@stigmer/server 3.31.0 → 3.33.0

package/dist/domain/iampolicy/steps.js

@@ -5,8 +5,9 @@
  * calls the ONE grant and revoke path (grant-path.ts, which owns the
  * cloud#425 orderings, the by-triple read and the wire refusals) and leaves
  * its answer under POLICY_RESULT_KEY for the handler. The chains are
- * deliberately short: `Authorize → ValidateProto → <one of these>`, so the
- * pipeline executor's fault mapping (a step's ConnectError keeps its code;
+ * deliberately short: `Authorize → ValidateProto → <one of these>`, with
+ * only the owner steps (the last section) before the write on the three
+ * caller lanes, so the pipeline executor's fault mapping (a step's ConnectError keeps its code;
  * a raw store fault becomes the sanitized INTERNAL) covers the path's two
  * error shapes with no second idiom in the handlers.
  *
@@ -51,14 +52,41 @@
  * exists and belongs to the resource's organization needs a read, which
  * this synchronous step does not make: that is the
  * `iam-policy-create:pre-side-effect-gate` slot's, spliced after it.
+ *
+ * Owner is assigned by owners. Every caller of the member lanes holds
+ * `can_grant_access` (admin) already, so an admin grants every role up to
+ * admin; a change that touches an organization's `owner` role also needs
+ * `can_assign_roles` there, which only its owners hold. Two steps carry it,
+ * on the caller lanes only (`create`, `delete`, `revokeOrgAccess`; never
+ * the bootstrap twins, whose platform-pipeline callers hold no
+ * organization role):
+ *   - AuthorizeOwnerAssignment asks `can_assign_roles` when the spec grants
+ *     or revokes `owner` on an organization, or when the account
+ *     `revokeOrgAccess` removes holds it. It is Authorize's own evaluation
+ *     (`authorizeResolvedResource`), so the `internal` caller skips it as it
+ *     skips position 1;
+ *   - KeepOneOwner refuses a revoke or a removal that would leave the
+ *     organization with no owner. It is a product rule rather than
+ *     authorization, so it is its own step. It skips `internal` too. The
+ *     port has no transaction, so two owners removing each other at the
+ *     same instant can both pass; each still needed `can_assign_roles`.
+ * Both read the organization's owner rows once per request
+ * (`organizationOwners`). They do not govern the grants that follow
+ * configuration rather than a caller (the organization creator's row, the
+ * membership rules, the trusted-local operator), which call the grant path
+ * directly, nor an edition's in-process doors that grant a role on a
+ * person's behalf (an invitation's redemption, an identity provider's
+ * auto-grant), which run as `internal` and hold the same rule at their own
+ * sites.
  */
 import { create } from "@bufbuild/protobuf";
 import { Code, ConnectError } from "@connectrpc/connect";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
-import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { IamPermission, IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import { grantableRolesFor, kindEnumName, teamGrantableRolesFor, } from "../../pipeline/apiresource-meta.js";
-import { PER_RESOURCE_GRANTS_UNIMPLEMENTED_MESSAGE, TEAM_MEMBERS_RELATION, noGrantableRolesMessage, personQualifierMessage, principalNotGrantableMessage, roleNotGrantableMessage, teamNotGrantableMessage, teamQualifierMessage, teamRoleNotGrantableMessage, } from "./constants.js";
+import { authorizeResolvedResource } from "../../pipeline/steps/authorize.js";
+import { LAST_OWNER_MESSAGE, OWNER_ASSIGNMENT_DENIED_MESSAGE, PER_RESOURCE_GRANTS_UNIMPLEMENTED_MESSAGE, TEAM_MEMBERS_RELATION, noGrantableRolesMessage, personQualifierMessage, principalNotGrantableMessage, roleNotGrantableMessage, teamNotGrantableMessage, teamQualifierMessage, teamRoleNotGrantableMessage, } from "./constants.js";
 import { requireKnownPrincipalKind, requireKnownResourceKind, } from "./wire-refusals.js";
 /** The row a write chain answers — the granted row, or the revoked row (the default instance when there was none). */
 export const POLICY_RESULT_KEY = "policyResult";
@@ -156,4 +184,91 @@ export function newCleanupResourceStep(grantPath) {
         },
     };
 }
+// ---------------------------------------------------------------------------
+// Owner is assigned by owners (the module header's last section)
+// ---------------------------------------------------------------------------
+/** The wire names the two owner steps compare against. */
+const ORGANIZATION_KIND_NAME = kindEnumName(ApiResourceKind.organization);
+const IDENTITY_ACCOUNT_KIND_NAME = kindEnumName(ApiResourceKind.identity_account);
+const OWNER_RELATION = IamRole[IamRole.owner];
+/** The context key the organization's owner rows are kept under for the rest of the request. */
+const ORGANIZATION_OWNERS_KEY = "organizationOwners";
+/**
+ * The ids of the people holding `owner` on the organization, read once per
+ * request and shared by both owner steps: the organization's `owner` rows
+ * whose principal is a person, the only principal the model admits there.
+ */
+async function organizationOwners(ctx, policies, organizationId) {
+    const held = ctx.get(ORGANIZATION_OWNERS_KEY);
+    if (held instanceof Set) {
+        return held;
+    }
+    const rows = await policies.findByResourceWithRelations(ORGANIZATION_KIND_NAME, organizationId, [OWNER_RELATION]);
+    const owners = new Set(rows
+        .map((row) => row.spec?.principal)
+        .filter((principal) => principal?.kind === IDENTITY_ACCOUNT_KIND_NAME)
+        .map((principal) => principal?.id ?? ""));
+    ctx.set(ORGANIZATION_OWNERS_KEY, owners);
+    return owners;
+}
+/** `create` and `delete`: the spec names the change; nothing is read. */
+export function specOwnerRoleChange(ctx) {
+    const { resource, principal, relation } = ctx.input;
+    if (resource?.kind !== ORGANIZATION_KIND_NAME || relation !== OWNER_RELATION) {
+        return Promise.resolve(undefined);
+    }
+    return Promise.resolve({
+        organizationId: resource.id,
+        accountId: principal?.id ?? "",
+    });
+}
+/** `revokeOrgAccess`: the removal touches owner exactly when the account holds it. */
+export function orgAccessOwnerRoleChange(policies) {
+    return async (ctx) => {
+        const { identityAccountId, organizationId } = ctx.input;
+        const owners = await organizationOwners(ctx, policies, organizationId);
+        return owners.has(identityAccountId)
+            ? { organizationId, accountId: identityAccountId }
+            : undefined;
+    };
+}
+/** A change touching an organization's owner role needs `can_assign_roles` there; see the module header. */
+export function newAuthorizeOwnerAssignmentStep(authorizer, ownerRoleChange) {
+    return {
+        name: "AuthorizeOwnerAssignment",
+        async execute(ctx) {
+            if (ctx.callerIdentity.callerClass === "internal") {
+                return;
+            }
+            const change = await ownerRoleChange(ctx);
+            if (change === undefined) {
+                return;
+            }
+            await authorizeResolvedResource(authorizer, ctx.callerIdentity, {
+                permission: IamPermission.can_assign_roles,
+                resourceKind: ApiResourceKind.organization,
+                resourceId: change.organizationId,
+            }, OWNER_ASSIGNMENT_DENIED_MESSAGE);
+        },
+    };
+}
+/** A revoke or removal may not leave the organization with no owner; see the module header. */
+export function newKeepOneOwnerStep(policies, ownerRoleChange) {
+    return {
+        name: "KeepOneOwner",
+        async execute(ctx) {
+            if (ctx.callerIdentity.callerClass === "internal") {
+                return;
+            }
+            const change = await ownerRoleChange(ctx);
+            if (change === undefined) {
+                return;
+            }
+            const owners = await organizationOwners(ctx, policies, change.organizationId);
+            if (owners.has(change.accountId) && owners.size === 1) {
+                throw new ConnectError(LAST_OWNER_MESSAGE, Code.FailedPrecondition);
+            }
+        },
+    };
+}
 //# sourceMappingURL=steps.js.map

package/dist/domain/iampolicy/steps.js.map

@@ -1 +1 @@
-{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAOrF,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAGpE,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,GACtB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EACL,yCAAyC,EACzC,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAE5B,sHAAsH;AACtH,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEhD,gFAAgF;AAChF,MAAM,UAAU,4BAA4B,CAC1C,KAAuB;IAEvB,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,OAAO,CAAC,GAA+C;YACrD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,YAAY,CACpB,uBAAuB,CAAC,QAAQ,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CACpB,yCAAyC,EACzC,IAAI,CAAC,aAAa,CACnB,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,IAAI,SAAS,EAAE,IAAI,KAAK,cAAc,EAAE,CAAC;gBACvC,gBAAgB,CACd,IAAI,CAAC,QAAQ,EACb,SAAS,CAAC,QAAQ,EAClB,IAAI,EACJ,QAAQ,EACR,MAAM,CACP,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,YAAY,CACpB,uBAAuB,CACrB,IAAI,CAAC,QAAQ,EACb,QAAQ,EACR,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CACvC,EACD,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,iBAAiB,GAAG,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;YAChD,MAAM,aAAa,GAAG,yBAAyB,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,aAAa,KAAK,eAAe,CAAC,gBAAgB,EAAE,CAAC;gBACvD,MAAM,IAAI,YAAY,CACpB,4BAA4B,CAAC,iBAAiB,CAAC,EAC/C,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;YAC5C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,YAAY,CACpB,sBAAsB,CAAC,SAAS,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,cAAc,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;AAE1D;;;GAGG;AACH,SAAS,gBAAgB,CACvB,IAAY,EACZ,SAAiB,EACjB,IAAqB,EACrB,QAAgB,EAChB,MAA4B;IAE5B,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CACd,CAAC;IACF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CACpB,uBAAuB,CAAC,QAAQ,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,YAAY,CACpB,2BAA2B,CACzB,IAAI,EACJ,QAAQ,EACR,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CACrC,EACD,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,qBAAqB,EAAE,CAAC;QACxC,MAAM,IAAI,YAAY,CACpB,oBAAoB,CAAC,SAAS,CAAC,EAC/B,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAC1B,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,OAAO,CACX,GAA+C;YAE/C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YACxE,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,aAAa,CAC3B,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CACX,GAA+C;YAE/C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACxD,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sBAAsB,CACpC,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,CACL,GAAsD;YAEtD,OAAO,SAAS,CAAC,eAAe,CAC9B,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAC3B,GAAG,CAAC,KAAK,CAAC,cAAc,CACzB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,sBAAsB,CACpC,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,CAAC,GAAgD;YACtD,MAAM,GAAG,GAAmB,GAAG,CAAC,KAAK,CAAC;YACtC,OAAO,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AACH,OAAO,EAAE,MAAM,EAAoB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAOrF,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAInF,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,GACtB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EACL,kBAAkB,EAClB,+BAA+B,EAC/B,yCAAyC,EACzC,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAE5B,sHAAsH;AACtH,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEhD,gFAAgF;AAChF,MAAM,UAAU,4BAA4B,CAC1C,KAAuB;IAEvB,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,OAAO,CAAC,GAA+C;YACrD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,YAAY,CACpB,uBAAuB,CAAC,QAAQ,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CACpB,yCAAyC,EACzC,IAAI,CAAC,aAAa,CACnB,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,IAAI,SAAS,EAAE,IAAI,KAAK,cAAc,EAAE,CAAC;gBACvC,gBAAgB,CACd,IAAI,CAAC,QAAQ,EACb,SAAS,CAAC,QAAQ,EAClB,IAAI,EACJ,QAAQ,EACR,MAAM,CACP,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,YAAY,CACpB,uBAAuB,CACrB,IAAI,CAAC,QAAQ,EACb,QAAQ,EACR,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CACvC,EACD,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,iBAAiB,GAAG,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;YAChD,MAAM,aAAa,GAAG,yBAAyB,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,aAAa,KAAK,eAAe,CAAC,gBAAgB,EAAE,CAAC;gBACvD,MAAM,IAAI,YAAY,CACpB,4BAA4B,CAAC,iBAAiB,CAAC,EAC/C,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;YAC5C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,YAAY,CACpB,sBAAsB,CAAC,SAAS,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,cAAc,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;AAE1D;;;GAGG;AACH,SAAS,gBAAgB,CACvB,IAAY,EACZ,SAAiB,EACjB,IAAqB,EACrB,QAAgB,EAChB,MAA4B;IAE5B,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CACd,CAAC;IACF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CACpB,uBAAuB,CAAC,QAAQ,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,YAAY,CACpB,2BAA2B,CACzB,IAAI,EACJ,QAAQ,EACR,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CACrC,EACD,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,qBAAqB,EAAE,CAAC;QACxC,MAAM,IAAI,YAAY,CACpB,oBAAoB,CAAC,SAAS,CAAC,EAC/B,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAC1B,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,OAAO,CACX,GAA+C;YAE/C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YACxE,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,aAAa,CAC3B,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CACX,GAA+C;YAE/C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACxD,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sBAAsB,CACpC,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,CACL,GAAsD;YAEtD,OAAO,SAAS,CAAC,eAAe,CAC9B,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAC3B,GAAG,CAAC,KAAK,CAAC,cAAc,CACzB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,sBAAsB,CACpC,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,CAAC,GAAgD;YACtD,MAAM,GAAG,GAAmB,GAAG,CAAC,KAAK,CAAC;YACtC,OAAO,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,0DAA0D;AAC1D,MAAM,sBAAsB,GAAG,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;AAC1E,MAAM,0BAA0B,GAAG,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;AAClF,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAE9C,gGAAgG;AAChG,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAQrD;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAC/B,GAAyB,EACzB,QAAwB,EACxB,cAAsB;IAEtB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC9C,IAAI,IAAI,YAAY,GAAG,EAAE,CAAC;QACxB,OAAO,IAA2B,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,2BAA2B,CACrD,sBAAsB,EACtB,cAAc,EACd,CAAC,cAAc,CAAC,CACjB,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,IAAI;SACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;SACjC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,IAAI,KAAK,0BAA0B,CAAC;SACrE,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAC3C,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CACjC,GAA+C;IAE/C,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;IACpD,IAAI,QAAQ,EAAE,IAAI,KAAK,sBAAsB,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QAC7E,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC;QACrB,cAAc,EAAE,QAAQ,CAAC,EAAE;QAC3B,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,wBAAwB,CACtC,QAAwB;IAIxB,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;QACvE,OAAO,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAClC,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,iBAAiB,EAAE;YAClD,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,+BAA+B,CAC7C,UAAsB,EACtB,eAAoF;IAEpF,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,GAAG,CAAC,cAAc,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,MAAM,yBAAyB,CAC7B,UAAU,EACV,GAAG,CAAC,cAAc,EAClB;gBACE,UAAU,EAAE,aAAa,CAAC,gBAAgB;gBAC1C,YAAY,EAAE,eAAe,CAAC,YAAY;gBAC1C,UAAU,EAAE,MAAM,CAAC,cAAc;aAClC,EACD,+BAA+B,CAChC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,mBAAmB,CACjC,QAAwB,EACxB,eAAoF;IAEpF,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,GAAG,CAAC,cAAc,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YAC9E,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/platformclient/constants.d.ts

@@ -11,6 +11,11 @@
  * sentences open source adds — a server that cannot mint, the guest
  * method's edition refusal, the mismatched-account guard — follow the
  * house style (single-quoted handles).
+ *
+ * One inherited sentence was changed on purpose: the expired-secret
+ * refusal told integrators to rotate, which never helps, because rotating
+ * leaves the expiry as it is (steps.ts, newRotateClientCredentialsStep).
+ * It now names the one fix and who can apply it (stigmer/stigmer#1254).
  */
 /** The kind's name as the shared error constructors render it. */
 export declare const PLATFORM_CLIENT_KIND_NAME = "PlatformClient";
@@ -43,7 +48,12 @@ export type SystemManagedMutation = "updated" | "deleted" | "rotated";
 export declare function systemManagedMessage(verb: SystemManagedMutation): string;
 export declare function referenceNotFoundMessage(org: string, slug: string): string;
 export declare const INVALID_CLIENT_CREDENTIALS_MESSAGE = "Invalid client_id or client_secret";
-export declare const EXPIRED_CLIENT_SECRET_MESSAGE = "PlatformClient secret has expired. Use rotateSecret to generate a new one.";
+/**
+ * The mint's refusal for a client whose expires_at has passed. Rotating
+ * does not extend the expiry, and both update and rotateSecret need the
+ * client's owner (can_edit), so the sentence names the owner's fix.
+ */
+export declare const EXPIRED_CLIENT_SECRET_MESSAGE = "PlatformClient secret has expired. Rotating the secret does not extend it; the client's owner must set a later expires_at or set never_expires.";
 export declare function organizationMismatchMessage(owningOrg: string): string;
 export declare function noAccountMessage(externalUserId: string, org: string): string;
 export declare const OWNER_AUTO_GRANT_MESSAGE = "auto_grant_role cannot be 'owner'; organization ownership must be assigned explicitly.";

package/dist/domain/platformclient/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,kEAAkE;AAClE,eAAO,MAAM,yBAAyB,mBAAmB,CAAC;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,CAE7D,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB;;;;;;;CAOpB,CAAC;AAEX,sCAAsC;AACtC,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,2DAA2D;AAC3D,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAEtE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,MAAM,CAExE;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,eAAO,MAAM,kCAAkC,uCACT,CAAC;AAEvC,eAAO,MAAM,6BAA6B,+EACoC,CAAC;AAE/E,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,eAAO,MAAM,wBAAwB,2FACqD,CAAC;AAE3F,eAAO,MAAM,2BAA2B,mGAC0D,CAAC;AAEnG,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,KAAK,GAAG,gBAAgB,GAC7B,MAAM,CAER;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,KAAK,GAAG,gBAAgB,EAC9B,KAAK,EAAE,MAAM,GACZ,MAAM,CAER;AAED,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,MAAM,GACV,MAAM,CAER;AAED,eAAO,MAAM,uCAAuC,2OACiL,CAAC;AAEtO,eAAO,MAAM,wBAAwB,0FACoD,CAAC;AAE1F,eAAO,MAAM,gCAAgC,oIACsF,CAAC;AAEpI,eAAO,MAAM,6BAA6B,4CACC,CAAC;AAE5C,eAAO,MAAM,sBAAsB,2JACuH,CAAC;AAE3J,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3D"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,kEAAkE;AAClE,eAAO,MAAM,yBAAyB,mBAAmB,CAAC;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,CAE7D,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB;;;;;;;CAOpB,CAAC;AAEX,sCAAsC;AACtC,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,2DAA2D;AAC3D,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAEtE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,MAAM,CAExE;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,eAAO,MAAM,kCAAkC,uCACT,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,oJACyG,CAAC;AAEpJ,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,eAAO,MAAM,wBAAwB,2FACqD,CAAC;AAE3F,eAAO,MAAM,2BAA2B,mGAC0D,CAAC;AAEnG,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,KAAK,GAAG,gBAAgB,GAC7B,MAAM,CAER;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,KAAK,GAAG,gBAAgB,EAC9B,KAAK,EAAE,MAAM,GACZ,MAAM,CAER;AAED,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,MAAM,GACV,MAAM,CAER;AAED,eAAO,MAAM,uCAAuC,2OACiL,CAAC;AAEtO,eAAO,MAAM,wBAAwB,0FACoD,CAAC;AAE1F,eAAO,MAAM,gCAAgC,oIACsF,CAAC;AAEpI,eAAO,MAAM,6BAA6B,4CACC,CAAC;AAE5C,eAAO,MAAM,sBAAsB,2JACuH,CAAC;AAE3J,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3D"}

package/dist/domain/platformclient/constants.js

@@ -11,6 +11,11 @@
  * sentences open source adds — a server that cannot mint, the guest
  * method's edition refusal, the mismatched-account guard — follow the
  * house style (single-quoted handles).
+ *
+ * One inherited sentence was changed on purpose: the expired-secret
+ * refusal told integrators to rotate, which never helps, because rotating
+ * leaves the expiry as it is (steps.ts, newRotateClientCredentialsStep).
+ * It now names the one fix and who can apply it (stigmer/stigmer#1254).
  */
 /** The kind's name as the shared error constructors render it. */
 export const PLATFORM_CLIENT_KIND_NAME = "PlatformClient";
@@ -49,7 +54,12 @@ export function referenceNotFoundMessage(org, slug) {
     return `PlatformClient '${org}/${slug}' not found`;
 }
 export const INVALID_CLIENT_CREDENTIALS_MESSAGE = "Invalid client_id or client_secret";
-export const EXPIRED_CLIENT_SECRET_MESSAGE = "PlatformClient secret has expired. Use rotateSecret to generate a new one.";
+/**
+ * The mint's refusal for a client whose expires_at has passed. Rotating
+ * does not extend the expiry, and both update and rotateSecret need the
+ * client's owner (can_edit), so the sentence names the owner's fix.
+ */
+export const EXPIRED_CLIENT_SECRET_MESSAGE = "PlatformClient secret has expired. Rotating the secret does not extend it; the client's owner must set a later expires_at or set never_expires.";
 export function organizationMismatchMessage(owningOrg) {
     return `org_id must be empty or the PlatformClient's owning organization ('${owningOrg}'); cross-organization minting is not supported`;
 }

package/dist/domain/platformclient/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/platformclient/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,kEAAkE;AAClE,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAE9D;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC;IACzE,wBAAwB;CACzB,CAAC,CAAC;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,OAAO,EAAE,KAAK;IACd,cAAc,EAAE,aAAa;IAC7B,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;IACV,gBAAgB,EAAE,oBAAoB;CAC9B,CAAC;AAEX,sCAAsC;AACtC,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,aAAa,IAAI,sNAAsN,CAAC;AACjP,CAAC;AAKD,MAAM,UAAU,oBAAoB,CAAC,IAA2B;IAC9D,OAAO,wDAAwD,IAAI,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAW,EAAE,IAAY;IAChE,OAAO,mBAAmB,GAAG,IAAI,IAAI,aAAa,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,MAAM,kCAAkC,GAC7C,oCAAoC,CAAC;AAEvC,MAAM,CAAC,MAAM,6BAA6B,GACxC,4EAA4E,CAAC;AAE/E,MAAM,UAAU,2BAA2B,CAAC,SAAiB;IAC3D,OAAO,sEAAsE,SAAS,iDAAiD,CAAC;AAC1I,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,cAAsB,EAAE,GAAW;IAClE,OAAO,SAAS,cAAc,6CAA6C,GAAG,sFAAsF,CAAC;AACvK,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GACnC,wFAAwF,CAAC;AAE3F,MAAM,CAAC,MAAM,2BAA2B,GACtC,gGAAgG,CAAC;AAEnG,MAAM,UAAU,uBAAuB,CACrC,IAA8B;IAE9B,OAAO,GAAG,IAAI,4BAA4B,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAA8B,EAC9B,KAAa;IAEb,OAAO,GAAG,IAAI,kDAAkD,KAAK,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,cAAsB,EACtB,GAAW;IAEX,OAAO,SAAS,cAAc,sBAAsB,GAAG,2FAA2F,CAAC;AACrJ,CAAC;AAED,MAAM,CAAC,MAAM,uCAAuC,GAClD,mOAAmO,CAAC;AAEtO,MAAM,CAAC,MAAM,wBAAwB,GACnC,uFAAuF,CAAC;AAE1F,MAAM,CAAC,MAAM,gCAAgC,GAC3C,iIAAiI,CAAC;AAEpI,MAAM,CAAC,MAAM,6BAA6B,GACxC,yCAAyC,CAAC;AAE5C,MAAM,CAAC,MAAM,sBAAsB,GACjC,wJAAwJ,CAAC;AAE3J,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,OAAO,mBAAmB,MAAM,iJAAiJ,CAAC;AACpL,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/platformclient/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,kEAAkE;AAClE,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAE9D;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC;IACzE,wBAAwB;CACzB,CAAC,CAAC;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,OAAO,EAAE,KAAK;IACd,cAAc,EAAE,aAAa;IAC7B,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;IACV,gBAAgB,EAAE,oBAAoB;CAC9B,CAAC;AAEX,sCAAsC;AACtC,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,aAAa,IAAI,sNAAsN,CAAC;AACjP,CAAC;AAKD,MAAM,UAAU,oBAAoB,CAAC,IAA2B;IAC9D,OAAO,wDAAwD,IAAI,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAW,EAAE,IAAY;IAChE,OAAO,mBAAmB,GAAG,IAAI,IAAI,aAAa,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,MAAM,kCAAkC,GAC7C,oCAAoC,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GACxC,iJAAiJ,CAAC;AAEpJ,MAAM,UAAU,2BAA2B,CAAC,SAAiB;IAC3D,OAAO,sEAAsE,SAAS,iDAAiD,CAAC;AAC1I,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,cAAsB,EAAE,GAAW;IAClE,OAAO,SAAS,cAAc,6CAA6C,GAAG,sFAAsF,CAAC;AACvK,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GACnC,wFAAwF,CAAC;AAE3F,MAAM,CAAC,MAAM,2BAA2B,GACtC,gGAAgG,CAAC;AAEnG,MAAM,UAAU,uBAAuB,CACrC,IAA8B;IAE9B,OAAO,GAAG,IAAI,4BAA4B,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAA8B,EAC9B,KAAa;IAEb,OAAO,GAAG,IAAI,kDAAkD,KAAK,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,cAAsB,EACtB,GAAW;IAEX,OAAO,SAAS,cAAc,sBAAsB,GAAG,2FAA2F,CAAC;AACrJ,CAAC;AAED,MAAM,CAAC,MAAM,uCAAuC,GAClD,mOAAmO,CAAC;AAEtO,MAAM,CAAC,MAAM,wBAAwB,GACnC,uFAAuF,CAAC;AAE1F,MAAM,CAAC,MAAM,gCAAgC,GAC3C,iIAAiI,CAAC;AAEpI,MAAM,CAAC,MAAM,6BAA6B,GACxC,yCAAyC,CAAC;AAE5C,MAAM,CAAC,MAAM,sBAAsB,GACjC,wJAAwJ,CAAC;AAE3J,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,OAAO,mBAAmB,MAAM,iJAAiJ,CAAC;AACpL,CAAC"}

package/dist/domain/platformclient/mint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mint.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/mint.ts"],"names":[],"mappings":"AAwDA,OAAO,KAAK,EACV,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,2DAA2D,CAAC;AAInE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAKnD,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAMrE,OAAO,KAAK,EACV,aAAa,EAEd,MAAM,oCAAoC,CAAC;AAE5C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAiBxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAQtD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,aAAa,CAAC,CAAC;IAC7D,qFAAqF;IACrF,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACtD,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC;CAC1B;AASD,wBAAsB,aAAa,CACjC,IAAI,EAAE,sBAAsB,EAC5B,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAmDhC;AA8LD,gFAAgF;AAChF,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,GACrB,MAAM,CAIR"}
+{"version":3,"file":"mint.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/mint.ts"],"names":[],"mappings":"AAiEA,OAAO,KAAK,EACV,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,2DAA2D,CAAC;AAInE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAMnD,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAMrE,OAAO,KAAK,EACV,aAAa,EAEd,MAAM,oCAAoC,CAAC;AAE5C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAiBxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAQtD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,aAAa,CAAC,CAAC;IAC7D,qFAAqF;IACrF,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACtD,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC;CAC1B;AASD,wBAAsB,aAAa,CACjC,IAAI,EAAE,sBAAsB,EAC5B,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAqDhC;AAmND,gFAAgF;AAChF,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,GACrB,MAAM,CAIR"}

package/dist/domain/platformclient/mint.js

@@ -44,6 +44,14 @@
  *
  * The email and name in the token and on the account are the platform's
  * assertion; nothing on the server derives authority from either.
+ *
+ * A signed token is a successful mint, so the client's use is then
+ * recorded on its status.last_used_at (identity/credential-use.ts): at most
+ * once a resolution, judged from the row authentication already read,
+ * written through the port's atomic `modifyById` — never the whole-row
+ * `update`, which could write back the secret hash a concurrent rotation
+ * just replaced — and best-effort: a failed stamp is logged and the token
+ * is still answered. A refused mint records nothing (stigmer/stigmer#1255).
  */
 import { Code, ConnectError } from "@connectrpc/connect";
 import { create } from "@bufbuild/protobuf";
@@ -51,8 +59,10 @@ import { timestampDate } from "@bufbuild/protobuf/wkt";
 import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
 import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
 import { IdentityAccountSpecSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/spec_pb";
+import { PlatformClientStatusSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
 import { MintUserTokenResponseSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/token_pb";
 import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { recordCredentialUse } from "../../identity/credential-use.js";
 import { internalError } from "../../pipeline/errors.js";
 import { serverActingFor } from "../../pipeline/interceptors/auth.js";
 import { validator } from "../../pipeline/steps/validation.js";
@@ -87,6 +97,7 @@ export async function mintUserToken(deps, request) {
         name: request.userName,
     };
     const accountId = await resolveOrProvisionAccount(deps, client, owningOrg, user);
+    const now = deps.now();
     const signed = signPlatformToken(keys, {
         [USER_TOKEN_CLAIMS.subject]: accountId,
         [USER_TOKEN_CLAIMS.externalUserId]: user.externalUserId,
@@ -94,7 +105,8 @@ export async function mintUserToken(deps, request) {
         [USER_TOKEN_CLAIMS.name]: user.name,
         [USER_TOKEN_CLAIMS.org]: owningOrg,
         [USER_TOKEN_CLAIMS.platformClientId]: client.metadata?.id ?? "",
-    }, { now: deps.now() });
+    }, { now });
+    await recordClientUse(deps, client, now);
     return create(MintUserTokenResponseSchema, {
         accessToken: signed.token,
         tokenType: BEARER_TOKEN_TYPE,
@@ -125,6 +137,21 @@ async function authenticateClient(deps, request) {
     }
     return client;
 }
+/** Stamps the minting client's last use on its own row, through the port's atomic write. */
+function recordClientUse(deps, client, now) {
+    const id = client.metadata?.id ?? "";
+    return recordCredentialUse({
+        credential: "platform client",
+        id,
+        lastUsedAt: client.status?.lastUsedAt,
+        now,
+        logger: deps.logger,
+        write: (stamp) => deps.clients.modifyById(id, (live) => {
+            live.status ??= create(PlatformClientStatusSchema);
+            stamp(live.status);
+        }),
+    });
+}
 /** The account id for the user: the existing platform-client account, or one provisioned now. */
 async function resolveOrProvisionAccount(deps, client, org, user) {
     const idpId = platformClientSubject(org, user.externalUserId);

package/dist/domain/platformclient/mint.js.map

@@ -1 +1 @@
-{"version":3,"file":"mint.js","sourceRoot":"","sources":["../../../src/domain/platformclient/mint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AAEjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAC5G,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AAMtG,OAAO,EAAE,2BAA2B,EAAE,MAAM,2DAA2D,CAAC;AACxG,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAIpE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,EACL,OAAO,GAER,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EACL,8BAA8B,EAC9B,YAAY,GACb,MAAM,iCAAiC,CAAC;AAKzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAEvE,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,kCAAkC,EAClC,wBAAwB,EACxB,uCAAuC,EACvC,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,EAChB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,gGAAgG;AAChG,MAAM,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC;AAsB/C,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAA4B,EAC5B,OAA6B;IAE7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,YAAY,CACpB,uCAAuC,EACvC,IAAI,CAAC,kBAAkB,CACxB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IAC7C,yEAAyE;IACzE,IAAI,OAAO,CAAC,KAAK,KAAK,EAAE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,IAAI,YAAY,CACpB,2BAA2B,CAAC,SAAS,CAAC,EACtC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAY;QACpB,cAAc,EAAE,OAAO,CAAC,MAAM;QAC9B,KAAK,EAAE,OAAO,CAAC,SAAS;QACxB,IAAI,EAAE,OAAO,CAAC,QAAQ;KACvB,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAC/C,IAAI,EACJ,MAAM,EACN,SAAS,EACT,IAAI,CACL,CAAC;IAEF,MAAM,MAAM,GAAG,iBAAiB,CAC9B,IAAI,EACJ;QACE,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,SAAS;QACtC,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,cAAc;QACvD,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK;QACrC,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;QACnC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,SAAS;QAClC,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;KAChE,EACD,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CACpB,CAAC;IACF,OAAO,MAAM,CAAC,2BAA2B,EAAE;QACzC,WAAW,EAAE,MAAM,CAAC,KAAK;QACzB,SAAS,EAAE,iBAAiB;QAC5B,SAAS,EAAE,IAAI,CAAC,UAAU;KAC3B,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,kBAAkB,CAC/B,IAA4B,EAC5B,OAA6B;IAE7B,IAAI,MAAkC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,wCAAwC,CAAC,CAAC;IACvE,CAAC;IACD,IACE,MAAM,KAAK,SAAS;QACpB,CAAC,iBAAiB,CAChB,OAAO,CAAC,YAAY,EACpB,MAAM,CAAC,IAAI,EAAE,gBAAgB,IAAI,EAAE,CACpC,EACD,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,kCAAkC,EAClC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IACE,IAAI,EAAE,YAAY,KAAK,IAAI;QAC3B,IAAI,EAAE,SAAS,KAAK,SAAS;QAC7B,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAC9D,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,kBAAkB,CACxB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iGAAiG;AACjG,KAAK,UAAU,yBAAyB,CACtC,IAA4B,EAC5B,MAAsB,EACtB,GAAW,EACX,IAAa;IAEb,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,uBAAuB,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,IAAI,EAAE,qBAAqB,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,YAAY,CACpB,gBAAgB,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,EAC1C,IAAI,CAAC,kBAAkB,CACxB,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzD,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,CACjD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CACjC,CAAC;QACF,OAAO,uBAAuB,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,KAAK,UAAU,WAAW,CACxB,IAA4B,EAC5B,KAAa;IAEb,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,wCAAwC,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAC9B,OAAwB,EACxB,IAAa,EACb,GAAW;IAEX,IACE,OAAO,CAAC,IAAI,EAAE,gBAAgB;QAC9B,+BAA+B,CAAC,eAAe,EAC/C,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,EAC/C,IAAI,CAAC,kBAAkB,CACxB,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CACnB,KAAa,EACb,GAAW,EACX,IAAa;IAEb,MAAM,KAAK,GAAuB;QAChC,IAAI,EAAE,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc;QAC1D,IAAI,EAAE,MAAM,CAAC,yBAAyB,EAAE;YACtC,KAAK;YACL,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;SACpC,CAAC;QACF,YAAY,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE;KAC/C,CAAC;IACF,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC,QAAQ,CACjC,qBAAqB,EACrB,MAAM,CAAC,qBAAqB,EAAE;QAC5B,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE;QACnC,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,CACH,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,YAAY,CACpB,6BAA6B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACnD,IAAI,CAAC,QAAQ,CACd,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAC1B,IAA4B,EAC5B,MAAsB,EACtB,GAAW,EACX,SAAiB,EACjB,KAAqB;IAErB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,aAAa,IAAI,OAAO,CAAC,oBAAoB,CAAC;IAC9E,IAAI,UAAU,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GACR,UAAU,KAAK,OAAO,CAAC,oBAAoB;QACzC,CAAC,CAAC,uBAAuB;QACzB,CAAC,CAAC,UAAU,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,4DAA4D,EAC5D;YACE,SAAS;YACT,gBAAgB,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;YAC3C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;QACF,MAAM,IAAI,YAAY,CAAC,2BAA2B,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CACnC,GAAW,EACX,cAAsB;IAEtB,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/B,kBAAkB,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IACrD,OAAO,GAAG,8BAA8B,GAAG,GAAG,GAAG,iBAAiB,GAAG,cAAc,EAAE,CAAC;AACxF,CAAC;AAED,SAAS,kBAAkB,CACzB,IAA8B,EAC9B,KAAa;IAEb,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,YAAY,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,YAAY,CACpB,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,EACpC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,SAAS,SAAS,CAChB,IAAY,EACZ,KAAa;IAEb,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,KAAK,GAAG,CAAC;YACd,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE;YACtE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC3E,CAAC"}
+{"version":3,"file":"mint.js","sourceRoot":"","sources":["../../../src/domain/platformclient/mint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AAEjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAC5G,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AAEtG,OAAO,EAAE,0BAA0B,EAAE,MAAM,yDAAyD,CAAC;AAKrG,OAAO,EAAE,2BAA2B,EAAE,MAAM,2DAA2D,CAAC;AACxG,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAIpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,EACL,OAAO,GAER,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EACL,8BAA8B,EAC9B,YAAY,GACb,MAAM,iCAAiC,CAAC;AAKzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAEvE,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,kCAAkC,EAClC,wBAAwB,EACxB,uCAAuC,EACvC,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,EAChB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,gGAAgG;AAChG,MAAM,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC;AAsB/C,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAA4B,EAC5B,OAA6B;IAE7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,YAAY,CACpB,uCAAuC,EACvC,IAAI,CAAC,kBAAkB,CACxB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IAC7C,yEAAyE;IACzE,IAAI,OAAO,CAAC,KAAK,KAAK,EAAE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,IAAI,YAAY,CACpB,2BAA2B,CAAC,SAAS,CAAC,EACtC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAY;QACpB,cAAc,EAAE,OAAO,CAAC,MAAM;QAC9B,KAAK,EAAE,OAAO,CAAC,SAAS;QACxB,IAAI,EAAE,OAAO,CAAC,QAAQ;KACvB,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAC/C,IAAI,EACJ,MAAM,EACN,SAAS,EACT,IAAI,CACL,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,iBAAiB,CAC9B,IAAI,EACJ;QACE,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,SAAS;QACtC,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,cAAc;QACvD,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK;QACrC,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;QACnC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,SAAS;QAClC,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;KAChE,EACD,EAAE,GAAG,EAAE,CACR,CAAC;IACF,MAAM,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,2BAA2B,EAAE;QACzC,WAAW,EAAE,MAAM,CAAC,KAAK;QACzB,SAAS,EAAE,iBAAiB;QAC5B,SAAS,EAAE,IAAI,CAAC,UAAU;KAC3B,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,kBAAkB,CAC/B,IAA4B,EAC5B,OAA6B;IAE7B,IAAI,MAAkC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,wCAAwC,CAAC,CAAC;IACvE,CAAC;IACD,IACE,MAAM,KAAK,SAAS;QACpB,CAAC,iBAAiB,CAChB,OAAO,CAAC,YAAY,EACpB,MAAM,CAAC,IAAI,EAAE,gBAAgB,IAAI,EAAE,CACpC,EACD,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,kCAAkC,EAClC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IACE,IAAI,EAAE,YAAY,KAAK,IAAI;QAC3B,IAAI,EAAE,SAAS,KAAK,SAAS;QAC7B,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAC9D,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,kBAAkB,CACxB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4FAA4F;AAC5F,SAAS,eAAe,CACtB,IAA4B,EAC5B,MAAsB,EACtB,GAAS;IAET,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACrC,OAAO,mBAAmB,CAAC;QACzB,UAAU,EAAE,iBAAiB;QAC7B,EAAE;QACF,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU;QACrC,GAAG;QACH,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;YACnC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC,CAAC;KACL,CAAC,CAAC;AACL,CAAC;AAED,iGAAiG;AACjG,KAAK,UAAU,yBAAyB,CACtC,IAA4B,EAC5B,MAAsB,EACtB,GAAW,EACX,IAAa;IAEb,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,uBAAuB,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,IAAI,EAAE,qBAAqB,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,YAAY,CACpB,gBAAgB,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,EAC1C,IAAI,CAAC,kBAAkB,CACxB,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzD,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,CACjD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CACjC,CAAC;QACF,OAAO,uBAAuB,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,KAAK,UAAU,WAAW,CACxB,IAA4B,EAC5B,KAAa;IAEb,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,wCAAwC,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAC9B,OAAwB,EACxB,IAAa,EACb,GAAW;IAEX,IACE,OAAO,CAAC,IAAI,EAAE,gBAAgB;QAC9B,+BAA+B,CAAC,eAAe,EAC/C,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,EAC/C,IAAI,CAAC,kBAAkB,CACxB,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CACnB,KAAa,EACb,GAAW,EACX,IAAa;IAEb,MAAM,KAAK,GAAuB;QAChC,IAAI,EAAE,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc;QAC1D,IAAI,EAAE,MAAM,CAAC,yBAAyB,EAAE;YACtC,KAAK;YACL,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;SACpC,CAAC;QACF,YAAY,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE;KAC/C,CAAC;IACF,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC,QAAQ,CACjC,qBAAqB,EACrB,MAAM,CAAC,qBAAqB,EAAE;QAC5B,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE;QACnC,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,CACH,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,YAAY,CACpB,6BAA6B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACnD,IAAI,CAAC,QAAQ,CACd,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAC1B,IAA4B,EAC5B,MAAsB,EACtB,GAAW,EACX,SAAiB,EACjB,KAAqB;IAErB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,aAAa,IAAI,OAAO,CAAC,oBAAoB,CAAC;IAC9E,IAAI,UAAU,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GACR,UAAU,KAAK,OAAO,CAAC,oBAAoB;QACzC,CAAC,CAAC,uBAAuB;QACzB,CAAC,CAAC,UAAU,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,4DAA4D,EAC5D;YACE,SAAS;YACT,gBAAgB,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;YAC3C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;QACF,MAAM,IAAI,YAAY,CAAC,2BAA2B,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CACnC,GAAW,EACX,cAAsB;IAEtB,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/B,kBAAkB,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IACrD,OAAO,GAAG,8BAA8B,GAAG,GAAG,GAAG,iBAAiB,GAAG,cAAc,EAAE,CAAC;AACxF,CAAC;AAED,SAAS,kBAAkB,CACzB,IAA8B,EAC9B,KAAa;IAEb,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,YAAY,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,YAAY,CACpB,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,EACpC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,SAAS,SAAS,CAChB,IAAY,EACZ,KAAa;IAEb,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,KAAK,GAAG,CAAC;YACd,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE;YACtE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC3E,CAAC"}

package/dist/domain/platformclient/resource-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-store.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/resource-store.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAItD,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,KAAK,GACX,mBAAmB,CA0GrB"}
+{"version":3,"file":"resource-store.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/resource-store.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAItD,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,KAAK,GACX,mBAAmB,CA0HrB"}

package/dist/domain/platformclient/resource-store.js

@@ -20,6 +20,8 @@
  * (org, slug) or client_id; `update` writes nothing for an unknown id; the
  * residual window between the read and the write is the platform-wide
  * CheckDuplicate-then-upsert window, not this adapter's to close.
+ * `modifyById` has no such window: it IS Store.updateResource, the generic
+ * store's own atomic read-modify-write, its not-found read as `undefined`.
  *
  * Store faults follow the ratified mapping: a typed ResourceNotFoundError
  * reads as `undefined`; anything else propagates — an outage must never
@@ -105,6 +107,17 @@ export function newResourcePlatformClientStore(store) {
             }
             await store.saveResource(KIND, id, PlatformClientSchema, client);
         },
+        async modifyById(id, modify) {
+            try {
+                return await store.updateResource(KIND, id, PlatformClientSchema, modify);
+            }
+            catch (error) {
+                if (error instanceof ResourceNotFoundError) {
+                    return undefined;
+                }
+                throw error;
+            }
+        },
         async deleteById(id) {
             await store.deleteResource(KIND, id);
         },

package/dist/domain/platformclient/resource-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-store.js","sourceRoot":"","sources":["../../../src/domain/platformclient/resource-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yDAAyD,CAAC;AAE/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAG1D,MAAM,IAAI,GAAG,eAAe,CAAC,eAAe,CAAC;AAE7C,MAAM,UAAU,8BAA8B,CAC5C,KAAY;IAEZ,KAAK,UAAU,QAAQ,CAAC,EAAU;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,oBAAoB,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,UAAU,cAAc,CAC3B,QAAgB;QAEhB,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,WAAW,CAC5B,IAAI,EACJ,eAAe,EACf,QAAQ,EACR,oBAAoB,CACrB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,mGAAmG;IACnG,KAAK,UAAU,OAAO,CAAC,GAAW;QAChC,MAAM,OAAO,GAAqB,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,IAAI,MAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,UAAU,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,qEAAqE;IACrE,KAAK,UAAU,gBAAgB,CAC7B,GAAW,EACX,IAAY;QAEZ,IAAI,GAAG,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAC9B,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,KAAK,IAAI,CACnD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,4BAA4B,CACpC,oBAAoB,EAAE,kBAAkB,CACzC,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACtD,MAAM,IAAI,4BAA4B,CACpC,oBAAoB,GAAG,IAAI,IAAI,kBAAkB,CAClD,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACtE,MAAM,IAAI,4BAA4B,CACpC,gDAAgD,CACjD,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAC;QACnE,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,OAAO;YACT,CAAC;YACD,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAC;QACnE,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE;YACjB,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC;QAED,QAAQ,EAAE,QAAQ;QAElB,cAAc,EAAE,cAAc;QAE9B,gBAAgB,EAAE,gBAAgB;QAElC,SAAS,EAAE,OAAO;KACnB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"resource-store.js","sourceRoot":"","sources":["../../../src/domain/platformclient/resource-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yDAAyD,CAAC;AAE/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAG1D,MAAM,IAAI,GAAG,eAAe,CAAC,eAAe,CAAC;AAE7C,MAAM,UAAU,8BAA8B,CAC5C,KAAY;IAEZ,KAAK,UAAU,QAAQ,CAAC,EAAU;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,oBAAoB,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,UAAU,cAAc,CAC3B,QAAgB;QAEhB,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,WAAW,CAC5B,IAAI,EACJ,eAAe,EACf,QAAQ,EACR,oBAAoB,CACrB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,mGAAmG;IACnG,KAAK,UAAU,OAAO,CAAC,GAAW;QAChC,MAAM,OAAO,GAAqB,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,IAAI,MAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,UAAU,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,qEAAqE;IACrE,KAAK,UAAU,gBAAgB,CAC7B,GAAW,EACX,IAAY;QAEZ,IAAI,GAAG,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAC9B,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,KAAK,IAAI,CACnD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,4BAA4B,CACpC,oBAAoB,EAAE,kBAAkB,CACzC,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACtD,MAAM,IAAI,4BAA4B,CACpC,oBAAoB,GAAG,IAAI,IAAI,kBAAkB,CAClD,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACtE,MAAM,IAAI,4BAA4B,CACpC,gDAAgD,CACjD,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAC;QACnE,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,OAAO;YACT,CAAC;YACD,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAC;QACnE,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM;YACzB,IAAI,CAAC;gBACH,OAAO,MAAM,KAAK,CAAC,cAAc,CAC/B,IAAI,EACJ,EAAE,EACF,oBAAoB,EACpB,MAAM,CACP,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE;YACjB,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC;QAED,QAAQ,EAAE,QAAQ;QAElB,cAAc,EAAE,cAAc;QAE9B,gBAAgB,EAAE,gBAAgB;QAElC,SAAS,EAAE,OAAO;KACnB,CAAC;AACJ,CAAC"}

package/dist/domain/platformclient/store-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store-contract.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/store-contract.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EACV,gBAAgB,EAEhB,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,gGAAgG;AAChG,MAAM,MAAM,kCAAkC,GAC5C,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;AAE3C,MAAM,MAAM,+BAA+B,GAAG,gBAAgB,CAAC;AA2Q/D,uEAAuE;AACvE,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,MAAM,OAAO,CAAC,kCAAkC,CAAC,GAC7D,aAAa,CAAC,+BAA+B,CAAC,CAEhD"}
+{"version":3,"file":"store-contract.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/store-contract.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EACV,gBAAgB,EAEhB,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,gGAAgG;AAChG,MAAM,MAAM,kCAAkC,GAC5C,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;AAE3C,MAAM,MAAM,+BAA+B,GAAG,gBAAgB,CAAC;AA+W/D,uEAAuE;AACvE,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,MAAM,OAAO,CAAC,kCAAkC,CAAC,GAC7D,aAAa,CAAC,+BAA+B,CAAC,CAEhD"}

package/dist/domain/platformclient/store-contract.js

@@ -154,6 +154,65 @@ const CASES = [
             assert.equal(await store.findById("pcl_contract_acme_dashboard"), undefined, "update must replace, never create");
         },
     ],
+    [
+        "modifyById persists what modify did, answers the persisted row, and the lookups follow it",
+        async ({ store }) => {
+            await store.save(ACME_DASHBOARD);
+            const answered = await store.modifyById("pcl_contract_acme_dashboard", (client) => {
+                assert.ok(client.spec, "the saved client carries a spec");
+                client.spec.allowedOrigins = ["https://app.acme.example"];
+            });
+            const expected = platformClient({
+                id: "pcl_contract_acme_dashboard",
+                org: "acme",
+                slug: "dashboard",
+                clientId: "stgm_cid_contract_acme_dashboard",
+                allowedOrigins: ["https://app.acme.example"],
+            });
+            assertSameClient(answered, expected, "modifyById must answer the persisted row");
+            assertSameClient(await store.findById("pcl_contract_acme_dashboard"), expected, "findById must answer the modified row");
+            assertSameClient(await store.findByClientId("stgm_cid_contract_acme_dashboard"), expected, "findByClientId must answer the modified row");
+            assertSameClient(await store.findByOrgAndSlug("acme", "dashboard"), expected, "findByOrgAndSlug must answer the modified row");
+        },
+    ],
+    [
+        "modifyById of an unknown id answers undefined and writes nothing",
+        async ({ store }) => {
+            let called = false;
+            const answered = await store.modifyById("pcl_contract_acme_dashboard", () => {
+                called = true;
+            });
+            assert.equal(answered, undefined);
+            assert.equal(called, false, "modify must not run for a row that is not held");
+            assert.equal(await store.findById("pcl_contract_acme_dashboard"), undefined, "modifyById must modify, never create");
+        },
+    ],
+    [
+        "a modify that throws writes nothing and rejects with its error",
+        async ({ store }) => {
+            await store.save(ACME_DASHBOARD);
+            const refusal = new Error("modify refused");
+            await assert.rejects(store.modifyById("pcl_contract_acme_dashboard", (client) => {
+                assert.ok(client.spec, "the saved client carries a spec");
+                client.spec.allowedOrigins = ["https://half.written.example"];
+                throw refusal;
+            }), (error) => error === refusal, "the modify's own error must propagate");
+            assertSameClient(await store.findById("pcl_contract_acme_dashboard"), ACME_DASHBOARD, "nothing a throwing modify did may persist");
+        },
+    ],
+    [
+        "concurrent modifyById calls on one row lose no write",
+        async ({ store }) => {
+            await store.save(ACME_DASHBOARD);
+            const origins = Array.from({ length: 8 }, (_, i) => `https://writer-${i}.acme.example`);
+            await Promise.all(origins.map((origin) => store.modifyById("pcl_contract_acme_dashboard", (client) => {
+                assert.ok(client.spec, "the saved client carries a spec");
+                client.spec.allowedOrigins.push(origin);
+            })));
+            const stored = await store.findById("pcl_contract_acme_dashboard");
+            assert.deepEqual([...(stored?.spec?.allowedOrigins ?? [])].sort(), [...origins].sort(), "every concurrent modify must see the one before it: a read-then-write driver loses edits here");
+        },
+    ],
     [
         "deleteById frees the id, the client_id and the slug; deleting an unknown id resolves",
         async ({ store }) => {

package/dist/domain/platformclient/store-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"store-contract.js","sourceRoot":"","sources":["../../../src/domain/platformclient/store-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAGpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yDAAyD,CAAC;AAE/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAMjE,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAS1D,gGAAgG;AAChG,SAAS,cAAc,CAAC,MAMvB;IACC,OAAO,MAAM,CAAC,oBAAoB,EAAE;QAClC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE;YACR,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,EAAE,MAAM,CAAC,GAAG;SAChB;QACD,IAAI,EAAE;YACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,gBAAgB,EAAE,WAAW,MAAM,CAAC,QAAQ,EAAE;YAC9C,iBAAiB,EAAE,QAAQ;YAC3B,qBAAqB,EAAE,IAAI;YAC3B,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;SAC5C;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAkC,EAClC,QAAwB,EACxB,OAAe;IAEf,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,EAAE,GAAG,OAAO,0BAA0B,CAAC,CAAC;IACtE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAAoB,EACpB,OAAe;IAEf,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,EACL,CAAC,KAAc,EAAE,EAAE,CAAC,KAAK,YAAY,4BAA4B,EACjE,OAAO,CACR,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,cAAc,CAAC;IACpC,EAAE,EAAE,6BAA6B;IACjC,GAAG,EAAE,MAAM;IACX,IAAI,EAAE,WAAW;IACjB,QAAQ,EAAE,kCAAkC;CAC7C,CAAC,CAAC;AAEH,MAAM,KAAK,GAAgE;IACzE;QACE,iFAAiF;QACjF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,gBAAgB,CACd,MAAM,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EACnD,cAAc,EACd,oCAAoC,CACrC,CAAC;YACF,gBAAgB,CACd,MAAM,KAAK,CAAC,cAAc,CAAC,kCAAkC,CAAC,EAC9D,cAAc,EACd,0CAA0C,CAC3C,CAAC;YACF,gBAAgB,CACd,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,EACjD,cAAc,EACd,4CAA4C,CAC7C,CAAC;QACJ,CAAC;KACF;IACD;QACE,uDAAuD;QACvD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,CAAC,CAAC;YACrE,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,cAAc,CAAC,0BAA0B,CAAC,EACtD,SAAS,CACV,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;YACxE,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,EACnD,SAAS,EACT,sEAAsE,CACvE,CAAC;QACJ,CAAC;KACF;IACD;QACE,0DAA0D;QAC1D,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,eAAe,CACnB,KAAK,CAAC,IAAI,CACR,cAAc,CAAC;gBACb,EAAE,EAAE,6BAA6B;gBACjC,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,OAAO;gBACb,QAAQ,EAAE,yBAAyB;aACpC,CAAC,CACH,EACD,8CAA8C,CAC/C,CAAC;QACJ,CAAC;KACF;IACD;QACE,mEAAmE;QACnE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,eAAe,CACnB,KAAK,CAAC,IAAI,CACR,cAAc,CAAC;gBACb,EAAE,EAAE,0BAA0B;gBAC9B,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,+BAA+B;aAC1C,CAAC,CACH,EACD,oCAAoC,CACrC,CAAC;QACJ,CAAC;KACF;IACD;QACE,iEAAiE;QACjE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,eAAe,CACnB,KAAK,CAAC,IAAI,CACR,cAAc,CAAC;gBACb,EAAE,EAAE,yBAAyB;gBAC7B,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,OAAO;gBACb,QAAQ,EAAE,kCAAkC;aAC7C,CAAC,CACH,EACD,oEAAoE,CACrE,CAAC;QACJ,CAAC;KACF;IACD;QACE,6DAA6D;QAC7D,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,cAAc,CAAC;gBAC5B,EAAE,EAAE,+BAA+B;gBACnC,GAAG,EAAE,QAAQ;gBACb,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,oCAAoC;aAC/C,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,gBAAgB,CACd,MAAM,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,EACnD,MAAM,EACN,8DAA8D,CAC/D,CAAC;QACJ,CAAC;KACF;IACD;QACE,kCAAkC;QAClC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,cAAc,CAAC;gBAC5B,EAAE,EAAE,6BAA6B;gBACjC,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,kCAAkC;gBAC5C,cAAc,EAAE,CAAC,0BAA0B,CAAC;aAC7C,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,gBAAgB,CACd,MAAM,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EACnD,MAAM,EACN,uCAAuC,CACxC,CAAC;YACF,gBAAgB,CACd,MAAM,KAAK,CAAC,cAAc,CAAC,kCAAkC,CAAC,EAC9D,MAAM,EACN,6CAA6C,CAC9C,CAAC;QACJ,CAAC;KACF;IACD;QACE,wCAAwC;QACxC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACnC,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EACnD,SAAS,EACT,mCAAmC,CACpC,CAAC;QACJ,CAAC;KACF;IACD;QACE,sFAAsF;QACtF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,KAAK,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC;YACtD,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EACnD,SAAS,CACV,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,cAAc,CAAC,kCAAkC,CAAC,EAC9D,SAAS,EACT,qFAAqF,CACtF,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,EACjD,SAAS,CACV,CAAC;YACF,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,KAAK,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;QAChD,CAAC;KACF;IACD;QACE,iEAAiE;QACjE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,KAAK,CAAC,IAAI,CACd,cAAc,CAAC;gBACb,EAAE,EAAE,0BAA0B;gBAC9B,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,+BAA+B;aAC1C,CAAC,CACH,CAAC;YACF,MAAM,KAAK,CAAC,IAAI,CACd,cAAc,CAAC;gBACb,EAAE,EAAE,+BAA+B;gBACnC,GAAG,EAAE,QAAQ;gBACb,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,oCAAoC;aAC/C,CAAC,CACH,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;iBACxC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;iBAC1C,IAAI,EAAE,CAAC;YACV,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE;gBACpB,6BAA6B;gBAC7B,0BAA0B;aAC3B,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QACzD,CAAC;KACF;IACD;QACE,oEAAoE;QACpE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EACrD,wGAAwG,CACzG,CAAC;YACF,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,kCAAkC,CAAC,EAChE,+EAA+E,CAChF,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAEF,uEAAuE;AACvE,MAAM,UAAU,2BAA2B,CACzC,WAA8D;IAE9D,OAAO,iBAAiB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"store-contract.js","sourceRoot":"","sources":["../../../src/domain/platformclient/store-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAGpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yDAAyD,CAAC;AAE/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAMjE,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAS1D,gGAAgG;AAChG,SAAS,cAAc,CAAC,MAMvB;IACC,OAAO,MAAM,CAAC,oBAAoB,EAAE;QAClC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE;YACR,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,EAAE,MAAM,CAAC,GAAG;SAChB;QACD,IAAI,EAAE;YACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,gBAAgB,EAAE,WAAW,MAAM,CAAC,QAAQ,EAAE;YAC9C,iBAAiB,EAAE,QAAQ;YAC3B,qBAAqB,EAAE,IAAI;YAC3B,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;SAC5C;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAkC,EAClC,QAAwB,EACxB,OAAe;IAEf,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,EAAE,GAAG,OAAO,0BAA0B,CAAC,CAAC;IACtE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAAoB,EACpB,OAAe;IAEf,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,EACL,CAAC,KAAc,EAAE,EAAE,CAAC,KAAK,YAAY,4BAA4B,EACjE,OAAO,CACR,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,cAAc,CAAC;IACpC,EAAE,EAAE,6BAA6B;IACjC,GAAG,EAAE,MAAM;IACX,IAAI,EAAE,WAAW;IACjB,QAAQ,EAAE,kCAAkC;CAC7C,CAAC,CAAC;AAEH,MAAM,KAAK,GAAgE;IACzE;QACE,iFAAiF;QACjF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,gBAAgB,CACd,MAAM,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EACnD,cAAc,EACd,oCAAoC,CACrC,CAAC;YACF,gBAAgB,CACd,MAAM,KAAK,CAAC,cAAc,CAAC,kCAAkC,CAAC,EAC9D,cAAc,EACd,0CAA0C,CAC3C,CAAC;YACF,gBAAgB,CACd,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,EACjD,cAAc,EACd,4CAA4C,CAC7C,CAAC;QACJ,CAAC;KACF;IACD;QACE,uDAAuD;QACvD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,CAAC,CAAC;YACrE,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,cAAc,CAAC,0BAA0B,CAAC,EACtD,SAAS,CACV,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;YACxE,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,EACnD,SAAS,EACT,sEAAsE,CACvE,CAAC;QACJ,CAAC;KACF;IACD;QACE,0DAA0D;QAC1D,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,eAAe,CACnB,KAAK,CAAC,IAAI,CACR,cAAc,CAAC;gBACb,EAAE,EAAE,6BAA6B;gBACjC,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,OAAO;gBACb,QAAQ,EAAE,yBAAyB;aACpC,CAAC,CACH,EACD,8CAA8C,CAC/C,CAAC;QACJ,CAAC;KACF;IACD;QACE,mEAAmE;QACnE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,eAAe,CACnB,KAAK,CAAC,IAAI,CACR,cAAc,CAAC;gBACb,EAAE,EAAE,0BAA0B;gBAC9B,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,+BAA+B;aAC1C,CAAC,CACH,EACD,oCAAoC,CACrC,CAAC;QACJ,CAAC;KACF;IACD;QACE,iEAAiE;QACjE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,eAAe,CACnB,KAAK,CAAC,IAAI,CACR,cAAc,CAAC;gBACb,EAAE,EAAE,yBAAyB;gBAC7B,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,OAAO;gBACb,QAAQ,EAAE,kCAAkC;aAC7C,CAAC,CACH,EACD,oEAAoE,CACrE,CAAC;QACJ,CAAC;KACF;IACD;QACE,6DAA6D;QAC7D,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,cAAc,CAAC;gBAC5B,EAAE,EAAE,+BAA+B;gBACnC,GAAG,EAAE,QAAQ;gBACb,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,oCAAoC;aAC/C,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,gBAAgB,CACd,MAAM,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,EACnD,MAAM,EACN,8DAA8D,CAC/D,CAAC;QACJ,CAAC;KACF;IACD;QACE,kCAAkC;QAClC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,cAAc,CAAC;gBAC5B,EAAE,EAAE,6BAA6B;gBACjC,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,kCAAkC;gBAC5C,cAAc,EAAE,CAAC,0BAA0B,CAAC;aAC7C,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,gBAAgB,CACd,MAAM,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EACnD,MAAM,EACN,uCAAuC,CACxC,CAAC;YACF,gBAAgB,CACd,MAAM,KAAK,CAAC,cAAc,CAAC,kCAAkC,CAAC,EAC9D,MAAM,EACN,6CAA6C,CAC9C,CAAC;QACJ,CAAC;KACF;IACD;QACE,wCAAwC;QACxC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACnC,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EACnD,SAAS,EACT,mCAAmC,CACpC,CAAC;QACJ,CAAC;KACF;IACD;QACE,2FAA2F;QAC3F,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CACrC,6BAA6B,EAC7B,CAAC,MAAM,EAAE,EAAE;gBACT,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,iCAAiC,CAAC,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,0BAA0B,CAAC,CAAC;YAC5D,CAAC,CACF,CAAC;YACF,MAAM,QAAQ,GAAG,cAAc,CAAC;gBAC9B,EAAE,EAAE,6BAA6B;gBACjC,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,kCAAkC;gBAC5C,cAAc,EAAE,CAAC,0BAA0B,CAAC;aAC7C,CAAC,CAAC;YACH,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,0CAA0C,CAAC,CAAC;YACjF,gBAAgB,CACd,MAAM,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EACnD,QAAQ,EACR,uCAAuC,CACxC,CAAC;YACF,gBAAgB,CACd,MAAM,KAAK,CAAC,cAAc,CAAC,kCAAkC,CAAC,EAC9D,QAAQ,EACR,6CAA6C,CAC9C,CAAC;YACF,gBAAgB,CACd,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,EACjD,QAAQ,EACR,+CAA+C,CAChD,CAAC;QACJ,CAAC;KACF;IACD;QACE,kEAAkE;QAClE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CACrC,6BAA6B,EAC7B,GAAG,EAAE;gBACH,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC,CACF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAClC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,gDAAgD,CAAC,CAAC;YAC9E,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EACnD,SAAS,EACT,sCAAsC,CACvC,CAAC;QACJ,CAAC;KACF;IACD;QACE,gEAAgE;QAChE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAC5C,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,UAAU,CAAC,6BAA6B,EAAE,CAAC,MAAM,EAAE,EAAE;gBACzD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,iCAAiC,CAAC,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,8BAA8B,CAAC,CAAC;gBAC9D,MAAM,OAAO,CAAC;YAChB,CAAC,CAAC,EACF,CAAC,KAAc,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,EACrC,uCAAuC,CACxC,CAAC;YACF,gBAAgB,CACd,MAAM,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EACnD,cAAc,EACd,2CAA2C,CAC5C,CAAC;QACJ,CAAC;KACF;IACD;QACE,sDAAsD;QACtD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CACxB,EAAE,MAAM,EAAE,CAAC,EAAE,EACb,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,eAAe,CAC7C,CAAC;YACF,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACrB,KAAK,CAAC,UAAU,CAAC,6BAA6B,EAAE,CAAC,MAAM,EAAE,EAAE;gBACzD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,iCAAiC,CAAC,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,CAAC,CAAC,CACH,CACF,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC;YACnE,MAAM,CAAC,SAAS,CACd,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAChD,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EACnB,+FAA+F,CAChG,CAAC;QACJ,CAAC;KACF;IACD;QACE,sFAAsF;QACtF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,KAAK,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC;YACtD,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EACnD,SAAS,CACV,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,cAAc,CAAC,kCAAkC,CAAC,EAC9D,SAAS,EACT,qFAAqF,CACtF,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,EACjD,SAAS,CACV,CAAC;YACF,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,KAAK,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;QAChD,CAAC;KACF;IACD;QACE,iEAAiE;QACjE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,KAAK,CAAC,IAAI,CACd,cAAc,CAAC;gBACb,EAAE,EAAE,0BAA0B;gBAC9B,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,+BAA+B;aAC1C,CAAC,CACH,CAAC;YACF,MAAM,KAAK,CAAC,IAAI,CACd,cAAc,CAAC;gBACb,EAAE,EAAE,+BAA+B;gBACnC,GAAG,EAAE,QAAQ;gBACb,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,oCAAoC;aAC/C,CAAC,CACH,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;iBACxC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;iBAC1C,IAAI,EAAE,CAAC;YACV,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE;gBACpB,6BAA6B;gBAC7B,0BAA0B;aAC3B,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QACzD,CAAC;KACF;IACD;QACE,oEAAoE;QACpE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EACrD,wGAAwG,CACzG,CAAC;YACF,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,kCAAkC,CAAC,EAChE,+EAA+E,CAChF,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAEF,uEAAuE;AACvE,MAAM,UAAU,2BAA2B,CACzC,WAA8D;IAE9D,OAAO,iBAAiB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC"}

package/dist/domain/platformclient/store.d.ts

@@ -13,6 +13,14 @@
  * duplicate check), by organization (listByOrg). A port carries nothing
  * only one edition calls.
  *
+ * One write is atomic: `modifyById`, the port's rendering of
+ * `Store.updateResource`, for the status the platform writes on its own
+ * (the mint's last-use stamp, identity/credential-use.ts). `update` stays
+ * a whole-row replace for the chains that load, edit and persist; a stamp
+ * written that way would race them and could restore a rotated secret. The
+ * driver supplies only the atomicity; what `modify` does stays the
+ * domain's, written once for every edition.
+ *
  * Contract every implementation must satisfy — proven by the port-contract
  * kit (store-contract.ts, exported), which the OSS adapter's test iterates
  * on both drivers and a composition's driver test iterates too:
@@ -21,6 +29,10 @@
  *     overwrite;
  *   - `update` replaces by id and never creates: an unknown id writes
  *     nothing;
+ *   - `modifyById` reads the row, applies `modify` and persists the result
+ *     in one atomic step, so no concurrent write is lost; it answers the
+ *     persisted row, an unknown id answers `undefined` and writes nothing,
+ *     and a `modify` that throws writes nothing and rejects with its error;
  *   - `deleteById` of an unknown id resolves;
  *   - `findByOrg` answers every client of the organization and no other,
  *     in no promised order (the chain sorts);
@@ -46,6 +58,14 @@ export interface PlatformClientStore {
     save(client: PlatformClient): Promise<void>;
     /** Full-row replace by id; an unknown id writes nothing. */
     update(client: PlatformClient): Promise<void>;
+    /**
+     * Atomic read-modify-write by id: `modify` mutates the stored client in
+     * place and the result is persisted, or nothing is. `modify` MUST be
+     * synchronous (Store.updateResource's rule: a driver may hold a write
+     * transaction or a row lock while it runs). Answers the persisted client;
+     * an unknown id answers `undefined`.
+     */
+    modifyById(id: string, modify: (client: PlatformClient) => void): Promise<PlatformClient | undefined>;
     /** Removes the row; no error when it does not exist. */
     deleteById(id: string): Promise<void>;
     findById(id: string): Promise<PlatformClient | undefined>;

package/dist/domain/platformclient/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAE9F;;;;;GAKG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAED,MAAM,WAAW,mBAAmB;IAClC,uFAAuF;IACvF,IAAI,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,4DAA4D;IAC5D,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,wDAAwD;IACxD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAC1D,qEAAqE;IACrE,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACtE,gBAAgB,CACd,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACvC,8DAA8D;IAC9D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;CAChE"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAE9F;;;;;GAKG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAED,MAAM,WAAW,mBAAmB;IAClC,uFAAuF;IACvF,IAAI,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,4DAA4D;IAC5D,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;;;;;;OAMG;IACH,UAAU,CACR,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,GACvC,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACvC,wDAAwD;IACxD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAC1D,qEAAqE;IACrE,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACtE,gBAAgB,CACd,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACvC,8DAA8D;IAC9D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;CAChE"}

package/dist/domain/platformclient/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/domain/platformclient/store.ts"],"names":[],"mappings":"AAiCA;;;;;GAKG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/domain/platformclient/store.ts"],"names":[],"mappings":"AA6CA;;;;;GAKG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF"}

package/dist/domain/platformclient/verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/verifier.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AAOtC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAM5E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,+BAA+B,GACpC,gBAAgB,CA8ClB"}
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/verifier.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AAOtC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAM5E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,+BAA+B,GACpC,gBAAgB,CA+ClB"}

package/dist/domain/platformclient/verifier.js

@@ -26,8 +26,12 @@
  * The identity is the account the token was minted for: `sub` IS the
  * account id (the mint signs it), so no account read is needed; class
  * `user`, issuer "stigmer", the token carried (the memory-capture gate and
- * the origin guard read its `platform_client_id`), and the email and name
- * the platform asserted, for display only.
+ * the origin guard read its `platform_client_id`, guards decoding their
+ * own skip logic from the raw token as extensions/caller-guards.ts
+ * prescribes), the email and name the platform asserted, for display
+ * only, and the minting client as `platformClientId` for the audit-actor
+ * seam, so every resource a minted user writes names the client they came
+ * through (stigmer/stigmer#1256).
  */
 import { Code, ConnectError } from "@connectrpc/connect";
 import { PLATFORM_TOKEN_ISSUER, platformTokenRefusalError, stringClaim, verifyPlatformToken, } from "../../platformtoken/envelope.js";
@@ -69,6 +73,7 @@ export function newPlatformClientTokenVerifier(deps) {
                 rawToken: token,
                 ...(email !== undefined ? { email } : {}),
                 ...(displayName !== undefined ? { displayName } : {}),
+                platformClientId,
             };
         },
     };