@stigmer/server 3.30.0 → 3.32.0

package/dist/domain/iampolicy/steps.js

@@ -5,8 +5,9 @@
  * calls the ONE grant and revoke path (grant-path.ts, which owns the
  * cloud#425 orderings, the by-triple read and the wire refusals) and leaves
  * its answer under POLICY_RESULT_KEY for the handler. The chains are
- * deliberately short: `Authorize → ValidateProto → <one of these>`, so the
- * pipeline executor's fault mapping (a step's ConnectError keeps its code;
+ * deliberately short: `Authorize → ValidateProto → <one of these>`, with
+ * only the owner steps (the last section) before the write on the three
+ * caller lanes, so the pipeline executor's fault mapping (a step's ConnectError keeps its code;
  * a raw store fault becomes the sanitized INTERNAL) covers the path's two
  * error shapes with no second idiom in the handlers.
  *
@@ -51,14 +52,41 @@
  * exists and belongs to the resource's organization needs a read, which
  * this synchronous step does not make: that is the
  * `iam-policy-create:pre-side-effect-gate` slot's, spliced after it.
+ *
+ * Owner is assigned by owners. Every caller of the member lanes holds
+ * `can_grant_access` (admin) already, so an admin grants every role up to
+ * admin; a change that touches an organization's `owner` role also needs
+ * `can_assign_roles` there, which only its owners hold. Two steps carry it,
+ * on the caller lanes only (`create`, `delete`, `revokeOrgAccess`; never
+ * the bootstrap twins, whose platform-pipeline callers hold no
+ * organization role):
+ *   - AuthorizeOwnerAssignment asks `can_assign_roles` when the spec grants
+ *     or revokes `owner` on an organization, or when the account
+ *     `revokeOrgAccess` removes holds it. It is Authorize's own evaluation
+ *     (`authorizeResolvedResource`), so the `internal` caller skips it as it
+ *     skips position 1;
+ *   - KeepOneOwner refuses a revoke or a removal that would leave the
+ *     organization with no owner. It is a product rule rather than
+ *     authorization, so it is its own step. It skips `internal` too. The
+ *     port has no transaction, so two owners removing each other at the
+ *     same instant can both pass; each still needed `can_assign_roles`.
+ * Both read the organization's owner rows once per request
+ * (`organizationOwners`). They do not govern the grants that follow
+ * configuration rather than a caller (the organization creator's row, the
+ * membership rules, the trusted-local operator), which call the grant path
+ * directly, nor an edition's in-process doors that grant a role on a
+ * person's behalf (an invitation's redemption, an identity provider's
+ * auto-grant), which run as `internal` and hold the same rule at their own
+ * sites.
  */
 import { create } from "@bufbuild/protobuf";
 import { Code, ConnectError } from "@connectrpc/connect";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
-import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { IamPermission, IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import { grantableRolesFor, kindEnumName, teamGrantableRolesFor, } from "../../pipeline/apiresource-meta.js";
-import { PER_RESOURCE_GRANTS_UNIMPLEMENTED_MESSAGE, TEAM_MEMBERS_RELATION, noGrantableRolesMessage, personQualifierMessage, principalNotGrantableMessage, roleNotGrantableMessage, teamNotGrantableMessage, teamQualifierMessage, teamRoleNotGrantableMessage, } from "./constants.js";
+import { authorizeResolvedResource } from "../../pipeline/steps/authorize.js";
+import { LAST_OWNER_MESSAGE, OWNER_ASSIGNMENT_DENIED_MESSAGE, PER_RESOURCE_GRANTS_UNIMPLEMENTED_MESSAGE, TEAM_MEMBERS_RELATION, noGrantableRolesMessage, personQualifierMessage, principalNotGrantableMessage, roleNotGrantableMessage, teamNotGrantableMessage, teamQualifierMessage, teamRoleNotGrantableMessage, } from "./constants.js";
 import { requireKnownPrincipalKind, requireKnownResourceKind, } from "./wire-refusals.js";
 /** The row a write chain answers — the granted row, or the revoked row (the default instance when there was none). */
 export const POLICY_RESULT_KEY = "policyResult";
@@ -156,4 +184,91 @@ export function newCleanupResourceStep(grantPath) {
         },
     };
 }
+// ---------------------------------------------------------------------------
+// Owner is assigned by owners (the module header's last section)
+// ---------------------------------------------------------------------------
+/** The wire names the two owner steps compare against. */
+const ORGANIZATION_KIND_NAME = kindEnumName(ApiResourceKind.organization);
+const IDENTITY_ACCOUNT_KIND_NAME = kindEnumName(ApiResourceKind.identity_account);
+const OWNER_RELATION = IamRole[IamRole.owner];
+/** The context key the organization's owner rows are kept under for the rest of the request. */
+const ORGANIZATION_OWNERS_KEY = "organizationOwners";
+/**
+ * The ids of the people holding `owner` on the organization, read once per
+ * request and shared by both owner steps: the organization's `owner` rows
+ * whose principal is a person, the only principal the model admits there.
+ */
+async function organizationOwners(ctx, policies, organizationId) {
+    const held = ctx.get(ORGANIZATION_OWNERS_KEY);
+    if (held instanceof Set) {
+        return held;
+    }
+    const rows = await policies.findByResourceWithRelations(ORGANIZATION_KIND_NAME, organizationId, [OWNER_RELATION]);
+    const owners = new Set(rows
+        .map((row) => row.spec?.principal)
+        .filter((principal) => principal?.kind === IDENTITY_ACCOUNT_KIND_NAME)
+        .map((principal) => principal?.id ?? ""));
+    ctx.set(ORGANIZATION_OWNERS_KEY, owners);
+    return owners;
+}
+/** `create` and `delete`: the spec names the change; nothing is read. */
+export function specOwnerRoleChange(ctx) {
+    const { resource, principal, relation } = ctx.input;
+    if (resource?.kind !== ORGANIZATION_KIND_NAME || relation !== OWNER_RELATION) {
+        return Promise.resolve(undefined);
+    }
+    return Promise.resolve({
+        organizationId: resource.id,
+        accountId: principal?.id ?? "",
+    });
+}
+/** `revokeOrgAccess`: the removal touches owner exactly when the account holds it. */
+export function orgAccessOwnerRoleChange(policies) {
+    return async (ctx) => {
+        const { identityAccountId, organizationId } = ctx.input;
+        const owners = await organizationOwners(ctx, policies, organizationId);
+        return owners.has(identityAccountId)
+            ? { organizationId, accountId: identityAccountId }
+            : undefined;
+    };
+}
+/** A change touching an organization's owner role needs `can_assign_roles` there; see the module header. */
+export function newAuthorizeOwnerAssignmentStep(authorizer, ownerRoleChange) {
+    return {
+        name: "AuthorizeOwnerAssignment",
+        async execute(ctx) {
+            if (ctx.callerIdentity.callerClass === "internal") {
+                return;
+            }
+            const change = await ownerRoleChange(ctx);
+            if (change === undefined) {
+                return;
+            }
+            await authorizeResolvedResource(authorizer, ctx.callerIdentity, {
+                permission: IamPermission.can_assign_roles,
+                resourceKind: ApiResourceKind.organization,
+                resourceId: change.organizationId,
+            }, OWNER_ASSIGNMENT_DENIED_MESSAGE);
+        },
+    };
+}
+/** A revoke or removal may not leave the organization with no owner; see the module header. */
+export function newKeepOneOwnerStep(policies, ownerRoleChange) {
+    return {
+        name: "KeepOneOwner",
+        async execute(ctx) {
+            if (ctx.callerIdentity.callerClass === "internal") {
+                return;
+            }
+            const change = await ownerRoleChange(ctx);
+            if (change === undefined) {
+                return;
+            }
+            const owners = await organizationOwners(ctx, policies, change.organizationId);
+            if (owners.has(change.accountId) && owners.size === 1) {
+                throw new ConnectError(LAST_OWNER_MESSAGE, Code.FailedPrecondition);
+            }
+        },
+    };
+}
 //# sourceMappingURL=steps.js.map

package/dist/domain/iampolicy/steps.js.map

@@ -1 +1 @@
-{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAOrF,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAGpE,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,GACtB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EACL,yCAAyC,EACzC,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAE5B,sHAAsH;AACtH,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEhD,gFAAgF;AAChF,MAAM,UAAU,4BAA4B,CAC1C,KAAuB;IAEvB,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,OAAO,CAAC,GAA+C;YACrD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,YAAY,CACpB,uBAAuB,CAAC,QAAQ,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CACpB,yCAAyC,EACzC,IAAI,CAAC,aAAa,CACnB,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,IAAI,SAAS,EAAE,IAAI,KAAK,cAAc,EAAE,CAAC;gBACvC,gBAAgB,CACd,IAAI,CAAC,QAAQ,EACb,SAAS,CAAC,QAAQ,EAClB,IAAI,EACJ,QAAQ,EACR,MAAM,CACP,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,YAAY,CACpB,uBAAuB,CACrB,IAAI,CAAC,QAAQ,EACb,QAAQ,EACR,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CACvC,EACD,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,iBAAiB,GAAG,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;YAChD,MAAM,aAAa,GAAG,yBAAyB,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,aAAa,KAAK,eAAe,CAAC,gBAAgB,EAAE,CAAC;gBACvD,MAAM,IAAI,YAAY,CACpB,4BAA4B,CAAC,iBAAiB,CAAC,EAC/C,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;YAC5C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,YAAY,CACpB,sBAAsB,CAAC,SAAS,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,cAAc,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;AAE1D;;;GAGG;AACH,SAAS,gBAAgB,CACvB,IAAY,EACZ,SAAiB,EACjB,IAAqB,EACrB,QAAgB,EAChB,MAA4B;IAE5B,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CACd,CAAC;IACF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CACpB,uBAAuB,CAAC,QAAQ,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,YAAY,CACpB,2BAA2B,CACzB,IAAI,EACJ,QAAQ,EACR,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CACrC,EACD,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,qBAAqB,EAAE,CAAC;QACxC,MAAM,IAAI,YAAY,CACpB,oBAAoB,CAAC,SAAS,CAAC,EAC/B,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAC1B,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,OAAO,CACX,GAA+C;YAE/C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YACxE,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,aAAa,CAC3B,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CACX,GAA+C;YAE/C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACxD,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sBAAsB,CACpC,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,CACL,GAAsD;YAEtD,OAAO,SAAS,CAAC,eAAe,CAC9B,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAC3B,GAAG,CAAC,KAAK,CAAC,cAAc,CACzB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,sBAAsB,CACpC,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,CAAC,GAAgD;YACtD,MAAM,GAAG,GAAmB,GAAG,CAAC,KAAK,CAAC;YACtC,OAAO,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AACH,OAAO,EAAE,MAAM,EAAoB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAOrF,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAInF,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,GACtB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EACL,kBAAkB,EAClB,+BAA+B,EAC/B,yCAAyC,EACzC,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAE5B,sHAAsH;AACtH,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEhD,gFAAgF;AAChF,MAAM,UAAU,4BAA4B,CAC1C,KAAuB;IAEvB,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,OAAO,CAAC,GAA+C;YACrD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,YAAY,CACpB,uBAAuB,CAAC,QAAQ,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CACpB,yCAAyC,EACzC,IAAI,CAAC,aAAa,CACnB,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,IAAI,SAAS,EAAE,IAAI,KAAK,cAAc,EAAE,CAAC;gBACvC,gBAAgB,CACd,IAAI,CAAC,QAAQ,EACb,SAAS,CAAC,QAAQ,EAClB,IAAI,EACJ,QAAQ,EACR,MAAM,CACP,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,YAAY,CACpB,uBAAuB,CACrB,IAAI,CAAC,QAAQ,EACb,QAAQ,EACR,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CACvC,EACD,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,iBAAiB,GAAG,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;YAChD,MAAM,aAAa,GAAG,yBAAyB,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,aAAa,KAAK,eAAe,CAAC,gBAAgB,EAAE,CAAC;gBACvD,MAAM,IAAI,YAAY,CACpB,4BAA4B,CAAC,iBAAiB,CAAC,EAC/C,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;YAC5C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,YAAY,CACpB,sBAAsB,CAAC,SAAS,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,cAAc,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;AAE1D;;;GAGG;AACH,SAAS,gBAAgB,CACvB,IAAY,EACZ,SAAiB,EACjB,IAAqB,EACrB,QAAgB,EAChB,MAA4B;IAE5B,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CACd,CAAC;IACF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CACpB,uBAAuB,CAAC,QAAQ,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,YAAY,CACpB,2BAA2B,CACzB,IAAI,EACJ,QAAQ,EACR,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CACrC,EACD,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,qBAAqB,EAAE,CAAC;QACxC,MAAM,IAAI,YAAY,CACpB,oBAAoB,CAAC,SAAS,CAAC,EAC/B,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAC1B,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,OAAO,CACX,GAA+C;YAE/C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YACxE,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,aAAa,CAC3B,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CACX,GAA+C;YAE/C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACxD,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sBAAsB,CACpC,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,CACL,GAAsD;YAEtD,OAAO,SAAS,CAAC,eAAe,CAC9B,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAC3B,GAAG,CAAC,KAAK,CAAC,cAAc,CACzB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,sBAAsB,CACpC,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,CAAC,GAAgD;YACtD,MAAM,GAAG,GAAmB,GAAG,CAAC,KAAK,CAAC;YACtC,OAAO,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,0DAA0D;AAC1D,MAAM,sBAAsB,GAAG,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;AAC1E,MAAM,0BAA0B,GAAG,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;AAClF,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAE9C,gGAAgG;AAChG,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAQrD;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAC/B,GAAyB,EACzB,QAAwB,EACxB,cAAsB;IAEtB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC9C,IAAI,IAAI,YAAY,GAAG,EAAE,CAAC;QACxB,OAAO,IAA2B,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,2BAA2B,CACrD,sBAAsB,EACtB,cAAc,EACd,CAAC,cAAc,CAAC,CACjB,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,IAAI;SACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;SACjC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,IAAI,KAAK,0BAA0B,CAAC;SACrE,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAC3C,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CACjC,GAA+C;IAE/C,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;IACpD,IAAI,QAAQ,EAAE,IAAI,KAAK,sBAAsB,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QAC7E,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC;QACrB,cAAc,EAAE,QAAQ,CAAC,EAAE;QAC3B,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,wBAAwB,CACtC,QAAwB;IAIxB,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;QACvE,OAAO,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAClC,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,iBAAiB,EAAE;YAClD,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,+BAA+B,CAC7C,UAAsB,EACtB,eAAoF;IAEpF,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,GAAG,CAAC,cAAc,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,MAAM,yBAAyB,CAC7B,UAAU,EACV,GAAG,CAAC,cAAc,EAClB;gBACE,UAAU,EAAE,aAAa,CAAC,gBAAgB;gBAC1C,YAAY,EAAE,eAAe,CAAC,YAAY;gBAC1C,UAAU,EAAE,MAAM,CAAC,cAAc;aAClC,EACD,+BAA+B,CAChC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,mBAAmB,CACjC,QAAwB,EACxB,eAAoF;IAEpF,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,GAAG,CAAC,cAAc,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YAC9E,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/oauthapp/controller.d.ts

@@ -12,19 +12,25 @@
  * The secret contract: client_secret is AES-256-GCM encrypted at rest via
  * the SAME SecretService instance the Environment controller uses (Go
  * wires one service for both), and redacted to ***REDACTED*** on every
- * read surface; the marker round-trips on update/apply as "keep the stored
- * secret"; client-supplied enc:v<N>:-shaped values are refused on every
- * write door (oss#395). Deletion is blocked while an McpServer's
- * oauth_app_ref resolves to the app (stigmer/stigmer#584).
+ * response, the delete's included; the marker round-trips on update/apply
+ * as "keep the stored secret"; client-supplied enc:v<N>:-shaped values are
+ * refused on every write door (oss#395). Deletion is blocked while an
+ * McpServer's oauth_app_ref resolves to the app (stigmer/stigmer#584).
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies, and
- * Publish steps (no multi-tenant auth, IAM/FGA, or event publishing), and
- * OAuthApp is deliberately not search-indexed (a configuration resource;
- * `not_search_indexed` in the kind registry).
+ * Every chain opens with Authorize; create and delete run the shared
+ * tuple-lifecycle steps against the composed lifecycle; getByReference
+ * loads, then authorizes the loaded app exactly as `get` would
+ * (AuthorizeResolvedTarget); listByOrg narrows through the list read
+ * scope, so a caller who may not `get` an app does not see it listed
+ * either: the model shows an app to its creator and the organization's
+ * admins, never to members or viewers (fga/model/iam/oauth_app.fga,
+ * stigmer/stigmer#1257). OAuthApp is deliberately not search-indexed (a
+ * configuration resource; `not_search_indexed` in the kind registry).
  */
 import type { ConnectRouter } from "@connectrpc/connect";
 import type { Logger } from "../../boot/logger.js";
 import type { Authorizer } from "../../extensions/authorizer.js";
+import type { ListReadScope } from "../../extensions/list-read-scope.js";
 import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
 import type { SecretService } from "../../encryption/encryption.js";
 import type { Store } from "../../store/interface.js";
@@ -36,6 +42,8 @@ export interface OAuthAppControllerDeps {
     readonly authorizer: Authorizer;
     /** The composed tuple-lifecycle driver — undefined = the shared steps no-op (C2). */
     readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
+    /** The composed list read scope — listByOrg narrows through it; undefined = the OSS full scan (stigmer/stigmer#1257). */
+    readonly listReadScope: ListReadScope | undefined;
 }
 /** Registers both OAuthApp services on the router (routes stage). */
 export declare function registerOAuthAppServices(router: ConnectRouter, deps: OAuthAppControllerDeps): void;

package/dist/domain/oauthapp/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/oauthapp/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAmBzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AACjG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AA6CpE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAQtD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kHAAkH;IAClH,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,qFAAqF;IACrF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;CAC7E;AAED,qEAAqE;AACrE,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,sBAAsB,GAC3B,IAAI,CAYN"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/oauthapp/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAmBzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AACjG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AA6CpE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAQtD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kHAAkH;IAClH,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,qFAAqF;IACrF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC5E,yHAAyH;IACzH,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;CACnD;AAED,qEAAqE;AACrE,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,sBAAsB,GAC3B,IAAI,CAYN"}

package/dist/domain/oauthapp/controller.js

@@ -4,6 +4,7 @@ import { OAuthAppSchema } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_p
 import { OAuthAppCommandController } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/command_pb";
 import { OAuthAppsSchema } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/io_pb";
 import { OAuthAppQueryController } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/query_pb";
+import { restrictListByReadScope } from "../../extensions/list-read-scope.js";
 import { internalError } from "../../pipeline/errors.js";
 import { apiResourceKindKey } from "../../pipeline/interceptors/apiresource.js";
 import { newPipeline } from "../../pipeline/pipeline.js";
@@ -122,8 +123,10 @@ async function apply(deps, app, ctx) {
  * between load and delete. The RESOURCE_ID_KEY is set manually because
  * ApiResourceDeleteInput carries resourceId, not the value field
  * ExtractResourceId expects (the environment-domain pattern). Returns the
- * deleted resource for the audit trail — unredacted, exactly as Go does
- * (see redactOAuthApp's header for the disclosure).
+ * deleted app for the audit trail, redacted like every other response (the
+ * ChannelApp and Environment delete shape): the chain has already
+ * destroyed the sealed secret, so the stored value could only leak
+ * (stigmer/stigmer#1257).
  */
 async function deleteOAuthApp(deps, input, ctx) {
     const reqCtx = new RequestContext(OAuthAppCommandController.method.delete.input, input, callerIdentityOf(ctx), kindOf(ctx));
@@ -142,7 +145,9 @@ async function deleteOAuthApp(deps, input, ctx) {
     if (deleted === undefined) {
         throw internalError(new Error("deleted OAuthApp not found in context"), "deleted OAuthApp not found in context");
     }
-    return deleted;
+    const app = deleted;
+    redactOAuthApp(app);
+    return app;
 }
 /** Get — LoadTarget by id, then redact (Go buildGetPipeline). */
 async function get(deps, id, ctx) {
@@ -173,16 +178,18 @@ async function getByReference(deps, ref, ctx) {
 }
 const LIST_RESULT_KEY = "listResult";
 /**
- * ListByOrg — all OAuthApps whose metadata.org matches, each redacted,
- * sorted created_at descending (Go listByOrgStep). No pagination:
- * typically 1–5 per org. No authorization filtering in OSS.
+ * ListByOrg — the organization's OAuthApps the caller may view, each
+ * redacted, sorted created_at descending (Go listByOrgStep). No
+ * pagination: typically 1–5 per org. The annotation admits anyone who can
+ * view the organization; the list read scope then keeps only the apps a
+ * `get` would return (stigmer/stigmer#1257).
  */
 async function listByOrg(deps, req, ctx) {
     const reqCtx = new RequestContext(OAuthAppQueryController.method.listByOrg.input, req, callerIdentityOf(ctx), kindOf(ctx));
     await newPipeline("oauthapp-list-by-org", deps.logger)
         .addStep(newAuthorizeStep(OAuthAppQueryController.method.listByOrg, deps.authorizer))
         .addStep(newValidateProtoStep())
-        .addStep(newListByOrgStep(deps.store, deps.logger))
+        .addStep(newListByOrgStep(deps.store, deps.listReadScope, deps.logger))
         .build()
         .execute(reqCtx);
     const list = reqCtx.get(LIST_RESULT_KEY);
@@ -191,8 +198,15 @@ async function listByOrg(deps, req, ctx) {
     }
     return list;
 }
-/** The domain-local list step: load all, filter by org, redact, sort. */
-function newListByOrgStep(store, logger) {
+/**
+ * The domain-local list step: load all, keep the request's org, narrow to
+ * the caller's apps, redact, sort. The org predicate stays the step's own
+ * because with no scope composed the helper returns its input unchanged
+ * and never reads the org (the trusted-local full scan); with one, the
+ * scope is the last per-row predicate, so a composed driver is asked about
+ * the org's apps, never every tenant's (the environment list's order).
+ */
+function newListByOrgStep(store, listReadScope, logger) {
     return {
         name: "ListByOrg",
         async execute(ctx) {
@@ -204,7 +218,7 @@ function newListByOrgStep(store, logger) {
             catch (error) {
                 throw internalError(error, "failed to list OAuthApps");
             }
-            const apps = [];
+            const requested = [];
             for (const data of resources) {
                 let app;
                 try {
@@ -219,8 +233,11 @@ function newListByOrgStep(store, logger) {
                 if ((app.metadata?.org ?? "") !== org) {
                     continue;
                 }
+                requested.push(app);
+            }
+            const apps = await restrictListByReadScope(listReadScope, ctx.callerIdentity, ApiResourceKind.oauth_app, requested, "");
+            for (const app of apps) {
                 redactOAuthApp(app);
-                apps.push(app);
             }
             apps.sort((a, b) => compareCreatedAtDesc(a.status?.audit?.specAudit?.createdAt, b.status?.audit?.specAudit?.createdAt));
             logger.info("listed OAuthApps by organization", {

package/dist/domain/oauthapp/controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/oauthapp/controller.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAMtH,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AAEnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,MAAM,kDAAkD,CAAC;AAKnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAM9F,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,8BAA8B,GAC/B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AAExF,OAAO,EACL,mCAAmC,EACnC,mCAAmC,EACnC,mCAAmC,EACnC,cAAc,GACf,MAAM,YAAY,CAAC;AAYpB,qEAAqE;AACrE,MAAM,UAAU,wBAAwB,CACtC,MAAqB,EACrB,IAA4B;IAE5B,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE;QACxC,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC1C,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QACpD,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC5C,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzD,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE;QACtC,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC5D,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;KACnD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,cAAc,CAC3B,IAA4B,EAC5B,GAAa,EACb,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,cAAc,EACd,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAwB,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC;SACrE,OAAO,CACN,gBAAgB,CACd,yBAAyB,CAAC,MAAM,CAAC,MAAM,EACvC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,mCAAmC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CACrE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC/B,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,MAAM,CACnB,IAA4B,EAC5B,GAAa,EACb,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,cAAc,EACd,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAwB,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC;SACrE,OAAO,CACN,gBAAgB,CACd,yBAAyB,CAAC,MAAM,CAAC,MAAM,EACvC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CACN,mCAAmC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CACrE;SACA,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC/B,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,KAAK,CAClB,IAA4B,EAC5B,GAAa,EACb,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,cAAc,EACd,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAwB,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC;SACpE,OAAO,CACN,gBAAgB,CAAC,yBAAyB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAC1E;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,OAAO,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,8CAA8C,CAAC,EACzD,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,YAAY;QACjB,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAChC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAC3B,IAA4B,EAC5B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,yBAAyB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAC7C,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,WAAW,CACf,iBAAiB,EACjB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,yBAAyB,CAAC,MAAM,CAAC,MAAM,EACvC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;SACjE,OAAO,CAAC,mCAAmC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SACrE,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,OAAO,CACN,gCAAgC,CAG9B,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CACzC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CACtD,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,uCAAuC,CAAC,EAClD,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO,OAAmB,CAAC;AAC7B,CAAC;AAED,iEAAiE;AACjE,KAAK,UAAU,GAAG,CAChB,IAA4B,EAC5B,EAAiB,EACjB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,uBAAuB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EACxC,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,cAAc,EACd,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,uBAAuB,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CACtE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;SACtD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAa,CAAC;IACxD,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gEAAgE;AAChE,KAAK,UAAU,cAAc,CAC3B,IAA4B,EAC5B,GAAyB,EACzB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,uBAAuB,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EACnD,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,2BAA2B,EAC3B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,uBAAuB,CAAC,MAAM,CAAC,cAAc,EAC7C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;SAC3D,OAAO,CACN,8BAA8B,CAC5B,IAAI,CAAC,UAAU,EACf,oBAAoB,CAAC,uBAAuB,CAAC,MAAM,CAAC,GAAG,CAAC,CACzD,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAa,CAAC;IACxD,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC;;;;GAIG;AACH,KAAK,UAAU,SAAS,CACtB,IAA4B,EAC5B,GAA4B,EAC5B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,uBAAuB,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAC9C,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,sBAAsB,EACtB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,uBAAuB,CAAC,MAAM,CAAC,SAAS,EACxC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SAClD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,2CAA2C,CAAC,EACtD,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,IAAiB,CAAC;AAC3B,CAAC;AAED,yEAAyE;AACzE,SAAS,gBAAgB,CACvB,KAAY,EACZ,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,KAAK,CAAC,OAAO,CACX,GAEC;YAED,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YAE1B,IAAI,SAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YACnE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;YACzD,CAAC;YAED,MAAM,IAAI,GAAe,EAAE,CAAC;YAC5B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,IAAI,GAAa,CAAC;gBAClB,IAAI,CAAC;oBACH,GAAG,GAAG,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;gBACzC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;wBACpD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;oBACtC,SAAS;gBACX,CAAC;gBACD,cAAc,CAAC,GAAG,CAAC,CAAC;gBACpB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACjB,oBAAoB,CAClB,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EACrC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CACtC,CACF,CAAC;YAEF,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBAC9C,GAAG;gBACH,UAAU,EAAE,IAAI,CAAC,MAAM;aACxB,CAAC,CAAC;YAEH,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/oauthapp/controller.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAMtH,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AAEnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,MAAM,kDAAkD,CAAC;AAKnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAK9F,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAG9E,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,8BAA8B,GAC/B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AAExF,OAAO,EACL,mCAAmC,EACnC,mCAAmC,EACnC,mCAAmC,EACnC,cAAc,GACf,MAAM,YAAY,CAAC;AAcpB,qEAAqE;AACrE,MAAM,UAAU,wBAAwB,CACtC,MAAqB,EACrB,IAA4B;IAE5B,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE;QACxC,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC1C,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QACpD,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC5C,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzD,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE;QACtC,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC5D,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;KACnD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,cAAc,CAC3B,IAA4B,EAC5B,GAAa,EACb,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,cAAc,EACd,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAwB,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC;SACrE,OAAO,CACN,gBAAgB,CACd,yBAAyB,CAAC,MAAM,CAAC,MAAM,EACvC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,mCAAmC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CACrE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC/B,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,MAAM,CACnB,IAA4B,EAC5B,GAAa,EACb,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,cAAc,EACd,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAwB,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC;SACrE,OAAO,CACN,gBAAgB,CACd,yBAAyB,CAAC,MAAM,CAAC,MAAM,EACvC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CACN,mCAAmC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CACrE;SACA,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC/B,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,KAAK,CAClB,IAA4B,EAC5B,GAAa,EACb,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,cAAc,EACd,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAwB,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC;SACpE,OAAO,CACN,gBAAgB,CAAC,yBAAyB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAC1E;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,OAAO,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,8CAA8C,CAAC,EACzD,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,YAAY;QACjB,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAChC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,cAAc,CAC3B,IAA4B,EAC5B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,yBAAyB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAC7C,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,WAAW,CACf,iBAAiB,EACjB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,yBAAyB,CAAC,MAAM,CAAC,MAAM,EACvC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;SACjE,OAAO,CAAC,mCAAmC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SACrE,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,OAAO,CACN,gCAAgC,CAG9B,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CACzC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CACtD,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,uCAAuC,CAAC,EAClD,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,OAAmB,CAAC;IAChC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iEAAiE;AACjE,KAAK,UAAU,GAAG,CAChB,IAA4B,EAC5B,EAAiB,EACjB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,uBAAuB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EACxC,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,cAAc,EACd,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,uBAAuB,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CACtE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;SACtD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAa,CAAC;IACxD,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gEAAgE;AAChE,KAAK,UAAU,cAAc,CAC3B,IAA4B,EAC5B,GAAyB,EACzB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,uBAAuB,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EACnD,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,2BAA2B,EAC3B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,uBAAuB,CAAC,MAAM,CAAC,cAAc,EAC7C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;SAC3D,OAAO,CACN,8BAA8B,CAC5B,IAAI,CAAC,UAAU,EACf,oBAAoB,CAAC,uBAAuB,CAAC,MAAM,CAAC,GAAG,CAAC,CACzD,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAa,CAAC;IACxD,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC;;;;;;GAMG;AACH,KAAK,UAAU,SAAS,CACtB,IAA4B,EAC5B,GAA4B,EAC5B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,uBAAuB,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAC9C,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,sBAAsB,EACtB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,uBAAuB,CAAC,MAAM,CAAC,SAAS,EACxC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SACtE,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,2CAA2C,CAAC,EACtD,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,IAAiB,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CACvB,KAAY,EACZ,aAAwC,EACxC,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,KAAK,CAAC,OAAO,CACX,GAEC;YAED,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YAE1B,IAAI,SAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YACnE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;YACzD,CAAC;YAED,MAAM,SAAS,GAAe,EAAE,CAAC;YACjC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,IAAI,GAAa,CAAC;gBAClB,IAAI,CAAC;oBACH,GAAG,GAAG,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;gBACzC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;wBACpD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;oBACtC,SAAS;gBACX,CAAC;gBACD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,uBAAuB,CACxC,aAAa,EACb,GAAG,CAAC,cAAc,EAClB,eAAe,CAAC,SAAS,EACzB,SAAS,EACT,EAAE,CACH,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,cAAc,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACjB,oBAAoB,CAClB,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EACrC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CACtC,CACF,CAAC;YAEF,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBAC9C,GAAG;gBACH,UAAU,EAAE,IAAI,CAAC,MAAM;aACxB,CAAC,CAAC;YAEH,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/oauthapp/refresolution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresolution.d.ts","sourceRoot":"","sources":["../../../src/domain/oauthapp/refresolution.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mDAAmD,CAAC;AAClF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAGjG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,oBAAoB,GAAG,SAAS,EACrC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CA6C/B"}
+{"version":3,"file":"refresolution.d.ts","sourceRoot":"","sources":["../../../src/domain/oauthapp/refresolution.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mDAAmD,CAAC;AAClF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAGjG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,oBAAoB,GAAG,SAAS,EACrC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CA6C/B"}

package/dist/domain/oauthapp/refresolution.js

@@ -7,8 +7,9 @@
  * answers): the read-path oauth_status enricher (mcpserver, #9), the
  * OAuth initiate and token-refresh paths (#19 — refresh MUST use the app
  * initiate selected or it runs against the wrong vendor credentials), and
- * the OAuthApp delete guard (#13). This file seeds src/domain/oauthapp/;
- * the domain's controllers arrive with #13.
+ * the OAuthApp delete guard (#13). Every consumer imports it from here,
+ * so there is one ladder to change (stigmer/stigmer#1173 removed a
+ * second copy the delete guard had read).
  *
  * Resolution semantics: OSS has a flat OAuthApp store — no org-override
  * chain like the cloud's OAuthAppResolutionService, so the ref is the

package/dist/domain/oauthapp/refresolution.js.map

@@ -1 +1 @@
-{"version":3,"file":"refresolution.js","sourceRoot":"","sources":["../../../src/domain/oauthapp/refresolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AAGnF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAY,EACZ,GAAqC,EACrC,MAAc;IAEd,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;IAC7B,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IAElE,qEAAqE;IACrE,uEAAuE;IACvE,uEAAuE;IACvE,mCAAmC;IACnC,MAAM,WAAW,GAAe,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,kCAAkC;QAC9C,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QAC9B,IAAI,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,MAAM,EAAE,CAAC;YAClD,OAAO,GAAG,CAAC,CAAC,oDAAoD;QAClE,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,CAAC,IAAI,CACT,kIAAkI,EAClI;QACE,YAAY,EAAE,IAAI;QAClB,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE;QACtB,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;KACjE,CACF,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"refresolution.js","sourceRoot":"","sources":["../../../src/domain/oauthapp/refresolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AAGnF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAY,EACZ,GAAqC,EACrC,MAAc;IAEd,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;IAC7B,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IAElE,qEAAqE;IACrE,uEAAuE;IACvE,uEAAuE;IACvE,mCAAmC;IACnC,MAAM,WAAW,GAAe,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,kCAAkC;QAC9C,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QAC9B,IAAI,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,MAAM,EAAE,CAAC;YAClD,OAAO,GAAG,CAAC,CAAC,oDAAoD;QAClE,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,CAAC,IAAI,CACT,kIAAkI,EAClI;QACE,YAAY,EAAE,IAAI;QAClB,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE;QACtB,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;KACjE,CACF,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/domain/oauthapp/steps.d.ts

@@ -10,11 +10,11 @@ import type { Store } from "../../store/interface.js";
  *
  * A function rather than a pipeline step because redaction applies at
  * different points per operation: create/update after persist on newState;
- * get/getByReference after load on the target; listByOrg per entry. Go's
- * response list deliberately excludes DELETE — the delete RPC returns the
- * STORED resource with its encrypted secret intact, ported byte-faithfully
- * and disclosed in the PR (a cross-edition follow-up candidate: with
- * encryption disabled the stored value is plaintext).
+ * get/getByReference after load on the target; listByOrg per entry; delete
+ * on the removed row after its chain. Every response is redacted, the
+ * delete's included: the Go port returned the stored secret from delete —
+ * ciphertext, or plaintext on a keyless server — which no reader needs
+ * once the chain has destroyed the sealed value (stigmer/stigmer#1257).
  */
 export declare function redactOAuthApp(app: OAuthApp): void;
 /**

package/dist/domain/oauthapp/steps.js

@@ -12,17 +12,17 @@ import { EncryptionScope } from "../../encryption/encryption.js";
 import { failedPreconditionError, internalError, invalidArgumentError, } from "../../pipeline/errors.js";
 import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
 import { CIPHERTEXT_SHAPED_SECRET_MESSAGE, MARKER_ON_CREATE_MESSAGE, PRESERVE_NO_EXISTING_SECRET_MESSAGE, REDACTED_MARKER, deleteBlockedByMcpServerMessage, } from "./constants.js";
-import { resolveOAuthAppRef } from "./refresolution/refresolution.js";
+import { resolveOAuthAppRef } from "./refresolution.js";
 /**
  * Replaces client_secret with the redaction marker (Go RedactOAuthApp).
  *
  * A function rather than a pipeline step because redaction applies at
  * different points per operation: create/update after persist on newState;
- * get/getByReference after load on the target; listByOrg per entry. Go's
- * response list deliberately excludes DELETE — the delete RPC returns the
- * STORED resource with its encrypted secret intact, ported byte-faithfully
- * and disclosed in the PR (a cross-edition follow-up candidate: with
- * encryption disabled the stored value is plaintext).
+ * get/getByReference after load on the target; listByOrg per entry; delete
+ * on the removed row after its chain. Every response is redacted, the
+ * delete's included: the Go port returned the stored secret from delete —
+ * ciphertext, or plaintext on a keyless server — which no reader needs
+ * once the chain has destroyed the sealed value (stigmer/stigmer#1257).
  */
 export function redactOAuthApp(app) {
     if (app.spec !== undefined && app.spec.clientSecret !== "") {

package/dist/domain/oauthapp/steps.js.map

@@ -1 +1 @@
-{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/oauthapp/steps.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AAEzF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEpE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E,OAAO,EACL,gCAAgC,EAChC,wBAAwB,EACxB,mCAAmC,EACnC,eAAe,EACf,+BAA+B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,GAAa;IAC1C,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;QAC3D,GAAG,CAAC,IAAI,CAAC,YAAY,GAAG,eAAe,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mCAAmC,CACjD,aAA4B,EAC5B,MAAc;IAEd,OAAO,0BAA0B,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CACjD,aAA4B,EAC5B,MAAc;IAEd,OAAO,0BAA0B,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,0BAA0B,CACjC,aAA4B,EAC5B,MAAc,EACd,QAAiB;IAEjB,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,KAAK,CAAC,OAAO,CAAC,GAA0C;YACtD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC;YACzB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;YAC3C,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;gBACxB,OAAO;YACT,CAAC;YAED,IAAI,YAAY,KAAK,eAAe,EAAE,CAAC;gBACrC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YAED,IAAI,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC;gBACrC,MAAM,oBAAoB,CAAC,gCAAgC,CAAC,CAAC;YAC/D,CAAC;YAED,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CACT,gEAAgE,CACjE,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,+DAA+D;gBAC/D,iEAAiE;gBACjE,aAAa;gBACb,GAAG,CAAC,IAAI,CAAC,YAAY,GAAG,MAAM,aAAa,CAAC,OAAO,CACjD,YAAY,EACZ,eAAe,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,CACzD,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,sBAAsB,CAC7B,GAA0C,EAC1C,GAAa,EACb,QAAiB,EACjB,MAAc;IAEd,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAyB,CAAC;IACxE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,8BAA8B,CAAC,EACzC,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC;IACzD,IAAI,cAAc,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,oBAAoB,CAAC,mCAAmC,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC;IACzC,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;QACzD,UAAU,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;KACnC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mCAAmC,CACjD,KAAY,EACZ,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAyB,CAAC;YACxE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,iDAAiD,CAAC,EAC5D,iDAAiD,CAClD,CAAC;YACJ,CAAC;YAED,IAAI,SAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CACjB,KAAK,EACL,4DAA4D,CAC7D,CAAC;YACJ,CAAC;YAED,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,IAAI,GAAc,CAAC;gBACnB,IAAI,CAAC;oBACH,GAAG,GAAG,UAAU,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBAC1C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,CACT,6EAA6E,EAC7E,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClE,CAAC;oBACF,SAAS;gBACX,CAAC;gBAED,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC;gBACxC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;oBACtB,SAAS;gBACX,CAAC;gBAED,IAAI,QAA8B,CAAC;gBACnC,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC1D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,aAAa,CACjB,KAAK,EACL,oEAAoE,CACrE,CAAC;gBACJ,CAAC;gBACD,IACE,QAAQ,KAAK,SAAS;oBACtB,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,EAC/D,CAAC;oBACD,MAAM,uBAAuB,CAC3B,+BAA+B,CAC7B,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,EAC5B,QAAQ,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,EAC7B,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CACzB,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/oauthapp/steps.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AAEzF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEpE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E,OAAO,EACL,gCAAgC,EAChC,wBAAwB,EACxB,mCAAmC,EACnC,eAAe,EACf,+BAA+B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,GAAa;IAC1C,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;QAC3D,GAAG,CAAC,IAAI,CAAC,YAAY,GAAG,eAAe,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mCAAmC,CACjD,aAA4B,EAC5B,MAAc;IAEd,OAAO,0BAA0B,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CACjD,aAA4B,EAC5B,MAAc;IAEd,OAAO,0BAA0B,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,0BAA0B,CACjC,aAA4B,EAC5B,MAAc,EACd,QAAiB;IAEjB,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,KAAK,CAAC,OAAO,CAAC,GAA0C;YACtD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC;YACzB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;YAC3C,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;gBACxB,OAAO;YACT,CAAC;YAED,IAAI,YAAY,KAAK,eAAe,EAAE,CAAC;gBACrC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YAED,IAAI,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC;gBACrC,MAAM,oBAAoB,CAAC,gCAAgC,CAAC,CAAC;YAC/D,CAAC;YAED,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CACT,gEAAgE,CACjE,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,+DAA+D;gBAC/D,iEAAiE;gBACjE,aAAa;gBACb,GAAG,CAAC,IAAI,CAAC,YAAY,GAAG,MAAM,aAAa,CAAC,OAAO,CACjD,YAAY,EACZ,eAAe,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,CACzD,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,sBAAsB,CAC7B,GAA0C,EAC1C,GAAa,EACb,QAAiB,EACjB,MAAc;IAEd,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAyB,CAAC;IACxE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,8BAA8B,CAAC,EACzC,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC;IACzD,IAAI,cAAc,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,oBAAoB,CAAC,mCAAmC,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC;IACzC,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;QACzD,UAAU,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;KACnC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mCAAmC,CACjD,KAAY,EACZ,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAyB,CAAC;YACxE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,iDAAiD,CAAC,EAC5D,iDAAiD,CAClD,CAAC;YACJ,CAAC;YAED,IAAI,SAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CACjB,KAAK,EACL,4DAA4D,CAC7D,CAAC;YACJ,CAAC;YAED,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,IAAI,GAAc,CAAC;gBACnB,IAAI,CAAC;oBACH,GAAG,GAAG,UAAU,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBAC1C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,CACT,6EAA6E,EAC7E,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClE,CAAC;oBACF,SAAS;gBACX,CAAC;gBAED,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC;gBACxC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;oBACtB,SAAS;gBACX,CAAC;gBAED,IAAI,QAA8B,CAAC;gBACnC,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC1D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,aAAa,CACjB,KAAK,EACL,oEAAoE,CACrE,CAAC;gBACJ,CAAC;gBACD,IACE,QAAQ,KAAK,SAAS;oBACtB,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,EAC/D,CAAC;oBACD,MAAM,uBAAuB,CAC3B,+BAA+B,CAC7B,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,EAC5B,QAAQ,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,EAC7B,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CACzB,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/platformclient/constants.d.ts

@@ -11,6 +11,11 @@
  * sentences open source adds — a server that cannot mint, the guest
  * method's edition refusal, the mismatched-account guard — follow the
  * house style (single-quoted handles).
+ *
+ * One inherited sentence was changed on purpose: the expired-secret
+ * refusal told integrators to rotate, which never helps, because rotating
+ * leaves the expiry as it is (steps.ts, newRotateClientCredentialsStep).
+ * It now names the one fix and who can apply it (stigmer/stigmer#1254).
  */
 /** The kind's name as the shared error constructors render it. */
 export declare const PLATFORM_CLIENT_KIND_NAME = "PlatformClient";
@@ -43,7 +48,12 @@ export type SystemManagedMutation = "updated" | "deleted" | "rotated";
 export declare function systemManagedMessage(verb: SystemManagedMutation): string;
 export declare function referenceNotFoundMessage(org: string, slug: string): string;
 export declare const INVALID_CLIENT_CREDENTIALS_MESSAGE = "Invalid client_id or client_secret";
-export declare const EXPIRED_CLIENT_SECRET_MESSAGE = "PlatformClient secret has expired. Use rotateSecret to generate a new one.";
+/**
+ * The mint's refusal for a client whose expires_at has passed. Rotating
+ * does not extend the expiry, and both update and rotateSecret need the
+ * client's owner (can_edit), so the sentence names the owner's fix.
+ */
+export declare const EXPIRED_CLIENT_SECRET_MESSAGE = "PlatformClient secret has expired. Rotating the secret does not extend it; the client's owner must set a later expires_at or set never_expires.";
 export declare function organizationMismatchMessage(owningOrg: string): string;
 export declare function noAccountMessage(externalUserId: string, org: string): string;
 export declare const OWNER_AUTO_GRANT_MESSAGE = "auto_grant_role cannot be 'owner'; organization ownership must be assigned explicitly.";

package/dist/domain/platformclient/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,kEAAkE;AAClE,eAAO,MAAM,yBAAyB,mBAAmB,CAAC;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,CAE7D,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB;;;;;;;CAOpB,CAAC;AAEX,sCAAsC;AACtC,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,2DAA2D;AAC3D,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAEtE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,MAAM,CAExE;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,eAAO,MAAM,kCAAkC,uCACT,CAAC;AAEvC,eAAO,MAAM,6BAA6B,+EACoC,CAAC;AAE/E,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,eAAO,MAAM,wBAAwB,2FACqD,CAAC;AAE3F,eAAO,MAAM,2BAA2B,mGAC0D,CAAC;AAEnG,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,KAAK,GAAG,gBAAgB,GAC7B,MAAM,CAER;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,KAAK,GAAG,gBAAgB,EAC9B,KAAK,EAAE,MAAM,GACZ,MAAM,CAER;AAED,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,MAAM,GACV,MAAM,CAER;AAED,eAAO,MAAM,uCAAuC,2OACiL,CAAC;AAEtO,eAAO,MAAM,wBAAwB,0FACoD,CAAC;AAE1F,eAAO,MAAM,gCAAgC,oIACsF,CAAC;AAEpI,eAAO,MAAM,6BAA6B,4CACC,CAAC;AAE5C,eAAO,MAAM,sBAAsB,2JACuH,CAAC;AAE3J,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3D"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,kEAAkE;AAClE,eAAO,MAAM,yBAAyB,mBAAmB,CAAC;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,CAE7D,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB;;;;;;;CAOpB,CAAC;AAEX,sCAAsC;AACtC,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,2DAA2D;AAC3D,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAEtE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,MAAM,CAExE;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,eAAO,MAAM,kCAAkC,uCACT,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,oJACyG,CAAC;AAEpJ,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,eAAO,MAAM,wBAAwB,2FACqD,CAAC;AAE3F,eAAO,MAAM,2BAA2B,mGAC0D,CAAC;AAEnG,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,KAAK,GAAG,gBAAgB,GAC7B,MAAM,CAER;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,KAAK,GAAG,gBAAgB,EAC9B,KAAK,EAAE,MAAM,GACZ,MAAM,CAER;AAED,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,MAAM,GACV,MAAM,CAER;AAED,eAAO,MAAM,uCAAuC,2OACiL,CAAC;AAEtO,eAAO,MAAM,wBAAwB,0FACoD,CAAC;AAE1F,eAAO,MAAM,gCAAgC,oIACsF,CAAC;AAEpI,eAAO,MAAM,6BAA6B,4CACC,CAAC;AAE5C,eAAO,MAAM,sBAAsB,2JACuH,CAAC;AAE3J,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3D"}

package/dist/domain/platformclient/constants.js

@@ -11,6 +11,11 @@
  * sentences open source adds — a server that cannot mint, the guest
  * method's edition refusal, the mismatched-account guard — follow the
  * house style (single-quoted handles).
+ *
+ * One inherited sentence was changed on purpose: the expired-secret
+ * refusal told integrators to rotate, which never helps, because rotating
+ * leaves the expiry as it is (steps.ts, newRotateClientCredentialsStep).
+ * It now names the one fix and who can apply it (stigmer/stigmer#1254).
  */
 /** The kind's name as the shared error constructors render it. */
 export const PLATFORM_CLIENT_KIND_NAME = "PlatformClient";
@@ -49,7 +54,12 @@ export function referenceNotFoundMessage(org, slug) {
     return `PlatformClient '${org}/${slug}' not found`;
 }
 export const INVALID_CLIENT_CREDENTIALS_MESSAGE = "Invalid client_id or client_secret";
-export const EXPIRED_CLIENT_SECRET_MESSAGE = "PlatformClient secret has expired. Use rotateSecret to generate a new one.";
+/**
+ * The mint's refusal for a client whose expires_at has passed. Rotating
+ * does not extend the expiry, and both update and rotateSecret need the
+ * client's owner (can_edit), so the sentence names the owner's fix.
+ */
+export const EXPIRED_CLIENT_SECRET_MESSAGE = "PlatformClient secret has expired. Rotating the secret does not extend it; the client's owner must set a later expires_at or set never_expires.";
 export function organizationMismatchMessage(owningOrg) {
     return `org_id must be empty or the PlatformClient's owning organization ('${owningOrg}'); cross-organization minting is not supported`;
 }

package/dist/domain/platformclient/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/platformclient/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,kEAAkE;AAClE,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAE9D;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC;IACzE,wBAAwB;CACzB,CAAC,CAAC;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,OAAO,EAAE,KAAK;IACd,cAAc,EAAE,aAAa;IAC7B,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;IACV,gBAAgB,EAAE,oBAAoB;CAC9B,CAAC;AAEX,sCAAsC;AACtC,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,aAAa,IAAI,sNAAsN,CAAC;AACjP,CAAC;AAKD,MAAM,UAAU,oBAAoB,CAAC,IAA2B;IAC9D,OAAO,wDAAwD,IAAI,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAW,EAAE,IAAY;IAChE,OAAO,mBAAmB,GAAG,IAAI,IAAI,aAAa,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,MAAM,kCAAkC,GAC7C,oCAAoC,CAAC;AAEvC,MAAM,CAAC,MAAM,6BAA6B,GACxC,4EAA4E,CAAC;AAE/E,MAAM,UAAU,2BAA2B,CAAC,SAAiB;IAC3D,OAAO,sEAAsE,SAAS,iDAAiD,CAAC;AAC1I,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,cAAsB,EAAE,GAAW;IAClE,OAAO,SAAS,cAAc,6CAA6C,GAAG,sFAAsF,CAAC;AACvK,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GACnC,wFAAwF,CAAC;AAE3F,MAAM,CAAC,MAAM,2BAA2B,GACtC,gGAAgG,CAAC;AAEnG,MAAM,UAAU,uBAAuB,CACrC,IAA8B;IAE9B,OAAO,GAAG,IAAI,4BAA4B,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAA8B,EAC9B,KAAa;IAEb,OAAO,GAAG,IAAI,kDAAkD,KAAK,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,cAAsB,EACtB,GAAW;IAEX,OAAO,SAAS,cAAc,sBAAsB,GAAG,2FAA2F,CAAC;AACrJ,CAAC;AAED,MAAM,CAAC,MAAM,uCAAuC,GAClD,mOAAmO,CAAC;AAEtO,MAAM,CAAC,MAAM,wBAAwB,GACnC,uFAAuF,CAAC;AAE1F,MAAM,CAAC,MAAM,gCAAgC,GAC3C,iIAAiI,CAAC;AAEpI,MAAM,CAAC,MAAM,6BAA6B,GACxC,yCAAyC,CAAC;AAE5C,MAAM,CAAC,MAAM,sBAAsB,GACjC,wJAAwJ,CAAC;AAE3J,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,OAAO,mBAAmB,MAAM,iJAAiJ,CAAC;AACpL,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/platformclient/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,kEAAkE;AAClE,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAE9D;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC;IACzE,wBAAwB;CACzB,CAAC,CAAC;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,OAAO,EAAE,KAAK;IACd,cAAc,EAAE,aAAa;IAC7B,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;IACV,gBAAgB,EAAE,oBAAoB;CAC9B,CAAC;AAEX,sCAAsC;AACtC,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,aAAa,IAAI,sNAAsN,CAAC;AACjP,CAAC;AAKD,MAAM,UAAU,oBAAoB,CAAC,IAA2B;IAC9D,OAAO,wDAAwD,IAAI,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAW,EAAE,IAAY;IAChE,OAAO,mBAAmB,GAAG,IAAI,IAAI,aAAa,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,MAAM,kCAAkC,GAC7C,oCAAoC,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GACxC,iJAAiJ,CAAC;AAEpJ,MAAM,UAAU,2BAA2B,CAAC,SAAiB;IAC3D,OAAO,sEAAsE,SAAS,iDAAiD,CAAC;AAC1I,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,cAAsB,EAAE,GAAW;IAClE,OAAO,SAAS,cAAc,6CAA6C,GAAG,sFAAsF,CAAC;AACvK,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GACnC,wFAAwF,CAAC;AAE3F,MAAM,CAAC,MAAM,2BAA2B,GACtC,gGAAgG,CAAC;AAEnG,MAAM,UAAU,uBAAuB,CACrC,IAA8B;IAE9B,OAAO,GAAG,IAAI,4BAA4B,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAA8B,EAC9B,KAAa;IAEb,OAAO,GAAG,IAAI,kDAAkD,KAAK,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,cAAsB,EACtB,GAAW;IAEX,OAAO,SAAS,cAAc,sBAAsB,GAAG,2FAA2F,CAAC;AACrJ,CAAC;AAED,MAAM,CAAC,MAAM,uCAAuC,GAClD,mOAAmO,CAAC;AAEtO,MAAM,CAAC,MAAM,wBAAwB,GACnC,uFAAuF,CAAC;AAE1F,MAAM,CAAC,MAAM,gCAAgC,GAC3C,iIAAiI,CAAC;AAEpI,MAAM,CAAC,MAAM,6BAA6B,GACxC,yCAAyC,CAAC;AAE5C,MAAM,CAAC,MAAM,sBAAsB,GACjC,wJAAwJ,CAAC;AAE3J,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,OAAO,mBAAmB,MAAM,iJAAiJ,CAAC;AACpL,CAAC"}

package/dist/domain/platformclient/verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/verifier.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AAOtC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAM5E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,+BAA+B,GACpC,gBAAgB,CA8ClB"}
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/verifier.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AAOtC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAM5E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,+BAA+B,GACpC,gBAAgB,CA+ClB"}

package/dist/domain/platformclient/verifier.js

@@ -26,8 +26,12 @@
  * The identity is the account the token was minted for: `sub` IS the
  * account id (the mint signs it), so no account read is needed; class
  * `user`, issuer "stigmer", the token carried (the memory-capture gate and
- * the origin guard read its `platform_client_id`), and the email and name
- * the platform asserted, for display only.
+ * the origin guard read its `platform_client_id`, guards decoding their
+ * own skip logic from the raw token as extensions/caller-guards.ts
+ * prescribes), the email and name the platform asserted, for display
+ * only, and the minting client as `platformClientId` for the audit-actor
+ * seam, so every resource a minted user writes names the client they came
+ * through (stigmer/stigmer#1256).
  */
 import { Code, ConnectError } from "@connectrpc/connect";
 import { PLATFORM_TOKEN_ISSUER, platformTokenRefusalError, stringClaim, verifyPlatformToken, } from "../../platformtoken/envelope.js";
@@ -69,6 +73,7 @@ export function newPlatformClientTokenVerifier(deps) {
                 rawToken: token,
                 ...(email !== undefined ? { email } : {}),
                 ...(displayName !== undefined ? { displayName } : {}),
+                platformClientId,
             };
         },
     };

package/dist/domain/platformclient/verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../src/domain/platformclient/verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAMzD,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,WAAW,EACX,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AASxB,MAAM,UAAU,8BAA8B,CAC5C,IAAqC;IAErC,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACnE,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;gBACvB,KAAK,SAAS;oBACZ,OAAO,IAAI,CAAC;gBACd,KAAK,SAAS;oBACZ,MAAM,yBAAyB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClD,KAAK,UAAU;oBACb,MAAM;gBACR,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,UAAU,GAAU,MAAM,CAAC;oBACjC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;gBACxE,CAAC;YACH,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC;YAC9B,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,gBAAgB,GAAG,WAAW,CAClC,QAAQ,CAAC,OAAO,EAChB,iBAAiB,CAAC,gBAAgB,CACnC,CAAC;YACF,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBAClE,MAAM,IAAI,YAAY,CAAC,sBAAsB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACrE,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC1E,OAAO;gBACL,UAAU,EAAE,QAAQ,CAAC,OAAO;gBAC5B,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,qBAAqB;gBAC7B,QAAQ,EAAE,KAAK;gBACf,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../src/domain/platformclient/verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAMzD,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,WAAW,EACX,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AASxB,MAAM,UAAU,8BAA8B,CAC5C,IAAqC;IAErC,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACnE,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;gBACvB,KAAK,SAAS;oBACZ,OAAO,IAAI,CAAC;gBACd,KAAK,SAAS;oBACZ,MAAM,yBAAyB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClD,KAAK,UAAU;oBACb,MAAM;gBACR,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,UAAU,GAAU,MAAM,CAAC;oBACjC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;gBACxE,CAAC;YACH,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC;YAC9B,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,gBAAgB,GAAG,WAAW,CAClC,QAAQ,CAAC,OAAO,EAChB,iBAAiB,CAAC,gBAAgB,CACnC,CAAC;YACF,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBAClE,MAAM,IAAI,YAAY,CAAC,sBAAsB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACrE,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC1E,OAAO;gBACL,UAAU,EAAE,QAAQ,CAAC,OAAO;gBAC5B,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,qBAAqB;gBAC7B,QAAQ,EAAE,KAAK;gBACf,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,gBAAgB;aACjB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/extensions/identity.d.ts

@@ -66,6 +66,20 @@ export interface CallerIdentity {
      */
     readonly email?: string;
     readonly displayName?: string;
+    /**
+     * The PlatformClient whose minted user token this caller presented,
+     * carried for the audit-actor seam as `email` and `displayName` are:
+     * the audit actor records it (ApiResourceAuditActor.platform_client_id),
+     * and that server-owned record is what later readers key on, never this
+     * field (stigmer/stigmer#1256). Set ONLY by the PlatformClient
+     * user-token verifier (domain/platformclient/verifier.ts), from the
+     * claim it has just verified and whose client it has just found alive;
+     * absent on every other credential. It is provenance, not authorization
+     * data (the account the token names is still the principal), and not a
+     * guard vocabulary: caller guards decode their own skip logic from
+     * `rawToken` (extensions/caller-guards.ts).
+     */
+    readonly platformClientId?: string;
     /**
      * The transport the request entered through (C2 Stage 3, ruling R5).
      * Absent = the wire; the in-process interceptor stamps `in-process` on