@stigmer/server 3.15.2-dev.20260913223433 → 3.15.3-dev.20260914100347

package/src/extensions/registry.ts

@@ -34,7 +34,10 @@
  * points (20260911.11) at the identity-accounts stage (the store driver,
  * ahead of the boot-time operator ensure) and the routes stage (the
  * federation capability and the provision slot's steps, into the
- * identity-account controller).
+ * identity-account controller); the IamPolicy points (20260913.01) at
+ * the same two stages — the store driver where the grant path is built,
+ * beside the identity-account store, and the grant scope and the query
+ * engine into the IamPolicy controller at the routes stage.
  */
 import type { DescMessage } from "@bufbuild/protobuf";
 import type { ConnectRouter } from "@connectrpc/connect";
@@ -45,10 +48,13 @@ import type { ArtifactStorageDriverFactory } from "../artifactstorage/artifact-s
 import { BUILT_IN_STORAGE_TYPES } from "../artifactstorage/artifact-storage.js";
 import type { ChannelRuntime } from "../domain/agentchannel/channel-runtime.js";
 import type { IdentityAccountStore } from "../domain/identityaccount/store.js";
+import type { IamPolicyStore } from "../domain/iampolicy/store.js";
 import type { SecretCodec } from "../encryption/codec.js";
 import { V1_VERSION } from "../encryption/v1-codec.js";
+import type { AuthorizationQueryEngine } from "./authorization-queries.js";
 import type { IdentityFederation } from "./identity-federation.js";
 import type { ListReadScope } from "./list-read-scope.js";
+import type { PolicyGrantScope } from "./policy-grant-scope.js";
 import type { ModelCatalogProvider } from "../domain/workflow/registry/model-catalog-provider.js";
 import type { VisitorErrorPolicy } from "../pipeline/interceptors/error-boundary.js";
 import type { PipelineStep } from "../pipeline/pipeline.js";
@@ -250,6 +256,22 @@ export interface ResolvedExtensionDrivers {
    * four federated RPCs refuse UNIMPLEMENTED with the edition reason.
    */
   readonly identityFederation: IdentityFederation | undefined;
+  /**
+   * The 20260913.01 IamPolicy store driver — undefined = the compose.ts
+   * stage that builds the grant path installs the OSS adapter over the
+   * generic Store, OSS behavior byte-identical.
+   */
+  readonly iamPolicyStore: IamPolicyStore | undefined;
+  /**
+   * The 20260913.01 policy grant scope — undefined = compose.ts installs
+   * open source's organization-only default.
+   */
+  readonly policyGrantScope: PolicyGrantScope | undefined;
+  /**
+   * The 20260913.01 authorization-query engine — undefined = the
+   * tuple-half RPC arms refuse UNIMPLEMENTED with the edition reason.
+   */
+  readonly authorizationQueries: AuthorizationQueryEngine | undefined;
 }
 
 /**
@@ -297,6 +319,12 @@ export function resolveExtensions(
   let identityAccountStoreDeclaredBy: string | undefined;
   let identityFederation: IdentityFederation | undefined;
   let identityFederationDeclaredBy: string | undefined;
+  let iamPolicyStore: IamPolicyStore | undefined;
+  let iamPolicyStoreDeclaredBy: string | undefined;
+  let policyGrantScope: PolicyGrantScope | undefined;
+  let policyGrantScopeDeclaredBy: string | undefined;
+  let authorizationQueries: AuthorizationQueryEngine | undefined;
+  let authorizationQueriesDeclaredBy: string | undefined;
   const artifactStorageDrivers = new Map<
     string,
     ArtifactStorageDriverFactory
@@ -458,6 +486,36 @@ export function resolveExtensions(
       identityFederationDeclaredBy = unit.name;
     }
 
+    if (unit.drivers?.iamPolicyStore !== undefined) {
+      if (iamPolicyStoreDeclaredBy !== undefined) {
+        throw new Error(
+          `extension '${unit.name}' registers an IamPolicyStore, but '${iamPolicyStoreDeclaredBy}' already did — exactly one may be composed`,
+        );
+      }
+      iamPolicyStore = unit.drivers.iamPolicyStore;
+      iamPolicyStoreDeclaredBy = unit.name;
+    }
+
+    if (unit.drivers?.policyGrantScope !== undefined) {
+      if (policyGrantScopeDeclaredBy !== undefined) {
+        throw new Error(
+          `extension '${unit.name}' registers a PolicyGrantScope, but '${policyGrantScopeDeclaredBy}' already did — exactly one may be composed`,
+        );
+      }
+      policyGrantScope = unit.drivers.policyGrantScope;
+      policyGrantScopeDeclaredBy = unit.name;
+    }
+
+    if (unit.drivers?.authorizationQueries !== undefined) {
+      if (authorizationQueriesDeclaredBy !== undefined) {
+        throw new Error(
+          `extension '${unit.name}' registers an AuthorizationQueryEngine, but '${authorizationQueriesDeclaredBy}' already did — exactly one may be composed`,
+        );
+      }
+      authorizationQueries = unit.drivers.authorizationQueries;
+      authorizationQueriesDeclaredBy = unit.name;
+    }
+
     if (unit.drivers?.artifactStorageDrivers !== undefined) {
       for (const [name, factory] of unit.drivers.artifactStorageDrivers) {
         if ((BUILT_IN_STORAGE_TYPES as ReadonlyArray<string>).includes(name)) {
@@ -580,6 +638,9 @@ export function resolveExtensions(
       scheduleFireCaller,
       identityAccountStore,
       identityFederation,
+      iamPolicyStore,
+      policyGrantScope,
+      authorizationQueries,
     },
     services,
     workers,

package/src/extensions/resource-authorization.ts

@@ -26,9 +26,37 @@
  *   - onVisibilityChanged: SYNCHRONOUS, post-persist; a throw fails the
  *     request (metadata may be persisted with tuples lagging — retrying
  *     the same transition converges, the set-diff is idempotent).
+ *
+ * Corrected 2026-09-13 (20260913.01, T01_1_review.md Q-OR-6, Q-OR-10):
+ * "no driver composed = OSS behavior byte-identical" described the seam
+ * while the only writer of authorization records was the cloud's tuple
+ * driver. The seam now records authorization at lifecycle points in EVERY
+ * edition: open source's built-in role lifecycle
+ * (domain/iampolicy/role-lifecycle.ts, the entry's slice 4) writes
+ * IamPolicy rows (the organization creator's `owner` row; cleanup on
+ * delete), and a composed driver writes tuples too. The two POLICY hooks below are the
+ * other direction of the same seam — the IamPolicy domain's one grant and
+ * revoke path (domain/iampolicy/grant-path.ts) telling the driver that a
+ * row was written or is about to be deleted, so a composition can mirror
+ * the row as a tuple. Their order is the cloud#425 invariant, fixed by the
+ * path and stated on each event:
+ *   - onPolicyGranted: SYNCHRONOUS, AFTER the row is persisted; fires on
+ *     the duplicate arm too (the inline heal for a row whose tuple never
+ *     landed). A throw fails the request with the row in place — the
+ *     caller's retry or a boot backfill heals it.
+ *   - onPolicyRevoked: SYNCHRONOUS, BEFORE the row is deleted. A throw
+ *     leaves row and tuple, so a retry converges; the reverse order was
+ *     the fail-open incident class ("revoke" silently becoming "keep").
+ *     On the absent arm (no row for the spec) it fires with the spec and
+ *     no policy, so a composition can still delete a bare tuple written
+ *     before the row mirror existed.
+ * Absent method = no mirror is written (the OSS posture: rows are the
+ * record).
  */
 import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { OwnerAttributionType } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
+import type { IamPolicy } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
+import type { IamPolicySpec } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
 
 import type { CallerIdentity } from "./identity.js";
 
@@ -125,6 +153,31 @@ export interface DefaultInstanceLinkedEvent {
   readonly blueprintId: string;
 }
 
+/**
+ * Fired synchronously AFTER an IamPolicy row is persisted by the domain's
+ * grant path — and on the duplicate arm, when the triple was already held
+ * and no row was written, so a composition heals a row whose tuple never
+ * landed (cloud#425's inline heal). `policy` is the row as stored: on the
+ * duplicate arm the FIRST writer's row, whose id may be a legacy random
+ * one on a composition that predates derived ids.
+ */
+export interface PolicyGrantedEvent {
+  readonly policy: IamPolicy;
+  /** True when the triple was already held and this grant wrote nothing. */
+  readonly duplicate: boolean;
+}
+
+/**
+ * Fired synchronously BEFORE an IamPolicy row is deleted by the domain's
+ * grant path. `spec` is always the triple being revoked; `policy` is the
+ * row found for it, or `undefined` on the absent arm — the spec alone is
+ * enough to name the tuple a composition still deletes then.
+ */
+export interface PolicyRevokedEvent {
+  readonly spec: IamPolicySpec;
+  readonly policy: IamPolicy | undefined;
+}
+
 /**
  * The driver interface (single-instance point, registered via
  * ExtensionDrivers.resourceAuthorizationLifecycle). Implementations must
@@ -142,4 +195,16 @@ export interface ResourceAuthorizationLifecycle {
    * (the OSS posture: local access control needs none).
    */
   onDefaultInstanceLinked?(event: DefaultInstanceLinkedEvent): Promise<void>;
+  /**
+   * OPTIONAL (added 20260913.01 slice 2): synchronous, AFTER the row
+   * persist, on the duplicate arm too; a throw fails the grant with the
+   * row in place. Absent method = rows are the record (the OSS posture).
+   */
+  onPolicyGranted?(event: PolicyGrantedEvent): Promise<void>;
+  /**
+   * OPTIONAL (added 20260913.01 slice 2): synchronous, BEFORE the row
+   * delete; a throw leaves row and tuple for the retry. Absent method =
+   * rows are the record (the OSS posture).
+   */
+  onPolicyRevoked?(event: PolicyRevokedEvent): Promise<void>;
 }

package/src/index.ts

@@ -100,6 +100,8 @@ export type { ResolvedExtensionDrivers } from "./extensions/registry.js";
 // tests pin against.
 export type {
   DefaultInstanceLinkedEvent,
+  PolicyGrantedEvent,
+  PolicyRevokedEvent,
   ResourceAuthorizationLifecycle,
   ResourceCreatedEvent,
   ResourceDeletedEvent,
@@ -125,6 +127,24 @@ export type {
   IdentityAccountStoreContractFixture,
 } from "./domain/identityaccount/store-contract.js";
 export { identityAccountStoreContract } from "./domain/identityaccount/store-contract.js";
+// The 20260913.01 IamPolicy seams (Q-OR-1, Q-OR-10): the store PORT a
+// composition drives the domain's grant path through (drivers.iamPolicyStore;
+// a driver throws DuplicatePolicyError for a held id) and its vitest-free
+// contract kit; the grant scope (drivers.policyGrantScope — which kinds an
+// edition grants on, with which roles; open source's default is the
+// organization alone); and the tuple-half query engine
+// (drivers.authorizationQueries — the three graph questions only an
+// authorization backend answers). The grant path itself is NOT exported: a
+// composition reaches it as in-process RPCs, the doctrine.
+export type { IamPolicyStore } from "./domain/iampolicy/store.js";
+export { DuplicatePolicyError } from "./domain/iampolicy/store.js";
+export type {
+  IamPolicyStoreContractCase,
+  IamPolicyStoreContractFixture,
+} from "./domain/iampolicy/store-contract.js";
+export { iamPolicyStoreContract } from "./domain/iampolicy/store-contract.js";
+export type { PolicyGrantScope } from "./extensions/policy-grant-scope.js";
+export type { AuthorizationQueryEngine } from "./extensions/authorization-queries.js";
 export type { IdentityFederation } from "./extensions/identity-federation.js";
 export type { AccountsBySubject } from "./domain/identityaccount/resolve.js";
 export { identityIdForSubject } from "./domain/identityaccount/resolve.js";

package/src/pipeline/__tests__/grantable-roles-for.test.ts

@@ -0,0 +1,87 @@
+/**
+ * Pins `grantableRolesFor` (pipeline/apiresource-meta.ts), the one read of
+ * a kind's `kind_meta.authorization.grantable_roles` — what the IamPolicy
+ * domain's ValidateGrantableRole consults FIRST (20260913.01, Q-OR-3 as
+ * refined: the proto says what can be granted at all; the composed
+ * PolicyGrantScope only narrows by edition) and what open source's
+ * organization-only scope reads for the organization.
+ *
+ * Three properties are load-bearing and pinned here rather than assumed:
+ *
+ *   - The ORGANIZATION lists exactly owner, admin, member, viewer, in the
+ *     proto's order. This is the Q-OR-4 ruling made a test: the four roles
+ *     every edition grants on an organization are the proto's, not a list
+ *     in code, so a change to `api_resource_kind.proto` fails here and
+ *     someone reads the ruling before the console shows a fifth word.
+ *   - The five system-managed kinds list NO roles. ValidateGrantableRole's
+ *     first arm refuses a grant on them with the cloud's byte-pinned
+ *     INVALID_ARGUMENT in every edition; this is the data that arm reads.
+ *   - TOTAL, never a throw. The reader is asked about the SECOND kind
+ *     vocabulary — an `ApiResourceRef.kind` resolved through
+ *     `kindByEnumName`, which yields the unknown kind for anything it does
+ *     not recognise and never throws (the module header). The unknown kind
+ *     is the one enum member without `kind_meta`; it answers the empty
+ *     list, as the cloud's `grantableRolesFor` (iam/policy/roles.ts) did.
+ */
+import { getOption, hasOption } from "@bufbuild/protobuf";
+import { describe, expect, it } from "vitest";
+
+import {
+  ApiResourceKind,
+  ApiResourceKindSchema,
+  kind_meta,
+} from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+
+import { grantableRolesFor } from "../apiresource-meta.js";
+
+describe("grantableRolesFor — the proto's grantable roles per kind", () => {
+  it("the organization grants exactly owner, admin, member, viewer, in proto order (Q-OR-4)", () => {
+    expect(grantableRolesFor(ApiResourceKind.organization)).toEqual([
+      IamRole.owner,
+      IamRole.admin,
+      IamRole.member,
+      IamRole.viewer,
+    ]);
+  });
+
+  it("a blueprint kind answers the descriptor's own list, not a copy", () => {
+    const agentValue = ApiResourceKindSchema.values.find(
+      (value) => value.number === ApiResourceKind.agent,
+    );
+    expect(agentValue).toBeDefined();
+    const fromDescriptor =
+      getOption(agentValue!, kind_meta).authorization?.grantableRoles ?? [];
+    expect(fromDescriptor.length).toBeGreaterThan(0);
+    expect(grantableRolesFor(ApiResourceKind.agent)).toEqual(fromDescriptor);
+  });
+
+  it.each([
+    ["identity_account", ApiResourceKind.identity_account],
+    ["api_key", ApiResourceKind.api_key],
+    ["iam_policy", ApiResourceKind.iam_policy],
+    ["invitation", ApiResourceKind.invitation],
+    ["agent_execution", ApiResourceKind.agent_execution],
+  ])(
+    "%s is system-managed: no grantable roles (Q-OR-3 arm 1)",
+    (_name, kind) => {
+      expect(grantableRolesFor(kind)).toEqual([]);
+    },
+  );
+
+  it("the unknown kind answers the empty list and never throws (the second vocabulary's doctrine)", () => {
+    expect(
+      grantableRolesFor(ApiResourceKind.api_resource_kind_unknown),
+    ).toEqual([]);
+  });
+
+  it("is total over the descriptor: every member answers an array", () => {
+    for (const value of ApiResourceKindSchema.values) {
+      const roles = grantableRolesFor(value.number as ApiResourceKind);
+      expect(Array.isArray(roles), value.name).toBe(true);
+      if (!hasOption(value, kind_meta)) {
+        expect(roles, `${value.name} carries no kind_meta`).toEqual([]);
+      }
+    }
+  });
+});

package/src/pipeline/__tests__/kind-by-enum-name.test.ts

@@ -0,0 +1,107 @@
+/**
+ * Pins `kindByEnumName` (pipeline/apiresource-meta.ts), the lookup for the
+ * SECOND kind vocabulary the contract carries. A resource's own `kind`
+ * field is the `kind_meta.name` ("McpServer"; `getKindEnum`, the #545
+ * lesson). An `ApiResourceRef.kind` — the IamPolicy spec's principal and
+ * resource, the FGA object type — is the enum MEMBER name ("mcp_server"),
+ * which is what every SDK call site sends and what the cloud's
+ * `kindFromSpecString` resolved before this entry (20260913.01, Q-OR-2).
+ *
+ * Two properties are load-bearing and pinned here rather than assumed:
+ *
+ *   - EXACT match, never canonicalised. The IamPolicy id is derived from
+ *     the spec's text (Q-OR-9), so a lenient matcher that admitted
+ *     "Organization" beside "organization" would mint two rows for one
+ *     grant, or force the domain to rewrite caller input before storing
+ *     it. The two spellings `getKindEnum` accepts are refused here on
+ *     purpose; the contrast arm keeps the two lookups from being merged.
+ *   - NEVER a throw. The Authorize step resolves `resource_kind_path`
+ *     through this function at position 1 of every chain, and resolution
+ *     never throws by doctrine (authorize.ts header): an unknown name is
+ *     the unknown kind, and the Authorizer owns the decision.
+ */
+import { describe, expect, it } from "vitest";
+
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+
+import {
+  getKindEnum,
+  kindByEnumName,
+  kindEnumName,
+} from "../apiresource-meta.js";
+
+describe("kindByEnumName — an ApiResourceRef.kind is the enum member name", () => {
+  it.each([
+    ["organization", ApiResourceKind.organization],
+    ["identity_account", ApiResourceKind.identity_account],
+    ["mcp_server", ApiResourceKind.mcp_server],
+    ["agent", ApiResourceKind.agent],
+    ["iam_policy", ApiResourceKind.iam_policy],
+  ])("%s resolves to its kind", (name, kind) => {
+    expect(kindByEnumName(name)).toBe(kind);
+  });
+
+  it.each([
+    ["Organization", "the kind_meta spelling, not a member name"],
+    ["McpServer", "the kind_meta spelling, not a member name"],
+    ["ORGANIZATION", "case differs"],
+    ["organization ", "trailing whitespace"],
+    ["", "empty"],
+    ["spaceship", "not a kind"],
+    ["5", "a number spelled as text is not a name"],
+    ["constructor", "a prototype key is not a name"],
+  ])("%s is the unknown kind (%s) — never a throw", (value) => {
+    expect(kindByEnumName(value)).toBe(
+      ApiResourceKind.api_resource_kind_unknown,
+    );
+  });
+
+  it("the zero value's own name is the unknown kind too", () => {
+    expect(kindByEnumName("api_resource_kind_unknown")).toBe(
+      ApiResourceKind.api_resource_kind_unknown,
+    );
+  });
+
+  it("is exact where getKindEnum is lenient — the two vocabularies stay two lookups", () => {
+    // A resource's `kind` field: canonical kind_meta.name matching,
+    // case-insensitive, underscores ignored, and a throw on unknown.
+    expect(getKindEnum("McpServer")).toBe(ApiResourceKind.mcp_server);
+    expect(getKindEnum("mcp_server")).toBe(ApiResourceKind.mcp_server);
+    expect(() => getKindEnum("spaceship")).toThrow();
+    // An ApiResourceRef.kind: the member name and nothing else.
+    expect(kindByEnumName("McpServer")).toBe(
+      ApiResourceKind.api_resource_kind_unknown,
+    );
+    expect(kindByEnumName("mcp_server")).toBe(ApiResourceKind.mcp_server);
+  });
+
+  it("every member of the enum round-trips through its own name", () => {
+    for (const [name, value] of Object.entries(ApiResourceKind)) {
+      if (typeof value !== "number") continue;
+      expect(kindByEnumName(name), name).toBe(value);
+    }
+  });
+});
+
+describe("kindEnumName — the inverse: a kind spelled as an ApiResourceRef.kind", () => {
+  it.each([
+    [ApiResourceKind.organization, "organization"],
+    [ApiResourceKind.identity_account, "identity_account"],
+    [ApiResourceKind.mcp_server, "mcp_server"],
+  ])("%s spells as %s", (kind, name) => {
+    expect(kindEnumName(kind)).toBe(name);
+  });
+
+  it("the unknown kind spells itself — never a throw", () => {
+    expect(kindEnumName(ApiResourceKind.api_resource_kind_unknown)).toBe(
+      "api_resource_kind_unknown",
+    );
+  });
+
+  it("round-trips with kindByEnumName over every member — the two are inverses", () => {
+    for (const value of Object.values(ApiResourceKind)) {
+      if (typeof value !== "number") continue;
+      expect(kindByEnumName(kindEnumName(value)), String(value)).toBe(value);
+    }
+  });
+});

package/src/pipeline/__tests__/kind-served-by-edition.test.ts

@@ -0,0 +1,107 @@
+/**
+ * Pins `tierServedByEdition` and `kindServedByEdition`
+ * (pipeline/apiresource-meta.ts), the server's twin of the SDK's tier-rank
+ * functions (sdk/typescript/src/resource-availability.ts: editions
+ * oss < enterprise < cloud; a tier admits its own edition and every edition
+ * above it; the enum NUMBERS are wire identifiers, never ranks —
+ * `enterprise` sits at 3 in both enums and ranks second). T01_1_review.md
+ * Q-OR-8 and claim check C5: the two implementations must agree on the
+ * whole matrix, because the console reads the SDK's answer to decide what
+ * to SHOW and `checkMyPermission` reads the server's to decide what is
+ * HELD; a disagreement is a surface that appears and then fails, the
+ * Q-EC-2b class.
+ *
+ * The matrix is spelled out rather than computed, so a change on either
+ * side is a visible diff here and the SDK's own test remains the SDK's.
+ */
+import { describe, expect, it } from "vitest";
+
+import {
+  ApiResourceKind,
+  ResourceTier,
+} from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
+
+import {
+  kindServedByEdition,
+  tierServedByEdition,
+} from "../apiresource-meta.js";
+
+const EDITIONS = [
+  ServerEdition.oss,
+  ServerEdition.enterprise,
+  ServerEdition.cloud,
+] as const;
+
+/** tier → the editions that serve it, in the SDK's order. */
+const MATRIX: ReadonlyArray<readonly [ResourceTier, readonly boolean[]]> = [
+  [ResourceTier.open_source, [true, true, true]],
+  [ResourceTier.enterprise, [false, true, true]],
+  [ResourceTier.cloud_only, [false, false, true]],
+  // A kind whose proto forgot the field is treated as core, as the SDK
+  // treats it: hiding a kind is the worse failure for a client, and holding
+  // a permission on a kind every edition serves is the truthful answer.
+  [ResourceTier.resource_tier_unspecified, [true, true, true]],
+];
+
+describe("tierServedByEdition — the SDK's rank table, spelled out", () => {
+  for (const [tier, served] of MATRIX) {
+    it(`${ResourceTier[tier]} is served by [oss, enterprise, cloud] = [${served.join(", ")}]`, () => {
+      expect(
+        EDITIONS.map((edition) => tierServedByEdition(tier, edition)),
+      ).toEqual(served);
+    });
+  }
+
+  it("an edition the server does not know serves everything — an older server hides nothing, the SDK's own fallback", () => {
+    for (const [tier] of MATRIX) {
+      expect(
+        tierServedByEdition(tier, ServerEdition.server_edition_unspecified),
+      ).toBe(true);
+    }
+  });
+});
+
+describe("kindServedByEdition — the kind's tier through the same table", () => {
+  it("reads the tier from kind_meta: agent everywhere, invitation from enterprise up, api_resource_version on cloud only", () => {
+    expect(
+      EDITIONS.map((edition) =>
+        kindServedByEdition(ApiResourceKind.agent, edition),
+      ),
+    ).toEqual([true, true, true]);
+    expect(
+      EDITIONS.map((edition) =>
+        kindServedByEdition(ApiResourceKind.invitation, edition),
+      ),
+    ).toEqual([false, true, true]);
+    expect(
+      EDITIONS.map((edition) =>
+        kindServedByEdition(ApiResourceKind.api_resource_version, edition),
+      ),
+    ).toEqual([false, false, true]);
+  });
+
+  it("platform is enterprise-tiered, so the operator seat's permissions are never held on open source (the settings-navigation arm)", () => {
+    expect(
+      kindServedByEdition(ApiResourceKind.platform, ServerEdition.oss),
+    ).toBe(false);
+    expect(
+      kindServedByEdition(ApiResourceKind.platform, ServerEdition.enterprise),
+    ).toBe(true);
+  });
+
+  it("iam_policy is served by every edition once this entry flips it", () => {
+    expect(
+      kindServedByEdition(ApiResourceKind.iam_policy, ServerEdition.oss),
+    ).toBe(true);
+  });
+
+  it("the unknown kind is a programming error, not an answer", () => {
+    expect(() =>
+      kindServedByEdition(
+        ApiResourceKind.api_resource_kind_unknown,
+        ServerEdition.cloud,
+      ),
+    ).toThrow();
+  });
+});