@stigmer/server 3.15.2-dev.20260913223433 → 3.15.3-dev.20260914100347

package/dist/domain/iampolicy/grant-path.js

@@ -0,0 +1,183 @@
+/**
+ * The ONE grant and revoke path of the IamPolicy domain (20260913.01,
+ * T01_0_plan.md §3a; T01_1_review.md Q-OR-1), moved from the cloud's
+ * iam/policy/service.ts into open source so every edition writes and
+ * deletes a policy row the same way. Its callers: the IamPolicy command
+ * controller (user grants and the three system RPCs), the built-in role
+ * lifecycle (the organization creator's `owner` row; cleanup on delete)
+ * and the membership rules (first-sign-in roles). Nothing else builds,
+ * saves or deletes a policy row; a composition reaches this path as
+ * in-process RPCs, never through an exported constructor.
+ *
+ * The two cloud#425 ordering invariants live here, nowhere else:
+ *   CREATE: row before tuple — a crash between the two leaves
+ *     row-without-tuple (granted on paper, denied in practice), healed by
+ *     the caller's natural retry (the tuple write deliberately runs on
+ *     duplicates too — the inline heal) or the boot backfill.
+ *   DELETE: tuple before row — a crash leaves row+tuple (revoke failed,
+ *     retry works); the reverse order was the fail-open incident class
+ *     ("revoke access" silently becoming "keep access forever").
+ * "Tuple" here is whatever the composed ResourceAuthorizationLifecycle does
+ * in `onPolicyGranted` and `onPolicyRevoked`; with none composed, or one
+ * without the two optional hooks, the path writes rows and notifies
+ * nothing (the OSS posture: rows are the record).
+ *
+ * The row for a triple is found BY TRIPLE, never by derived id. Open
+ * source's rows carry the derived id (constants.ts policyIdFor), so the
+ * two lookups would agree here; the cloud's Java-era rows carry random
+ * `iamp_<ulid>` ids and must revoke and deduplicate through this same
+ * code, so `findByTriple` (the pair's rows filtered by relation) is the
+ * one definition of "the row for this triple" and `findById` serves the
+ * `get` RPC alone. On the OSS adapter that read is one scan of the kind
+ * (resource-store.ts); §4 measures it.
+ *
+ * The path is the one writer, so it refuses before it writes (Q-S2-1;
+ * slice 1 ruling 2): before any read, write or hook, `grant` and
+ * `revokeBySpec` run the domain's wire refusals (wire-refusals.ts — a spec
+ * whose resource or principal kind is not an ApiResourceKind member name,
+ * or whose fields hold a canonical-text delimiter, is INVALID_ARGUMENT
+ * with the pinned copy; slice 5 made that module the one home of the rule
+ * the controller and the ValidateGrantableRole step share). The
+ * controller refuses the same kinds BEFORE position 1 (Q-S6-1), so a wire
+ * caller never reaches this check; it stands for the callers that enter
+ * here without the controller — the built-in lifecycle and the membership
+ * rules — and is what keeps a garbage row out of the store and a garbage
+ * spec away from a composition's tuple delete from every door.
+ * `cleanupResource` and `revokeOrgAccess` take refs and ids their callers
+ * read from rows, so they do not refuse.
+ *
+ * The row this path builds: the proto's apiVersion const and kind, the
+ * derived id, the spec as given, and the caller's audit stamp through the
+ * platform's one stamper (setAuditFieldsForCreate) — the cloud's
+ * `buildNewPolicy` stamped neither org nor creator; this path stamps the
+ * creator and, like the cloud, no `metadata.org`, because a policy may
+ * span organizations and none owns it.
+ */
+import { create } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
+import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
+import { kindEnumName } from "../../pipeline/apiresource-meta.js";
+import { setAuditFieldsForCreate } from "../../pipeline/steps/defaults.js";
+import { IAM_POLICY_API_VERSION, IAM_POLICY_KIND, policyIdFor, } from "./constants.js";
+import { DuplicatePolicyError } from "./store.js";
+import { refsOf, requireWellFormedTriple } from "./wire-refusals.js";
+export function newIamPolicyGrantPath(deps) {
+    const { policies, lifecycle, logger } = deps;
+    /** The row holding this exact triple — the pair's rows, filtered by relation. */
+    async function findByTriple(spec) {
+        const { principal, resource } = refsOf(spec);
+        const onPair = await policies.findByPrincipalAndResource(principal.kind, principal.id, resource.kind, resource.id);
+        return onPair.find((policy) => policy.spec !== undefined &&
+            policy.spec.relation === spec.relation &&
+            policy.spec.principal?.relation === principal.relation);
+    }
+    /** The revoke order for one row: the hook, then the delete. */
+    async function revokeRow(policy) {
+        const spec = policy.spec;
+        if (spec === undefined) {
+            throw new Error(`policy ${policy.metadata?.id ?? "?"} has no spec — corrupt row`);
+        }
+        await lifecycle?.onPolicyRevoked?.({ spec, policy });
+        const id = policy.metadata?.id ?? "";
+        await policies.deleteById(id);
+        logger.info("iam policy revoked", fieldsOf(id, spec));
+    }
+    return {
+        async grant(spec, caller) {
+            requireWellFormedTriple(spec);
+            let policy = await findByTriple(spec);
+            let duplicate = policy !== undefined;
+            if (policy === undefined) {
+                const fresh = buildRow(spec, caller);
+                try {
+                    await policies.save(fresh);
+                    policy = fresh;
+                    logger.info("iam policy granted", fieldsOf(policyIdFor(spec), spec));
+                }
+                catch (error) {
+                    if (!(error instanceof DuplicatePolicyError)) {
+                        throw error;
+                    }
+                    // Lost the race to another writer of the same triple: the
+                    // winner's row is the grant, exactly as if it had been found
+                    // above. A winner that cannot be read back means the refusal
+                    // was not a race — propagate it.
+                    const winner = await findByTriple(spec);
+                    if (winner === undefined) {
+                        throw error;
+                    }
+                    policy = winner;
+                    duplicate = true;
+                }
+            }
+            if (duplicate) {
+                logger.debug("iam policy already held", fieldsOf(policy.metadata?.id ?? "", spec));
+            }
+            // Deliberately unconditional (cloud#425): a duplicate re-grant is the
+            // inline heal for a row whose tuple never landed.
+            await lifecycle?.onPolicyGranted?.({ policy, duplicate });
+            return { policy, duplicate };
+        },
+        async revokeBySpec(spec) {
+            requireWellFormedTriple(spec);
+            const existing = await findByTriple(spec);
+            if (existing === undefined) {
+                // No row: a composition still deletes the bare tuple (one written
+                // before the row mirror existed); converges the store either way.
+                await lifecycle?.onPolicyRevoked?.({ spec, policy: undefined });
+                return undefined;
+            }
+            await revokeRow(existing);
+            return existing;
+        },
+        async cleanupResource(ref) {
+            const asResource = await policies.findByResource(ref.kind, ref.id);
+            const asPrincipal = await policies.findByPrincipal(ref.kind, ref.id);
+            for (const policy of distinctById([...asResource, ...asPrincipal])) {
+                await revokeRow(policy);
+            }
+        },
+        async revokeOrgAccess(identityAccountId, organizationId) {
+            const direct = await policies.findByPrincipalAndResource(kindEnumName(ApiResourceKind.identity_account), identityAccountId, kindEnumName(ApiResourceKind.organization), organizationId);
+            for (const policy of direct) {
+                await revokeRow(policy);
+            }
+        },
+    };
+}
+/** The row for a fresh grant: the contract's identity strings, the derived id, the caller's stamp. */
+function buildRow(spec, caller) {
+    const policy = create(IamPolicySchema, {
+        apiVersion: IAM_POLICY_API_VERSION,
+        kind: IAM_POLICY_KIND,
+        metadata: create(ApiResourceMetadataSchema, { id: policyIdFor(spec) }),
+        spec,
+    });
+    setAuditFieldsForCreate(IamPolicySchema, policy, caller);
+    return policy;
+}
+/** One row per id, at its first position. */
+function distinctById(policies) {
+    const seen = new Set();
+    return policies.filter((policy) => {
+        const id = policy.metadata?.id ?? "";
+        if (seen.has(id)) {
+            return false;
+        }
+        seen.add(id);
+        return true;
+    });
+}
+/** The structured fields every log line carries — ids and kinds, never a token. */
+function fieldsOf(id, spec) {
+    return {
+        policyId: id,
+        relation: spec.relation,
+        principalKind: spec.principal?.kind ?? "",
+        principalId: spec.principal?.id ?? "",
+        resourceKind: spec.resource?.kind ?? "",
+        resourceId: spec.resource?.id ?? "",
+    };
+}
+//# sourceMappingURL=grant-path.js.map

package/dist/domain/iampolicy/grant-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-path.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/grant-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,yBAAyB,EAAE,MAAM,4DAA4D,CAAC;AAEvG,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AASrF,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AA0CrE,MAAM,UAAU,qBAAqB,CACnC,IAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAE7C,iFAAiF;IACjF,KAAK,UAAU,YAAY,CACzB,IAAmB;QAEnB,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,0BAA0B,CACtD,SAAS,CAAC,IAAI,EACd,SAAS,CAAC,EAAE,EACZ,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,CACZ,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,IAAI,KAAK,SAAS;YACzB,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YACtC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,KAAK,SAAS,CAAC,QAAQ,CACzD,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,KAAK,UAAU,SAAS,CAAC,MAAiB;QACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,UAAU,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,GAAG,4BAA4B,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,EAAE,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QACrC,MAAM,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM;YACtB,uBAAuB,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC;YACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAC3B,MAAM,GAAG,KAAK,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBACvE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,CAAC,KAAK,YAAY,oBAAoB,CAAC,EAAE,CAAC;wBAC7C,MAAM,KAAK,CAAC;oBACd,CAAC;oBACD,0DAA0D;oBAC1D,6DAA6D;oBAC7D,6DAA6D;oBAC7D,iCAAiC;oBACjC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;oBACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;wBACzB,MAAM,KAAK,CAAC;oBACd,CAAC;oBACD,MAAM,GAAG,MAAM,CAAC;oBAChB,SAAS,GAAG,IAAI,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,CAAC,KAAK,CACV,yBAAyB,EACzB,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAC1C,CAAC;YACJ,CAAC;YACD,sEAAsE;YACtE,kDAAkD;YAClD,MAAM,SAAS,EAAE,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,IAAI;YACrB,uBAAuB,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,kEAAkE;gBAClE,kEAAkE;gBAClE,MAAM,SAAS,EAAE,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAChE,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC1B,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,GAAG;YACvB,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACnE,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACrE,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,EAAE,CAAC;gBACnE,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,iBAAiB,EAAE,cAAc;YACrD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,0BAA0B,CACtD,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAC9C,iBAAiB,EACjB,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,EAC1C,cAAc,CACf,CAAC;YACF,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;gBAC5B,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,SAAS,QAAQ,CAAC,IAAmB,EAAE,MAAsB;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,EAAE;QACrC,UAAU,EAAE,sBAAsB;QAClC,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,MAAM,CAAC,yBAAyB,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,IAAI;KACL,CAAC,CAAC;IACH,uBAAuB,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6CAA6C;AAC7C,SAAS,YAAY,CACnB,QAAkC;IAElC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;QAChC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mFAAmF;AACnF,SAAS,QAAQ,CAAC,EAAU,EAAE,IAAmB;IAC/C,OAAO;QACL,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE;QACzC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE;QACrC,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE;QACvC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;KACpC,CAAC;AACJ,CAAC"}

package/dist/domain/iampolicy/grant-scope.d.ts

@@ -0,0 +1,4 @@
+import type { PolicyGrantScope } from "../../extensions/policy-grant-scope.js";
+/** The open-source default: organization → its proto roles; every other kind → none. */
+export declare function newOrganizationOnlyGrantScope(): PolicyGrantScope;
+//# sourceMappingURL=grant-scope.d.ts.map

package/dist/domain/iampolicy/grant-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-scope.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/grant-scope.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAG/E,wFAAwF;AACxF,wBAAgB,6BAA6B,IAAI,gBAAgB,CAQhE"}

package/dist/domain/iampolicy/grant-scope.js

@@ -0,0 +1,34 @@
+/**
+ * Open source's PolicyGrantScope (20260913.01, T01_1_review.md Q-OR-3 and
+ * Q-OR-4): the ORGANIZATION grants the roles its `kind_meta` lists —
+ * owner, admin, member, viewer — and no other kind grants anything. This
+ * is what lights the console's Members page in every edition while a
+ * viewer on one agent, the per-resource grant, stays what the Enterprise
+ * and Cloud editions add by composing a wider scope
+ * (extensions/policy-grant-scope.ts carries the contract every scope is
+ * held to: narrows the proto, total over the enum, synchronous).
+ *
+ * Installed by the composition root when no unit registers
+ * `drivers.policyGrantScope` — the `newPermissiveSingleTeamAuthorizer`
+ * shape: the default lives with the domain that defines its semantics and
+ * is called at the `??` site, never held by the registry.
+ *
+ * The organization's roles are READ from the proto through
+ * `grantableRolesFor`, not written here: the four words the Members page
+ * shows and entry 3's authorizer enforces have one source, and a proto
+ * change is the only way to change them (grant-scope.test.ts pins the
+ * equality; grantable-roles-for.test.ts pins the four).
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { grantableRolesFor } from "../../pipeline/apiresource-meta.js";
+/** The open-source default: organization → its proto roles; every other kind → none. */
+export function newOrganizationOnlyGrantScope() {
+    return {
+        grantableRoles(kind) {
+            return kind === ApiResourceKind.organization
+                ? grantableRolesFor(kind)
+                : [];
+        },
+    };
+}
+//# sourceMappingURL=grant-scope.js.map

package/dist/domain/iampolicy/grant-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-scope.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/grant-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAEvE,wFAAwF;AACxF,MAAM,UAAU,6BAA6B;IAC3C,OAAO;QACL,cAAc,CAAC,IAAI;YACjB,OAAO,IAAI,KAAK,eAAe,CAAC,YAAY;gBAC1C,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC;gBACzB,CAAC,CAAC,EAAE,CAAC;QACT,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/iampolicy/membership.d.ts

@@ -0,0 +1,111 @@
+/**
+ * The open-source membership rules (20260913.01, T01_0_plan.md §3a;
+ * T01_1_review.md Q-OR-6b, Q-OR-6c; slice 4 rulings Q-S4-2 to Q-S4-7):
+ * how organization roles come to exist on a self-host that has no
+ * administrator to grant them. Core code, installed only under the
+ * built-in authorization posture (boot/compose.ts `builtInAuthorization`:
+ * no unit registered an Authorizer); a composition with its own
+ * Authorizer has its own onboarding and never constructs this.
+ *
+ * Two moments:
+ *
+ *   onAccountCreated(account, caller) — a person's FIRST provisioning, and
+ *   only that (the identity-account domain's AccountCreatedHook, run by
+ *   provisionMyAccount on the call whose `created` is true). For every
+ *   organization the account holds no row on, in this order:
+ *     1. `owner`  — the organization's creator stamp is this account (its
+ *                   subject or its id): the founder, who founded it
+ *                   idp-shaped before any row existed;
+ *     2. `admin`  — this account created a blueprint in it (BLUEPRINT_KINDS,
+ *                   constants.ts: the kinds an admin authors; sessions and
+ *                   executions are personal and confer nothing, DD-002
+ *                   rule 2);
+ *     3. `admin`  — the account's email is the configured operator email
+ *                   (an empty configuration matches nobody);
+ *     4. `admin`  — the organization has ZERO role rows and no PERSON other
+ *                   than this account created it or any blueprint in it:
+ *                   the fresh install's first caller, and the
+ *                   trusted-local-turned-OIDC laptop whose stamps are all
+ *                   "system". "Zero rows", never "no admin now" — revoking
+ *                   every admin of a bootstrapped organization must not
+ *                   hand it to the next stranger (plan finding 2); and the
+ *                   founder's own stamp counts as a person (Q-S4-7), so a
+ *                   revoked founder's empty organization is not handed
+ *                   over either;
+ *     5. `member` — everyone else.
+ *   Arms 3 and 4 both answer `admin`; 3 is checked first because it is a
+ *   string compare and 4 reads the organization's rows. `user`-class
+ *   callers only (Q-OR-6b): a runner, a machine or the in-process class
+ *   never earns a role. Nothing on an organization the account already
+ *   holds a row on, so a run that faulted midway converges on the next.
+ *
+ *   ensureOperatorOwnership(operator) — the trusted-local boot ensure
+ *   (Q-OR-6c): the laptop's operator becomes `owner` of every organization
+ *   that has NO owner row. "No owner row", not "no row of this operator"
+ *   (Q-S4-3): a boot-time write never overrides a human grant recorded
+ *   under an earlier OIDC life of the same database, and the permissive
+ *   Authorizer admits the operator regardless. A second boot writes
+ *   nothing. The row is granted AS the operator — the trusted-local
+ *   identity shape (empty issuer and token) carrying the account's id,
+ *   email and name — so its audit actor reads like every other write on
+ *   that laptop.
+ *
+ * What a creator stamp is. The rules read `status.audit.spec_audit
+ * .created_by.id` off organizations and blueprints. That stamp is the
+ * caller's identityId at the time: a provisioned caller's ACCOUNT id, an
+ * unprovisioned caller's raw issuer SUBJECT, and — under the trusted-local
+ * posture — the operator's EMAIL or the "system" placeholder
+ * (pipeline/interceptors/auth.ts trustedLocalIdentityFor). So "mine" is
+ * "equals my subject or my id" (an email stamp is nobody's by this rule;
+ * the operator is covered by arm 3 and by ensureOperatorOwnership), and a
+ * stamp is a PERSON when it is non-empty and not the "system" placeholder
+ * (SYSTEM_OPERATOR_IDENTITY_ID, the one home of that word — Q-S4-6). The
+ * rules classify stamps by shape and consult no account store (Q-S4-5).
+ *
+ * Reads. Policy rows through the IamPolicyStore PORT (`policies`, the
+ * same instance the grant path writes through) — never around it
+ * (Q-S4-5). Organizations and blueprints through the generic Store,
+ * decoded with each kind's own schema (CREATOR_SCAN_SCHEMAS; Q-S4-2: the
+ * envelope shares its field numbers but each status carries its audit
+ * under its own, so no generic decode exists). Cost, measured in the
+ * entry's execution record: one scan of each of seven kinds and one row
+ * read per organization, once per account creation.
+ *
+ * The window this design accepts (Q-S4-4). A store fault after the
+ * account row persisted fails the request INTERNAL (the controller's
+ * mapping) with the account in place; later calls answer `created:
+ * false`, so the rules never run again for that person. The writes ride
+ * the idempotent grant path, so a partial run leaves only correct rows,
+ * and the recovery is an administrator's grant — or, on a fresh install,
+ * arm 3 at the operator's own sign-in. An account created through the
+ * `create` RPC (the platform's own pipelines, cloud#393) never reaches
+ * this hook either: the rules are about a person signing in.
+ */
+import type { DescMessage } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import type { Store } from "../../store/interface.js";
+import type { AccountCreatedHook } from "../identityaccount/provisioning.js";
+import type { IamPolicyGrantPath } from "./grant-path.js";
+import type { IamPolicyStore } from "./store.js";
+export interface MembershipRulesDeps {
+    readonly grantPath: IamPolicyGrantPath;
+    /** The port the grant path writes through — read here for "holds a row", "zero rows", "has an owner". */
+    readonly policies: IamPolicyStore;
+    readonly store: Store;
+    /** STIGMER_OPERATOR_EMAIL as the operator seam holds it; "" when unconfigured. */
+    readonly operatorEmail: string;
+}
+export interface MembershipRules extends AccountCreatedHook {
+    /** The trusted-local boot ensure: `owner` wherever no owner row exists. */
+    ensureOperatorOwnership(operator: IdentityAccount): Promise<void>;
+}
+/**
+ * The schemas the creator scan decodes with: the organization and every
+ * BLUEPRINT_KINDS member. Pinned equal to that set by the domain's tests,
+ * so a kind added to the constant without a schema fails loudly instead
+ * of being skipped.
+ */
+export declare const CREATOR_SCAN_SCHEMAS: ReadonlyMap<ApiResourceKind, DescMessage>;
+export declare function newMembershipRules(deps: MembershipRulesDeps): MembershipRules;
+//# sourceMappingURL=membership.d.ts.map

package/dist/domain/iampolicy/membership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"membership.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/membership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAStD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAShG,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAE7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,yGAAyG;IACzG,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,kFAAkF;IAClF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD,2EAA2E;IAC3E,uBAAuB,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,eAAe,EAAE,WAAW,CASvE,CAAC;AAiBL,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,GAAG,eAAe,CAuH7E"}

package/dist/domain/iampolicy/membership.js

@@ -0,0 +1,152 @@
+import { fromBinary } from "@bufbuild/protobuf";
+import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import { EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
+import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
+import { ScheduleSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
+import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
+import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
+import { kindEnumName } from "../../pipeline/apiresource-meta.js";
+import { SYSTEM_OPERATOR_IDENTITY_ID } from "../../pipeline/interceptors/auth.js";
+import { auditOf } from "../../pipeline/steps/defaults.js";
+import { metadataOf } from "../../pipeline/steps/shapes.js";
+import { BLUEPRINT_KINDS } from "./constants.js";
+import { organizationRole, relationOf } from "./specs.js";
+/**
+ * The schemas the creator scan decodes with: the organization and every
+ * BLUEPRINT_KINDS member. Pinned equal to that set by the domain's tests,
+ * so a kind added to the constant without a schema fails loudly instead
+ * of being skipped.
+ */
+export const CREATOR_SCAN_SCHEMAS = new Map([
+    [ApiResourceKind.organization, OrganizationSchema],
+    [ApiResourceKind.agent, AgentSchema],
+    [ApiResourceKind.workflow, WorkflowSchema],
+    [ApiResourceKind.skill, SkillSchema],
+    [ApiResourceKind.mcp_server, McpServerSchema],
+    [ApiResourceKind.environment, EnvironmentSchema],
+    [ApiResourceKind.schedule, ScheduleSchema],
+]);
+const ORGANIZATION = kindEnumName(ApiResourceKind.organization);
+const IDENTITY_ACCOUNT = kindEnumName(ApiResourceKind.identity_account);
+/** A creator stamp that names a person: non-empty and not the unconfigured laptop's placeholder. */
+function isPersonStamp(stamp) {
+    return stamp !== "" && stamp !== SYSTEM_OPERATOR_IDENTITY_ID;
+}
+export function newMembershipRules(deps) {
+    const { grantPath, policies, store, operatorEmail } = deps;
+    async function scan(kind) {
+        const schema = CREATOR_SCAN_SCHEMAS.get(kind);
+        if (schema === undefined) {
+            throw new Error(`no schema to decode ${kindEnumName(kind)} rows for the creator scan`);
+        }
+        const rows = await store.listResources(kind);
+        return rows.map((bytes) => {
+            const resource = fromBinary(schema, bytes);
+            const metadata = metadataOf(resource);
+            return {
+                id: metadata?.id ?? "",
+                org: metadata?.org ?? "",
+                createdBy: auditOf(schema, resource)?.specAudit?.createdBy?.id ?? "",
+            };
+        });
+    }
+    async function scanBlueprints() {
+        const scanned = [];
+        for (const kind of BLUEPRINT_KINDS) {
+            scanned.push(...(await scan(kind)));
+        }
+        return scanned;
+    }
+    /** The organizations `accountId` already holds any row on — the idempotency set. */
+    async function organizationsHeldBy(accountId) {
+        const rows = await policies.findByPrincipal(IDENTITY_ACCOUNT, accountId);
+        return new Set(rows
+            .filter((row) => row.spec?.resource?.kind === ORGANIZATION)
+            .map((row) => row.spec?.resource?.id ?? ""));
+    }
+    return {
+        async onAccountCreated(account, caller) {
+            if (caller.callerClass !== "user") {
+                return;
+            }
+            const accountId = account.metadata?.id ?? "";
+            if (accountId === "") {
+                throw new Error("membership rules: the provisioned account carries no id");
+            }
+            const organizations = await scan(ApiResourceKind.organization);
+            if (organizations.length === 0) {
+                return;
+            }
+            const subject = account.spec?.idpId ?? "";
+            const email = account.spec?.email ?? "";
+            const isMine = (stamp) => stamp !== "" && (stamp === subject || stamp === accountId);
+            const held = await organizationsHeldBy(accountId);
+            const blueprints = await scanBlueprints();
+            for (const organization of organizations) {
+                if (held.has(organization.id)) {
+                    continue;
+                }
+                const inOrganization = blueprints.filter((blueprint) => blueprint.org === organization.id);
+                let role;
+                if (isMine(organization.createdBy)) {
+                    role = IamRole.owner;
+                }
+                else if (inOrganization.some((b) => isMine(b.createdBy))) {
+                    role = IamRole.admin;
+                }
+                else if (operatorEmail !== "" && email === operatorEmail) {
+                    role = IamRole.admin;
+                }
+                else if (![
+                    organization.createdBy,
+                    ...inOrganization.map((b) => b.createdBy),
+                ].some((stamp) => isPersonStamp(stamp) && !isMine(stamp)) &&
+                    (await policies.findByResource(ORGANIZATION, organization.id))
+                        .length === 0) {
+                    role = IamRole.admin;
+                }
+                else {
+                    role = IamRole.member;
+                }
+                await grantPath.grant(organizationRole(accountId, role, organization.id), caller);
+            }
+        },
+        async ensureOperatorOwnership(operator) {
+            const accountId = operator.metadata?.id ?? "";
+            if (accountId === "") {
+                throw new Error("membership rules: the operator account carries no id");
+            }
+            const actor = operatorActor(operator, accountId);
+            for (const organization of await scan(ApiResourceKind.organization)) {
+                const owners = await policies.findByResourceWithRelations(ORGANIZATION, organization.id, [relationOf(IamRole.owner)]);
+                if (owners.length > 0) {
+                    continue;
+                }
+                await grantPath.grant(organizationRole(accountId, IamRole.owner, organization.id), actor);
+            }
+        },
+    };
+}
+/**
+ * The operator acting as its account: the trusted-local identity shape
+ * (pipeline/interceptors/auth.ts trustedLocalIdentityFor — no issuer, no
+ * token; email and display name only when known) with the account id as
+ * the principal, so the row's audit actor is the account, named the way
+ * every other trusted-local write names it.
+ */
+function operatorActor(operator, accountId) {
+    const email = operator.spec?.email ?? "";
+    const displayName = operator.metadata?.name ?? "";
+    return {
+        identityId: accountId,
+        callerClass: "user",
+        issuer: "",
+        rawToken: "",
+        ...(email !== "" ? { email } : {}),
+        ...(displayName !== "" ? { displayName } : {}),
+    };
+}
+//# sourceMappingURL=membership.js.map

package/dist/domain/iampolicy/membership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"membership.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/membership.ts"],"names":[],"mappings":"AAoFA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAG/F,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAG5D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAiB1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAC/B,IAAI,GAAG,CAA+B;IACpC,CAAC,eAAe,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAClD,CAAC,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC;IACpC,CAAC,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC;IAC1C,CAAC,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC;IACpC,CAAC,eAAe,CAAC,UAAU,EAAE,eAAe,CAAC;IAC7C,CAAC,eAAe,CAAC,WAAW,EAAE,iBAAiB,CAAC;IAChD,CAAC,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC;CAC3C,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;AAChE,MAAM,gBAAgB,GAAG,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;AASxE,oGAAoG;AACpG,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,2BAA2B,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAyB;IAC1D,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAE3D,KAAK,UAAU,IAAI,CAAC,IAAqB;QACvC,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,uBAAuB,YAAY,CAAC,IAAI,CAAC,4BAA4B,CACtE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACxB,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO;gBACL,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE;gBACtB,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE;gBACxB,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE;aACrE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,cAAc;QAC3B,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,oFAAoF;IACpF,KAAK,UAAU,mBAAmB,CAChC,SAAiB;QAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QACzE,OAAO,IAAI,GAAG,CACZ,IAAI;aACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,YAAY,CAAC;aAC1D,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAC9C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM;YACpC,IAAI,MAAM,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;gBAClC,OAAO;YACT,CAAC;YACD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YAC7C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;YAC/D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAW,EAAE,CACxC,KAAK,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC;YAC7D,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC;YAClD,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;YAE1C,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;gBACzC,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC9B,SAAS;gBACX,CAAC;gBACD,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CACtC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,YAAY,CAAC,EAAE,CACjD,CAAC;gBACF,IAAI,IAAa,CAAC;gBAClB,IAAI,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;oBACnC,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;gBACvB,CAAC;qBAAM,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;oBAC3D,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;gBACvB,CAAC;qBAAM,IAAI,aAAa,KAAK,EAAE,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;oBAC3D,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;gBACvB,CAAC;qBAAM,IACL,CAAC;oBACC,YAAY,CAAC,SAAS;oBACtB,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;iBAC1C,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACzD,CAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;yBAC3D,MAAM,KAAK,CAAC,EACf,CAAC;oBACD,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;gBACvB,CAAC;qBAAM,CAAC;oBACN,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;gBACxB,CAAC;gBACD,MAAM,SAAS,CAAC,KAAK,CACnB,gBAAgB,CAAC,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC,EAClD,MAAM,CACP,CAAC;YACJ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,uBAAuB,CAAC,QAAQ;YACpC,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACjD,KAAK,MAAM,YAAY,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;gBACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,2BAA2B,CACvD,YAAY,EACZ,YAAY,CAAC,EAAE,EACf,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAC5B,CAAC;gBACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtB,SAAS;gBACX,CAAC;gBACD,MAAM,SAAS,CAAC,KAAK,CACnB,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC,EAC3D,KAAK,CACN,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CACpB,QAAyB,EACzB,SAAiB;IAEjB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;IAClD,OAAO;QACL,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,MAAM;QACnB,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,EAAE;QACZ,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;AACJ,CAAC"}

package/dist/domain/iampolicy/permissions.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The permission vocabulary as the wire spells it (20260913.01 slice 5,
+ * Q-S5-3): `checkMyPermission` carries its `relation` as a string — the
+ * FGA relation name, which is the `IamPermission` member name — while the
+ * composed Authorizer's `AuthzCheck` carries the enum. This is the one
+ * read from the first spelling to the second. A relation that names no
+ * permission is the caller's mistake (INVALID_ARGUMENT in the controller),
+ * never a permission nobody holds: the console asks with the ten strings
+ * `IamPermission` lists (claim check C4) and a typo should be heard.
+ *
+ * A Map over the descriptor's values, never the TS enum's reverse index
+ * (the `kindsByEnumName` doctrine in pipeline/apiresource-meta.ts): a
+ * prototype key or a number spelled as text must resolve to nothing. The
+ * zero value `unspecified` is not a permission and is left out.
+ */
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+/** The permission a wire relation names, or `undefined`. */
+export declare function permissionByEnumName(relation: string): IamPermission | undefined;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/domain/iampolicy/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,aAAa,EAEd,MAAM,2CAA2C,CAAC;AAInD,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,GACf,aAAa,GAAG,SAAS,CAS3B"}

package/dist/domain/iampolicy/permissions.js

@@ -0,0 +1,27 @@
+/**
+ * The permission vocabulary as the wire spells it (20260913.01 slice 5,
+ * Q-S5-3): `checkMyPermission` carries its `relation` as a string — the
+ * FGA relation name, which is the `IamPermission` member name — while the
+ * composed Authorizer's `AuthzCheck` carries the enum. This is the one
+ * read from the first spelling to the second. A relation that names no
+ * permission is the caller's mistake (INVALID_ARGUMENT in the controller),
+ * never a permission nobody holds: the console asks with the ten strings
+ * `IamPermission` lists (claim check C4) and a typo should be heard.
+ *
+ * A Map over the descriptor's values, never the TS enum's reverse index
+ * (the `kindsByEnumName` doctrine in pipeline/apiresource-meta.ts): a
+ * prototype key or a number spelled as text must resolve to nothing. The
+ * zero value `unspecified` is not a permission and is left out.
+ */
+import { IamPermission, IamPermissionSchema, } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+let byName;
+/** The permission a wire relation names, or `undefined`. */
+export function permissionByEnumName(relation) {
+    if (byName === undefined) {
+        byName = new Map(IamPermissionSchema.values
+            .filter((value) => value.number !== IamPermission.unspecified)
+            .map((value) => [value.name, value.number]));
+    }
+    return byName.get(relation);
+}
+//# sourceMappingURL=permissions.js.map

package/dist/domain/iampolicy/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,aAAa,EACb,mBAAmB,GACpB,MAAM,2CAA2C,CAAC;AAEnD,IAAI,MAA8C,CAAC;AAEnD,4DAA4D;AAC5D,MAAM,UAAU,oBAAoB,CAClC,QAAgB;IAEhB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,GAAG,IAAI,GAAG,CACd,mBAAmB,CAAC,MAAM;aACvB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC,WAAW,CAAC;aAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAuB,CAAC,CAAC,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC"}

package/dist/domain/iampolicy/resource-store.d.ts

@@ -0,0 +1,4 @@
+import type { Store } from "../../store/interface.js";
+import type { IamPolicyStore } from "./store.js";
+export declare function newResourceIamPolicyStore(store: Store): IamPolicyStore;
+//# sourceMappingURL=resource-store.d.ts.map

package/dist/domain/iampolicy/resource-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-store.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/resource-store.ts"],"names":[],"mappings":"AA2CA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAGtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAmBjD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,KAAK,GAAG,cAAc,CAwGtE"}