type { AuthorizationQueryEngine } from "./authorization-queries.js";
+import type { GuestTokenMinting } from "./guest-token-minting.js";
 import type { IdentityFederation } from "./identity-federation.js";
 import type { LicenseStatusProvider } from "./license-status.js";
 import type { OutboundEgressPolicy } from "./outbound-egress.js";
@@ -247,4 +255,33 @@ export interface ExtensionDrivers {
    * (extensions/outbound-egress.ts carries the contract).
    */
   readonly outboundEgress?: OutboundEgressPolicy;
+  /**
+   * The platform-client store driver (single-instance point). The
+   * platform-client domain's persistence is a PORT like the
+   * identity-account domain's: when composed, every chain, the mint and
+   * the verifier's liveness read go through this driver (the cloud serves
+   * the domain over its own `cloud.iam_platform_client` table this way,
+   * legacy `pc_` ids included). When absent, the OSS adapter over the
+   * generic Store installs at the compose.ts consumption site.
+   */
+  readonly platformClientStore?: PlatformClientStore;
+  /**
+   * The platform-token key ring (single-instance point): the RS256 keys
+   * every token the server signs for itself rides
+   * (platformtoken/key-ring.ts). Consumed only under an authentication
+   * posture — nothing verifies a token on a server that trusts every
+   * request. When absent there, open source composes its own ring on the
+   * key-manager ladder; a composition declaring an edition other than
+   * open source must supply one (compose.ts refuses to boot without it,
+   * so a hosted edition never signs with a generated key).
+   */
+  readonly platformTokenKeys?: PlatformTokenKeyRing;
+  /**
+   * The guest-token capability (single-instance point): the one
+   * PlatformClientTokenController method only an edition hosting
+   * shared-agent pages serves. When absent, `mintGuestToken` refuses
+   * UNIMPLEMENTED with the edition sentence
+   * (extensions/guest-token-minting.ts carries the contract).
+   */
+  readonly guestTokenMinting?: GuestTokenMinting;
 }

package/src/extensions/guest-token-minting.ts

@@ -0,0 +1,32 @@
+/**
+ * The guest-token capability: `PlatformClientTokenController.mintGuestToken`,
+ * the credential-free mint for anonymous visitors of a shared agent's
+ * hosted page. Single instance, registered as `drivers.guestTokenMinting`
+ * (the identityFederation shape: a driver point whose absence is a
+ * refusal, never a silent no-op).
+ *
+ * Why a capability and not a second service: open source registers the
+ * whole PlatformClientTokenController, because `mintUserToken` is core,
+ * and the composition refuses an extension that registers a service the
+ * core already routes. Guest sharing — the hosted page, its rate limits,
+ * the share resolution, the org's system-managed client and guest
+ * account — is an edition's, so the one method that needs it is
+ * dispatched here.
+ *
+ * Absent, the controller answers UNIMPLEMENTED with the edition sentence
+ * (domain/platformclient/constants.ts). Present, the capability owns the
+ * whole arm: the request has passed the protovalidate interceptor, and
+ * `headers` carries the request's `origin` for the embed checks. It signs
+ * with the ring its own composition supplied (`signPlatformToken`).
+ */
+import type {
+  MintGuestTokenRequest,
+  MintGuestTokenResponse,
+} from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/token_pb";
+
+export interface GuestTokenMinting {
+  mintGuestToken(
+    request: MintGuestTokenRequest,
+    headers: Headers,
+  ): Promise<MintGuestTokenResponse>;
+}

package/src/extensions/identity.ts

@@ -23,10 +23,12 @@
  * known classes from the type surface).
  *
  * `internal` is ratified contract with a structural guarantee: it is
- * minted ONLY by the in-process chain's identity interceptor
- * (boot/inprocess.ts). No IdentityVerifier may produce it — the serving
- * chain always overwrites the position-1 identity from the wire, so a
- * spoofed internal class cannot enter through a transport.
+ * minted ONLY by server code, in pipeline/interceptors/auth.ts — the
+ * in-process chain's identity interceptor (boot/inprocess.ts) and
+ * `serverActingFor`, the server acting for a principal it authenticated
+ * itself (the PlatformClient mint). No IdentityVerifier may produce it —
+ * the serving chain always overwrites the position-1 identity from the
+ * wire, so a spoofed internal class cannot enter through a transport.
  */
 export type CallerClass =
   | "user"

package/src/extensions/list-read-scope.ts

@@ -81,18 +81,15 @@
  *     driver's cost is proportional to the candidates offered (the cloud
  *     checks each one against its authorization engine), and the whole
  *     kind across every tenant is what rolled back on 2026-09-14; the
- *     request's org is tens of rows. Two idioms carry the rule and both
- *     keep their reason: a lane whose Go/Java contract org-narrows in
- *     BOTH editions (environment, memory, schedule, agent-instance,
- *     agent-share and agent-channel lists; the getBy* parent filters)
- *     applies its own filter ABOVE the helper call and passes `""`; a lane
- *     whose contract is cross-org on OSS (`agentExecution.list`,
- *     `workflowExecution.list`, `listPendingApprovals`) hands the request
- *     org to the helper, which applies it before the scope ONLY when a
- *     scope is composed — a scope-less server still returns the input
- *     untouched with the org unconsulted (the first line above). Two lanes
- *     have no org on the wire (`session.list`, `apiKey.findAll`) and offer
- *     the kind until P1 entry 12 pages them.
+ *     request's org is tens of rows. The lanes over the session, execution
+ *     and artifact kinds narrow by the request's org or parent in the
+ *     store's indexed read (store/list-index.ts; every posture honours the
+ *     request) and page there (pipeline/steps/list-page.ts, one batch per
+ *     scope call), passing `""`; the small org-scoped lists (environment,
+ *     memory, schedule, agent-instance, agent-share and agent-channel; the
+ *     getBy* parent filters) apply their own filter above the helper call
+ *     and pass `""` too. `apiKey.findAll` has no org on the wire and offers
+ *     the kind: a few rows per person.
  *   - A KIND WHOSE AUTHORIZATION IS ITS PARENT'S CARRIES THAT PARENT ON
  *     EVERY CANDIDATE (stigmer-cloud 20260913.04 T04, Q-LB-33..36). When
  *     `kind_meta` declares PARENT scope with INHERITED owner

package/src/extensions/registry.ts

@@ -49,9 +49,12 @@ import { BUILT_IN_STORAGE_TYPES } from "../artifactstorage/artifact-storage.js";
 import type { ChannelRuntime } from "../domain/agentchannel/channel-runtime.js";
 import type { IdentityAccountStore } from "../domain/identityaccount/store.js";
 import type { IamPolicyStore } from "../domain/iampolicy/store.js";
+import type { PlatformClientStore } from "../domain/platformclient/store.js";
 import type { SecretCodec } from "../encryption/codec.js";
 import { V1_VERSION } from "../encryption/v1-codec.js";
+import type { PlatformTokenKeyRing } from "../platformtoken/key-ring.js";
 import type { AuthorizationQueryEngine } from "./authorization-queries.js";
+import type { GuestTokenMinting } from "./guest-token-minting.js";
 import type { IdentityFederation } from "./identity-federation.js";
 import type { LicenseStatusProvider } from "./license-status.js";
 import type { OutboundEgressPolicy } from "./outbound-egress.js";
@@ -88,6 +91,17 @@ import type {
  */
 export type ExtensionServiceRegistration = (router: ConnectRouter) => void;
 
+/**
+ * A service registration with the unit that contributed it, so the routes
+ * stage can name the unit when a registration shadows a core route
+ * (compose.ts refuses that at boot: Connect's router keys handlers by
+ * request path and the last registration wins, silently).
+ */
+export interface ResolvedServiceRegistration {
+  readonly unit: string;
+  readonly register: ExtensionServiceRegistration;
+}
+
 /**
  * One named extension unit — a package's whole contribution to the server
  * composition. All fields but `name` are optional; an omitted field is
@@ -191,7 +205,7 @@ export interface ResolvedExtensions {
   readonly statusObservers: ReadonlyArray<AgentExecutionStatusObserver>;
   readonly responseDecorators: ReadonlyArray<AgentExecutionResponseDecorator>;
   readonly drivers: ResolvedExtensionDrivers;
-  readonly services: ReadonlyArray<ExtensionServiceRegistration>;
+  readonly services: ReadonlyArray<ResolvedServiceRegistration>;
   readonly workers: ReadonlyArray<WorkerFactory>;
 }
 
@@ -284,6 +298,22 @@ export interface ResolvedExtensionDrivers {
    * source's relaxed posture (only the link-local range refused).
    */
   readonly outboundEgress: OutboundEgressPolicy | undefined;
+  /**
+   * The platform-client store driver — undefined = compose.ts installs the
+   * OSS adapter over the generic Store.
+   */
+  readonly platformClientStore: PlatformClientStore | undefined;
+  /**
+   * The platform-token key ring — undefined = compose.ts composes open
+   * source's ring under an authentication posture, and refuses to boot a
+   * non-open-source edition that supplied none.
+   */
+  readonly platformTokenKeys: PlatformTokenKeyRing | undefined;
+  /**
+   * The guest-token capability — undefined = `mintGuestToken` refuses
+   * UNIMPLEMENTED with the edition sentence.
+   */
+  readonly guestTokenMinting: GuestTokenMinting | undefined;
 }
 
 /**
@@ -301,7 +331,7 @@ export function resolveExtensions(
   const gateSteps = new Map<string, ReadonlyArray<PipelineStep<DescMessage>>>();
   const statusObservers: AgentExecutionStatusObserver[] = [];
   const responseDecorators: AgentExecutionResponseDecorator[] = [];
-  const services: ExtensionServiceRegistration[] = [];
+  const services: ResolvedServiceRegistration[] = [];
   const workers: WorkerFactory[] = [];
 
   let edition: ServerEdition | undefined;
@@ -341,6 +371,12 @@ export function resolveExtensions(
   let licenseStatusDeclaredBy: string | undefined;
   let outboundEgress: OutboundEgressPolicy | undefined;
   let outboundEgressDeclaredBy: string | undefined;
+  let platformClientStore: PlatformClientStore | undefined;
+  let platformClientStoreDeclaredBy: string | undefined;
+  let platformTokenKeys: PlatformTokenKeyRing | undefined;
+  let platformTokenKeysDeclaredBy: string | undefined;
+  let guestTokenMinting: GuestTokenMinting | undefined;
+  let guestTokenMintingDeclaredBy: string | undefined;
   const artifactStorageDrivers = new Map<
     string,
     ArtifactStorageDriverFactory
@@ -552,6 +588,36 @@ export function resolveExtensions(
       outboundEgressDeclaredBy = unit.name;
     }
 
+    if (unit.drivers?.platformClientStore !== undefined) {
+      if (platformClientStoreDeclaredBy !== undefined) {
+        throw new Error(
+          `extension '${unit.name}' registers a PlatformClientStore, but '${platformClientStoreDeclaredBy}' already did — exactly one may be composed`,
+        );
+      }
+      platformClientStore = unit.drivers.platformClientStore;
+      platformClientStoreDeclaredBy = unit.name;
+    }
+
+    if (unit.drivers?.platformTokenKeys !== undefined) {
+      if (platformTokenKeysDeclaredBy !== undefined) {
+        throw new Error(
+          `extension '${unit.name}' registers a PlatformTokenKeyRing, but '${platformTokenKeysDeclaredBy}' already did — exactly one may be composed`,
+        );
+      }
+      platformTokenKeys = unit.drivers.platformTokenKeys;
+      platformTokenKeysDeclaredBy = unit.name;
+    }
+
+    if (unit.drivers?.guestTokenMinting !== undefined) {
+      if (guestTokenMintingDeclaredBy !== undefined) {
+        throw new Error(
+          `extension '${unit.name}' registers a GuestTokenMinting capability, but '${guestTokenMintingDeclaredBy}' already did — exactly one may be composed`,
+        );
+      }
+      guestTokenMinting = unit.drivers.guestTokenMinting;
+      guestTokenMintingDeclaredBy = unit.name;
+    }
+
     if (unit.drivers?.artifactStorageDrivers !== undefined) {
       for (const [name, factory] of unit.drivers.artifactStorageDrivers) {
         if ((BUILT_IN_STORAGE_TYPES as ReadonlyArray<string>).includes(name)) {
@@ -643,7 +709,12 @@ export function resolveExtensions(
     responseDecorators.push(
       ...(unit.statusTransitionHooks?.responseDecorators ?? []),
     );
-    services.push(...(unit.services ?? []));
+    services.push(
+      ...(unit.services ?? []).map((register) => ({
+        unit: unit.name,
+        register,
+      })),
+    );
     workers.push(...(unit.workers ?? []));
   }
 
@@ -679,6 +750,9 @@ export function resolveExtensions(
       authorizationQueries,
       licenseStatus,
       outboundEgress,
+      platformClientStore,
+      platformTokenKeys,
+      guestTokenMinting,
     },
     services,
     workers,