Products

List an account's product instances

⛔ The boundary here is **account ownership**, not the tenant filter.

This partition is keyed by an account the caller named, and its rows would pass a tenant filter for every account inside the caller's own tenant. So it gates on ``require_visible_account``, which reads through the guarded ``get_account`` and 404s identically for "not yours" and "never existed" — the laas-64 rule for every ``account_id`` branch.

Parâmetros

Respostas

List the products bound to the caller's tenant

A tenant's own catalog.

⟲ *LaaS-77:* ``quadra-escrow`` now appears, for the tenants that have bound it — SafeSwap is catalog product #1 and these routes genuinely drive it. What a product is listed *by* is its binding row, so the rule is unchanged and ``quadra-squad`` is still absent: it has no row, and listing it would advertise a surface these routes cannot drive (laas-91 is where it gets one).

Parâmetros

Respostas

Get one bound product

Parâmetros

Respostas

List a product's instances

Parâmetros

Respostas

Get one product instance and its on-chain timeline

The instance index row plus every product UTxO it has ever had.

⛔ **The timeline is NOT filtered to this product**, and that is a correction rather than an omission. A close writes its release output as a **custody** row — the value has left the product — so filtering on ``product_id`` drops the terminal transition and a closed instance's history stops at whatever state preceded it. The devlocal run is what showed it: three transitions, two rows.

The boundary is elsewhere and is not weakened by that. The index row is tenant-guarded at the accessor and its ``product_id`` must match the path, so a caller reaches this line only for an instance of a product already shown to be theirs; every row GSI4 returns belongs to that instance by key; and each row is still put through the same tenant predicate, which permits an un-attributed row exactly as ``tenant_owned`` does (the obligation-first window writes one before head-indexer stamps it).

⟲ *LaaS-77:* an instance created through a product's **own** bespoke routes has no index row — that row is written by the write path — so the summary is projected from the obligation rows when it is absent. One product, one set of instances, whichever surface created them.

Parâmetros

Respostas