@stigmer/server 3.15.2 → 3.15.3-dev.20260914100347

package/dist/domain/iampolicy/controller.js

@@ -0,0 +1,451 @@
+/**
+ * IamPolicy controller (20260913.01, T01_0_plan.md §3a; T01_1_review.md
+ * Q-OR-2, Q-OR-3, Q-OR-7, Q-OR-8 and the slice-5 rulings Q-S5-1..10) —
+ * the ROW half of the IamPolicy contract served ONCE by @stigmer/server in
+ * every edition, all fourteen RPCs. The behavioural reference is the
+ * cloud's iam/policy/handlers.ts (the Java pipelines rendered flat), whose
+ * handlers retire against this module at the S3 re-point; the byte-pinned
+ * copy moved with it (constants.ts). The cloud keeps what differs per
+ * edition and registers it: its row store (`drivers.iamPolicyStore`), its
+ * grant scope (`drivers.policyGrantScope`), its OpenFGA query engine
+ * (`drivers.authorizationQueries`) and the tuple mirror in the lifecycle
+ * driver's two policy hooks — and reaches the write lanes here as
+ * in-process RPCs (Q-OR-1), never through an exported constructor.
+ *
+ * Shape (Q-S5-1). The six command RPCs are pipeline chains, each
+ * `Authorize → ValidateProto → <one domain step>` (steps.ts): the write is
+ * the grant path's, the annotation drives position 1, and the executor's
+ * fault mapping covers a store fault from inside the path. The eight
+ * query RPCs are direct handlers over `authorizeDirect` (the cloud's
+ * shape; the identity-account lookups' precedent). No chain here splices
+ * a tuple step: a policy is the authorization record, not a protected
+ * resource — the cloud builds policies outside any chain, the FGA
+ * `iam_policy` type is dead, and seeding scope links for a row would
+ * recurse (the ts-server guideline records this exception).
+ *
+ * What the cloud's handlers recorded as surprises, kept or corrected:
+ *   - `delete` and `create` are idempotent (absent → the default instance;
+ *     held → the row). `delete` now authorizes BEFORE it loads (Q-OR-2:
+ *     the annotation names the spec's resource), so a caller without
+ *     `can_grant_access` hears PERMISSION_DENIED even for an absent
+ *     triple — strictly safer than the cloud's silent default instance.
+ *   - `create` validates the role BEFORE it writes (the cloud's order): a
+ *     held row under a role the kind does not grant is refused, never
+ *     answered as a duplicate. It also grants to PEOPLE only (Q-S9-2,
+ *     2026-09-14): a principal that is not an identity account is
+ *     INVALID_ARGUMENT — a row naming a resource as its principal is the
+ *     structural link the hierarchy walk follows, `bootstrapPolicy`'s to
+ *     write, and through this lane would have let a right on one
+ *     organization list another's members. The cloud's create had the
+ *     gap; the corrected answer lands at the re-point.
+ *   - `checkMyPermission`, `checkAuthorization` and
+ *     `listAuthorizedResourceIds` skip position 1 by proto option (IAM
+ *     authorizing IAM would recurse); trust is authentication plus the
+ *     principal-trust rule, compared against the caller's ACCOUNT
+ *     (`accountForCaller`, Q-S4-1 — the trusted-local interceptor stamps
+ *     the operator's email, so the stamp alone would never match).
+ *   - `listAuthorizedPrincipalIds` is annotation-driven since slice 1
+ *     (finding 7): the same target `listResourceAccessByPrincipal` checks.
+ *   - `get` is the one load-then-authorize lane: its target is the ROW's
+ *     resource, handed to the annotation's evaluation as an override.
+ *   - the three system RPCs (`bootstrapPolicy`, `cleanupResourcePolicies`,
+ *     `bootstrapRevokeOrgAccess`) admit the platform's own pipelines only
+ *     (`isPlatformPipelineCaller`) and refuse a wire user
+ *     PERMISSION_DENIED with the annotation's own `error_msg`, BEFORE the
+ *     chain — under the permissive Authorizer the annotation alone would
+ *     admit anyone (Q-OR-7). Position 1 still runs the static platform
+ *     check, so the cloud's `can_bootstrap_iam` FGA check is unchanged.
+ *   - every kind string that came off the wire passes the domain's wire
+ *     refusals (Q-S5-2) BEFORE position 1 (Q-S6-1, 2026-09-14):
+ *     INVALID_ARGUMENT with the pinned copy, on every lane, in every
+ *     edition. This is not input validation moved ahead of authorization
+ *     — it is naming the authorization target. A kind string that names
+ *     no kind names nothing to authorize against, so there is no
+ *     position-1 question to ask; `checkMyPermission` refuses an unknown
+ *     permission name first for the same reason, and the cloud's
+ *     handlers kept this order (`kindFromSpecString` before
+ *     `authorizeRpc`), so the wire is unchanged at the re-point. Safe by
+ *     construction: the protovalidate interceptor (chain position 3) has
+ *     validated every request before a handler runs, so both refs are
+ *     present. The resolver's "resolution never throws" rule
+ *     (steps/authorize.ts) is untouched — its unknown-kind deny remains
+ *     the backstop for a stored row on `get`, the one kind string that is
+ *     not wire input.
+ *
+ * `checkMyPermission` has one definition (Q-OR-8; Q-S5-3), in this order:
+ * UNAUTHENTICATED for an empty identity; the relation must be an
+ * IamPermission name; the resource kind must be known; contextual
+ * policies ride the query engine or refuse UNIMPLEMENTED; then (1) a kind
+ * this edition does not serve is `false` — nobody holds a permission on a
+ * kind that does not exist here, which is what keeps the operator-only
+ * settings navigation hidden on open source; (2) `can_grant_access` on a
+ * kind outside the grant scope is `false` — the console's PermissionGate
+ * hides grant controls with no new SDK surface (Q-OR-5); (3) the composed
+ * Authorizer: allow → true, deny and not-found → false, unavailable →
+ * INTERNAL, never softened into a denial.
+ *
+ * Proven by __tests__/controller.test.ts (every arm, over a router
+ * transport with fakes), __tests__/iampolicy.test.ts (the composed
+ * trusted-local server) and the iampolicy conformance suite.
+ */
+import { create } from "@bufbuild/protobuf";
+import { getOption } from "@bufbuild/protobuf";
+import { EmptySchema } from "@bufbuild/protobuf/wkt";
+import { Code, ConnectError } from "@connectrpc/connect";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { config as rpcAuthorizationConfig } from "@stigmer/protos/ai/stigmer/commons/rpc/method_options_pb";
+import { IamPolicyCommandController } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/command_pb";
+import { AuthorizedPrincipalIdsListSchema, AuthorizedResourceIdsListSchema, CheckAuthorizationResultSchema, PrincipalResourceRolesSchema, PrincipalsCountSchema, ResourceAccessByPrincipalListSchema, RevokeOrgAccessInputSchema, } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/io_pb";
+import { IamPolicyQueryController } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/query_pb";
+import { ApiResourceRefSchema, IamPolicySpecSchema, } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { isPlatformPipelineCaller } from "../../extensions/identity.js";
+import { kindByEnumName, kindEnumName, kindServedByEdition, } from "../../pipeline/apiresource-meta.js";
+import { internalError } from "../../pipeline/errors.js";
+import { apiResourceKindKey } from "../../pipeline/interceptors/apiresource.js";
+import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
+import { newPipeline } from "../../pipeline/pipeline.js";
+import { RequestContext } from "../../pipeline/request-context.js";
+import { AUTHORIZATION_UNAVAILABLE_MESSAGE, authorizeDirect, evaluateAuthorizer, newAuthorizeStep, } from "../../pipeline/steps/authorize.js";
+import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
+import { accountForCaller } from "../identityaccount/resolve.js";
+import { buildPrincipalAccessList, resolveHierarchy } from "./access-lists.js";
+import { AUTHENTICATION_REQUIRED_MESSAGE, AUTHORIZATION_QUERIES_UNIMPLEMENTED_MESSAGE, policyNotFoundMessage, unknownPermissionMessage, } from "./constants.js";
+import { newAccountDisplayResolver } from "./display-resolver.js";
+import { permissionByEnumName } from "./permissions.js";
+import { assignableRelations, isAssignableRole, roleInfoFromRelation, } from "./roles.js";
+import { POLICY_RESULT_KEY, newCleanupResourceStep, newGrantStep, newRevokeOrgAccessStep, newRevokeStep, newValidateGrantableRoleStep, } from "./steps.js";
+import { refsOf, requireKnownPrincipalKind, requireKnownResourceKind, requireWellFormedTriple, } from "./wire-refusals.js";
+/**
+ * The Java pre-migration `_self` principal alias — rejected with a
+ * pointer at checkMyPermission (kept only for the precise error copy).
+ */
+const SELF_PRINCIPAL_ID = "_self";
+/** Registers both IamPolicy services on the router (routes stage). */
+export function registerIamPolicyServices(router, deps) {
+    const displayResolver = newAccountDisplayResolver(deps.accounts);
+    const command = IamPolicyCommandController.method;
+    router.service(IamPolicyCommandController, {
+        create: (spec, ctx) => createPolicy(deps, spec, ctx),
+        delete: (spec, ctx) => deletePolicy(deps, spec, ctx),
+        bootstrapPolicy: (spec, ctx) => {
+            guardSystemRpc(command.bootstrapPolicy, callerIdentityOf(ctx));
+            return grantThroughChain(deps, command.bootstrapPolicy, spec, ctx, false);
+        },
+        cleanupResourcePolicies: (ref, ctx) => {
+            guardSystemRpc(command.cleanupResourcePolicies, callerIdentityOf(ctx));
+            return cleanupResourcePolicies(deps, ref, ctx);
+        },
+        revokeOrgAccess: (input, ctx) => revokeOrgAccess(deps, command.revokeOrgAccess, input, ctx),
+        bootstrapRevokeOrgAccess: (input, ctx) => {
+            guardSystemRpc(command.bootstrapRevokeOrgAccess, callerIdentityOf(ctx));
+            return revokeOrgAccess(deps, command.bootstrapRevokeOrgAccess, input, ctx);
+        },
+    });
+    router.service(IamPolicyQueryController, {
+        get: (id, ctx) => get(deps, id, ctx),
+        checkMyPermission: (input, ctx) => checkMyPermission(deps, input, ctx),
+        checkAuthorization: (input, ctx) => checkAuthorization(deps, input, ctx),
+        listAuthorizedResourceIds: (input, ctx) => listAuthorizedResourceIds(deps, input, ctx),
+        listAuthorizedPrincipalIds: (input, ctx) => listAuthorizedPrincipalIds(deps, input, ctx),
+        listResourceAccessByPrincipal: (input, ctx) => listResourceAccessByPrincipal(deps, displayResolver, input, ctx),
+        getPrincipalResourceRoles: (input, ctx) => getPrincipalResourceRoles(deps, input, ctx),
+        getPrincipalsCount: (input, ctx) => getPrincipalsCount(deps, input, ctx),
+    });
+}
+function kindOf(ctx) {
+    return ctx.values.get(apiResourceKindKey);
+}
+/**
+ * The admission rule of the three system RPCs (Q-OR-7): the platform's own
+ * pipelines only, refused with the RPC's own annotation copy — the proto
+ * owns that sentence, so no second pinned copy exists here.
+ */
+function guardSystemRpc(method, caller) {
+    if (isPlatformPipelineCaller(caller)) {
+        return;
+    }
+    throw new ConnectError(getOption(method, rpcAuthorizationConfig).errorMsg, Code.PermissionDenied);
+}
+// ---------------------------------------------------------------------------
+// The command chains
+// ---------------------------------------------------------------------------
+/** `create`: the wire refusal, then Authorize → ValidateProto → ValidateGrantableRole → Grant. */
+function createPolicy(deps, spec, ctx) {
+    requireWellFormedTriple(spec);
+    return grantThroughChain(deps, IamPolicyCommandController.method.create, spec, ctx, true);
+}
+/**
+ * The grant chain both `create` and `bootstrapPolicy` run; only the user
+ * lane validates the role — bootstrap writes structural relations no
+ * scope would admit.
+ */
+async function grantThroughChain(deps, method, spec, ctx, validateRole) {
+    const reqCtx = new RequestContext(IamPolicySpecSchema, spec, callerIdentityOf(ctx), kindOf(ctx));
+    const pipeline = newPipeline(`iampolicy-${method.localName}`, deps.logger)
+        .addStep(newAuthorizeStep(method, deps.authorizer))
+        .addStep(newValidateProtoStep());
+    if (validateRole) {
+        pipeline.addStep(newValidateGrantableRoleStep(deps.grantScope));
+    }
+    await pipeline.addStep(newGrantStep(deps.grantPath)).build().execute(reqCtx);
+    return policyResultOf(reqCtx, method);
+}
+/** `delete`: the wire refusal, then Authorize → ValidateProto → Revoke; the revoked row, or the default instance. */
+async function deletePolicy(deps, spec, ctx) {
+    requireWellFormedTriple(spec);
+    const method = IamPolicyCommandController.method.delete;
+    const reqCtx = new RequestContext(IamPolicySpecSchema, spec, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("iampolicy-delete", deps.logger)
+        .addStep(newAuthorizeStep(method, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newRevokeStep(deps.grantPath))
+        .build()
+        .execute(reqCtx);
+    return policyResultOf(reqCtx, method);
+}
+/** `revokeOrgAccess` and its system twin share one chain; only the annotation differs. */
+async function revokeOrgAccess(deps, method, input, ctx) {
+    const reqCtx = new RequestContext(RevokeOrgAccessInputSchema, input, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline(`iampolicy-${method.localName}`, deps.logger)
+        .addStep(newAuthorizeStep(method, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newRevokeOrgAccessStep(deps.grantPath))
+        .build()
+        .execute(reqCtx);
+    return create(EmptySchema);
+}
+async function cleanupResourcePolicies(deps, ref, ctx) {
+    const method = IamPolicyCommandController.method.cleanupResourcePolicies;
+    const reqCtx = new RequestContext(ApiResourceRefSchema, ref, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("iampolicy-cleanupResourcePolicies", deps.logger)
+        .addStep(newAuthorizeStep(method, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newCleanupResourceStep(deps.grantPath))
+        .build()
+        .execute(reqCtx);
+    return create(EmptySchema);
+}
+function policyResultOf(reqCtx, method) {
+    const result = reqCtx.get(POLICY_RESULT_KEY);
+    if (result === undefined) {
+        throw internalError(new Error(`${method.localName} pipeline completed without a policy`), "policy not found in context");
+    }
+    return result;
+}
+// ---------------------------------------------------------------------------
+// The direct query handlers
+// ---------------------------------------------------------------------------
+/** `get`: load THEN authorize — the target is the row's resource. */
+async function get(deps, id, ctx) {
+    const policy = await read(() => deps.policies.findById(id.value), "failed to load IAM policy");
+    if (policy === undefined) {
+        throw new ConnectError(policyNotFoundMessage(id.value), Code.NotFound);
+    }
+    // A stored row is not wire input: its kind resolves without a refusal
+    // sentence (a legacy row with an unknown kind is the Authorizer's to
+    // deny, as position 1 would), and its id is the target.
+    const { resource } = refsOf(specOfRow(policy));
+    await authorizeDirect(IamPolicyQueryController.method.get, deps.authorizer, callerIdentityOf(ctx), id, { resourceKind: kindByEnumName(resource.kind), resourceId: resource.id });
+    return policy;
+}
+/** The one definition — see the module header for the order and its reasons. */
+async function checkMyPermission(deps, input, ctx) {
+    const caller = requireAuthenticated(callerIdentityOf(ctx));
+    const permission = permissionByEnumName(input.relation);
+    if (permission === undefined) {
+        throw new ConnectError(unknownPermissionMessage(input.relation), Code.InvalidArgument);
+    }
+    const resource = requireRef(input.resource);
+    const resourceKind = requireKnownResourceKind(resource.kind);
+    if (input.contextualPolicies.length > 0) {
+        const engine = requireQueryEngine(deps);
+        const principal = create(ApiResourceRefSchema, {
+            kind: kindEnumName(ApiResourceKind.identity_account),
+            id: await callerPrincipalId(deps, caller),
+        });
+        const policy = create(IamPolicySpecSchema, {
+            principal,
+            relation: input.relation,
+            resource,
+        });
+        const allowed = await engine.check(policy, input.contextualPolicies);
+        return create(CheckAuthorizationResultSchema, { isAuthorized: allowed });
+    }
+    // Arm 1: nobody holds a permission on a kind this edition does not serve.
+    if (!kindServedByEdition(resourceKind, deps.edition)) {
+        return create(CheckAuthorizationResultSchema, { isAuthorized: false });
+    }
+    // Arm 2: a grant target outside the composed scope is nobody's to grant.
+    if (permission === IamPermission.can_grant_access &&
+        deps.grantScope.grantableRoles(resourceKind).length === 0) {
+        return create(CheckAuthorizationResultSchema, { isAuthorized: false });
+    }
+    // Arm 3: the composed Authorizer's answer, an outage never softened.
+    const decision = await evaluateAuthorizer(deps.authorizer, caller, {
+        permission,
+        resourceKind,
+        resourceId: resource.id,
+    });
+    switch (decision.kind) {
+        case "allow":
+            return create(CheckAuthorizationResultSchema, { isAuthorized: true });
+        case "deny":
+        case "not-found":
+            return create(CheckAuthorizationResultSchema, { isAuthorized: false });
+        case "unavailable":
+            throw internalError(decision.cause, AUTHORIZATION_UNAVAILABLE_MESSAGE);
+        default: {
+            const exhaustive = decision;
+            throw internalError(new Error(`unknown decision ${JSON.stringify(exhaustive)}`), AUTHORIZATION_UNAVAILABLE_MESSAGE);
+        }
+    }
+}
+async function checkAuthorization(deps, input, ctx) {
+    const caller = requireAuthenticated(callerIdentityOf(ctx));
+    const policy = requireInputPolicy(input.policy);
+    await enforcePrincipalTrust(deps, caller, policy.principal);
+    requireWellFormedTriple(policy);
+    const engine = requireQueryEngine(deps);
+    const allowed = await engine.check(policy, input.contextualPolicies);
+    return create(CheckAuthorizationResultSchema, { isAuthorized: allowed });
+}
+/** The skip lane with no resource (finding 7): trust on the principal, then the engine. */
+async function listAuthorizedResourceIds(deps, input, ctx) {
+    const caller = requireAuthenticated(callerIdentityOf(ctx));
+    const principal = requireRef(input.principal);
+    await enforcePrincipalTrust(deps, caller, principal);
+    requireKnownPrincipalKind(principal.kind);
+    requireKnownResourceKind(input.resourceKind);
+    const engine = requireQueryEngine(deps);
+    const resourceIds = await engine.listResourceIds(principal, input.relation, input.resourceKind, input.contextualPolicies);
+    return create(AuthorizedResourceIdsListSchema, {
+        resourceIds: [...resourceIds],
+    });
+}
+async function listAuthorizedPrincipalIds(deps, input, ctx) {
+    const resource = requireRef(input.resource);
+    requireKnownResourceKind(resource.kind);
+    requireKnownPrincipalKind(input.principalKind);
+    await authorizeDirect(IamPolicyQueryController.method.listAuthorizedPrincipalIds, deps.authorizer, callerIdentityOf(ctx), input);
+    const engine = requireQueryEngine(deps);
+    const principalIds = await engine.listPrincipalIds(resource, input.relation, input.principalKind, input.contextualPolicies);
+    return create(AuthorizedPrincipalIdsListSchema, {
+        principalIds: [...principalIds],
+    });
+}
+async function listResourceAccessByPrincipal(deps, displayResolver, input, ctx) {
+    const resource = requireRef(input.resource);
+    requireKnownResourceKind(resource.kind);
+    await authorizeDirect(IamPolicyQueryController.method.listResourceAccessByPrincipal, deps.authorizer, callerIdentityOf(ctx), input);
+    const entries = await read(async () => {
+        const hierarchy = await resolveHierarchy(deps.policies, resource.kind, resource.id, input.includeInherited);
+        return buildPrincipalAccessList(deps.policies, displayResolver, hierarchy);
+    }, "failed to list resource access");
+    return create(ResourceAccessByPrincipalListSchema, {
+        entries: [...entries],
+    });
+}
+async function getPrincipalResourceRoles(deps, input, ctx) {
+    const resource = requireRef(input.resource);
+    const principal = requireRef(input.principal);
+    requireKnownResourceKind(resource.kind);
+    requireKnownPrincipalKind(principal.kind);
+    await authorizeDirect(IamPolicyQueryController.method.getPrincipalResourceRoles, deps.authorizer, callerIdentityOf(ctx), input);
+    const rows = await read(() => deps.policies.findByPrincipalAndResource(principal.kind, principal.id, resource.kind, resource.id), "failed to load principal roles");
+    const roles = rows
+        .map((policy) => policy.spec?.relation ?? "")
+        .filter(isAssignableRole)
+        .map(roleInfoFromRelation);
+    return create(PrincipalResourceRolesSchema, { roles });
+}
+async function getPrincipalsCount(deps, input, ctx) {
+    // The wire's "" means any principal kind (the port's `undefined`).
+    const principalKind = input.principalKind === "" ? undefined : input.principalKind;
+    if (principalKind !== undefined) {
+        requireKnownPrincipalKind(principalKind);
+    }
+    await authorizeDirect(IamPolicyQueryController.method.getPrincipalsCount, deps.authorizer, callerIdentityOf(ctx), input);
+    const count = await read(() => deps.policies.countDistinctPrincipalsByResource(kindEnumName(ApiResourceKind.organization), input.orgId, principalKind, assignableRelations()), "failed to count principals");
+    return create(PrincipalsCountSchema, { count });
+}
+// ---------------------------------------------------------------------------
+// Shared rules
+// ---------------------------------------------------------------------------
+/** Java's authenticated-caller precondition on the check handlers. */
+function requireAuthenticated(caller) {
+    if (caller.identityId === "") {
+        throw new ConnectError(AUTHENTICATION_REQUIRED_MESSAGE, Code.Unauthenticated);
+    }
+    return caller;
+}
+/**
+ * The principal the caller IS, for the engine and the trust rule: the
+ * account `accountForCaller` resolves (the trusted-local stamp is an
+ * email; a composition verifier that ran before any row existed stamps
+ * a subject), else the stamped identity — an unprovisioned subject
+ * matches no tuple, which is the cloud's answer for it too.
+ */
+async function callerPrincipalId(deps, caller) {
+    const account = await read(() => accountForCaller(deps.accounts, caller), "failed to resolve the caller's account");
+    return account?.metadata?.id ?? caller.identityId;
+}
+/**
+ * The Java EnforcePrincipalTrust rules in order: the platform's own
+ * pipelines (`machine`, `internal`) may ask about any principal; a user
+ * only about their own account.
+ */
+async function enforcePrincipalTrust(deps, caller, principal) {
+    if (caller.callerClass === "machine" || caller.callerClass === "internal") {
+        return;
+    }
+    if (principal?.kind !== kindEnumName(ApiResourceKind.identity_account)) {
+        throw new ConnectError("Only self identity_account permission checks are supported", Code.InvalidArgument);
+    }
+    const requestedId = principal.id;
+    if (requestedId === "" || requestedId === SELF_PRINCIPAL_ID) {
+        throw new ConnectError(`The '${SELF_PRINCIPAL_ID}' principal alias is not supported — ` +
+            "use checkMyPermission for self permission checks", Code.InvalidArgument);
+    }
+    if (requestedId !== (await callerPrincipalId(deps, caller))) {
+        throw new ConnectError("Principal must be the authenticated caller", Code.PermissionDenied);
+    }
+}
+/** The tuple-half capability, or the edition's UNIMPLEMENTED — never INTERNAL. */
+function requireQueryEngine(deps) {
+    if (deps.queries === undefined) {
+        throw new ConnectError(AUTHORIZATION_QUERIES_UNIMPLEMENTED_MESSAGE, Code.Unimplemented);
+    }
+    return deps.queries;
+}
+/** Boundary-validated required refs — absence here is a contract bug. */
+function requireRef(ref) {
+    if (ref === undefined) {
+        throw internalError(new Error("required reference missing after boundary validation"), "required reference missing after boundary validation");
+    }
+    return ref;
+}
+/** Boundary-validated required policy input — absence here is a contract bug. */
+function requireInputPolicy(policy) {
+    if (policy === undefined) {
+        throw internalError(new Error("required policy missing after boundary validation"), "required policy missing after boundary validation");
+    }
+    return policy;
+}
+/** A stored row's spec — a row without one is corrupt storage, an infrastructure fault. */
+function specOfRow(policy) {
+    if (policy.spec === undefined) {
+        throw internalError(new Error(`policy ${policy.metadata?.id ?? "?"} has no spec — corrupt row`), "failed to load IAM policy");
+    }
+    return policy.spec;
+}
+/** A direct handler's store read: a fault is INTERNAL with a static message, never "not found". */
+async function read(operation, message) {
+    try {
+        return await operation();
+    }
+    catch (error) {
+        throw internalError(error, message);
+    }
+}
+//# sourceMappingURL=controller.js.map

package/dist/domain/iampolicy/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,MAAM,IAAI,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAE5G,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AAapG,OAAO,EACL,gCAAgC,EAChC,+BAA+B,EAC/B,8BAA8B,EAC9B,4BAA4B,EAC5B,qBAAqB,EACrB,mCAAmC,EACnC,0BAA0B,GAC3B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sDAAsD,CAAC;AAKhG,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAM1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAGxE,OAAO,EACL,cAAc,EACd,YAAY,EACZ,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EACL,iCAAiC,EACjC,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EACL,+BAA+B,EAC/B,2CAA2C,EAC3C,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAGlE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,4BAA4B,GAC7B,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,MAAM,EACN,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAoBlC,sEAAsE;AACtE,MAAM,UAAU,yBAAyB,CACvC,MAAqB,EACrB,IAA6B;IAE7B,MAAM,eAAe,GAAG,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC;IAElD,MAAM,CAAC,OAAO,CAAC,0BAA0B,EAAE;QACzC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACpD,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACpD,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC7B,cAAc,CAAC,OAAO,CAAC,eAAe,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC;QACD,uBAAuB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpC,cAAc,CAAC,OAAO,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YACvE,OAAO,uBAAuB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,eAAe,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC9B,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,CAAC;QAC5D,wBAAwB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACvC,cAAc,CAAC,OAAO,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YACxE,OAAO,eAAe,CACpB,IAAI,EACJ,OAAO,CAAC,wBAAwB,EAChC,KAAK,EACL,GAAG,CACJ,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE;QACvC,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,iBAAiB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACtE,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACxE,yBAAyB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxC,yBAAyB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC7C,0BAA0B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACzC,0BAA0B,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC9C,6BAA6B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC5C,6BAA6B,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,CAAC;QAClE,yBAAyB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxC,yBAAyB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC7C,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAkB,EAAE,MAAsB;IAChE,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO;IACT,CAAC;IACD,MAAM,IAAI,YAAY,CACpB,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,QAAQ,EAClD,IAAI,CAAC,gBAAgB,CACtB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,kGAAkG;AAClG,SAAS,YAAY,CACnB,IAA6B,EAC7B,IAAmB,EACnB,GAAmB;IAEnB,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,iBAAiB,CACtB,IAAI,EACJ,0BAA0B,CAAC,MAAM,CAAC,MAAM,EACxC,IAAI,EACJ,GAAG,EACH,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,MAAkB,EAClB,IAAmB,EACnB,GAAmB,EACnB,YAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,mBAAmB,EACnB,IAAI,EACJ,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,CAC1B,aAAa,MAAM,CAAC,SAAS,EAAE,EAC/B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnC,IAAI,YAAY,EAAE,CAAC;QACjB,QAAQ,CAAC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7E,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,qHAAqH;AACrH,KAAK,UAAU,YAAY,CACzB,IAA6B,EAC7B,IAAmB,EACnB,GAAmB;IAEnB,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,mBAAmB,EACnB,IAAI,EACJ,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAA6B,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC;SAC3E,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SACtC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,eAAe,CAC5B,IAA6B,EAC7B,MAAkB,EAClB,KAA2B,EAC3B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,0BAA0B,EAC1B,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,aAAa,MAAM,CAAC,SAAS,EAAE,EAC/B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SAC/C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,IAA6B,EAC7B,GAAmB,EACnB,GAAmB;IAEnB,MAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,uBAAuB,CAAC;IACzE,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,oBAAoB,EACpB,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,mCAAmC,EACnC,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SAC/C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,cAAc,CACrB,MAA4B,EAC5B,MAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,SAAS,sCAAsC,CAAC,EACpE,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,MAAmB,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,qEAAqE;AACrE,KAAK,UAAU,GAAG,CAChB,IAA6B,EAC7B,EAAe,EACf,GAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,EACtC,2BAA2B,CAC5B,CAAC;IACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,qBAAqB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;IACD,sEAAsE;IACtE,qEAAqE;IACrE,wDAAwD;IACxD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,GAAG,EACnC,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,EAAE,EACF,EAAE,YAAY,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CACzE,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,EACxC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE7D,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,CAAC,oBAAoB,EAAE;YAC7C,IAAI,EAAE,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC;YACpD,EAAE,EAAE,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,EAAE;YACzC,SAAS;YACT,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,0EAA0E;IAC1E,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,yEAAyE;IACzE,IACE,UAAU,KAAK,aAAa,CAAC,gBAAgB;QAC7C,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EACzD,CAAC;QACD,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,qEAAqE;IACrE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE;QACjE,UAAU;QACV,YAAY;QACZ,UAAU,EAAE,QAAQ,CAAC,EAAE;KACxB,CAAC,CAAC;IACH,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,KAAK,aAAa;YAChB,MAAM,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAC3D,iCAAiC,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAA6B,EAC7B,KAA8B,EAC9B,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,yBAAyB,CACtC,IAA6B,EAC7B,KAAqC,EACrC,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACrD,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,eAAe,CAC9C,SAAS,EACT,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,OAAO,MAAM,CAAC,+BAA+B,EAAE;QAC7C,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,IAA6B,EAC7B,KAAsC,EACtC,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,yBAAyB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,0BAA0B,EAC1D,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAChD,QAAQ,EACR,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,OAAO,MAAM,CAAC,gCAAgC,EAAE;QAC9C,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,IAA6B,EAC7B,eAA6D,EAC7D,KAA8B,EAC9B,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,6BAA6B,EAC7D,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,IAAI,EAAE;QACpC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CACtC,IAAI,CAAC,QAAQ,EACb,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,EACX,KAAK,CAAC,gBAAgB,CACvB,CAAC;QACF,OAAO,wBAAwB,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;IAC7E,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,mCAAmC,EAAE;QACjD,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;KACtB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,IAA6B,EAC7B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,yBAAyB,EACzD,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,IAAI,CACrB,GAAG,EAAE,CACH,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CACtC,SAAS,CAAC,IAAI,EACd,SAAS,CAAC,EAAE,EACZ,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,CACZ,EACH,gCAAgC,CACjC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI;SACf,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;SAC5C,MAAM,CAAC,gBAAgB,CAAC;SACxB,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAA6B,EAC7B,KAA8B,EAC9B,GAAmB;IAEnB,mEAAmE;IACnE,MAAM,aAAa,GACjB,KAAK,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAC/D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,yBAAyB,CAAC,aAAa,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,kBAAkB,EAClD,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,GAAG,EAAE,CACH,IAAI,CAAC,QAAQ,CAAC,iCAAiC,CAC7C,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,EAC1C,KAAK,CAAC,KAAK,EACX,aAAa,EACb,mBAAmB,EAAE,CACtB,EACH,4BAA4B,CAC7B,CAAC;IACF,OAAO,MAAM,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,sEAAsE;AACtE,SAAS,oBAAoB,CAAC,MAAsB;IAClD,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,+BAA+B,EAC/B,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,MAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,IAAI,CACxB,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAC7C,wCAAwC,CACzC,CAAC;IACF,OAAO,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAClC,IAA6B,EAC7B,MAAsB,EACtB,SAAqC;IAErC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC1E,OAAO;IACT,CAAC;IACD,IAAI,SAAS,EAAE,IAAI,KAAK,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,YAAY,CACpB,4DAA4D,EAC5D,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,SAAS,CAAC,EAAE,CAAC;IACjC,IAAI,WAAW,KAAK,EAAE,IAAI,WAAW,KAAK,iBAAiB,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CACpB,QAAQ,iBAAiB,uCAAuC;YAC9D,kDAAkD,EACpD,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,KAAK,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CACpB,4CAA4C,EAC5C,IAAI,CAAC,gBAAgB,CACtB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,kBAAkB,CACzB,IAA6B;IAE7B,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CACpB,2CAA2C,EAC3C,IAAI,CAAC,aAAa,CACnB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,GAA+B;IACjD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,sDAAsD,CAAC,EACjE,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,MAAiC;IAC3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,mDAAmD,CAAC,EAC9D,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2FAA2F;AAC3F,SAAS,SAAS,CAAC,MAAiB;IAClC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,UAAU,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,GAAG,4BAA4B,CACjE,EACD,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,mGAAmG;AACnG,KAAK,UAAU,IAAI,CACjB,SAA2B,EAC3B,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}

package/dist/domain/iampolicy/display-resolver.d.ts

@@ -0,0 +1,6 @@
+import type { IdentityAccountStore } from "../identityaccount/store.js";
+import type { PrincipalDisplayResolver } from "./access-lists.js";
+/** The one read enrichment needs from the identity-account port. */
+export type AccountsByIds = Pick<IdentityAccountStore, "findByIds">;
+export declare function newAccountDisplayResolver(accounts: AccountsByIds): PrincipalDisplayResolver;
+//# sourceMappingURL=display-resolver.d.ts.map

package/dist/domain/iampolicy/display-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"display-resolver.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/display-resolver.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAKlE,oEAAoE;AACpE,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;AAEpE,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,aAAa,GACtB,wBAAwB,CAc1B"}

package/dist/domain/iampolicy/display-resolver.js

@@ -0,0 +1,90 @@
+/**
+ * The access-list display resolver (20260913.01 slice 5; Q-S5-4, Q-S5-8):
+ * the account half of the Java PrincipalEnricher — batch-loads identity
+ * accounts through the identity-account domain's PORT (`findByIds`, one
+ * row per distinct id, the port's own line) and renders the
+ * ApiResourceRefView shape access listings carry: display name, email,
+ * avatar, identity origin. Moved from the cloud's iam/account/
+ * display-resolver.ts; built by the IamPolicy controller over the accounts
+ * port it already holds, never composed as a seam — the data is a domain
+ * READ, the same in every edition.
+ *
+ * The display-name precedence is `first + last > first > last >
+ * metadata.name > email`. The `metadata.name` arm is this domain's one
+ * deliberate divergence from the Java code (Q-S5-4): the trusted-local
+ * operator account carries its display name THERE and empty first/last
+ * names (identityaccount/operator.ts), while the cloud names every
+ * provisioned account by its EMAIL and fills first/last from userinfo
+ * (identityaccount/provisioning.ts; the DefaultAccountName step) — so on
+ * the cloud this arm and the email arm answer the same string, and on a
+ * laptop the Members row reads the name the operator configured instead
+ * of an address. `email` stays as the last resort for a row whose name
+ * was never defaulted.
+ *
+ * The federated provider label stays empty (the cloud's 3C provider
+ * display-name lookup never landed in the shared shape); direct and
+ * machine accounts carry the "Stigmer" label, the Java constant.
+ */
+import { create } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
+import { ApiResourceRefViewSchema, IdentityOriginSchema, } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/io_pb";
+import { kindEnumName } from "../../pipeline/apiresource-meta.js";
+/** The Java STIGMER_PROVIDER_LABEL constant. */
+const STIGMER_PROVIDER_LABEL = "Stigmer";
+export function newAccountDisplayResolver(accounts) {
+    return {
+        async resolveIdentityAccounts(ids) {
+            const rows = await accounts.findByIds(ids);
+            const resolved = new Map();
+            for (const account of rows) {
+                const id = account.metadata?.id ?? "";
+                resolved.set(id, viewOf(id, account));
+            }
+            return resolved;
+        },
+    };
+}
+function viewOf(id, account) {
+    const spec = account.spec;
+    return create(ApiResourceRefViewSchema, {
+        kind: kindEnumName(ApiResourceKind.identity_account),
+        id,
+        name: displayNameOf(spec?.firstName ?? "", spec?.lastName ?? "", account.metadata?.name ?? "", spec?.email ?? ""),
+        email: spec?.email ?? "",
+        avatar: spec?.pictureUrl ?? "",
+        identityOrigin: create(IdentityOriginSchema, {
+            provisioningMode: spec?.provisioningMode ??
+                IdentityAccountProvisioningMode.identity_account_provisioning_mode_unspecified,
+            providerDisplayName: providerLabelOf(spec?.provisioningMode),
+        }),
+    });
+}
+/** The Java buildDisplayName precedence, with the account's own name before the email (Q-S5-4). */
+function displayNameOf(firstName, lastName, accountName, email) {
+    if (firstName !== "" && lastName !== "") {
+        return `${firstName} ${lastName}`;
+    }
+    if (firstName !== "") {
+        return firstName;
+    }
+    if (lastName !== "") {
+        return lastName;
+    }
+    if (accountName !== "") {
+        return accountName;
+    }
+    return email;
+}
+function providerLabelOf(mode) {
+    switch (mode) {
+        case IdentityAccountProvisioningMode.direct:
+        case IdentityAccountProvisioningMode.machine:
+            return STIGMER_PROVIDER_LABEL;
+        default:
+            // federated / platform_client / unspecified carry no external
+            // provider label (the Java switch arms).
+            return "";
+    }
+}
+//# sourceMappingURL=display-resolver.js.map

package/dist/domain/iampolicy/display-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"display-resolver.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/display-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAE5G,OAAO,EACL,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,mDAAmD,CAAC;AAE3D,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAIlE,gDAAgD;AAChD,MAAM,sBAAsB,GAAG,SAAS,CAAC;AAKzC,MAAM,UAAU,yBAAyB,CACvC,QAAuB;IAEvB,OAAO;QACL,KAAK,CAAC,uBAAuB,CAC3B,GAAG;YAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;YACvD,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;gBACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,EAAU,EAAE,OAAwB;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,OAAO,MAAM,CAAC,wBAAwB,EAAE;QACtC,IAAI,EAAE,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC;QACpD,EAAE;QACF,IAAI,EAAE,aAAa,CACjB,IAAI,EAAE,SAAS,IAAI,EAAE,EACrB,IAAI,EAAE,QAAQ,IAAI,EAAE,EACpB,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,EAC5B,IAAI,EAAE,KAAK,IAAI,EAAE,CAClB;QACD,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE;QACxB,MAAM,EAAE,IAAI,EAAE,UAAU,IAAI,EAAE;QAC9B,cAAc,EAAE,MAAM,CAAC,oBAAoB,EAAE;YAC3C,gBAAgB,EACd,IAAI,EAAE,gBAAgB;gBACtB,+BAA+B,CAAC,8CAA8C;YAChF,mBAAmB,EAAE,eAAe,CAAC,IAAI,EAAE,gBAAgB,CAAC;SAC7D,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,SAAS,aAAa,CACpB,SAAiB,EACjB,QAAgB,EAChB,WAAmB,EACnB,KAAa;IAEb,IAAI,SAAS,KAAK,EAAE,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACxC,OAAO,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QACvB,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CACtB,IAAiD;IAEjD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,+BAA+B,CAAC,MAAM,CAAC;QAC5C,KAAK,+BAA+B,CAAC,OAAO;YAC1C,OAAO,sBAAsB,CAAC;QAChC;YACE,8DAA8D;YAC9D,yCAAyC;YACzC,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/domain/iampolicy/grant-path.d.ts

@@ -0,0 +1,42 @@
+import type { IamPolicy } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
+import type { ApiResourceRef, IamPolicySpec } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
+import type { Logger } from "../../boot/logger.js";
+import type { CallerIdentity } from "../../extensions/identity.js";
+import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
+import type { IamPolicyStore } from "./store.js";
+export interface GrantResult {
+    readonly policy: IamPolicy;
+    /** True when the triple was already held: no row was written, the hook still fired. */
+    readonly duplicate: boolean;
+}
+export interface IamPolicyGrantPath {
+    /**
+     * Grant the triple as `caller`: gate, find by triple, write the row when
+     * absent (the caller's audit stamp), then `onPolicyGranted` — on the
+     * duplicate arm too. A hook throw fails the grant with the row in place.
+     */
+    grant(spec: IamPolicySpec, caller: CallerIdentity): Promise<GrantResult>;
+    /**
+     * Revoke the triple: gate, find by triple, `onPolicyRevoked` (with the
+     * row, or with the spec alone on the absent arm), then delete the row.
+     * A hook throw leaves row and tuple. Answers the revoked row, or
+     * `undefined` when there was none.
+     */
+    revokeBySpec(spec: IamPolicySpec): Promise<IamPolicy | undefined>;
+    /**
+     * Revoke every row naming the ref as its resource, then every row naming
+     * it as its principal, each through the revoke order; a row that is both
+     * is revoked once. Nothing to clean is a no-op.
+     */
+    cleanupResource(ref: ApiResourceRef): Promise<void>;
+    /** Revoke every relation the account holds directly on the organization. */
+    revokeOrgAccess(identityAccountId: string, organizationId: string): Promise<void>;
+}
+export interface IamPolicyGrantPathDeps {
+    readonly policies: IamPolicyStore;
+    /** The composed driver, if any; a driver without the two policy hooks is the same as none. */
+    readonly lifecycle: ResourceAuthorizationLifecycle | undefined;
+    readonly logger: Logger;
+}
+export declare function newIamPolicyGrantPath(deps: IamPolicyGrantPathDeps): IamPolicyGrantPath;
+//# sourceMappingURL=grant-path.d.ts.map

package/dist/domain/iampolicy/grant-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-path.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/grant-path.ts"],"names":[],"mappings":"AA2DA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oDAAoD,CAAC;AAEpF,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACd,MAAM,qDAAqD,CAAC;AAE7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AASjG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAGjD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,uFAAuF;IACvF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACzE;;;;;OAKG;IACH,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IAClE;;;;OAIG;IACH,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,4EAA4E;IAC5E,eAAe,CACb,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,8FAA8F;IAC9F,QAAQ,CAAC,SAAS,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,sBAAsB,GAC3B,kBAAkB,CA4GpB"}