@owlmeans/iam 0.1.18-rc.44 → 0.1.18-rc.46

package/README.md

@@ -6,14 +6,16 @@ Provider-agnostic IAM abstraction for the OwlMeans framework — `IamService` in
 
 - `IamService` — unified interface for provisioning clients, realms, and permissions across IAM backends (e.g. Keycloak, built-in)
 - `IamClient` / `IamCredentialsPair` / `IamResourceSpec` — shared contract types used by server-side IAM implementations
-- `IamPermissionArgs` — describes a named permission including resource-scope and human-readable title
-- `hasPermission` — utility to check whether a set of grants covers a given permission/resource pair
-- Errors: `IamError` and subtypes for client-provisioning and permission failures
+- `IamPermissionArgs` — describes a named permission: resource and organization binding (`resourceScoped`, `entityScoped`), title, area and `defaultClass`
+- Tenancy facets on `IamService` — `organizations`, `groups`, `subjects` — and `unsupportedFacet` for a backend without them
+- `makeIamRuntimeProtocols` — declarations of the provider's runtime IAM API (organizations, members, permissions, grants)
+- `hasPermission` — utility to check whether a set of grants covers a given permission, resource and acting organization
+- Errors: `IamError` and subtypes for client, permission, user, organization and group failures
 
 ## Installation
 
 ```bash
-bun add @owlmeans/iam@^0.1.18-rc.44
+bun add @owlmeans/iam@^0.1.18-rc.46
 ```
 
 ## Usage
@@ -22,8 +24,8 @@ bun add @owlmeans/iam@^0.1.18-rc.44
 import type { IamService, IamClient } from '@owlmeans/iam'
 import { hasPermission } from '@owlmeans/iam'
 
-// Check whether an auth payload includes a required permission
-const allowed = hasPermission(auth, { permission: 'manage-users', resourceScoped: false })
+// Check whether an auth payload grants a permission for one record, in the organization the request acts in
+const allowed = hasPermission(auth, 'order--edit', { resourceId: 'ord-1', entitySlug: 'acme' })
 ```
 
 Typically consumed via `@owlmeans/server-iam` which wires the concrete OIDC-backed implementation.
@@ -36,7 +38,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.42
+npx @owlmeans/agent-skills@^0.1.18-rc.45
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/iam",
-  "version": "0.1.18-rc.44",
-  "generatedAt": "2026-09-29T08:01:58.122Z",
+  "version": "0.1.18-rc.46",
+  "generatedAt": "2026-10-01T23:27:48.730Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/iam/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: iam
-description: "How to use @owlmeans/iam — the provider-agnostic IamService, the permission-definition and two-form grant model, client-id uniqueness, issuer and redirect-URI rules, and hasPermission. Load when wiring IAM operations, granting or revoking permissions, selecting the IAM backend, or implementing a new IAM provider. Applies to files matching **/services/iam*.ts, **/context.ts, **/types.ts."
+description: "How to use @owlmeans/iam — the provider-agnostic IamService, the permission-definition model with its four kinds (unbound, entity-bound, resource-bound, both) and default classes, the organization/group/subject facets, the runtime IAM API declarations, client-id uniqueness, issuer and redirect-URI rules, and hasPermission. Load when wiring IAM operations, granting or revoking permissions, working with tenanted clients, selecting the IAM backend, or implementing a new IAM provider. Applies to files matching **/services/iam*.ts, **/context.ts, **/types.ts."
 metadata:
   applyTo: "**/services/iam*.ts, **/context.ts, **/types.ts"
 ---
@@ -8,10 +8,11 @@ metadata:
 
 # Using `@owlmeans/iam`
 
-**Install:** `"@owlmeans/iam": "^0.1.18-rc.44"` in `dependencies`
+**Install:** `"@owlmeans/iam": "^0.1.18-rc.46"` in `dependencies`
 
 Provider-agnostic IAM abstraction: the `IamService` interface, the permission and grant shapes, the
-gate-param grammar, and `hasPermission`. It contains no implementation and talks to no provider —
+gate-param grammar, `hasPermission`, and the declarations of the provider's runtime IAM API. It
+contains no implementation and talks to no provider —
 concrete backends (a Keycloak proxy, an integrated backend built on the OwlMeans OIDC provider) are
 separate packages, and every consumer depends on this interface rather than on one of them.
 
@@ -29,6 +30,9 @@ lines.
 | `requireConsentForLogin(ctx, opts?)` | That precondition on its own, for a context wired some other way |
 | `CONSENT_LOGIN_PRECONDITION` / `CLIENT_IAM_SERVICE` | The precondition alias and the service alias |
 | `useLogin` / `useLogout`, `LoginOutcome` / `LoginIntent`, `LoginPlugin` / `LoginService` / … | Re-exported sign-in surface, so an app has one IAM import rather than three |
+| `listOrganizations(ctx)` | The signed-in subject's organizations (`OidcOrganizationItem[]`, the acting one marked `acting`) over `oidcProtocols.organizations` |
+| `switchOrganization(ctx, entitySlug)` | Moves the session into another of its organizations over `oidcProtocols.organization` and adopts the re-signed token with `adoptToken` |
+| `ORGANIZATION_REFUSAL` / `ORGANIZATION_OWNER_REFUSAL` | Re-exported from `@owlmeans/oidc`: the `AuthForbidden` reasons a screen phrases (not a member; not the owner) |
 | Everything from `@owlmeans/iam` | The types above, plus `hasPermission` |
 
 The protocol tree is immutable. Decorate it once with `withIamGuard(protocols)` before binding local
@@ -40,25 +44,35 @@ plugin, because `begin` is the single funnel every sign-in mechanic passes throu
 the user's gesture is still live — a refusal resolves as `LoginOutcome.Gesture` and opens the consent dialog in
 the same gesture. An application that genuinely sets no cookie passes `{ consent: { disabled: true } }`.
 
+Both organization calls need the bindings `iamEntrypoints()` spreads, and both are answered by the
+application's own server from the session it holds — there is no per-request organization selector,
+so a screen that offers "act in another organization" calls `switchOrganization` and re-reads `auth`.
+
 The server half of the same story is `@owlmeans/server-iam` — the IAM gate that asserts the grants
-this package's screens hand out. Permission decisions are made there, never in the browser.
+this package's screens hand out, and the runtime IAM client. Permission decisions are made there,
+never in the browser.
 
 ## Public API surface
 
 | Symbol | Kind | Purpose |
 |--------|------|---------|
 | `IamService` | type | Unified IAM interface — all provisioning + authorization operations |
-| `IamClient` | type | Provisioned OIDC client `{ id?, clientId, secret?, name?, realm? }` |
-| `IamClientOptions` | type | `{ redirectUris? }` — explicit `ensureClient` hardening; omitting is a keycloak-only legacy shape (see below) |
+| `IamClient` | type | Provisioned OIDC client `{ id?, clientId, secret?, name?, realm?, config? }` |
+| `IamClientInfo` | type | `IamClient` without `secret` — what `getClient` answers |
+| `IamClientConfig` | type | `{ operators?, users?, [key]: unknown }` — the two tenancy flags plus the client's arbitrary configuration |
+| `IamClientOptions` | type | `{ redirectUris?, config? }` — explicit `ensureClient` hardening (omitting `redirectUris` is a keycloak-only legacy shape, see below); `config` merges shallowly |
 | `IamCredentialsPair` | type | `{ token: string; realm: string }` |
-| `IamPermissionArgs` | type | `{ permission?, resourceScoped?, title?, area?, managed?, defaultEnabled? }` — `permission` absent means unscoped resource name |
+| `IamPermissionArgs` | type | `{ permission?, resourceScoped?, entityScoped?, title?, area?, managed?, defaultClass? }` — `permission` absent means unscoped resource name; omitted flags are kept, passed ones (`false` / `None` included) written |
 | `IamResourceSpec` | type | `{ name: string; displayName?: string }` |
-| `IamPermissionDefinition` | type | Declared permission `{ name, resource, action?, resourceScoped?, title?, area?, managed?, defaultEnabled? }` |
-| `IamPermissionFilter` | type | `{ areas?, managed?, resourceScoped? }` — narrows `listPermissions`; an `areas` entry of `null` matches untagged definitions |
-| `IamGrantArgs` | type | `{ resources?: string[], mode? }` |
-| `IamGrant` | type | `{ profileId, clientId, permission, resources?, mode?, inherited? }` |
+| `IamPermissionDefinition` | type | Declared permission `{ name, resource, action?, resourceScoped?, entityScoped?, title?, area?, managed?, defaultClass? }` |
+| `IamPermissionFilter` | type | `{ areas?, managed?, resourceScoped?, entityScoped? }` — narrows `listPermissions`; an `areas` entry of `null` matches untagged definitions |
+| `IamDefaultClass` | enum | `None` / `User` / `Member` / `Owner` — who holds a definition without a grant (see "Permission kinds") |
+| `IamGrantArgs` | type | `{ resources?, mode?, entitySlug? }` — `entitySlug` binds an `entityScoped` grant |
+| `IamGrant` | type | `{ profileId? \| group?, clientId, permission, resources?, mode?, entitySlug?, origin?, through? }` — exactly one subject |
+| `IamGrantOrigin` | enum | `Direct` / `Default` / `Group` — why a listed grant is held; `through` names the group |
+| `IamGroupRef` | type | `{ entitySlug, key }` — a group by its organization's slug and its key |
 | `IamGrantMode` | enum | `Blanket` / `Resources` / `All` — which FORM of a grant an operation addresses |
-| `IamGrantBundle` | type | `{ filter?, permissions?, mode?, resources? }` — what `grantBundle` hands out |
+| `IamGrantBundle` | type | `{ filter?, permissions?, mode?, resources?, entitySlug? }` — what `grantBundle` hands out |
 | `IamRemovalPolicy` | enum | `Cascade` / `Refuse` — what to do about grants of a definition being deleted |
 | `IamPermissionDeleteArgs`, `IamPermissionRemoval` | type | `{ policy?, managed? }` and `{ permission, clientId, found, revoked }` |
 | `IamNormalizeArgs`, `IamNormalizationReport` | type | `{ dryRun? }` and the rename/merge plan `normalizePermissions` reports |
@@ -66,11 +80,24 @@ this package's screens hand out. Permission decisions are made there, never in t
 | `PERMISSION_ACTION_SEPARATOR` | const | `'--'` — TWO hyphens, never one |
 | `parsePermissionName` / `composePermissionName` / `isPermissionName` | fn | Read, build and validate a permission NAME |
 | `ParsedPermissionName` | type | `{ name, resource, action?, problem? }` |
-| `IamUser` | type | End-user of an entity `{ profileId, email?, name?, role, disabled?, grantCount? }` |
+| `IamUser` | type | Subject of one client `{ profileId, email?, name?, role, disabled?, grantCount?, home?, memberships? }` |
+| `IamMembershipInfo` | type | `{ entitySlug, title?, owner, groups, home? }` — one organization of an `IamUser` |
 | `IamUserInvite` | type | `{ email, name?, role? }` — find-or-create args |
-| `IamUserUpdate` | type | `{ name?, role?, disabled? }` |
-| `hasPermission` | fn | `(auth, permission, { scope?, resourceId? }?)` — checks `Authorization.permissions` PermissionSet[]; an unscoped set satisfies a resourceId check |
-| `HasPermissionOptions` | type | `{ scope?, resourceId? }` |
+| `IamUserUpdate` | type | `{ name?, role?, disabled? }` — `disabled` lands on the primary row |
+| `IamOrganization`, `IamOrganizationArgs`, `IamOrganizationUpdate` | type | `{ entitySlug, title?, members? }`; create `{ title?, profileId? }` (the new owner); update `{ title }` |
+| `IamMember`, `IamMemberInvite`, `IamMemberUpdate` | type | `{ profileId, email?, name?, owner, groups, managed? }`; `{ email, name?, owner? }`; `{ owner?, groups? }` |
+| `IamGroup`, `IamGroupArgs`, `IamGroupBundle` | type | `{ entitySlug, key, title?, managed?, members?, bundles }`; `{ title?, bundles? }`; `{ filter?, permissions? }` |
+| `IamStaffSyncArgs`, `IamStaffSyncReport` | type | `{ bundles }` and `{ added, removed }` (profile ids) of `syncStaff` |
+| `IamSubject`, `IamSignInArgs`, `IamSignInResult` | type | `{ profileId, email?, name?, organizations, permissions }` (claims input); `{ email, name? }`; `{ accountId, profileId }` |
+| `IamOrganizationFacet`, `IamGroupFacet`, `IamSubjectFacet` | type | The three facets of `IamService` |
+| `unsupportedFacet<T>(what)` | fn | A facet whose every method throws `IamUnsupported(what)` — synchronously |
+| `IAM_MEMBERS_GROUP` | const | `'members'` — the managed staff group `syncStaff` keeps |
+| `IAM_EMAIL_PROOF` | const | `'proof:email'` — the `profileId` of a credential that proves an address and identifies nobody yet |
+| `hasPermission` | fn | `(auth, permission, { scope?, resourceId?, entitySlug? }?)` — checks `Authorization.permissions`; an unscoped set satisfies a resourceId check, an unbound set any organization |
+| `HasPermissionOptions` | type | `{ scope?, resourceId?, entitySlug? }` |
+| `makeIamRuntimeProtocols({ service, path? })` | fn | The runtime IAM API's protocol tree — see "Runtime IAM API" |
+| `IAM_RUNTIME_GUARD`, `IAM_RUNTIME_PATH`, `IAM_RUNTIME_ROUTES` | const | Its guard alias, default base path (`'/runtime'`) and leaf-path table |
+| `IamRuntime*` | type/schema | Its wire shapes and closed schemas (`IamRuntimeOrganization`, `IamRuntimeMember`, `IamRuntimePermission`, `IamRuntimeGrant`, `IamRuntimeGrantRequest`, … and `*Schema`) |
 | Gate grammar | fn/type | `parseGateParam`, `parseGateSelector`, `formatGateParam`, `resolveGateResource`, `validateGateParams`, `routeParamsOf`, plus `RESOURCE_*_SEPARATOR`, `GateParamSource`, `DEFAULT_GATE_PARAM_SOURCES`, `GateParamErrorCode`, `GateResolutionFailure` and the `Gate*` types. The syntax itself is documented in the `server-iam` skill |
 | `DEFAULT_ALIAS` | const | Default service alias `'iam-service'` |
 | `IAM_MODE_KEYCLOAK` | const | `'keycloak'` |
@@ -82,9 +109,11 @@ this package's screens hand out. Permission decisions are made there, never in t
 | `IamGrantError` | class | Grant subject missing or entity mismatch |
 | `IamPermissionError` | class | A refusal about a DEFINITION: `permission:held:<name>`, `permission:managed:<name>` |
 | `IamUserError` | class | An end-user operation was refused |
+| `IamOrganizationError` | class | An organization or membership refusal — unknown organization, last owner, membership cap |
+| `IamGroupError` | class | A group refusal — unknown key, a managed group written by an operator, another app's group |
 | `IamUnsupported` | class | Operation not supported by the active backend (e.g. `resource-scoped-grant`, `user-management`) |
 
-## Permission model (two grant forms)
+## Permission model (kinds and grant forms)
 
 Permissions are declared per entity client (project) with `ensurePermission` and granted to end-user
 subjects with `grantPermission`:
@@ -113,12 +142,44 @@ nothing at request time. `managed: true` marks a definition the platform owns: a
 revoke it from an undifferentiated list, and a repair that deletes "definitions no declaration names"
 must not reach one.
 
-`defaultEnabled: true` makes an unmanaged `user`-area permission effective for every end user of
-that client. `mergePermissionDefaults` adds inherited blanket grants when reading grants or
-building OIDC claims; it never writes a grant to every profile. The first explicit blanket change
-stores `true` or `false` on that profile, and a stored `false` suppresses the inherited grant.
-Resource-specific grants remain independent. Integrated IAM supports this contract; Keycloak
-refuses a default-enabled definition with `IamUnsupported`.
+### Permission kinds
+
+What a grant binds to is a property of the DEFINITION, and grants follow it:
+
+| Kind | Definition flags | Grant stored on | Applies |
+|---|---|---|---|
+| unbound | none | the subject's primary row, or a group | everywhere |
+| entity-bound | `entityScoped` | the subject's row of THAT organization, or a group of it | only while acting in that organization |
+| resource-bound | `resourceScoped` | the primary row, a titled set with `resources` | to those resource ids |
+| both | both | that organization's row, a titled set with `resources` | both checks |
+
+- Granting an `entityScoped` definition REQUIRES `args.entitySlug`, which names the subject's row
+  there — the subject must be a member. Any other definition refuses `args.entitySlug`. Turning
+  `entityScoped` off while grants exist is refused: every bound grant would silently widen.
+- Stored sets carry the organization's id; CLAIM sets (provider → relying party only) carry its
+  `entitySlug` instead (`OidcPermissionSetClaim`). The relying party keeps the unbound sets and the
+  acting organization's, strips the binding, and drops the rest — a browser token never carries a
+  bound set of another organization.
+- `hasPermission(auth, name, { entitySlug })` applies a set without `entitySlug` everywhere and a
+  bound one only when `opts.entitySlug` names its organization — fail-closed, so a bound set that
+  leaked into a token never counts where the caller named no organization.
+
+### Default classes
+
+`defaultClass` says who holds a definition without an explicit grant. It is evaluated when claims and
+grant listings are built — never written onto a row:
+
+- `User` — every signed-in subject of the client. Requires an unbound, unmanaged `user`-area definition.
+- `Member` / `Owner` — every member / owner of the organization the subject acts in. Requires
+  `entityScoped`.
+- `None` — nobody.
+
+A class default is a BLANKET set, so `Owner` on a resource-scoped definition is its all-records form.
+An explicit `false` on a row suppresses only the class default of that binding (an unbound `false`
+suppresses `User`; a `false` on the row of an organization suppresses `Member`/`Owner` there).
+Grants are additive — there is no deny rule over a group's grant. A listing marks each grant's
+`origin`: `Direct`, `Default`, or `Group` with `through` naming the group. A backend that cannot
+evaluate classes (Keycloak) refuses any `defaultClass` other than `None` with `IamUnsupported`.
 
 ## `IamService` interface
 
@@ -135,10 +196,14 @@ interface IamService extends InitializedService {
   // "A client id is a global name" for the two rules it has to obey.
   ensureClient: (entityId: string, clientId: string, options?: IamClientOptions) => Promise<IamClient>
 
+  // The entity's client without its secret, or null. Never provisions.
+  getClient: (entityId: string, clientId: string) => Promise<IamClientInfo | null>
+
   // Reserve a free client id without provisioning it; false when anyone else holds it.
   claimClient: (entityId: string, clientId: string) => Promise<boolean>
 
-  // Release a client id and everything keyed by it (called when a project/slot is deleted).
+  // Release a client id and everything keyed by it — its subjects' rows, its groups, its
+  // definitions (called when a project/slot is deleted).
   deleteClient: (entityId: string, clientId: string) => Promise<void>
 
   // Declare a permission. Returns the canonical name. MERGES into an existing definition —
@@ -162,7 +227,8 @@ interface IamService extends InitializedService {
 
   listPermissions: (entityId: string, clientId: string, filter?: IamPermissionFilter) => Promise<IamPermissionDefinition[]>
 
-  // args.resources selects the resource-scoped form; see "Permission model (two grant forms)"
+  // args.resources selects the resource-scoped form, args.entitySlug the binding of an entityScoped
+  // definition; see "Permission model (kinds and grant forms)"
   grantPermission: (entityId: string, clientId: string, profileId: string, permission: string, args?: IamGrantArgs) => Promise<IamGrant>
   revokePermission: (entityId: string, clientId: string, profileId: string, permission: string, args?: IamGrantArgs) => Promise<void>
 
@@ -171,30 +237,108 @@ interface IamService extends InitializedService {
   // grantPermission, which costs N·M writes and N·M lost-update windows on the same records.
   grantBundle: (entityId: string, clientId: string, profileIds: string[], bundle: IamGrantBundle) => Promise<IamGrant[]>
 
+  // Direct, default-class and group grants, each with its `origin`.
   listGrants: (entityId: string, clientId: string, profileId?: string) => Promise<IamGrant[]>
 
-  // --- End-user management — see "End-users are customer-wide" ---
+  // --- Users of one client — see "Users are per client" ---
 
   listUsers: (entityId: string, clientId?: string) => Promise<IamUser[]>
-  getUser: (entityId: string, profileId: string) => Promise<IamUser | null>
-  inviteUser: (entityId: string, invite: IamUserInvite) => Promise<IamUser>
-  updateUser: (entityId: string, profileId: string, update: IamUserUpdate) => Promise<IamUser>
-  removeUser: (entityId: string, profileId: string) => Promise<void>
+  getUser: (entityId: string, clientId: string, profileId: string) => Promise<IamUser | null>
+  inviteUser: (entityId: string, clientId: string, invite: IamUserInvite) => Promise<IamUser>
+  updateUser: (entityId: string, clientId: string, profileId: string, update: IamUserUpdate) => Promise<IamUser>
+  removeUser: (entityId: string, clientId: string, profileId: string) => Promise<void>
+
+  // The owning organization's staff, admitted to the client through the managed `members` group.
+  syncStaff: (entityId: string, clientId: string, args: IamStaffSyncArgs) => Promise<IamStaffSyncReport>
+
+  // --- Tenancy facets — see "Organizations, groups and subjects" ---
+  organizations: IamOrganizationFacet
+  groups: IamGroupFacet
+  subjects: IamSubjectFacet
 }
 ```
 
-## End-users are customer-wide
-
-An end-user belongs to the **entity**, not to a project: one customer's users are shared across every
-project they own. `listUsers` therefore returns the entity's whole set and `clientId` only scopes the
-reported `grantCount` to one project's client. Do not reintroduce a per-client filter — a person who
-has authenticated against a project but holds no grant there is still that project's user, and the
-screen that hands out grants is exactly where they have to be visible.
-
-`inviteUser` is idempotent by email, which is what lets an invitation and a first sign-in converge on
-one record instead of accumulating twins. A backend with no user store of its own — one where the
-customer manages users in the provider's own console — throws `IamUnsupported('user-management')`
-from all five methods.
+The first parameter of every method is `entityId` — the organization that OWNS the client — and
+every `(entityId, clientId)` method verifies that ownership before it reads or writes anything. The
+organizations a client's subjects act in are a different thing, named by `entitySlug` inside the
+facets.
+
+## Users are per client
+
+A person is ONE account (one per e-mail address); what a client sees of it are its rows of that app —
+one per (account, app, organization), the PRIMARY one in the account's own organization. The
+`profileId` a client knows is the pairwise subject, the same on every row of one (account, app) and
+different for every app, so two apps of one customer cannot correlate their users by it.
+
+- `listUsers(entityId, clientId)` lists every account holding a row of the client, in whichever
+  organization. Without `clientId` it is a read-only aggregate over the entity's clients, for a
+  console — nothing is written through it.
+- `getUser` / `inviteUser` / `updateUser` / `removeUser` take the client. `removeUser` deletes this
+  account's rows of THAT app only — the account, and its rows of other apps, stay. `updateUser`
+  writes `disabled` on the primary row, which is what refuses the subject at the provider.
+- `inviteUser` is idempotent by email, which is what lets an invitation and a first sign-in converge on
+  one record instead of accumulating twins.
+
+A backend with no user store of its own — one where the customer manages users in the provider's own
+console — throws `IamUnsupported('user-management')` from all five methods.
+
+## Organizations, groups and subjects
+
+The three facets of `IamService` carry tenancy. A backend that cannot provide one answers
+`unsupportedFacet<IamOrganizationFacet>('organizations')` (and so on): every method of it throws
+`IamUnsupported(what)` SYNCHRONOUSLY, because `subjects.identify` is synchronous and a rejected
+promise would hand it the wrong type — an awaited call rejects either way.
+
+- **Tenancy is the client's configuration.** `IamClientConfig.users` / `.operators` turn it on: with
+  neither flag, every subject acts in the client's owning organization (a single-tenant app); with
+  either, each subject acts in organizations of its own and the provider claims them under the
+  `organizations` scope (`@owlmeans/oidc`). The flags also gate the runtime API's writes by area.
+- **`organizations`** — `list`, `get`, `create({ title?, profileId? })` (that subject becomes the
+  owner), `update({ title })`, `members`, `addMember` (find-or-create by e-mail, idempotent, refused
+  past the membership cap), `updateMember`, `removeMember`. The last owner cannot be demoted or
+  removed (`IamOrganizationError`).
+- **`groups`** — a group is (organization, client, key), kept inside the organization record; one
+  client never reads or writes another's. `ensure`, `remove`, `members`, `addMembers`,
+  `removeMembers`, `grant` / `revoke` (bound to the group's organization), `grants`, and
+  `setBundles` — a bundle (`{ filter?, permissions? }`) grants every definition it selects to the
+  group's members at claim time. `IAM_MEMBERS_GROUP` is the managed group `syncStaff` keeps in the
+  owning organization; it is read-only to an operator (`IamGroupError`).
+- **`subjects`** — the provider's half, keyed by the ACCOUNT, which never leaves the provider.
+  `signIn(clientId, { email })` finds or creates the account and its rows for the client;
+  `resolve(clientId, accountId)` builds the `IamSubject` the claims come from (`null` = not admitted:
+  no row, or a disabled primary row); `identify(clientId, accountId)` is the pairwise `sub`.
+
+## Runtime IAM API
+
+`makeIamRuntimeProtocols({ service, path? })` declares the provider-side API a tenanted client's
+server calls on behalf of its signed-in subject. It is declarations only: the provider binds it, and
+a relying party calls it through `iamRuntime` (`@owlmeans/server-iam`) over plain `fetch`.
+
+| Route (under `path`, default `IAM_RUNTIME_PATH`) | Tree | Who |
+|---|---|---|
+| `GET /organizations` | `organizations.list` | any subject — its own |
+| `POST /organizations` `{ title? }` | `organizations.create` | any subject of a tenanted client; it becomes owner |
+| `POST /organizations/:entitySlug` `{ title }` | `organizations.update` | owner |
+| `GET /organizations/:entitySlug/members` | `members.list` | member |
+| `POST /organizations/:entitySlug/members` `{ email, name?, owner? }` | `members.add` | owner; idempotent by e-mail |
+| `POST …/members/:profileId` `{ owner?, groups? }` | `members.update` | owner |
+| `POST …/members/:profileId/remove` | `members.remove` | owner, or the member itself |
+| `GET …/permissions` | `permissions.list` | member |
+| `GET …/grants` `?profileId` | `grants.list` | owner |
+| `POST …/grants`, `POST …/grants/revoke` `{ profileId, permission, resources?, mode? }` | `grants.assign` / `grants.revoke` | owner |
+
+- **Every route, the base included, is pinned to `service`** — a route's service is never inherited
+  from its parent — and every leaf hangs under ONE base carrying `IAM_RUNTIME_GUARD`. The serving
+  process registers that guard: it admits only a bearer access token the provider issued, and takes
+  the client and the account from it, never from the request.
+- **The wire names organizations by `entitySlug` and subjects by the calling client's pairwise
+  `profileId`** — no organization or account id appears in any shape. Every schema is closed, since
+  the server's AJV strips an undeclared key silently. `IAM_RUNTIME_ROUTES` is the one leaf-path table
+  the declarations and the fetch client share.
+- The serving process enforces the write rules: only `entityScoped`, unmanaged definitions of the
+  CALLING client, binding forced to the path's organization, the last owner protected, the
+  membership cap, and only for an area the client's tenancy config opens (`users` → `user`,
+  `operators` → `operator`). A non-owner write is `AuthForbidden(ORGANIZATION_OWNER_REFUSAL)`.
 
 ## A client id is a global name
 
@@ -286,13 +430,16 @@ the same options — otherwise they disagree about the issuer, and only one of t
 - `IamClientError` means the provisioned client was invalid (missing secret, null token). The adapter
   already throws it; callers handle it rather than re-throwing a wrapped error.
 - `IamClient.realm` is set by every concrete implementation.
-- An operation a backend cannot support throws `IamUnsupported('<what>')`. Callers turn that into a
-  fallback — an "external console" link, a disabled control — rather than an error screen.
+- An operation a backend cannot support throws `IamUnsupported('<what>')`; a whole facet it cannot
+  support is `unsupportedFacet(what)`. Callers turn that into a fallback — an "external console"
+  link, a disabled control — rather than an error screen.
+- A wire value names an organization by `entitySlug` only; the `entityId` parameter is the client's
+  OWNER, resolved server-side, never taken from a token or a request.
 
 ## Related
 
-- `@owlmeans/server-iam` — the IAM gate that asserts both grant forms, and the gate-param grammar;
-  see the `server-iam` skill
+- `@owlmeans/server-iam` — the IAM gate that asserts every permission kind, the gate-param grammar,
+  the session's organizations and the runtime IAM client; see the `server-iam` skill
 - `@owlmeans/oidc` — provider descriptors and the `iamMode` config seam; see the `oidc` skill
 - The concrete adapters (a Keycloak proxy, and the integrated backend built on
   `@owlmeans/server-oidc-provider` plus `@owlmeans/server-auth-identity`) ship separately and are

package/build/consts.d.ts

@@ -93,4 +93,61 @@ export declare const IAM_AREAS: readonly ['user', 'operator', 'admin'];
 export type IamArea = typeof IAM_AREAS[number];
 /** Separates the resource from the action in a permission name. TWO hyphens, never one. */
 export declare const PERMISSION_ACTION_SEPARATOR = "--";
+/**
+ * Who holds a permission without an explicit grant — a property of the DEFINITION, evaluated when
+ * claims are built and never written onto a profile.
+ *
+ * `User` is every signed-in subject of the client (an unbound, unmanaged `user`-area definition
+ * only); `Member` and `Owner` are every member / owner of the organization the subject acts in, so
+ * they require an `entityScoped` definition. A class default is a BLANKET set: `Owner` on a
+ * resource-scoped definition is its all-records form.
+ */
+export declare enum IamDefaultClass {
+    None = "none",
+    User = "user",
+    Member = "member",
+    Owner = "owner"
+}
+/** Why a subject holds a grant, as a listing reports it. */
+export declare enum IamGrantOrigin {
+    /** Written on the subject's own row. */
+    Direct = "direct",
+    /** The definition's `defaultClass` covers the subject. */
+    Default = "default",
+    /** Held by a group the subject is a member of — `IamGrant.through` names it. */
+    Group = "group"
+}
+/**
+ * The managed group `syncStaff` keeps in a client's owning organization: the owner's own staff,
+ * admitted to the client with the bundles the sync hands it. Read-only to an operator.
+ */
+export declare const IAM_MEMBERS_GROUP = "members";
+/**
+ * The `profileId` of a credential that proves an e-mail address and identifies nobody yet: what the
+ * end-user sign-in hands the provider's finalizer, which then resolves the account itself. It carries
+ * no `entitySlug` — a proof bound to an organization is something else.
+ */
+export declare const IAM_EMAIL_PROOF = "proof:email";
+/**
+ * The guard of the runtime IAM API (`makeIamRuntimeProtocols`). The serving process registers it: it
+ * admits a bearer access token the provider itself issued, and takes the client and the account from
+ * that token, never from the request.
+ */
+export declare const IAM_RUNTIME_GUARD = "iam-runtime-guard";
+/** Where the runtime IAM API mounts under its service unless the declaration names another path. */
+export declare const IAM_RUNTIME_PATH = "/runtime";
+/**
+ * The runtime API's leaf paths under its base. One table so the declarations and a fetch-only client
+ * (a target's server, which binds no entrypoint of the provider's tree) cannot disagree on a segment.
+ */
+export declare const IAM_RUNTIME_ROUTES: {
+    readonly organizations: '/organizations';
+    readonly organization: '/organizations/:entitySlug';
+    readonly members: '/organizations/:entitySlug/members';
+    readonly member: '/organizations/:entitySlug/members/:profileId';
+    readonly memberRemove: '/organizations/:entitySlug/members/:profileId/remove';
+    readonly permissions: '/organizations/:entitySlug/permissions';
+    readonly grants: '/organizations/:entitySlug/grants';
+    readonly grantsRevoke: '/organizations/:entitySlug/grants/revoke';
+};
 //# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,gBAAgB,CAAA;AAE1C,eAAO,MAAM,iBAAiB,aAAa,CAAA;AAC3C,eAAO,MAAM,mBAAmB,eAAe,CAAA;AAE/C,MAAM,MAAM,OAAO,GAAG,OAAO,iBAAiB,GAAG,OAAO,mBAAmB,CAAA;AAE3E;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAA;AAE3C;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,MAAM,CAAA;AAE5C,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,MAAM,CAAA;AAE1C,8DAA8D;AAC9D,oBAAY,eAAe;IACzB,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAED;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,eAAe,EAEvD,CAAA;AAED,+FAA+F;AAC/F,oBAAY,kBAAkB;IAC5B,aAAa,8BAA8B;IAC3C,aAAa,8BAA8B;IAC3C,YAAY,6BAA6B;IACzC,oGAAoG;IACpG,cAAc,+BAA+B;IAC7C,oEAAoE;IACpE,iBAAiB,mCAAmC;CACrD;AAED,8CAA8C;AAC9C,oBAAY,qBAAqB;IAC/B,4CAA4C;IAC5C,WAAW,iBAAiB;IAC5B,iDAAiD;IACjD,aAAa,mBAAmB;IAChC,wFAAwF;IACxF,SAAS,eAAe;IACxB,yCAAyC;IACzC,SAAS,cAAc;CACxB;AAED;;;;;;;GAOG;AACH,oBAAY,YAAY;IACtB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,mDAAmD;IACnD,GAAG,QAAQ;CACZ;AAED,+EAA+E;AAC/E,oBAAY,gBAAgB;IAC1B,uFAAuF;IACvF,OAAO,YAAY;IACnB,gFAAgF;IAChF,MAAM,WAAW;CAClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,YAAI,MAAM,EAAE,UAAU,EAAE,OAAO,CAAU,CAAA;AAE/D,MAAM,MAAM,OAAO,GAAG,OAAO,SAAS,CAAC,MAAM,CAAC,CAAA;AAE9C,2FAA2F;AAC3F,eAAO,MAAM,2BAA2B,OAAO,CAAA"}
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,gBAAgB,CAAA;AAE1C,eAAO,MAAM,iBAAiB,aAAa,CAAA;AAC3C,eAAO,MAAM,mBAAmB,eAAe,CAAA;AAE/C,MAAM,MAAM,OAAO,GAAG,OAAO,iBAAiB,GAAG,OAAO,mBAAmB,CAAA;AAE3E;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAA;AAE3C;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,MAAM,CAAA;AAE5C,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,MAAM,CAAA;AAE1C,8DAA8D;AAC9D,oBAAY,eAAe;IACzB,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAED;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,eAAe,EAEvD,CAAA;AAED,+FAA+F;AAC/F,oBAAY,kBAAkB;IAC5B,aAAa,8BAA8B;IAC3C,aAAa,8BAA8B;IAC3C,YAAY,6BAA6B;IACzC,oGAAoG;IACpG,cAAc,+BAA+B;IAC7C,oEAAoE;IACpE,iBAAiB,mCAAmC;CACrD;AAED,8CAA8C;AAC9C,oBAAY,qBAAqB;IAC/B,4CAA4C;IAC5C,WAAW,iBAAiB;IAC5B,iDAAiD;IACjD,aAAa,mBAAmB;IAChC,wFAAwF;IACxF,SAAS,eAAe;IACxB,yCAAyC;IACzC,SAAS,cAAc;CACxB;AAED;;;;;;;GAOG;AACH,oBAAY,YAAY;IACtB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,mDAAmD;IACnD,GAAG,QAAQ;CACZ;AAED,+EAA+E;AAC/E,oBAAY,gBAAgB;IAC1B,uFAAuF;IACvF,OAAO,YAAY;IACnB,gFAAgF;IAChF,MAAM,WAAW;CAClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,YAAI,MAAM,EAAE,UAAU,EAAE,OAAO,CAAU,CAAA;AAE/D,MAAM,MAAM,OAAO,GAAG,OAAO,SAAS,CAAC,MAAM,CAAC,CAAA;AAE9C,2FAA2F;AAC3F,eAAO,MAAM,2BAA2B,OAAO,CAAA;AAE/C;;;;;;;;GAQG;AACH,oBAAY,eAAe;IACzB,IAAI,SAAS;IACb,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,KAAK,UAAU;CAChB;AAED,4DAA4D;AAC5D,oBAAY,cAAc;IACxB,wCAAwC;IACxC,MAAM,WAAW;IACjB,0DAA0D;IAC1D,OAAO,YAAY;IACnB,gFAAgF;IAChF,KAAK,UAAU;CAChB;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,YAAY,CAAA;AAE1C;;;;GAIG;AACH,eAAO,MAAM,eAAe,gBAAgB,CAAA;AAE5C;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,sBAAsB,CAAA;AAEpD,oGAAoG;AACpG,eAAO,MAAM,gBAAgB,aAAa,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,kBAAkB;aAC7B,aAAa,EAAE,gBAAgB;aAC/B,YAAY,EAAE,4BAA4B;aAC1C,OAAO,EAAE,oCAAoC;aAC7C,MAAM,EAAE,+CAA+C;aACvD,YAAY,EAAE,sDAAsD;aACpE,WAAW,EAAE,wCAAwC;aACrD,MAAM,EAAE,mCAAmC;aAC3C,YAAY,EAAE,0CAA0C;CAChD,CAAA"}

package/build/consts.js

@@ -98,4 +98,63 @@ export var IamRemovalPolicy;
 export const IAM_AREAS = ['user', 'operator', 'admin'];
 /** Separates the resource from the action in a permission name. TWO hyphens, never one. */
 export const PERMISSION_ACTION_SEPARATOR = '--';
+/**
+ * Who holds a permission without an explicit grant — a property of the DEFINITION, evaluated when
+ * claims are built and never written onto a profile.
+ *
+ * `User` is every signed-in subject of the client (an unbound, unmanaged `user`-area definition
+ * only); `Member` and `Owner` are every member / owner of the organization the subject acts in, so
+ * they require an `entityScoped` definition. A class default is a BLANKET set: `Owner` on a
+ * resource-scoped definition is its all-records form.
+ */
+export var IamDefaultClass;
+(function (IamDefaultClass) {
+    IamDefaultClass["None"] = "none";
+    IamDefaultClass["User"] = "user";
+    IamDefaultClass["Member"] = "member";
+    IamDefaultClass["Owner"] = "owner";
+})(IamDefaultClass || (IamDefaultClass = {}));
+/** Why a subject holds a grant, as a listing reports it. */
+export var IamGrantOrigin;
+(function (IamGrantOrigin) {
+    /** Written on the subject's own row. */
+    IamGrantOrigin["Direct"] = "direct";
+    /** The definition's `defaultClass` covers the subject. */
+    IamGrantOrigin["Default"] = "default";
+    /** Held by a group the subject is a member of — `IamGrant.through` names it. */
+    IamGrantOrigin["Group"] = "group";
+})(IamGrantOrigin || (IamGrantOrigin = {}));
+/**
+ * The managed group `syncStaff` keeps in a client's owning organization: the owner's own staff,
+ * admitted to the client with the bundles the sync hands it. Read-only to an operator.
+ */
+export const IAM_MEMBERS_GROUP = 'members';
+/**
+ * The `profileId` of a credential that proves an e-mail address and identifies nobody yet: what the
+ * end-user sign-in hands the provider's finalizer, which then resolves the account itself. It carries
+ * no `entitySlug` — a proof bound to an organization is something else.
+ */
+export const IAM_EMAIL_PROOF = 'proof:email';
+/**
+ * The guard of the runtime IAM API (`makeIamRuntimeProtocols`). The serving process registers it: it
+ * admits a bearer access token the provider itself issued, and takes the client and the account from
+ * that token, never from the request.
+ */
+export const IAM_RUNTIME_GUARD = 'iam-runtime-guard';
+/** Where the runtime IAM API mounts under its service unless the declaration names another path. */
+export const IAM_RUNTIME_PATH = '/runtime';
+/**
+ * The runtime API's leaf paths under its base. One table so the declarations and a fetch-only client
+ * (a target's server, which binds no entrypoint of the provider's tree) cannot disagree on a segment.
+ */
+export const IAM_RUNTIME_ROUTES = {
+    organizations: '/organizations',
+    organization: '/organizations/:entitySlug',
+    members: '/organizations/:entitySlug/members',
+    member: '/organizations/:entitySlug/members/:profileId',
+    memberRemove: '/organizations/:entitySlug/members/:profileId/remove',
+    permissions: '/organizations/:entitySlug/permissions',
+    grants: '/organizations/:entitySlug/grants',
+    grantsRevoke: '/organizations/:entitySlug/grants/revoke',
+};
 //# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAA;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAA;AAI/C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAA;AAE3C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAA;AAE5C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAA;AAE1C,8DAA8D;AAC9D,MAAM,CAAN,IAAY,eAMX;AAND,WAAY,eAAe;IACzB,oCAAiB,CAAA;IACjB,kCAAe,CAAA;IACf,gCAAa,CAAA;IACb,sCAAmB,CAAA;IACnB,gCAAa,CAAA;AACf,CAAC,EANW,eAAe,KAAf,eAAe,QAM1B;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,eAAe,CAAC,MAAM,EAAE,eAAe,CAAC,KAAK;CAC9C,CAAA;AAED,+FAA+F;AAC/F,MAAM,CAAN,IAAY,kBAQX;AARD,WAAY,kBAAkB;IAC5B,iEAA2C,CAAA;IAC3C,iEAA2C,CAAA;IAC3C,+DAAyC,CAAA;IACzC,oGAAoG;IACpG,mEAA6C,CAAA;IAC7C,oEAAoE;IACpE,0EAAoD,CAAA;AACtD,CAAC,EARW,kBAAkB,KAAlB,kBAAkB,QAQ7B;AAED,8CAA8C;AAC9C,MAAM,CAAN,IAAY,qBASX;AATD,WAAY,qBAAqB;IAC/B,4CAA4C;IAC5C,qDAA4B,CAAA;IAC5B,iDAAiD;IACjD,yDAAgC,CAAA;IAChC,wFAAwF;IACxF,iDAAwB,CAAA;IACxB,yCAAyC;IACzC,gDAAuB,CAAA;AACzB,CAAC,EATW,qBAAqB,KAArB,qBAAqB,QAShC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,YAKX;AALD,WAAY,YAAY;IACtB,mCAAmB,CAAA;IACnB,uCAAuB,CAAA;IACvB,mDAAmD;IACnD,2BAAW,CAAA;AACb,CAAC,EALW,YAAY,KAAZ,YAAY,QAKvB;AAED,+EAA+E;AAC/E,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,uFAAuF;IACvF,uCAAmB,CAAA;IACnB,gFAAgF;IAChF,qCAAiB,CAAA;AACnB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAU,CAAA;AAI/D,2FAA2F;AAC3F,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAA"}
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAA;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAA;AAI/C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAA;AAE3C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAA;AAE5C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAA;AAE1C,8DAA8D;AAC9D,MAAM,CAAN,IAAY,eAMX;AAND,WAAY,eAAe;IACzB,oCAAiB,CAAA;IACjB,kCAAe,CAAA;IACf,gCAAa,CAAA;IACb,sCAAmB,CAAA;IACnB,gCAAa,CAAA;AACf,CAAC,EANW,eAAe,KAAf,eAAe,QAM1B;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,eAAe,CAAC,MAAM,EAAE,eAAe,CAAC,KAAK;CAC9C,CAAA;AAED,+FAA+F;AAC/F,MAAM,CAAN,IAAY,kBAQX;AARD,WAAY,kBAAkB;IAC5B,iEAA2C,CAAA;IAC3C,iEAA2C,CAAA;IAC3C,+DAAyC,CAAA;IACzC,oGAAoG;IACpG,mEAA6C,CAAA;IAC7C,oEAAoE;IACpE,0EAAoD,CAAA;AACtD,CAAC,EARW,kBAAkB,KAAlB,kBAAkB,QAQ7B;AAED,8CAA8C;AAC9C,MAAM,CAAN,IAAY,qBASX;AATD,WAAY,qBAAqB;IAC/B,4CAA4C;IAC5C,qDAA4B,CAAA;IAC5B,iDAAiD;IACjD,yDAAgC,CAAA;IAChC,wFAAwF;IACxF,iDAAwB,CAAA;IACxB,yCAAyC;IACzC,gDAAuB,CAAA;AACzB,CAAC,EATW,qBAAqB,KAArB,qBAAqB,QAShC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,YAKX;AALD,WAAY,YAAY;IACtB,mCAAmB,CAAA;IACnB,uCAAuB,CAAA;IACvB,mDAAmD;IACnD,2BAAW,CAAA;AACb,CAAC,EALW,YAAY,KAAZ,YAAY,QAKvB;AAED,+EAA+E;AAC/E,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,uFAAuF;IACvF,uCAAmB,CAAA;IACnB,gFAAgF;IAChF,qCAAiB,CAAA;AACnB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAU,CAAA;AAI/D,2FAA2F;AAC3F,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAA;AAE/C;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,gCAAa,CAAA;IACb,gCAAa,CAAA;IACb,oCAAiB,CAAA;IACjB,kCAAe,CAAA;AACjB,CAAC,EALW,eAAe,KAAf,eAAe,QAK1B;AAED,4DAA4D;AAC5D,MAAM,CAAN,IAAY,cAOX;AAPD,WAAY,cAAc;IACxB,wCAAwC;IACxC,mCAAiB,CAAA;IACjB,0DAA0D;IAC1D,qCAAmB,CAAA;IACnB,gFAAgF;IAChF,iCAAe,CAAA;AACjB,CAAC,EAPW,cAAc,KAAd,cAAc,QAOzB;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAA;AAE1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAA;AAE5C;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAA;AAEpD,oGAAoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAA;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,aAAa,EAAE,gBAAgB;IAC/B,YAAY,EAAE,4BAA4B;IAC1C,OAAO,EAAE,oCAAoC;IAC7C,MAAM,EAAE,+CAA+C;IACvD,YAAY,EAAE,sDAAsD;IACpE,WAAW,EAAE,wCAAwC;IACrD,MAAM,EAAE,mCAAmC;IAC3C,YAAY,EAAE,0CAA0C;CAChD,CAAA"}

package/build/errors.d.ts

@@ -36,4 +36,17 @@ export declare class IamUserError extends IamError {
     static typeName: string;
     constructor(message?: string);
 }
+/**
+ * A refusal about an organization or a membership in it — an unknown organization, the last owner,
+ * the membership cap.
+ */
+export declare class IamOrganizationError extends IamError {
+    static typeName: string;
+    constructor(message?: string);
+}
+/** A refusal about a group: an unknown key, a managed group written by an operator, another app's group. */
+export declare class IamGroupError extends IamError {
+    static typeName: string;
+    constructor(message?: string);
+}
 //# sourceMappingURL=errors.d.ts.map

package/build/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,qBAAa,QAAS,SAAQ,cAAc;IAC1C,OAAuB,QAAQ,SAAkC;IAEjE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,OAAuB,QAAQ,SAAwC;IAEvE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,gBAAiB,SAAQ,QAAQ;IAC5C,OAAuB,QAAQ,SAA0C;IAEzE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,aAAc,SAAQ,QAAQ;IACzC,OAAuB,QAAQ,SAAuC;IAEtE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,SAAQ,QAAQ;IAC9C,OAAuB,QAAQ,SAA4C;IAE3E,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,OAAuB,QAAQ,SAA6C;IAE5E,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,YAAa,SAAQ,QAAQ;IACxC,OAAuB,QAAQ,SAAsC;IAErE,YAAY,OAAO,SAAU,EAG5B;CACF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,qBAAa,QAAS,SAAQ,cAAc;IAC1C,OAAuB,QAAQ,SAAkC;IAEjE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,OAAuB,QAAQ,SAAwC;IAEvE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,gBAAiB,SAAQ,QAAQ;IAC5C,OAAuB,QAAQ,SAA0C;IAEzE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,aAAc,SAAQ,QAAQ;IACzC,OAAuB,QAAQ,SAAuC;IAEtE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,SAAQ,QAAQ;IAC9C,OAAuB,QAAQ,SAA4C;IAE3E,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,OAAuB,QAAQ,SAA6C;IAE5E,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,YAAa,SAAQ,QAAQ;IACxC,OAAuB,QAAQ,SAAsC;IAErE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ;IAChD,OAAuB,QAAQ,SAA8C;IAE7E,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,4GAA4G;AAC5G,qBAAa,aAAc,SAAQ,QAAQ;IACzC,OAAuB,QAAQ,SAAuC;IAEtE,YAAY,OAAO,SAAU,EAG5B;CACF"}

package/build/errors.js

@@ -57,6 +57,25 @@ export class IamUserError extends IamError {
         this.type = IamUserError.typeName;
     }
 }
+/**
+ * A refusal about an organization or a membership in it — an unknown organization, the last owner,
+ * the membership cap.
+ */
+export class IamOrganizationError extends IamError {
+    static typeName = `IamOrganization${ResilientError.typeName}`;
+    constructor(message = 'error') {
+        super(`organization:${message}`);
+        this.type = IamOrganizationError.typeName;
+    }
+}
+/** A refusal about a group: an unknown key, a managed group written by an operator, another app's group. */
+export class IamGroupError extends IamError {
+    static typeName = `IamGroup${ResilientError.typeName}`;
+    constructor(message = 'error') {
+        super(`group:${message}`);
+        this.type = IamGroupError.typeName;
+    }
+}
 ResilientError.registerErrorClass(IamError);
 ResilientError.registerErrorClass(IamClientError);
 ResilientError.registerErrorClass(IamResourceError);
@@ -64,4 +83,6 @@ ResilientError.registerErrorClass(IamGrantError);
 ResilientError.registerErrorClass(IamPermissionError);
 ResilientError.registerErrorClass(IamUnsupported);
 ResilientError.registerErrorClass(IamUserError);
+ResilientError.registerErrorClass(IamOrganizationError);
+ResilientError.registerErrorClass(IamGroupError);
 //# sourceMappingURL=errors.js.map