@stigmer/server 3.32.0 → 3.33.0

package/dist/temporal/schedule/status-writes.js

@@ -1,20 +1,16 @@
 /**
- * The clock's status-write helpers — port the ensureStatus/bumpStatusAudit
- * pair of pkg/domain/schedule/temporal/syncer.go.
+ * The clock's status-write helper — ports ensureStatus of
+ * pkg/domain/schedule/temporal/syncer.go.
  *
- * bumpStatusAudit is DELIBERATELY narrower than the shared
- * setAuditFieldsForUpdate: Go's clock stamps only status-audit
- * updated_at + event ("the same two leaves every cloud runtime patch
- * bumps") and never an actor — the clock is the platform, not an operator.
- * Controller-side status writes (trigger's last_fire_at stamp, resume's
- * clear) use the FULL shared helper instead, exactly as Go splits
- * steps.SetAuditFieldsForUpdate from the clock's bump. Two flavors, two
- * writers, both wire-visible — keep them distinct.
+ * The clock's audit stamp is the shared `bumpStatusAudit`
+ * (pipeline/steps/defaults.ts): status-audit updated_at + event only, never
+ * an actor — the clock is the platform, not an operator. Controller-side
+ * status writes (trigger's last_fire_at stamp, resume's clear) use the FULL
+ * setAuditFieldsForUpdate instead, exactly as Go splits
+ * steps.SetAuditFieldsForUpdate from the clock's bump.
  */
 import { create } from "@bufbuild/protobuf";
-import { timestampNow } from "@bufbuild/protobuf/wkt";
 import { ScheduleStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/status_pb";
-import { ApiResourceAuditInfoSchema, ApiResourceAuditSchema, } from "@stigmer/protos/ai/stigmer/commons/apiresource/status_pb";
 /**
  * Returns the schedule's status, materializing the nested message a fresh
  * row may lack (Go ensureStatus).
@@ -25,19 +21,4 @@ export function ensureStatus(schedule) {
     }
     return schedule.status;
 }
-/**
- * Stamps the status-audit trail for a runtime write — updated_at + event
- * "updated", nothing else (Go bumpStatusAudit; see the module header for
- * why this is not setAuditFieldsForUpdate).
- */
-export function bumpStatusAudit(status) {
-    if (status.audit === undefined) {
-        status.audit = create(ApiResourceAuditSchema);
-    }
-    if (status.audit.statusAudit === undefined) {
-        status.audit.statusAudit = create(ApiResourceAuditInfoSchema);
-    }
-    status.audit.statusAudit.updatedAt = timestampNow();
-    status.audit.statusAudit.event = "updated";
-}
 //# sourceMappingURL=status-writes.js.map

package/dist/temporal/schedule/status-writes.js.map

@@ -1 +1 @@
-{"version":3,"file":"status-writes.js","sourceRoot":"","sources":["../../../src/temporal/schedule/status-writes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAGtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0DAA0D,CAAC;AAEhG,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,0DAA0D,CAAC;AAElE;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,QAAkB;IAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAsB;IACpD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,GAAG,SAAS,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"status-writes.js","sourceRoot":"","sources":["../../../src/temporal/schedule/status-writes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,0DAA0D,CAAC;AAGhG;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,QAAkB;IAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC;AACzB,CAAC"}

package/dist/temporal/schedule/syncer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"syncer.d.ts","sourceRoot":"","sources":["../../../src/temporal/schedule/syncer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAuB,MAAM,oBAAoB,CAAC;AAKtE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uDAAuD,CAAC;AAGtF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAKtD;;;;GAIG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;;CAKlD;AAED,qBAAa,cAAc;IAEvB,+DAA+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;;IAJvB,+DAA+D;IAC9C,cAAc,EAAE,MAAM,MAAM,GAAG,SAAS,EACxC,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,EAAE,MAAM;IAGjC;;;;;OAKG;IACG,eAAe,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IA+CpE;;;;;OAKG;IACG,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAqBnE;;;;OAIG;IACG,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBjD;;;;OAIG;YACW,gBAAgB;CA6B/B"}
+{"version":3,"file":"syncer.d.ts","sourceRoot":"","sources":["../../../src/temporal/schedule/syncer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAuB,MAAM,oBAAoB,CAAC;AAKtE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uDAAuD,CAAC;AAGtF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAGnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAKtD;;;;GAIG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;;CAKlD;AAED,qBAAa,cAAc;IAEvB,+DAA+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;;IAJvB,+DAA+D;IAC9C,cAAc,EAAE,MAAM,MAAM,GAAG,SAAS,EACxC,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,EAAE,MAAM;IAGjC;;;;;OAKG;IACG,eAAe,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IA+CpE;;;;;OAKG;IACG,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAqBnE;;;;OAIG;IACG,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBjD;;;;OAIG;YACW,gBAAgB;CA6B/B"}

package/dist/temporal/schedule/syncer.js

@@ -2,10 +2,11 @@ import { ScheduleAlreadyRunning, ScheduleNotFoundError } from "@temporalio/clien
 import { timestampFromDate } from "@bufbuild/protobuf/wkt";
 import { ScheduleSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { bumpStatusAudit } from "../../pipeline/steps/defaults.js";
 import { ResourceNotFoundError } from "../../store/interface.js";
 import { desiredPaused, note } from "./artifact.js";
 import { artifactId } from "./names.js";
-import { bumpStatusAudit, ensureStatus } from "./status-writes.js";
+import { ensureStatus } from "./status-writes.js";
 /**
  * The syncer's answer when no Temporal client exists right now (Go
  * ErrTemporalUnavailable). Callers on the write path treat it as "converge

package/dist/temporal/schedule/syncer.js.map

@@ -1 +1 @@
-{"version":3,"file":"syncer.js","sourceRoot":"","sources":["../../../src/temporal/schedule/syncer.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AAEvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEnE;;;;GAIG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD;QACE,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,cAAc;IAGN;IACA;IACA;IACA;IALnB;IACE,+DAA+D;IAC9C,cAAwC,EACxC,KAAY,EACZ,QAA0B,EAC1B,MAAc;QAHd,mBAAc,GAAd,cAAc,CAA0B;QACxC,UAAK,GAAL,KAAK,CAAO;QACZ,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,QAAkB;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,wBAAwB,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QAC/C,MAAM,EAAE,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QAElC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;gBAC5C,WAAW,EAAE,EAAE;gBACf,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC;gBACpB,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,sBAAsB,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE;oBACnE,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;YACD,qEAAqE;YACrE,sEAAsE;YACtE,qCAAqC;YACrC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,QAAQ;qBAClB,SAAS,CAAC,EAAE,CAAC;qBACb,MAAM,CAAC,CAAC,QAA6B,EAAE,EAAE,CACxC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CACpD,CAAC;YACN,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,4BAA4B,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC,EAAE,EACzD,EAAE,KAAK,EAAE,WAAW,EAAE,CACvB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;gBAC5C,WAAW,EAAE,EAAE;gBACf,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC;gBACpB,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,QAAkB;QACrC,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,wBAAwB,EAAE,CAAC;QACvC,CAAC;QACD,IAAI,WAAgC,CAAC;QACrC,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,MAAM,CAAC,QAAQ;iBAChC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;iBAClD,QAAQ,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,+BAA+B,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE;gBAC/D,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QACD,OAAO,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,UAAkB;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,wBAAwB,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,EAAE,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE;gBACnE,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAAC,QAAkB;QAC/C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAC7B,eAAe,CAAC,QAAQ,EACxB,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAC3B,cAAc,EACd,CAAC,IAAI,EAAE,EAAE;gBACP,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;gBAClC,MAAM,CAAC,UAAU;oBACf,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;gBACvE,eAAe,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,mEAAmE;gBACnE,iEAAiE;gBACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAwD,EACxD,EAAE,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAC7C,CAAC;gBACF,OAAO,UAAU,CAAC;YACpB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;CACF;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"syncer.js","sourceRoot":"","sources":["../../../src/temporal/schedule/syncer.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AAEvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD;;;;GAIG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD;QACE,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,cAAc;IAGN;IACA;IACA;IACA;IALnB;IACE,+DAA+D;IAC9C,cAAwC,EACxC,KAAY,EACZ,QAA0B,EAC1B,MAAc;QAHd,mBAAc,GAAd,cAAc,CAA0B;QACxC,UAAK,GAAL,KAAK,CAAO;QACZ,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,QAAkB;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,wBAAwB,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QAC/C,MAAM,EAAE,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QAElC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;gBAC5C,WAAW,EAAE,EAAE;gBACf,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC;gBACpB,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,sBAAsB,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE;oBACnE,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;YACD,qEAAqE;YACrE,sEAAsE;YACtE,qCAAqC;YACrC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,QAAQ;qBAClB,SAAS,CAAC,EAAE,CAAC;qBACb,MAAM,CAAC,CAAC,QAA6B,EAAE,EAAE,CACxC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CACpD,CAAC;YACN,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,4BAA4B,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC,EAAE,EACzD,EAAE,KAAK,EAAE,WAAW,EAAE,CACvB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;gBAC5C,WAAW,EAAE,EAAE;gBACf,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC;gBACpB,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,QAAkB;QACrC,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,wBAAwB,EAAE,CAAC;QACvC,CAAC;QACD,IAAI,WAAgC,CAAC;QACrC,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,MAAM,CAAC,QAAQ;iBAChC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;iBAClD,QAAQ,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,+BAA+B,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE;gBAC/D,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QACD,OAAO,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,UAAkB;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,wBAAwB,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,EAAE,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE;gBACnE,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAAC,QAAkB;QAC/C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAC7B,eAAe,CAAC,QAAQ,EACxB,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAC3B,cAAc,EACd,CAAC,IAAI,EAAE,EAAE;gBACP,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;gBAClC,MAAM,CAAC,UAAU;oBACf,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;gBACvE,eAAe,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,mEAAmE;gBACnE,iEAAiE;gBACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAwD,EACxD,EAAE,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAC7C,CAAC;gBACF,OAAO,UAAU,CAAC;YACpB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;CACF;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/server",
-  "version": "3.32.0",
+  "version": "3.33.0",
   "description": "The Stigmer OSS control plane as a composable library: composeServer, the extension registry and the driver seams a composition builds on. The self-contained deployable of the same server is @stigmer/server-slim.",
   "license": "Apache-2.0",
   "type": "module",
@@ -63,11 +63,11 @@
     "@connectrpc/connect-node": "^2.0.0",
     "@kubernetes/client-node": "2.0.0",
     "@opentelemetry/api": "^1.9.0",
-    "@stigmer/outbound": "3.32.0",
-    "@stigmer/plugin-package": "3.32.0",
-    "@stigmer/protos": "3.32.0",
-    "@stigmer/temporal-codecs": "3.32.0",
-    "@stigmer/zip-structure": "3.32.0",
+    "@stigmer/outbound": "3.33.0",
+    "@stigmer/plugin-package": "3.33.0",
+    "@stigmer/protos": "3.33.0",
+    "@stigmer/temporal-codecs": "3.33.0",
+    "@stigmer/zip-structure": "3.33.0",
     "@temporalio/activity": "1.16.2",
     "@temporalio/client": "1.16.2",
     "@temporalio/common": "1.16.2",

package/src/boot/compose.ts

@@ -1693,7 +1693,14 @@ export async function composeServer(
   //     own (the cloud's sandbox lanes).
   const identityVerifiers = [
     ...(requireAuthentication
-      ? [newApiKeyIdentityVerifier({ store, accounts: identityAccounts })]
+      ? [
+          newApiKeyIdentityVerifier({
+            store,
+            accounts: identityAccounts,
+            logger,
+            now: () => new Date(),
+          }),
+        ]
       : []),
     // The PlatformClient user-token lane rides the ring, which the keys
     // stage resolves only under an authentication posture. It sits before

package/src/domain/apikey/__tests__/apikey.test.ts

@@ -12,7 +12,9 @@
  *     values; only the expiry fields move;
  *   - getByKeyHash resolves by the stored hash and answers the
  *     byte-pinned "ApiKey not found" for an unknown or deleted hash —
- *     deletion takes effect on the very next lookup (no cache).
+ *     deletion takes effect on the very next lookup (no cache);
+ *   - findAll answers newest first, so a key's last-use stamp rewriting
+ *     its row never reorders the list (stigmer/stigmer#1255).
  */
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -21,7 +23,7 @@ import path from "node:path";
 import { Code, ConnectError, createClient } from "@connectrpc/connect";
 import type { Client, Transport } from "@connectrpc/connect";
 import { createGrpcTransport } from "@connectrpc/connect-node";
-import { timestampFromDate } from "@bufbuild/protobuf/wkt";
+import { timestampDate, timestampFromDate } from "@bufbuild/protobuf/wkt";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 
 import { ApiKeyCommandController } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/command_pb";
@@ -250,4 +252,17 @@ describe("apikey domain (composed server)", () => {
     expect(mine).toBeDefined();
     expect(mine?.spec?.keyHash).toBe(hashApiKey(plaintext));
   });
+
+  it("findAll answers newest first", async () => {
+    for (let i = 0; i < 3; i += 1) {
+      await command.create(keyInput());
+    }
+    const created = (await query.findAll({})).entries.map((entry) => {
+      const at = entry.status?.audit?.specAudit?.createdAt;
+      expect(at, "every stored key carries its creation instant").toBeDefined();
+      return timestampDate(at!).getTime();
+    });
+    expect(created.length).toBeGreaterThanOrEqual(3);
+    expect(created).toEqual([...created].sort((a, b) => b - a));
+  });
 });

package/src/domain/apikey/__tests__/verifier.test.ts

@@ -15,13 +15,18 @@
  * the REAL open-source adapter over the same SQLite store the keys live
  * in, so what is pinned is the production pair; only the fault arm
  * substitutes a one-method lookup that rejects.
+ *
+ * An accepted key's use lands on its own row (stigmer/stigmer#1255):
+ * stamped on the first verify, left alone inside the resolution, moved
+ * forward after it; a refused key records nothing; a stamp that cannot be
+ * written is logged and the request is still authenticated.
  */
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 
 import { create } from "@bufbuild/protobuf";
-import { timestampFromDate } from "@bufbuild/protobuf/wkt";
+import { timestampDate, timestampFromDate } from "@bufbuild/protobuf/wkt";
 import { Code, ConnectError } from "@connectrpc/connect";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 
@@ -31,6 +36,9 @@ import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityac
 import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
 
 import { createLogger } from "../../../boot/logger.js";
+import type { Logger } from "../../../boot/logger.js";
+import { LAST_USED_RESOLUTION_MS } from "../../../identity/credential-use.js";
+import type { Store } from "../../../store/interface.js";
 import { SqliteStore } from "../../../store/sqlite/store.js";
 import { accountIdFor } from "../../identityaccount/constants.js";
 import type { AccountsBySubject } from "../../identityaccount/resolve.js";
@@ -56,9 +64,24 @@ beforeAll(() => {
   accounts = newResourceIdentityAccountStore(store);
 });
 
+const silent = createLogger({ level: "error", pretty: false, write: () => {} });
+
 /** The verifier as compose builds it: the key store and the account port over ONE store. */
-function verifier(lookup: AccountsBySubject = accounts) {
-  return newApiKeyIdentityVerifier({ store, accounts: lookup });
+function verifier(
+  lookup: AccountsBySubject = accounts,
+  options: { store?: Store; now?: () => Date; logger?: Logger } = {},
+) {
+  return newApiKeyIdentityVerifier({
+    store: options.store ?? store,
+    accounts: lookup,
+    logger: options.logger ?? silent,
+    now: options.now ?? (() => new Date()),
+  });
+}
+
+/** The key's row as stored now. */
+function storedKey(id: string) {
+  return store.getResource(ApiResourceKind.api_key, id, ApiKeySchema);
 }
 
 /** A direct account for `sub` through the real adapter — derived id, as provisioning writes it. */
@@ -302,3 +325,63 @@ describe("creator stamp → account resolution (20260911.11 A6)", () => {
     expect(reads).toEqual([]);
   });
 });
+
+describe("last use (stigmer/stigmer#1255)", () => {
+  it("an accepted key stamps its last use on its own row, once per resolution, forward after it", async () => {
+    const { plaintext, id } = await seedKey();
+    let clock = new Date("2026-09-28T12:00:00Z");
+    const apikey = verifier(accounts, { now: () => clock });
+
+    expect((await storedKey(id)).status?.lastUsedAt).toBeUndefined();
+    await apikey.verify(plaintext);
+    const first = (await storedKey(id)).status;
+    expect(timestampDate(first!.lastUsedAt!)).toEqual(clock);
+    expect(first?.audit?.statusAudit?.event).toBe("updated");
+    expect(
+      first?.audit?.statusAudit?.createdBy?.id,
+      "the status-audit slot keeps who created the key",
+    ).toBe("user@example.com");
+    expect(first?.audit?.specAudit?.updatedAt, "the spec audit is not touched").toBeUndefined();
+
+    clock = new Date(clock.getTime() + LAST_USED_RESOLUTION_MS - 1);
+    await apikey.verify(plaintext);
+    expect(
+      (await storedKey(id)).status,
+      "inside the resolution nothing is written",
+    ).toEqual(first);
+
+    clock = new Date(clock.getTime() + 1);
+    await apikey.verify(plaintext);
+    expect(timestampDate((await storedKey(id)).status!.lastUsedAt!)).toEqual(clock);
+  });
+
+  it("a refused key records nothing", async () => {
+    const { plaintext, id } = await seedKey({
+      expiresAt: new Date(Date.now() - 60_000),
+    });
+    await expect(verifier().verify(plaintext)).rejects.toBeInstanceOf(ConnectError);
+    expect((await storedKey(id)).status?.lastUsedAt).toBeUndefined();
+  });
+
+  it("a stamp that cannot be written is logged with the key's id and the request is still authenticated", async () => {
+    const { plaintext, id } = await seedKey({ ownerId: "ida_resilient" });
+    const lines: string[] = [];
+    const logger = createLogger({
+      level: "warn",
+      pretty: false,
+      write: (line) => lines.push(line),
+    });
+    const failingWrites = {
+      findByField: store.findByField.bind(store),
+      updateResource: () => Promise.reject(new Error("disk full")),
+    } as unknown as Store;
+
+    const identity = await verifier(accounts, { store: failingWrites, logger }).verify(plaintext);
+
+    expect(identity?.identityId).toBe("ida_resilient");
+    expect(lines).toHaveLength(1);
+    const entry = JSON.parse(lines[0]!) as Record<string, unknown>;
+    expect(entry).toMatchObject({ level: "warn", credential: "api key", id, error: "disk full" });
+    expect(lines[0], "the token is never logged").not.toContain(plaintext);
+  });
+});

package/src/domain/apikey/controller.ts

@@ -58,6 +58,7 @@ import {
   newLoadExistingForDeleteStep,
 } from "../../pipeline/steps/delete.js";
 import { newCheckDuplicateStep } from "../../pipeline/steps/duplicate.js";
+import { compareCreatedAtDesc } from "../../pipeline/steps/helpers.js";
 import {
   EXISTING_RESOURCE_KEY,
   newLoadExistingStep,
@@ -289,7 +290,10 @@ async function getByKeyHash(
  * 9) the list narrows to the caller's can_view keys — the Java
  * ApiKeyFindAllHandler baseline (no guest arm, no org intersection).
  * Stored hashes ride the response exactly as the cloud's do — the
- * plaintext exists nowhere.
+ * plaintext exists nowhere. Newest first, as PlatformClient's listByOrg
+ * answers: the store's scan has no order, and a key's own last-use stamp
+ * rewrites its row, so an unsorted list would reorder as keys are used
+ * (stigmer/stigmer#1255).
  */
 async function findAll(
   deps: ApiKeyControllerDeps,
@@ -319,12 +323,18 @@ async function findAll(
   } catch (error) {
     throw internalError(error, "failed to list api keys");
   }
-  const entries = await restrictListByReadScope(
+  const visible = await restrictListByReadScope(
     deps.listReadScope,
     identity,
     ApiResourceKind.api_key,
     rows.map((row) => fromBinary(ApiKeySchema, row)),
     "",
   );
+  const entries = [...visible].sort((a, b) =>
+    compareCreatedAtDesc(
+      a.status?.audit?.specAudit?.createdAt,
+      b.status?.audit?.specAudit?.createdAt,
+    ),
+  );
   return create(ApiKeysSchema, { entries });
 }

package/src/domain/apikey/verifier.ts

@@ -33,14 +33,28 @@
  * identityId changes on a hit: email/displayName stay the stamp's, the
  * actor the key recorded at minting. The credential checks run first, so
  * a revoked or expired key never reaches the account store.
+ *
+ * An accepted key's use is then recorded on its status.last_used_at
+ * (identity/credential-use.ts): at most once a resolution, judged from the
+ * row this read already holds, written atomically through
+ * Store.updateResource so it can never undo a concurrent update of the
+ * key, and best-effort — a failed stamp is logged and the request
+ * proceeds. A refused key records nothing (stigmer/stigmer#1255).
  */
 import { Code, ConnectError } from "@connectrpc/connect";
+import { create } from "@bufbuild/protobuf";
 import { timestampDate } from "@bufbuild/protobuf/wkt";
 
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiKeySchema, ApiKeyStatusSchema } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/api_pb";
+import type { ApiKey } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/api_pb";
+
+import type { Logger } from "../../boot/logger.js";
 import type {
   CallerIdentity,
   IdentityVerifier,
 } from "../../extensions/identity.js";
+import { recordCredentialUse } from "../../identity/credential-use.js";
 import type { Store } from "../../store/interface.js";
 import { identityIdForSubject } from "../identityaccount/resolve.js";
 import type { AccountsBySubject } from "../identityaccount/resolve.js";
@@ -58,12 +72,16 @@ export interface ApiKeyVerifierDeps {
   readonly store: Store;
   /** The identity-account domain's subject lookup the creator stamp resolves through (A6). */
   readonly accounts: AccountsBySubject;
+  /** Where a failed last-use stamp is reported. */
+  readonly logger: Logger;
+  /** The clock both the expiry check and the last-use stamp read. */
+  readonly now: () => Date;
 }
 
 export function newApiKeyIdentityVerifier(
   deps: ApiKeyVerifierDeps,
 ): IdentityVerifier {
-  const { store, accounts } = deps;
+  const { store, accounts, logger } = deps;
   return {
     name: "apikey",
     async verify(token: string): Promise<CallerIdentity | null> {
@@ -74,8 +92,9 @@ export function newApiKeyIdentityVerifier(
       if (key === undefined) {
         throw new ConnectError(INVALID_TOKEN_MESSAGE, Code.Unauthenticated);
       }
+      const now = deps.now();
       const expiresAt = key.spec?.expiresAt;
-      if (expiresAt !== undefined && timestampDate(expiresAt) <= new Date()) {
+      if (expiresAt !== undefined && timestampDate(expiresAt) <= now) {
         throw new ConnectError(TOKEN_EXPIRED_MESSAGE, Code.Unauthenticated);
       }
       const owner = key.status?.audit?.specAudit?.createdBy;
@@ -85,8 +104,10 @@ export function newApiKeyIdentityVerifier(
         // through the pipeline; guards hand-seeded or corrupted rows).
         throw new ConnectError(INVALID_TOKEN_MESSAGE, Code.Unauthenticated);
       }
+      const identityId = await identityIdForSubject(accounts, owner.id);
+      await recordKeyUse(store, logger, key, now);
       return {
-        identityId: await identityIdForSubject(accounts, owner.id),
+        identityId,
         callerClass: "user",
         issuer: "",
         rawToken: token,
@@ -96,3 +117,25 @@ export function newApiKeyIdentityVerifier(
     },
   };
 }
+
+/** Stamps the accepted key's last use on its own row, atomically. */
+function recordKeyUse(
+  store: Store,
+  logger: Logger,
+  key: ApiKey,
+  now: Date,
+): Promise<void> {
+  const id = key.metadata?.id ?? "";
+  return recordCredentialUse({
+    credential: "api key",
+    id,
+    lastUsedAt: key.status?.lastUsedAt,
+    now,
+    logger,
+    write: (stamp) =>
+      store.updateResource(ApiResourceKind.api_key, id, ApiKeySchema, (live) => {
+        live.status ??= create(ApiKeyStatusSchema);
+        stamp(live.status);
+      }),
+  });
+}

package/src/domain/platformclient/__tests__/mint.test.ts

@@ -15,13 +15,17 @@
  *     nothing; a failed create leaves the grant, and the next mint completes
  *     the account; a concurrent winner is read back;
  *   - the default role is viewer, owner is refused, and the token carries
- *     the cloud's claim set for the account.
+ *     the cloud's claim set for the account;
+ *   - a successful mint stamps the client's last use through the port's
+ *     atomic modifyById (never the whole-row update), once per resolution;
+ *     a refused mint records nothing; a stamp that cannot be written is
+ *     logged and the token is still answered (stigmer/stigmer#1255).
  */
 import { generateKeyPairSync } from "node:crypto";
 
 import { Code, ConnectError } from "@connectrpc/connect";
-import { create } from "@bufbuild/protobuf";
-import { timestampFromDate } from "@bufbuild/protobuf/wkt";
+import { clone, create } from "@bufbuild/protobuf";
+import { timestampDate, timestampFromDate } from "@bufbuild/protobuf/wkt";
 import { describe, expect, it } from "vitest";
 
 import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
@@ -30,12 +34,18 @@ import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/
 import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
 import type { IamPolicySpec } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
 import type { PlatformClient } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
-import { PlatformClientSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+import {
+  PlatformClientSchema,
+  PlatformClientStatusSchema,
+} from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
 import { MintUserTokenRequestSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/token_pb";
 import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
+import { createLogger } from "../../../boot/logger.js";
+import type { Logger } from "../../../boot/logger.js";
 import type { CallerIdentity } from "../../../extensions/identity.js";
 import { silentLogger } from "../../../extensions/__tests__/composed-support.js";
+import { LAST_USED_RESOLUTION_MS } from "../../../identity/credential-use.js";
 import { verifyPlatformToken } from "../../../platformtoken/envelope.js";
 import { platformTokenKeyRingFromPem } from "../../../platformtoken/key-ring.js";
 import type { PlatformTokenKeyRing } from "../../../platformtoken/key-ring.js";
@@ -101,6 +111,10 @@ interface Harness {
   }>;
   readonly granted: Array<{ spec: IamPolicySpec; caller: CallerIdentity }>;
   readonly accounts: Map<string, IdentityAccount>;
+  /** The client row as the port holds it; modifyById writes here. */
+  readonly stored: { client: PlatformClient };
+  /** Every port write, by method: the stamp must ride modifyById alone. */
+  readonly clientWrites: string[];
 }
 
 function harness(
@@ -109,9 +123,12 @@ function harness(
     keys?: PlatformTokenKeyRing | undefined;
     failGrant?: boolean;
     failCreate?: "fault" | "lost-race";
+    failStamp?: boolean;
+    logger?: Logger;
   } = {},
 ): Harness {
-  const client = options.client ?? platformClient();
+  const stored = { client: options.client ?? platformClient() };
+  const clientWrites: string[] = [];
   const events: string[] = [];
   const created: Harness["created"] = [];
   const granted: Harness["granted"] = [];
@@ -126,12 +143,25 @@ function harness(
   };
   const deps: PlatformClientMintDeps = {
     clients: {
-      save: async () => {},
-      update: async () => {},
+      save: async () => {
+        clientWrites.push("save");
+      },
+      update: async () => {
+        clientWrites.push("update");
+      },
+      modifyById: async (id, modify) => {
+        clientWrites.push("modifyById");
+        if (options.failStamp === true) throw new Error("client store down");
+        if (id !== stored.client.metadata?.id) return undefined;
+        const next = clone(PlatformClientSchema, stored.client);
+        modify(next);
+        stored.client = next;
+        return next;
+      },
       deleteById: async () => {},
-      findById: async () => client,
+      findById: async () => stored.client,
       findByClientId: async (clientId) =>
-        clientId === client.spec?.clientId ? client : undefined,
+        clientId === stored.client.spec?.clientId ? stored.client : undefined,
       findByOrgAndSlug: async () => undefined,
       findByOrg: async () => [],
     },
@@ -156,10 +186,10 @@ function harness(
     },
     grantPath,
     keys: "keys" in options ? options.keys : RING,
-    logger: silentLogger,
+    logger: options.logger ?? silentLogger,
     now: () => NOW,
   };
-  return { deps, events, created, granted, accounts };
+  return { deps, events, created, granted, accounts, stored, clientWrites };
 }
 
 function request(
@@ -419,3 +449,59 @@ describe("mintUserToken — the user", () => {
     );
   });
 });
+
+describe("mintUserToken — the client's last use", () => {
+  it("a successful mint stamps the client's last use at the mint's clock, through modifyById alone", async () => {
+    const h = harness();
+    await mintUserToken(h.deps, request());
+    expect(h.clientWrites).toEqual(["modifyById"]);
+    expect(timestampDate(h.stored.client.status!.lastUsedAt!)).toEqual(NOW);
+    expect(h.stored.client.status?.audit?.statusAudit?.event).toBe("updated");
+    expect(
+      h.stored.client.spec?.clientSecretHash,
+      "the stamp never rewrites the credential",
+    ).toBe(hashClientSecret(SECRET));
+  });
+
+  it("a mint inside the resolution writes nothing", async () => {
+    const recent = platformClient();
+    recent.status = create(PlatformClientStatusSchema, {
+      lastUsedAt: timestampFromDate(
+        new Date(NOW.getTime() - LAST_USED_RESOLUTION_MS / 2),
+      ),
+    });
+    const h = harness({ client: recent });
+    await mintUserToken(h.deps, request());
+    expect(h.clientWrites).toEqual([]);
+  });
+
+  it("a refused mint records nothing", async () => {
+    const h = harness();
+    await refusal(mintUserToken(h.deps, request({ clientSecret: "wrong" })));
+    await refusal(mintUserToken(h.deps, request({ orgId: "globex" })));
+    expect(h.clientWrites).toEqual([]);
+    expect(h.stored.client.status?.lastUsedAt).toBeUndefined();
+  });
+
+  it("a stamp that cannot be written is logged with the client's id and the token is still answered", async () => {
+    const lines: string[] = [];
+    const h = harness({
+      failStamp: true,
+      logger: createLogger({
+        level: "warn",
+        pretty: false,
+        write: (line) => lines.push(line),
+      }),
+    });
+    const response = await mintUserToken(h.deps, request());
+    expect(response.accessToken).not.toBe("");
+    expect(lines).toHaveLength(1);
+    expect(JSON.parse(lines[0]!)).toMatchObject({
+      level: "warn",
+      credential: "platform client",
+      id: "pcl_dashboard",
+      error: "client store down",
+    });
+    expect(lines[0], "the secret is never logged").not.toContain(SECRET);
+  });
+});

package/src/domain/platformclient/__tests__/resource-store.test.ts

@@ -39,6 +39,10 @@ const CONTRACT_CASE_NAMES = [
   "the same slug in another organization is a different client",
   "update replaces the row in place",
   "update of an unknown id writes nothing",
+  "modifyById persists what modify did, answers the persisted row, and the lookups follow it",
+  "modifyById of an unknown id answers undefined and writes nothing",
+  "a modify that throws writes nothing and rejects with its error",
+  "concurrent modifyById calls on one row lose no write",
   "deleteById frees the id, the client_id and the slug; deleting an unknown id resolves",
   "findByOrg answers every client of the organization and no other",
   "a disconnected store is an infrastructure fault, never 'not found'",