@stigmer/server 3.24.0 → 3.26.0

package/dist/domain/platform/controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/platform/controller.ts"],"names":[],"mappings":"AAiDA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AACjF,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,EACpC,gCAAgC,EAChC,yBAAyB,EACzB,uBAAuB,GAExB,MAAM,uDAAuD,CAAC;AAW/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAKvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AA+C7E,yEAAyE;AACzE,MAAM,UAAU,wBAAwB,CACtC,MAAqB,EACrB,IAA4B;IAE5B,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE;QACtC,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC;QACxC,gBAAgB,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;QAC9C,wBAAwB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CACxC,wBAAwB,CAAC,IAAI,EAAE,GAAG,CAAC;QACrC,oBAAoB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACnC,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED,gEAAgE;AAChE,SAAS,aAAa,CAAC,IAA4B;IACjD,OAAO,MAAM,CAAC,yBAAyB,EAAE;QACvC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,gBAAgB,CAC7B,IAA4B;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,4BAA4B,EAAE;QAClD,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,iBAAiB,CAAC,GAAG,CAAC;KAClC,CAAC,CAAC;IACH,QAAQ,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,YAAY,CAAC,MAAM;YACtB,OAAO,MAAM,CAAC;QAChB,KAAK,YAAY,CAAC,OAAO;YACvB,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC5B,OAAO,MAAM,CAAC;QAChB,KAAK,YAAY,CAAC,KAAK,CAAC;QACxB,KAAK,YAAY,CAAC,QAAQ,CAAC;QAC3B,KAAK,YAAY,CAAC,KAAK,CAAC;QACxB,KAAK,YAAY,CAAC,OAAO;YACvB,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC5B,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,OAAO,MAAM,CAAC;QAChB,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,MAAM,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,wBAAwB,CACrC,IAA4B,EAC5B,GAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,CAAC,oCAAoC,EAAE;QAC1D,eAAe,EAAE,IAAI,CAAC,gBAAgB;QACtC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IACH,MAAM,oBAAoB,GACxB,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC5E,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,iBAAiB,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC;YACzD,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;YAC5B,MAAM,CAAC,iCAAiC;gBACtC,WAAW,CAAC,WAAW,CAAC,gBAAgB,CAAC;QAC7C,CAAC;QACD,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,oBAAoB,GAAG,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC;YAChE,MAAM,CAAC,sBAAsB,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC;YAC9D,MAAM,CAAC,6BAA6B;gBAClC,WAAW,CAAC,WAAW,CAAC,kBAAkB,IAAI,EAAE,CAAC;YACnD,MAAM,CAAC,+BAA+B;gBACpC,WAAW,CAAC,WAAW,CAAC,cAAc,IAAI,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wEAAwE,EACxE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAA4B,EAC5B,KAAgC,EAChC,GAAmB;IAEnB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,IAAI,CAC/D,IAAI,CAAC,iBAAiB,CACvB,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAC3B,iBAAiB,CAAC,KAAK,CAAC,EACxB,gBAAgB,CAAC,GAAG,CAAC,CACtB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC,gCAAgC,EAAE;YAC9C,iBAAiB,EAAE,MAAM,CAAC,KAAK;YAC/B,SAAS,EAAE,QAAQ;YACnB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAmB,CAAC;IACxB,QAAQ,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,kBAAkB;YACrB,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;YAChC,MAAM;QACR,KAAK,qBAAqB;YACxB,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;YAChC,MAAM;QACR,KAAK,WAAW,CAAC;QACjB,KAAK,SAAS,CAAC;QACf,KAAK,SAAS;YACZ,iEAAiE;YACjE,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC,KAAK,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,IACE,WAAW,KAAK,EAAE;QAClB,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,2BAA2B,CAAC,EAC9D,CAAC;QACD,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CACxC,2BAA2B,EAC3B,WAAW,EACX,CAAC,CACF,CAAC;QACF,OAAO,MAAM,CAAC,gCAAgC,EAAE;YAC9C,iBAAiB,EAAE,MAAM,CAAC,KAAK;YAC/B,SAAS,EAAE,QAAQ;YACnB,gBAAgB,EAAE,MAAM,CAAC,UAAU;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2DAA2D,EAC3D;YACE,WAAW;YACX,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;QACF,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,KAAgC;IAEhC,QAAQ,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,kBAAkB;YACrB,OAAO,EAAE,GAAG,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACpE,KAAK,qBAAqB;YACxB,OAAO,EAAE,GAAG,EAAE,oBAAoB,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACvE,KAAK,WAAW;YACd,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACvE,KAAK,SAAS;YACZ,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QAC5B,KAAK,SAAS;YACZ,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC,KAAK,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/platform/controller.ts"],"names":[],"mappings":"AAiDA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AACjF,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,EACpC,gCAAgC,EAChC,yBAAyB,EACzB,uBAAuB,GAExB,MAAM,uDAAuD,CAAC;AAW/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAKvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAyD7E,yEAAyE;AACzE,MAAM,UAAU,wBAAwB,CACtC,MAAqB,EACrB,IAA4B;IAE5B,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE;QACtC,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC;QACxC,gBAAgB,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;QAC9C,wBAAwB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CACxC,wBAAwB,CAAC,IAAI,EAAE,GAAG,CAAC;QACrC,oBAAoB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACnC,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED,wFAAwF;AACxF,SAAS,aAAa,CAAC,IAA4B;IACjD,OAAO,MAAM,CAAC,yBAAyB,EAAE;QACvC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,gBAAgB,CAC7B,IAA4B;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,4BAA4B,EAAE;QAClD,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,iBAAiB,CAAC,GAAG,CAAC;KAClC,CAAC,CAAC;IACH,QAAQ,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,YAAY,CAAC,MAAM;YACtB,OAAO,MAAM,CAAC;QAChB,KAAK,YAAY,CAAC,OAAO;YACvB,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC5B,OAAO,MAAM,CAAC;QAChB,KAAK,YAAY,CAAC,KAAK,CAAC;QACxB,KAAK,YAAY,CAAC,QAAQ,CAAC;QAC3B,KAAK,YAAY,CAAC,KAAK,CAAC;QACxB,KAAK,YAAY,CAAC,OAAO;YACvB,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC5B,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,OAAO,MAAM,CAAC;QAChB,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,MAAM,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,wBAAwB,CACrC,IAA4B,EAC5B,GAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,CAAC,oCAAoC,EAAE;QAC1D,eAAe,EAAE,IAAI,CAAC,gBAAgB;QACtC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IACH,MAAM,oBAAoB,GACxB,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC5E,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,iBAAiB,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC;YACzD,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;YAC5B,MAAM,CAAC,iCAAiC;gBACtC,WAAW,CAAC,WAAW,CAAC,gBAAgB,CAAC;QAC7C,CAAC;QACD,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,oBAAoB,GAAG,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC;YAChE,MAAM,CAAC,sBAAsB,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC;YAC9D,MAAM,CAAC,6BAA6B;gBAClC,WAAW,CAAC,WAAW,CAAC,kBAAkB,IAAI,EAAE,CAAC;YACnD,MAAM,CAAC,+BAA+B;gBACpC,WAAW,CAAC,WAAW,CAAC,cAAc,IAAI,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wEAAwE,EACxE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAA4B,EAC5B,KAAgC,EAChC,GAAmB;IAEnB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,IAAI,CAC/D,IAAI,CAAC,iBAAiB,CACvB,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAC3B,iBAAiB,CAAC,KAAK,CAAC,EACxB,gBAAgB,CAAC,GAAG,CAAC,CACtB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC,gCAAgC,EAAE;YAC9C,iBAAiB,EAAE,MAAM,CAAC,KAAK;YAC/B,SAAS,EAAE,QAAQ;YACnB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAmB,CAAC;IACxB,QAAQ,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,kBAAkB;YACrB,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;YAChC,MAAM;QACR,KAAK,qBAAqB;YACxB,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;YAChC,MAAM;QACR,KAAK,WAAW,CAAC;QACjB,KAAK,SAAS,CAAC;QACf,KAAK,SAAS;YACZ,iEAAiE;YACjE,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC,KAAK,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,IACE,WAAW,KAAK,EAAE;QAClB,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,2BAA2B,CAAC,EAC9D,CAAC;QACD,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CACxC,2BAA2B,EAC3B,WAAW,EACX,CAAC,CACF,CAAC;QACF,OAAO,MAAM,CAAC,gCAAgC,EAAE;YAC9C,iBAAiB,EAAE,MAAM,CAAC,KAAK;YAC/B,SAAS,EAAE,QAAQ;YACnB,gBAAgB,EAAE,MAAM,CAAC,UAAU;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2DAA2D,EAC3D;YACE,WAAW;YACX,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;QACF,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,KAAgC;IAEhC,QAAQ,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,kBAAkB;YACrB,OAAO,EAAE,GAAG,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACpE,KAAK,qBAAqB;YACxB,OAAO,EAAE,GAAG,EAAE,oBAAoB,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACvE,KAAK,WAAW;YACd,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACvE,KAAK,SAAS;YACZ,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QAC5B,KAAK,SAAS;YACZ,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC,KAAK,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/domain/platformclient/constants.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The platform-client domain's pinned vocabulary: reserved names, the
+ * user-token claim names and every refusal sentence.
+ *
+ * Most copy is wire contract inherited from Stigmer Cloud, which has
+ * answered integrators with these exact sentences since the Java service:
+ * the mint's credential, expiry, organization and provisioning refusals,
+ * the system-managed and reserved-slug refusals, and the minting client's
+ * liveness and origin refusals on every request its tokens bear (pinned
+ * cross-edition by platformclient-enforcement.conformance.test.ts). The
+ * sentences open source adds — a server that cannot mint, the guest
+ * method's edition refusal, the mismatched-account guard — follow the
+ * house style (single-quoted handles).
+ */
+/** The kind's name as the shared error constructors render it. */
+export declare const PLATFORM_CLIENT_KIND_NAME = "PlatformClient";
+/**
+ * The slug of an organization's system-managed share client: the client
+ * an edition that hosts shared-agent pages names in the tokens it signs
+ * for guests and schedule fires, so every platform token names a real
+ * client. A user client holding it would be adopted by those lanes.
+ */
+export declare const SYSTEM_SHARE_CLIENT_SLUG = "system-share-client";
+/**
+ * Slugs the platform keeps for its own clients: the create chain refuses
+ * them, and newSystemManagedPlatformClient builds only under them.
+ */
+export declare const RESERVED_PLATFORM_CLIENT_SLUGS: ReadonlySet<string>;
+/** The claims the PlatformClient user token carries beside the envelope's. */
+export declare const USER_TOKEN_CLAIMS: {
+    readonly subject: "sub";
+    readonly externalUserId: "ext_user_id";
+    readonly email: "email";
+    readonly name: "name";
+    readonly org: "org";
+    readonly platformClientId: "platform_client_id";
+};
+/** The mint response's token_type. */
+export declare const BEARER_TOKEN_TYPE = "Bearer";
+export declare function reservedSlugMessage(slug: string): string;
+/** The three mutations a system-managed client refuses. */
+export type SystemManagedMutation = "updated" | "deleted" | "rotated";
+export declare function systemManagedMessage(verb: SystemManagedMutation): string;
+export declare function referenceNotFoundMessage(org: string, slug: string): string;
+export declare const INVALID_CLIENT_CREDENTIALS_MESSAGE = "Invalid client_id or client_secret";
+export declare const EXPIRED_CLIENT_SECRET_MESSAGE = "PlatformClient secret has expired. Use rotateSecret to generate a new one.";
+export declare function organizationMismatchMessage(owningOrg: string): string;
+export declare function noAccountMessage(externalUserId: string, org: string): string;
+export declare const OWNER_AUTO_GRANT_MESSAGE = "auto_grant_role cannot be 'owner'; organization ownership must be assigned explicitly.";
+export declare const PROVISIONING_FAILED_MESSAGE = "Account provisioning failed. No partial account was left behind; the request is safe to retry.";
+export declare function blankSubjectPartMessage(part: "org" | "externalUserId"): string;
+export declare function subjectSeparatorMessage(part: "org" | "externalUserId", value: string): string;
+export declare function foreignAccountMessage(externalUserId: string, org: string): string;
+export declare const MINTING_REQUIRES_AUTHENTICATION_MESSAGE = "mintUserToken requires a server that authenticates its callers: this server trusts every request, so nothing would verify the token \u2014 configure an identity provider (STIGMER_OIDC_ISSUER) to enable PlatformClient token minting";
+export declare const MINTING_DISABLED_MESSAGE = "mintUserToken is disabled: this server's platform-token key ring holds no signing key";
+export declare const GUEST_MINT_UNIMPLEMENTED_MESSAGE = "PlatformClientTokenController.mintGuestToken is not implemented: guest tokens for shared agents are served by the Cloud edition";
+export declare const TOKEN_NAMES_NO_CLIENT_MESSAGE = "platform token names no platform client";
+export declare const DELETED_CLIENT_MESSAGE = "The platform client that minted this token has been deleted, so the token is no longer accepted. Mint a new user token from an active platform client.";
+export declare function originRefusalMessage(origin: string): string;
+//# sourceMappingURL=constants.d.ts.map

package/dist/domain/platformclient/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,kEAAkE;AAClE,eAAO,MAAM,yBAAyB,mBAAmB,CAAC;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,CAE7D,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB;;;;;;;CAOpB,CAAC;AAEX,sCAAsC;AACtC,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,2DAA2D;AAC3D,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAEtE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,MAAM,CAExE;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,eAAO,MAAM,kCAAkC,uCACT,CAAC;AAEvC,eAAO,MAAM,6BAA6B,+EACoC,CAAC;AAE/E,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,eAAO,MAAM,wBAAwB,2FACqD,CAAC;AAE3F,eAAO,MAAM,2BAA2B,mGAC0D,CAAC;AAEnG,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,KAAK,GAAG,gBAAgB,GAC7B,MAAM,CAER;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,KAAK,GAAG,gBAAgB,EAC9B,KAAK,EAAE,MAAM,GACZ,MAAM,CAER;AAED,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,MAAM,GACV,MAAM,CAER;AAED,eAAO,MAAM,uCAAuC,2OACiL,CAAC;AAEtO,eAAO,MAAM,wBAAwB,0FACoD,CAAC;AAE1F,eAAO,MAAM,gCAAgC,oIACsF,CAAC;AAEpI,eAAO,MAAM,6BAA6B,4CACC,CAAC;AAE5C,eAAO,MAAM,sBAAsB,2JACuH,CAAC;AAE3J,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3D"}

package/dist/domain/platformclient/constants.js

@@ -0,0 +1,78 @@
+/**
+ * The platform-client domain's pinned vocabulary: reserved names, the
+ * user-token claim names and every refusal sentence.
+ *
+ * Most copy is wire contract inherited from Stigmer Cloud, which has
+ * answered integrators with these exact sentences since the Java service:
+ * the mint's credential, expiry, organization and provisioning refusals,
+ * the system-managed and reserved-slug refusals, and the minting client's
+ * liveness and origin refusals on every request its tokens bear (pinned
+ * cross-edition by platformclient-enforcement.conformance.test.ts). The
+ * sentences open source adds — a server that cannot mint, the guest
+ * method's edition refusal, the mismatched-account guard — follow the
+ * house style (single-quoted handles).
+ */
+/** The kind's name as the shared error constructors render it. */
+export const PLATFORM_CLIENT_KIND_NAME = "PlatformClient";
+/**
+ * The slug of an organization's system-managed share client: the client
+ * an edition that hosts shared-agent pages names in the tokens it signs
+ * for guests and schedule fires, so every platform token names a real
+ * client. A user client holding it would be adopted by those lanes.
+ */
+export const SYSTEM_SHARE_CLIENT_SLUG = "system-share-client";
+/**
+ * Slugs the platform keeps for its own clients: the create chain refuses
+ * them, and newSystemManagedPlatformClient builds only under them.
+ */
+export const RESERVED_PLATFORM_CLIENT_SLUGS = new Set([
+    SYSTEM_SHARE_CLIENT_SLUG,
+]);
+/** The claims the PlatformClient user token carries beside the envelope's. */
+export const USER_TOKEN_CLAIMS = {
+    subject: "sub",
+    externalUserId: "ext_user_id",
+    email: "email",
+    name: "name",
+    org: "org",
+    platformClientId: "platform_client_id",
+};
+/** The mint response's token_type. */
+export const BEARER_TOKEN_TYPE = "Bearer";
+export function reservedSlugMessage(slug) {
+    return `The slug '${slug}' is reserved for the platform's system-managed resources and cannot be used. If you did not provide a slug explicitly, it was derived from the resource name — choose a different name or provide an explicit slug.`;
+}
+export function systemManagedMessage(verb) {
+    return `This platform client is system-managed and cannot be ${verb}`;
+}
+export function referenceNotFoundMessage(org, slug) {
+    return `PlatformClient '${org}/${slug}' not found`;
+}
+export const INVALID_CLIENT_CREDENTIALS_MESSAGE = "Invalid client_id or client_secret";
+export const EXPIRED_CLIENT_SECRET_MESSAGE = "PlatformClient secret has expired. Use rotateSecret to generate a new one.";
+export function organizationMismatchMessage(owningOrg) {
+    return `org_id must be empty or the PlatformClient's owning organization ('${owningOrg}'); cross-organization minting is not supported`;
+}
+export function noAccountMessage(externalUserId, org) {
+    return `User '${externalUserId}' has no Stigmer account in organization '${org}'. Enable auto_provision_accounts on the PlatformClient or create the account first.`;
+}
+export const OWNER_AUTO_GRANT_MESSAGE = "auto_grant_role cannot be 'owner'; organization ownership must be assigned explicitly.";
+export const PROVISIONING_FAILED_MESSAGE = "Account provisioning failed. No partial account was left behind; the request is safe to retry.";
+export function blankSubjectPartMessage(part) {
+    return `${part} must not be null or blank`;
+}
+export function subjectSeparatorMessage(part, value) {
+    return `${part} must not contain the separator character '|': ${value}`;
+}
+export function foreignAccountMessage(externalUserId, org) {
+    return `User '${externalUserId}' in organization '${org}' resolves to an account no platform client provisioned — refusing to mint a token for it`;
+}
+export const MINTING_REQUIRES_AUTHENTICATION_MESSAGE = "mintUserToken requires a server that authenticates its callers: this server trusts every request, so nothing would verify the token — configure an identity provider (STIGMER_OIDC_ISSUER) to enable PlatformClient token minting";
+export const MINTING_DISABLED_MESSAGE = "mintUserToken is disabled: this server's platform-token key ring holds no signing key";
+export const GUEST_MINT_UNIMPLEMENTED_MESSAGE = "PlatformClientTokenController.mintGuestToken is not implemented: guest tokens for shared agents are served by the Cloud edition";
+export const TOKEN_NAMES_NO_CLIENT_MESSAGE = "platform token names no platform client";
+export const DELETED_CLIENT_MESSAGE = "The platform client that minted this token has been deleted, so the token is no longer accepted. Mint a new user token from an active platform client.";
+export function originRefusalMessage(origin) {
+    return `Request origin '${origin}' is not in this platform client's allowed_origins. Add it to the PlatformClient's allowed_origins to permit browser requests from this origin.`;
+}
+//# sourceMappingURL=constants.js.map

package/dist/domain/platformclient/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/platformclient/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,kEAAkE;AAClE,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAE9D;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC;IACzE,wBAAwB;CACzB,CAAC,CAAC;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,OAAO,EAAE,KAAK;IACd,cAAc,EAAE,aAAa;IAC7B,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;IACV,gBAAgB,EAAE,oBAAoB;CAC9B,CAAC;AAEX,sCAAsC;AACtC,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,aAAa,IAAI,sNAAsN,CAAC;AACjP,CAAC;AAKD,MAAM,UAAU,oBAAoB,CAAC,IAA2B;IAC9D,OAAO,wDAAwD,IAAI,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAW,EAAE,IAAY;IAChE,OAAO,mBAAmB,GAAG,IAAI,IAAI,aAAa,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,MAAM,kCAAkC,GAC7C,oCAAoC,CAAC;AAEvC,MAAM,CAAC,MAAM,6BAA6B,GACxC,4EAA4E,CAAC;AAE/E,MAAM,UAAU,2BAA2B,CAAC,SAAiB;IAC3D,OAAO,sEAAsE,SAAS,iDAAiD,CAAC;AAC1I,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,cAAsB,EAAE,GAAW;IAClE,OAAO,SAAS,cAAc,6CAA6C,GAAG,sFAAsF,CAAC;AACvK,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GACnC,wFAAwF,CAAC;AAE3F,MAAM,CAAC,MAAM,2BAA2B,GACtC,gGAAgG,CAAC;AAEnG,MAAM,UAAU,uBAAuB,CACrC,IAA8B;IAE9B,OAAO,GAAG,IAAI,4BAA4B,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAA8B,EAC9B,KAAa;IAEb,OAAO,GAAG,IAAI,kDAAkD,KAAK,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,cAAsB,EACtB,GAAW;IAEX,OAAO,SAAS,cAAc,sBAAsB,GAAG,2FAA2F,CAAC;AACrJ,CAAC;AAED,MAAM,CAAC,MAAM,uCAAuC,GAClD,mOAAmO,CAAC;AAEtO,MAAM,CAAC,MAAM,wBAAwB,GACnC,uFAAuF,CAAC;AAE1F,MAAM,CAAC,MAAM,gCAAgC,GAC3C,iIAAiI,CAAC;AAEpI,MAAM,CAAC,MAAM,6BAA6B,GACxC,yCAAyC,CAAC;AAE5C,MAAM,CAAC,MAAM,sBAAsB,GACjC,wJAAwJ,CAAC;AAE3J,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,OAAO,mBAAmB,MAAM,iJAAiJ,CAAC;AACpL,CAAC"}

package/dist/domain/platformclient/controller.d.ts

@@ -0,0 +1,59 @@
+/**
+ * PlatformClient controller — the command and query sides, served by open
+ * source in every edition (the token side is token-controller.ts). A
+ * PlatformClient is an organization's inbound credential pair: its backend
+ * presents client_id + client_secret to mint short-lived user tokens for
+ * its own product's users (mint.ts). The inbound counterpart to OAuthApp,
+ * whose controller this one follows chain for chain.
+ *
+ * Every chain opens with Authorize and runs over the PlatformClientStore
+ * port (store.ts), so the cloud serves these same chains over its own
+ * table. What the domain adds to the OAuthApp shape:
+ *   - the credential steps: generated on create and shown once in
+ *     PlatformClientCreateResponse, kept from the row on update, replaced
+ *     by rotateSecret (the client_id is permanent);
+ *   - `system-share-client` refused on create, and the platform's
+ *     system-managed clients refused on update, delete and rotate;
+ *   - the reference rule on `environment_refs` (NormalizeReferences, then
+ *     ValidateReferences) on create and update, which every chain that
+ *     stores a spec reference runs; it reads the environments from the
+ *     resource Store, not from the port, because a driver may keep client
+ *     rows in a table of its own while environments stay in the Store;
+ *   - the stored hash cleared on EVERY response, deletes and rotations
+ *     included — the model promises it is never returned
+ *     (fga/model/iam/platform_client.fga), and no reader needs it;
+ *   - getByReference loads, then authorizes the loaded client exactly as
+ *     `get` would (AuthorizeResolvedTarget), and listByOrg narrows through
+ *     the list read scope, so a member who may not `get` a client does not
+ *     see it listed either: the model gives organization members no access
+ *     to a credential.
+ *
+ * There is no apply and no updateVisibility: clients are created through
+ * the console or the API and are always organization-private.
+ *
+ * Proven by platformclient.conformance.test.ts (local targets and the
+ * cloud) and __tests__/controller.test.ts.
+ */
+import type { ConnectRouter } from "@connectrpc/connect";
+import type { Logger } from "../../boot/logger.js";
+import type { Authorizer } from "../../extensions/authorizer.js";
+import type { ListReadScope } from "../../extensions/list-read-scope.js";
+import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
+import type { Store } from "../../store/interface.js";
+import type { PlatformClientStore } from "./store.js";
+export interface PlatformClientControllerDeps {
+    /** The composed store — a driver's, or the OSS adapter over the generic Store. */
+    readonly clients: PlatformClientStore;
+    /** The resource store the reference rule reads the environments `environment_refs` names from. */
+    readonly store: Store;
+    readonly logger: Logger;
+    /** The composed authorization seam — the Authorize step at position 1 of every chain calls it. */
+    readonly authorizer: Authorizer;
+    /** The composed tuple-lifecycle driver — undefined = the shared steps no-op. */
+    readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
+    /** The composed list read scope — listByOrg narrows through it; undefined = every client of the org. */
+    readonly listReadScope: ListReadScope | undefined;
+}
+/** Registers the command and query services on the router (routes stage). */
+export declare function registerPlatformClientServices(router: ConnectRouter, deps: PlatformClientControllerDeps): void;
+//# sourceMappingURL=controller.d.ts.map

package/dist/domain/platformclient/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAwBzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AA6BjG,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAoBtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,WAAW,4BAA4B;IAC3C,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,kGAAkG;IAClG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kGAAkG;IAClG,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,gFAAgF;IAChF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC5E,wGAAwG;IACxG,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;CACnD;AAED,6EAA6E;AAC7E,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,4BAA4B,GACjC,IAAI,CAYN"}

package/dist/domain/platformclient/controller.js

@@ -0,0 +1,191 @@
+import { create } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { PlatformClientSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+import { PlatformClientCommandController } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/command_pb";
+import { PlatformClientCreateResponseSchema, PlatformClientsSchema, } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/io_pb";
+import { PlatformClientQueryController } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/query_pb";
+import { restrictListByReadScope } from "../../extensions/list-read-scope.js";
+import { internalError } from "../../pipeline/errors.js";
+import { apiResourceKindKey } from "../../pipeline/interceptors/apiresource.js";
+import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
+import { newPipeline } from "../../pipeline/pipeline.js";
+import { RequestContext } from "../../pipeline/request-context.js";
+import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import { loadedTargetAsMethod, newAuthorizeResolvedTargetStep, } from "../../pipeline/steps/authorize-resolved-target.js";
+import { newCleanupIamPoliciesStep, newCreateAuthorizationTuplesStep, } from "../../pipeline/steps/authorization-tuples.js";
+import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
+import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
+import { RESOURCE_ID_KEY } from "../../pipeline/steps/delete.js";
+import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
+import { compareCreatedAtDesc } from "../../pipeline/steps/helpers.js";
+import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
+import { TARGET_RESOURCE_KEY } from "../../pipeline/steps/load-target.js";
+import { newNormalizeReferencesStep, newValidateReferencesStep, } from "../../pipeline/steps/references.js";
+import { newResolveSlugStep } from "../../pipeline/steps/slug.js";
+import { newValidateVisibilityStep } from "../../pipeline/steps/validate-visibility.js";
+import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
+import { newCheckDuplicateStep, newDeleteClientStep, newGenerateClientCredentialsStep, newLoadClientByReferenceStep, newLoadExistingClientForDeleteStep, newLoadExistingClientStep, newLoadTargetClientStep, newPersistNewClientStep, newPersistTargetClientStep, newPersistUpdatedClientStep, newPreserveClientCredentialsStep, newRefuseReservedSlugStep, newRefuseSystemManagedStep, newRotateClientCredentialsStep, parkedClientSecret, redactPlatformClient, storedClientOf, } from "./steps.js";
+/** Registers the command and query services on the router (routes stage). */
+export function registerPlatformClientServices(router, deps) {
+    router.service(PlatformClientCommandController, {
+        create: (client, ctx) => createClient(deps, client, ctx),
+        update: (client, ctx) => updateClient(deps, client, ctx),
+        delete: (input, ctx) => deleteClient(deps, input, ctx),
+        rotateSecret: (id, ctx) => rotateSecret(deps, id, ctx),
+    });
+    router.service(PlatformClientQueryController, {
+        get: (id, ctx) => get(deps, id, ctx),
+        getByReference: (ref, ctx) => getByReference(deps, ref, ctx),
+        listByOrg: (input, ctx) => listByOrg(deps, input, ctx),
+    });
+}
+function kindOf(ctx) {
+    return ctx.values.get(apiResourceKindKey);
+}
+/**
+ * Create — OAuthApp's chain with the reserved-slug refusal after the slug
+ * resolves, the reference rule where every sibling chain runs it, and the
+ * credentials generated only once the row is known to be storable; the
+ * response carries the redacted client and the one look at its secret.
+ */
+async function createClient(deps, client, ctx) {
+    const reqCtx = new RequestContext(PlatformClientSchema, client, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("platformclient-create", deps.logger)
+        .addStep(newAuthorizeStep(PlatformClientCommandController.method.create, deps.authorizer))
+        .addStep(newResolveSlugStep())
+        .addStep(newValidateProtoStep())
+        .addStep(newValidateVisibilityStep())
+        .addStep(newRefuseReservedSlugStep())
+        .addStep(newCheckDuplicateStep(deps.clients))
+        .addStep(newBuildNewStateStep())
+        .addStep(newGuardReservedLabelsStep(deps.authorizer))
+        .addStep(newNormalizeReferencesStep())
+        .addStep(newValidateReferencesStep(deps.store))
+        .addStep(newGenerateClientCredentialsStep())
+        .addStep(newPersistNewClientStep(deps.clients))
+        .addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle, deps.logger))
+        .build()
+        .execute(reqCtx);
+    return create(PlatformClientCreateResponseSchema, {
+        platformClient: redactPlatformClient(reqCtx.newState),
+        clientSecret: parkedClientSecret(reqCtx),
+    });
+}
+/**
+ * Update — full spec replacement from the request (BuildUpdateState),
+ * addressed by id or org-scoped slug; the platform's own clients refused
+ * before any state is built; the reference rule as on create; the
+ * credential fields kept from the row.
+ */
+async function updateClient(deps, client, ctx) {
+    const reqCtx = new RequestContext(PlatformClientSchema, client, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("platformclient-update", deps.logger)
+        .addStep(newAuthorizeStep(PlatformClientCommandController.method.update, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newResolveSlugStep())
+        .addStep(newLoadExistingClientStep(deps.clients))
+        .addStep(newRefuseSystemManagedStep("updated", EXISTING_RESOURCE_KEY))
+        .addStep(newBuildUpdateStateStep())
+        .addStep(newGuardReservedLabelsStep(deps.authorizer))
+        .addStep(newNormalizeReferencesStep())
+        .addStep(newValidateReferencesStep(deps.store))
+        .addStep(newPreserveClientCredentialsStep())
+        .addStep(newPersistUpdatedClientStep(deps.clients))
+        .build()
+        .execute(reqCtx);
+    return redactPlatformClient(reqCtx.newState);
+}
+/**
+ * Delete — the platform's own clients refused before the delete; the
+ * client's policies cleaned up after. The client's outstanding tokens stop
+ * at their next request (the verifier's liveness read); the end-user
+ * accounts it provisioned stay, because an account belongs to the
+ * organization, not to one of its clients.
+ */
+async function deleteClient(deps, input, ctx) {
+    const reqCtx = new RequestContext(PlatformClientCommandController.method.delete.input, input, callerIdentityOf(ctx), kindOf(ctx));
+    // ApiResourceDeleteInput carries resource_id, not the `value` field
+    // ExtractResourceId reads (OAuthApp's pattern).
+    reqCtx.set(RESOURCE_ID_KEY, input.resourceId);
+    await newPipeline("platformclient-delete", deps.logger)
+        .addStep(newAuthorizeStep(PlatformClientCommandController.method.delete, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadExistingClientForDeleteStep(deps.clients))
+        .addStep(newRefuseSystemManagedStep("deleted", EXISTING_RESOURCE_KEY))
+        .addStep(newDeleteClientStep(deps.clients))
+        .addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle, deps.logger))
+        .build()
+        .execute(reqCtx);
+    return redactPlatformClient(storedClientOf(reqCtx, EXISTING_RESOURCE_KEY));
+}
+/**
+ * RotateSecret — a new secret for the loaded client (the client_id stays),
+ * shown once in the response. Tokens already minted stay valid until they
+ * expire; deleting the client is what revokes them.
+ */
+async function rotateSecret(deps, id, ctx) {
+    const reqCtx = new RequestContext(PlatformClientCommandController.method.rotateSecret.input, id, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("platformclient-rotate-secret", deps.logger)
+        .addStep(newAuthorizeStep(PlatformClientCommandController.method.rotateSecret, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadTargetClientStep(deps.clients))
+        .addStep(newRefuseSystemManagedStep("rotated", TARGET_RESOURCE_KEY))
+        .addStep(newRotateClientCredentialsStep())
+        .addStep(newPersistTargetClientStep(deps.clients))
+        .build()
+        .execute(reqCtx);
+    return create(PlatformClientCreateResponseSchema, {
+        platformClient: redactPlatformClient(storedClientOf(reqCtx, TARGET_RESOURCE_KEY)),
+        clientSecret: parkedClientSecret(reqCtx),
+    });
+}
+async function get(deps, id, ctx) {
+    const reqCtx = new RequestContext(PlatformClientQueryController.method.get.input, id, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("platformclient-get", deps.logger)
+        .addStep(newAuthorizeStep(PlatformClientQueryController.method.get, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadTargetClientStep(deps.clients))
+        .build()
+        .execute(reqCtx);
+    return redactPlatformClient(storedClientOf(reqCtx, TARGET_RESOURCE_KEY));
+}
+/** GetByReference — load by org/slug, then authorize the loaded client as `get` would. */
+async function getByReference(deps, ref, ctx) {
+    const reqCtx = new RequestContext(PlatformClientQueryController.method.getByReference.input, ref, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("platformclient-get-by-reference", deps.logger)
+        .addStep(newAuthorizeStep(PlatformClientQueryController.method.getByReference, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadClientByReferenceStep(deps.clients))
+        .addStep(newAuthorizeResolvedTargetStep(deps.authorizer, loadedTargetAsMethod(PlatformClientQueryController.method.get)))
+        .build()
+        .execute(reqCtx);
+    return redactPlatformClient(storedClientOf(reqCtx, TARGET_RESOURCE_KEY));
+}
+/**
+ * ListByOrg — the organization's clients the caller may view, newest
+ * first, each redacted. The annotation admits anyone who can view the
+ * organization; the list read scope then keeps only the clients a `get`
+ * would return.
+ */
+async function listByOrg(deps, input, ctx) {
+    const caller = callerIdentityOf(ctx);
+    const reqCtx = new RequestContext(PlatformClientQueryController.method.listByOrg.input, input, caller, kindOf(ctx));
+    await newPipeline("platformclient-list-by-org", deps.logger)
+        .addStep(newAuthorizeStep(PlatformClientQueryController.method.listByOrg, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .build()
+        .execute(reqCtx);
+    let candidates;
+    try {
+        candidates = await deps.clients.findByOrg(input.org);
+    }
+    catch (error) {
+        throw internalError(error, "failed to list platform clients");
+    }
+    const visible = await restrictListByReadScope(deps.listReadScope, caller, ApiResourceKind.platform_client, candidates, input.org);
+    const entries = [...visible]
+        .sort((a, b) => compareCreatedAtDesc(a.status?.audit?.specAudit?.createdAt, b.status?.audit?.specAudit?.createdAt))
+        .map(redactPlatformClient);
+    return create(PlatformClientsSchema, { entries });
+}
+//# sourceMappingURL=controller.js.map

package/dist/domain/platformclient/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/platformclient/controller.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAMtH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yDAAyD,CAAC;AAE/F,OAAO,EAAE,+BAA+B,EAAE,MAAM,6DAA6D,CAAC;AAC9G,OAAO,EACL,kCAAkC,EAClC,qBAAqB,GACtB,MAAM,wDAAwD,CAAC;AAOhE,OAAO,EAAE,6BAA6B,EAAE,MAAM,2DAA2D,CAAC;AAK1G,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE9E,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,8BAA8B,GAC/B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,gCAAgC,EAChC,4BAA4B,EAC5B,kCAAkC,EAClC,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,EAC3B,gCAAgC,EAChC,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EAC9B,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,GACf,MAAM,YAAY,CAAC;AAiBpB,6EAA6E;AAC7E,MAAM,UAAU,8BAA8B,CAC5C,MAAqB,EACrB,IAAkC;IAElC,MAAM,CAAC,OAAO,CAAC,+BAA+B,EAAE;QAC9C,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC;QACxD,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC;QACxD,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACtD,YAAY,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;KACvD,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,6BAA6B,EAAE;QAC5C,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC5D,SAAS,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACvD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,MAAsB,EACtB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,oBAAoB,EACpB,MAAM,EACN,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,uBAAuB,EACvB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,+BAA+B,CAAC,MAAM,CAAC,MAAM,EAC7C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;SAC5C,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,CAAC;SACrC,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC9C,OAAO,CAAC,gCAAgC,EAAE,CAAC;SAC3C,OAAO,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;SAC9C,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,kCAAkC,EAAE;QAChD,cAAc,EAAE,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC;QACrD,YAAY,EAAE,kBAAkB,CAAC,MAAM,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,MAAsB,EACtB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,oBAAoB,EACpB,MAAM,EACN,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,uBAAuB,EACvB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,+BAA+B,CAAC,MAAM,CAAC,MAAM,EAC7C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;SAChD,OAAO,CACN,0BAA0B,CACxB,SAAS,EACT,qBAAqB,CACtB,CACF;SACA,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,CAAC;SACrC,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC9C,OAAO,CAAC,gCAAgC,EAAE,CAAC;SAC3C,OAAO,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;SAClD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,KAA6B,EAC7B,GAAmB;IAGnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,+BAA+B,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EACnD,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,oEAAoE;IACpE,gDAAgD;IAChD,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,WAAW,CAAc,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC;SACjE,OAAO,CACN,gBAAgB,CACd,+BAA+B,CAAC,MAAM,CAAC,MAAM,EAC7C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kCAAkC,CAAc,IAAI,CAAC,OAAO,CAAC,CAAC;SACtE,OAAO,CACN,0BAA0B,CAAc,SAAS,EAAE,qBAAqB,CAAC,CAC1E;SACA,OAAO,CAAC,mBAAmB,CAAc,IAAI,CAAC,OAAO,CAAC,CAAC;SACvD,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,oBAAoB,CAAC,cAAc,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,EAAoB,EACpB,GAAmB;IAInB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,+BAA+B,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EACzD,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAc,8BAA8B,EAAE,IAAI,CAAC,MAAM,CAAC;SACxE,OAAO,CACN,gBAAgB,CACd,+BAA+B,CAAC,MAAM,CAAC,YAAY,EACnD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,uBAAuB,CAAc,IAAI,CAAC,OAAO,CAAC,CAAC;SAC3D,OAAO,CACN,0BAA0B,CAAc,SAAS,EAAE,mBAAmB,CAAC,CACxE;SACA,OAAO,CAAC,8BAA8B,EAAe,CAAC;SACtD,OAAO,CAAC,0BAA0B,CAAc,IAAI,CAAC,OAAO,CAAC,CAAC;SAC9D,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,kCAAkC,EAAE;QAChD,cAAc,EAAE,oBAAoB,CAClC,cAAc,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAC5C;QACD,YAAY,EAAE,kBAAkB,CAAC,MAAM,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,GAAG,CAChB,IAAkC,EAClC,EAAiB,EACjB,GAAmB;IAGnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,6BAA6B,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAC9C,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAW,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC;SAC3D,OAAO,CACN,gBAAgB,CACd,6BAA6B,CAAC,MAAM,CAAC,GAAG,EACxC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,uBAAuB,CAAW,IAAI,CAAC,OAAO,CAAC,CAAC;SACxD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,oBAAoB,CAAC,cAAc,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,cAAc,CAC3B,IAAkC,EAClC,GAAyB,EACzB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,6BAA6B,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EACzD,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,iCAAiC,EAAE,IAAI,CAAC,MAAM,CAAC;SAC9C,OAAO,CACN,gBAAgB,CACd,6BAA6B,CAAC,MAAM,CAAC,cAAc,EACnD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;SACnD,OAAO,CACN,8BAA8B,CAC5B,IAAI,CAAC,UAAU,EACf,oBAAoB,CAAC,6BAA6B,CAAC,MAAM,CAAC,GAAG,CAAC,CAC/D,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,oBAAoB,CAAC,cAAc,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,SAAS,CACtB,IAAkC,EAClC,KAAoC,EACpC,GAAmB;IAEnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,6BAA6B,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EACpD,KAAK,EACL,MAAM,EACN,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,4BAA4B,EAAE,IAAI,CAAC,MAAM,CAAC;SACzC,OAAO,CACN,gBAAgB,CACd,6BAA6B,CAAC,MAAM,CAAC,SAAS,EAC9C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,IAAI,UAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAC3C,IAAI,CAAC,aAAa,EAClB,MAAM,EACN,eAAe,CAAC,eAAe,EAC/B,UAAU,EACV,KAAK,CAAC,GAAG,CACV,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC;SACzB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACb,oBAAoB,CAClB,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EACrC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CACtC,CACF;SACA,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,qBAAqB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AACpD,CAAC"}

package/dist/domain/platformclient/credentials.d.ts

@@ -0,0 +1,13 @@
+export declare const CLIENT_ID_PREFIX = "stgm_cid_";
+export declare const CLIENT_SECRET_PREFIX = "stgm_cs_";
+/** Characters of the secret kept for display. */
+export declare const SECRET_FINGERPRINT_LENGTH = 6;
+export declare function generateClientId(): string;
+export declare function generateClientSecret(): string;
+/** SHA-256 over the whole prefixed secret, base64url — the stored form. */
+export declare function hashClientSecret(secret: string): string;
+/** The secret's last six characters (the whole secret when shorter). */
+export declare function secretFingerprint(secret: string): string;
+/** Whether `secret` hashes to `storedHash`, compared in constant time. */
+export declare function secretMatchesHash(secret: string, storedHash: string): boolean;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/domain/platformclient/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/credentials.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAC5C,eAAO,MAAM,oBAAoB,aAAa,CAAC;AAQ/C,iDAAiD;AACjD,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAE3C,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAK7C;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,wEAAwE;AACxE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIxD;AAED,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAS7E"}

package/dist/domain/platformclient/credentials.js

@@ -0,0 +1,56 @@
+/**
+ * PlatformClient credential material — byte-compatible with every client
+ * Stigmer Cloud has issued since the Java service, because the rows (and
+ * the secrets integrators hold) move under this code unchanged:
+ *
+ *   - client_id: "stgm_cid_" + 32 random bytes, base64url (43 characters).
+ *     Public by design — safe in logs and client-side code — so its
+ *     existence is no secret and the mint may answer an unknown id and a
+ *     wrong secret with the same copy at different speeds.
+ *   - client_secret: "stgm_cs_" + 48 random bytes, base64url (64
+ *     characters): 384 bits, returned once and never stored.
+ *   - the stored hash: SHA-256 over the whole prefixed secret, base64url
+ *     (43 characters). A slow KDF defends low-entropy passwords, not
+ *     384-bit random tokens — ApiKey's precedent (domain/apikey/keymaterial.ts).
+ *   - the fingerprint: the secret's last six characters, for display.
+ *
+ * The comparison hashes the presented secret and compares the two hashes in
+ * constant time, so neither the secret nor the stored hash leaks through
+ * timing.
+ */
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+export const CLIENT_ID_PREFIX = "stgm_cid_";
+export const CLIENT_SECRET_PREFIX = "stgm_cs_";
+/** Random bytes behind a client_id. */
+const CLIENT_ID_BYTES = 32;
+/** Random bytes behind a client_secret: 384 bits. */
+const CLIENT_SECRET_BYTES = 48;
+/** Characters of the secret kept for display. */
+export const SECRET_FINGERPRINT_LENGTH = 6;
+export function generateClientId() {
+    return CLIENT_ID_PREFIX + randomBytes(CLIENT_ID_BYTES).toString("base64url");
+}
+export function generateClientSecret() {
+    return (CLIENT_SECRET_PREFIX +
+        randomBytes(CLIENT_SECRET_BYTES).toString("base64url"));
+}
+/** SHA-256 over the whole prefixed secret, base64url — the stored form. */
+export function hashClientSecret(secret) {
+    return createHash("sha256").update(secret, "utf8").digest("base64url");
+}
+/** The secret's last six characters (the whole secret when shorter). */
+export function secretFingerprint(secret) {
+    return secret.length <= SECRET_FINGERPRINT_LENGTH
+        ? secret
+        : secret.slice(-SECRET_FINGERPRINT_LENGTH);
+}
+/** Whether `secret` hashes to `storedHash`, compared in constant time. */
+export function secretMatchesHash(secret, storedHash) {
+    if (storedHash === "") {
+        return false;
+    }
+    const presented = Buffer.from(hashClientSecret(secret), "utf8");
+    const stored = Buffer.from(storedHash, "utf8");
+    return (presented.length === stored.length && timingSafeEqual(presented, stored));
+}
+//# sourceMappingURL=credentials.js.map

package/dist/domain/platformclient/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/domain/platformclient/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAC5C,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAE/C,uCAAuC;AACvC,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,qDAAqD;AACrD,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,iDAAiD;AACjD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAE3C,MAAM,UAAU,gBAAgB;IAC9B,OAAO,gBAAgB,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO,CACL,oBAAoB;QACpB,WAAW,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CACvD,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACzE,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,MAAM,CAAC,MAAM,IAAI,yBAAyB;QAC/C,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,yBAAyB,CAAC,CAAC;AAC/C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,UAAkB;IAClE,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,OAAO,CACL,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CACzE,CAAC;AACJ,CAAC"}

package/dist/domain/platformclient/mint.d.ts

@@ -0,0 +1,23 @@
+import type { MintUserTokenRequest, MintUserTokenResponse } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/token_pb";
+import type { Logger } from "../../boot/logger.js";
+import { type PlatformTokenKeyRing } from "../../platformtoken/key-ring.js";
+import type { IamPolicyGrantPath } from "../iampolicy/grant-path.js";
+import type { CreateAccount } from "../identityaccount/provisioning.js";
+import type { IdentityAccountStore } from "../identityaccount/store.js";
+import type { PlatformClientStore } from "./store.js";
+export interface PlatformClientMintDeps {
+    readonly clients: PlatformClientStore;
+    /** The any-mode subject lookup: an existing end user is found whatever wrote it. */
+    readonly accounts: Pick<IdentityAccountStore, "findByIdpId">;
+    /** The identity-account domain's one create path (identityaccount/controller.ts). */
+    readonly createAccount: CreateAccount;
+    readonly grantPath: Pick<IamPolicyGrantPath, "grant">;
+    /** The composed ring; undefined when the server trusts every request. */
+    readonly keys: PlatformTokenKeyRing | undefined;
+    readonly logger: Logger;
+    readonly now: () => Date;
+}
+export declare function mintUserToken(deps: PlatformClientMintDeps, request: MintUserTokenRequest): Promise<MintUserTokenResponse>;
+/** `stgm_pc|<org>|<user_id>`, each part non-blank and free of the separator. */
+export declare function platformClientSubject(org: string, externalUserId: string): string;
+//# sourceMappingURL=mint.d.ts.map

package/dist/domain/platformclient/mint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mint.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/mint.ts"],"names":[],"mappings":"AAwDA,OAAO,KAAK,EACV,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,2DAA2D,CAAC;AAInE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAKnD,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAMrE,OAAO,KAAK,EACV,aAAa,EAEd,MAAM,oCAAoC,CAAC;AAE5C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAiBxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAQtD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,aAAa,CAAC,CAAC;IAC7D,qFAAqF;IACrF,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACtD,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC;CAC1B;AASD,wBAAsB,aAAa,CACjC,IAAI,EAAE,sBAAsB,EAC5B,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAmDhC;AA8LD,gFAAgF;AAChF,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,GACrB,MAAM,CAIR"}