@stigmer/server 3.15.2 → 3.15.3-dev.20260914100347

package/dist/domain/iampolicy/resource-store.js

@@ -0,0 +1,135 @@
+/**
+ * The open-source IamPolicyStore: the port (store.ts) over the generic
+ * Store, rows of the `resources` table by kind (20260913.01, T01_0_plan.md
+ * §3a, §4). The composition root installs it when no extension registers
+ * `drivers.iamPolicyStore`.
+ *
+ * Reads. `findById` is a PRIMARY-KEY read. Every other find decodes
+ * `listResources(iam_policy)` and filters in memory: the `resources` table
+ * has no secondary index and `findByField` is single-hit, so a scan is the
+ * honest shape, and the row count is members × organizations on a
+ * self-host — measured in the entry's execution record (§4), not assumed.
+ * The filters are the cloud store's WHERE clauses restated over the proto
+ * (store.ts names each), so a driver's test over either edition reads the
+ * same contract.
+ *
+ * Writes. `save` refuses a policy whose id is not its triple's derived id
+ * (constants.ts policyIdFor): open source has no legacy random ids, and a
+ * stray id would break the primary key's promise of one row per triple.
+ * It is then read-then-write refusing a held id with DuplicatePolicyError,
+ * because the generic Store's saveResource is an upsert with no
+ * create-only form — the 2a adapter's shape and its recorded residual
+ * window (two concurrent saves of one triple may both fulfil; the primary
+ * key still guarantees ONE row, which is the invariant that matters, and
+ * the grant path treats a same-triple winner as the duplicate arm either
+ * way). Conditional store writes are a platform-wide follow-up, not this
+ * adapter's to invent.
+ *
+ * Store faults follow the ratified mapping (domain/apikey/lookup.ts): a
+ * typed ResourceNotFoundError reads as `undefined`; anything else
+ * propagates — an outage must never read as "no grant".
+ *
+ * The port's contract is proven by store-contract.ts, run over this
+ * adapter on both drivers in __tests__/resource-store.test.ts, which also
+ * pins the derived-id refusal that is this adapter's own.
+ */
+import { fromBinary } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
+import { kindEnumName } from "../../pipeline/apiresource-meta.js";
+import { ResourceNotFoundError } from "../../store/interface.js";
+import { USER_GRANT_PRINCIPAL_KINDS, policyIdFor } from "./constants.js";
+import { DuplicatePolicyError } from "./store.js";
+const KIND = ApiResourceKind.iam_policy;
+/**
+ * The cloud SQL's scope-tuple exclusions (store.ts): a scope tuple is a
+ * row whose principal is a RESOURCE and whose relation is structural. The
+ * principal half is derived from the user lane's grantee vocabulary
+ * (constants.ts USER_GRANT_PRINCIPAL_KINDS; Q-S9-2) so the writer's "who a
+ * person may grant to" and the reader's "what is a person, not a parent"
+ * are one definition; `team` stays for the cloud's Java-era rows (not an
+ * ApiResourceKind, so no wire spec names it).
+ */
+const NON_STRUCTURAL_PRINCIPAL_KINDS = [
+    ...USER_GRANT_PRINCIPAL_KINDS.map((kind) => kindEnumName(kind)),
+    "team",
+];
+const NON_STRUCTURAL_RELATIONS = ["owner", "creator"];
+export function newResourceIamPolicyStore(store) {
+    async function readById(id) {
+        try {
+            return await store.getResource(KIND, id, IamPolicySchema);
+        }
+        catch (error) {
+            if (error instanceof ResourceNotFoundError) {
+                return undefined;
+            }
+            throw error;
+        }
+    }
+    /** Every row of the kind, decoded — the scan behind every non-id read. */
+    async function all() {
+        const rows = await store.listResources(KIND);
+        return rows.map((bytes) => fromBinary(IamPolicySchema, bytes));
+    }
+    async function where(predicate) {
+        return (await all()).filter(predicate);
+    }
+    return {
+        async save(policy) {
+            const id = policy.metadata?.id ?? "";
+            if (policy.spec === undefined || id !== policyIdFor(policy.spec)) {
+                throw new Error("policy id must be derived from its triple");
+            }
+            if ((await readById(id)) !== undefined) {
+                throw new DuplicatePolicyError(`IAM policy '${id}' already exists`);
+            }
+            await store.saveResource(KIND, id, IamPolicySchema, policy);
+        },
+        async deleteById(id) {
+            await store.deleteResource(KIND, id);
+        },
+        findById: readById,
+        findByPrincipal(principalKind, principalId) {
+            return where((policy) => onPrincipal(policy, principalKind, principalId));
+        },
+        findByResource(resourceKind, resourceId) {
+            return where((policy) => onResource(policy, resourceKind, resourceId));
+        },
+        findByPrincipalAndResource(principalKind, principalId, resourceKind, resourceId) {
+            return where((policy) => onPrincipal(policy, principalKind, principalId) &&
+                onResource(policy, resourceKind, resourceId));
+        },
+        findByResourceWithRelations(resourceKind, resourceId, relations) {
+            return where((policy) => onResource(policy, resourceKind, resourceId) &&
+                relations.includes(relationOf(policy)));
+        },
+        async countDistinctPrincipalsByResource(resourceKind, resourceId, principalKind, relations) {
+            const principals = new Set();
+            for (const policy of await all()) {
+                if (onResource(policy, resourceKind, resourceId) &&
+                    relations.includes(relationOf(policy)) &&
+                    (principalKind === undefined ||
+                        policy.spec?.principal?.kind === principalKind)) {
+                    principals.add(`${policy.spec?.principal?.kind ?? ""}:${policy.spec?.principal?.id ?? ""}`);
+                }
+            }
+            return principals.size;
+        },
+        async findScopeTuple(resourceKind, resourceId) {
+            return (await all()).find((policy) => onResource(policy, resourceKind, resourceId) &&
+                !NON_STRUCTURAL_PRINCIPAL_KINDS.includes(policy.spec?.principal?.kind ?? "") &&
+                !NON_STRUCTURAL_RELATIONS.includes(relationOf(policy)));
+        },
+    };
+}
+function onPrincipal(policy, kind, id) {
+    return (policy.spec?.principal?.kind === kind && policy.spec?.principal?.id === id);
+}
+function onResource(policy, kind, id) {
+    return (policy.spec?.resource?.kind === kind && policy.spec?.resource?.id === id);
+}
+function relationOf(policy) {
+    return policy.spec?.relation ?? "";
+}
+//# sourceMappingURL=resource-store.js.map

package/dist/domain/iampolicy/resource-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-store.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/resource-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAErF,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAGlD,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC;AAExC;;;;;;;;GAQG;AACH,MAAM,8BAA8B,GAA0B;IAC5D,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM;CACP,CAAC;AACF,MAAM,wBAAwB,GAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAE7E,MAAM,UAAU,yBAAyB,CAAC,KAAY;IACpD,KAAK,UAAU,QAAQ,CAAC,EAAU;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,KAAK,UAAU,GAAG;QAChB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,UAAU,KAAK,CAClB,SAAyC;QAEzC,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YACrC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,KAAK,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,oBAAoB,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE;YACjB,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC;QAED,QAAQ,EAAE,QAAQ;QAElB,eAAe,CAAC,aAAa,EAAE,WAAW;YACxC,OAAO,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;QAC5E,CAAC;QAED,cAAc,CAAC,YAAY,EAAE,UAAU;YACrC,OAAO,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;QACzE,CAAC;QAED,0BAA0B,CACxB,aAAa,EACb,WAAW,EACX,YAAY,EACZ,UAAU;YAEV,OAAO,KAAK,CACV,CAAC,MAAM,EAAE,EAAE,CACT,WAAW,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC;gBAC/C,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAC/C,CAAC;QACJ,CAAC;QAED,2BAA2B,CAAC,YAAY,EAAE,UAAU,EAAE,SAAS;YAC7D,OAAO,KAAK,CACV,CAAC,MAAM,EAAE,EAAE,CACT,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC;gBAC5C,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CACzC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,iCAAiC,CACrC,YAAY,EACZ,UAAU,EACV,aAAa,EACb,SAAS;YAET,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;YACrC,KAAK,MAAM,MAAM,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;gBACjC,IACE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC;oBAC5C,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;oBACtC,CAAC,aAAa,KAAK,SAAS;wBAC1B,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,aAAa,CAAC,EACjD,CAAC;oBACD,UAAU,CAAC,GAAG,CACZ,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,CAC5E,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,UAAU,CAAC,IAAI,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,YAAY,EAAE,UAAU;YAC3C,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,IAAI,CACvB,CAAC,MAAM,EAAE,EAAE,CACT,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC;gBAC5C,CAAC,8BAA8B,CAAC,QAAQ,CACtC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CACnC;gBACD,CAAC,wBAAwB,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CACzD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAiB,EAAE,IAAY,EAAE,EAAU;IAC9D,OAAO,CACL,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAiB,EAAE,IAAY,EAAE,EAAU;IAC7D,OAAO,CACL,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,CACzE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAiB;IACnC,OAAO,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACrC,CAAC"}

package/dist/domain/iampolicy/role-lifecycle.d.ts

@@ -0,0 +1,9 @@
+import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
+import type { AccountsByCaller } from "../identityaccount/resolve.js";
+import type { IamPolicyGrantPath } from "./grant-path.js";
+export interface BuiltInRoleLifecycleDeps {
+    readonly grantPath: IamPolicyGrantPath;
+    readonly accounts: AccountsByCaller;
+}
+export declare function newBuiltInRoleLifecycle(deps: BuiltInRoleLifecycleDeps): ResourceAuthorizationLifecycle;
+//# sourceMappingURL=role-lifecycle.d.ts.map

package/dist/domain/iampolicy/role-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-lifecycle.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/role-lifecycle.ts"],"names":[],"mappings":"AAoEA,OAAO,KAAK,EACV,8BAA8B,EAG/B,MAAM,4CAA4C,CAAC;AAGpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAG1D,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;CACrC;AAQD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,wBAAwB,GAC7B,8BAA8B,CAuChC"}

package/dist/domain/iampolicy/role-lifecycle.js

@@ -0,0 +1,106 @@
+/**
+ * The built-in role lifecycle (20260913.01, T01_0_plan.md §3a; T01_1_review.md
+ * Q-OR-6a): the ResourceAuthorizationLifecycle open source installs when
+ * no unit registers one, under the built-in authorization posture
+ * (boot/compose.ts `builtInAuthorization`). It is the ROW writer of that
+ * posture at the resource lifecycle points — the one arm that makes an
+ * organization's creator its owner without an administrator — and nothing
+ * more. The cloud's tuple driver plays the same part for tuples; a
+ * composition that registers one never sees this object.
+ *
+ * It is handed to the ORGANIZATION and IDENTITY-ACCOUNT controllers only
+ * (slice 4 ruling Q-S4-8), the two kinds whose events it reads. A
+ * lifecycle on a controller turns on the tuple steps' full event
+ * resolution for that kind, and resolution fails a request whose
+ * configured parent id is missing — Java parity the cloud relies on, and
+ * a state open source admits by contract for other kinds (a memory
+ * captured with no credential has no subject). Every other controller
+ * keeps the composed driver (undefined in open source) and its steps
+ * no-op before any resolution, byte-identical to before this entry.
+ *
+ * What it writes:
+ *   - `organization` created with DIRECT attribution (the kind's
+ *     owner_type in kind_meta — the event says so; the driver follows it
+ *     exactly as the cloud's does) by a `user`-class caller that RESOLVES
+ *     to an account: one `owner` row for that account. Only `organization`,
+ *     because that row is what the Members page and entry 3's admin rule
+ *     read; an owner row on an agent would be the per-resource grant the
+ *     grant scope keeps Enterprise (Q-OR-3).
+ *   - `organization` and `identity_account` deleted: every row naming the
+ *     resource on either side goes, through the grant path's bidirectional
+ *     cleanup — the delete chains' CleanupIamPolicies step calls this, so
+ *     the rows die with the resource.
+ *
+ * Who the row is FOR, and who it says wrote it. The event's caller is the
+ * position-1 identity, which is an account id only when a verifier
+ * resolved it: under the trusted-local posture it is the operator's
+ * EMAIL (or "system"), and a composition verifier may stamp a raw
+ * subject. `accountForCaller` (domain/identityaccount/resolve.ts) is the
+ * domain's one statement of "the caller's account" — the two reads
+ * whoAmI makes — so this object and whoAmI cannot disagree (Q-S4-1). The
+ * row is then granted AS the account (`identityId` re-stamped, the
+ * `provisionMyAccount` idiom), so every policy row's `created_by.id` is
+ * an account id — never an email, never an idp subject. A caller that
+ * resolves to no account (an idp-shaped subject before provisioning)
+ * writes nothing: the membership rules heal a real person's ownership at
+ * first provisioning through the organization's creator stamp
+ * (membership.ts, Q-OR-6b), so the guard loses nobody. Non-`user` classes
+ * (`internal`, `runner`, a composition's own) write nothing by rule — the
+ * roles are people's (Q-OR-6b), and under trusted-local a daemon-origin
+ * caller carries the operator's fields and would otherwise resolve.
+ *
+ * Acyclic by construction: this object sits ON TOP of the grant path and
+ * defines neither policy hook. The grant path's own lifecycle is the
+ * composed driver (undefined in open source), never this object (S1
+ * finding B); the test pins both facts.
+ *
+ * Faults propagate. The create arm's throw fails the organization create
+ * (the step maps it INTERNAL; the row survives, a retry converges through
+ * the grant path's duplicate arm); the delete arm's throw is logged and
+ * the delete succeeds (the step's best-effort contract).
+ */
+import { create } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { OwnerAttributionType } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
+import { ApiResourceRefSchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { kindEnumName } from "../../pipeline/apiresource-meta.js";
+import { accountForCaller } from "../identityaccount/resolve.js";
+import { organizationRole } from "./specs.js";
+/** The kinds whose rows die with the resource — the two sides an organization role names. */
+const CLEANUP_KINDS = new Set([
+    ApiResourceKind.organization,
+    ApiResourceKind.identity_account,
+]);
+export function newBuiltInRoleLifecycle(deps) {
+    const { grantPath, accounts } = deps;
+    return {
+        async onResourceCreated(event) {
+            if (event.kind !== ApiResourceKind.organization ||
+                event.ownerAttribution !== OwnerAttributionType.DIRECT ||
+                event.caller.callerClass !== "user") {
+                return;
+            }
+            const account = await accountForCaller(accounts, event.caller);
+            const accountId = account?.metadata?.id ?? "";
+            if (accountId === "") {
+                return;
+            }
+            await grantPath.grant(organizationRole(accountId, IamRole.owner, event.resourceId), { ...event.caller, identityId: accountId });
+        },
+        async onResourceDeleted(event) {
+            if (!CLEANUP_KINDS.has(event.kind)) {
+                return;
+            }
+            await grantPath.cleanupResource(create(ApiResourceRefSchema, {
+                kind: kindEnumName(event.kind),
+                id: event.resourceId,
+            }));
+        },
+        async onVisibilityChanged() {
+            // Visibility is a tuple concern (org-viewer, public-viewer shapes);
+            // open source's rows record roles, not visibility.
+        },
+    };
+}
+//# sourceMappingURL=role-lifecycle.js.map

package/dist/domain/iampolicy/role-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-lifecycle.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/role-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,oBAAoB,EAAE,MAAM,wFAAwF,CAAC;AAC9H,OAAO,EAAE,oBAAoB,EAAE,MAAM,qDAAqD,CAAC;AAC3F,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAOpE,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAGjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAO9C,6FAA6F;AAC7F,MAAM,aAAa,GAAiC,IAAI,GAAG,CAAC;IAC1D,eAAe,CAAC,YAAY;IAC5B,eAAe,CAAC,gBAAgB;CACjC,CAAC,CAAC;AAEH,MAAM,UAAU,uBAAuB,CACrC,IAA8B;IAE9B,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACrC,OAAO;QACL,KAAK,CAAC,iBAAiB,CAAC,KAA2B;YACjD,IACE,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC,YAAY;gBAC3C,KAAK,CAAC,gBAAgB,KAAK,oBAAoB,CAAC,MAAM;gBACtD,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,MAAM,EACnC,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/D,MAAM,SAAS,GAAG,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,SAAS,CAAC,KAAK,CACnB,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,EAC5D,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAC3C,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,KAA2B;YACjD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,OAAO;YACT,CAAC;YACD,MAAM,SAAS,CAAC,eAAe,CAC7B,MAAM,CAAC,oBAAoB,EAAE;gBAC3B,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC9B,EAAE,EAAE,KAAK,CAAC,UAAU;aACrB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,mBAAmB;YACvB,oEAAoE;YACpE,mDAAmD;QACrD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/iampolicy/roles.d.ts

@@ -0,0 +1,11 @@
+import type { RoleInfo } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/io_pb";
+/** The allowlist for access-listing queries (Java assignableRelations). */
+export declare function assignableRelations(): ReadonlyArray<string>;
+/** True when the relation names an assignable IAM role, never structural. */
+export declare function isAssignableRole(relation: string): boolean;
+/**
+ * Relation string → RoleInfo with display metadata; the default instance
+ * for unknown relations (the Java fromRelationString contract).
+ */
+export declare function roleInfoFromRelation(relation: string): RoleInfo;
+//# sourceMappingURL=roles.d.ts.map

package/dist/domain/iampolicy/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/roles.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mDAAmD,CAAC;AAgDlF,2EAA2E;AAC3E,wBAAgB,mBAAmB,IAAI,aAAa,CAAC,MAAM,CAAC,CAE3D;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAY/D"}

package/dist/domain/iampolicy/roles.js

@@ -0,0 +1,78 @@
+/**
+ * IAM role metadata (20260913.01 slice 5): display metadata for the five
+ * assignable roles and the assignable-relation allowlist that keeps
+ * structural relations (parent links, runtime grants, observability
+ * usersets) out of every access listing BY CONSTRUCTION — reads filter to
+ * this set rather than maintaining a denylist a new structural relation
+ * could slip past. Moved as-is from the cloud's iam/policy/roles.ts, itself
+ * the port of Java's apishape/authorization/IamRoleMetadata; the cloud's
+ * `grantableRolesFor` did not come along — it lives in
+ * pipeline/apiresource-meta.ts as the contract's one read of
+ * `kind_meta.grantable_roles`, and the cloud registers its own reading of
+ * it as the `policyGrantScope` driver.
+ *
+ * The four words this table renders for an organization are the four
+ * roles every edition grants there (Q-OR-4) and the ladder entry 3's
+ * authorizer enforces; the copy is shown verbatim by the console's role
+ * badges and selector, so it is contract.
+ */
+import { create } from "@bufbuild/protobuf";
+import { RoleInfoSchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/io_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+const ROLE_DISPLAY = [
+    {
+        role: IamRole.owner,
+        name: "Owner",
+        description: "Full control of the resource including ownership transfer",
+    },
+    {
+        role: IamRole.admin,
+        name: "Administrator",
+        description: "Administrative access with most permissions except ownership transfer",
+    },
+    {
+        role: IamRole.member,
+        name: "Member",
+        description: "Read and limited write access to the resource",
+    },
+    {
+        role: IamRole.viewer,
+        name: "Viewer",
+        description: "Read-only access to the resource",
+    },
+    // Grantable on agent_channel only (channel-conversations DD-010);
+    // omitting it would let the grant succeed while hiding the participant
+    // from every access listing (the Java IamRoleMetadataTest lesson).
+    {
+        role: IamRole.participant,
+        name: "Participant",
+        description: "Reply to customers and manage conversation takeover on a channel",
+    },
+];
+const RELATION_TO_DISPLAY = new Map(ROLE_DISPLAY.map((entry) => [IamRole[entry.role], entry]));
+/** The allowlist for access-listing queries (Java assignableRelations). */
+export function assignableRelations() {
+    return [...RELATION_TO_DISPLAY.keys()];
+}
+/** True when the relation names an assignable IAM role, never structural. */
+export function isAssignableRole(relation) {
+    return RELATION_TO_DISPLAY.has(relation);
+}
+/**
+ * Relation string → RoleInfo with display metadata; the default instance
+ * for unknown relations (the Java fromRelationString contract).
+ */
+export function roleInfoFromRelation(relation) {
+    const display = RELATION_TO_DISPLAY.get(relation);
+    if (display === undefined) {
+        return create(RoleInfoSchema);
+    }
+    const code = IamRole[display.role];
+    return create(RoleInfoSchema, {
+        id: code,
+        code,
+        name: display.name,
+        description: display.description,
+    });
+}
+//# sourceMappingURL=roles.js.map

package/dist/domain/iampolicy/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG5C,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AASpE,MAAM,YAAY,GAA+B;IAC/C;QACE,IAAI,EAAE,OAAO,CAAC,KAAK;QACnB,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,2DAA2D;KACzE;IACD;QACE,IAAI,EAAE,OAAO,CAAC,KAAK;QACnB,IAAI,EAAE,eAAe;QACrB,WAAW,EACT,uEAAuE;KAC1E;IACD;QACE,IAAI,EAAE,OAAO,CAAC,MAAM;QACpB,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,IAAI,EAAE,OAAO,CAAC,MAAM;QACpB,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,kCAAkC;KAChD;IACD,kEAAkE;IAClE,uEAAuE;IACvE,mEAAmE;IACnE;QACE,IAAI,EAAE,OAAO,CAAC,WAAW;QACzB,IAAI,EAAE,aAAa;QACnB,WAAW,EACT,kEAAkE;KACrE;CACF,CAAC;AAEF,MAAM,mBAAmB,GAAqC,IAAI,GAAG,CACnE,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAC1D,CAAC;AAEF,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB;IACjC,OAAO,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,cAAc,EAAE;QAC5B,EAAE,EAAE,IAAI;QACR,IAAI;QACJ,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;AACL,CAAC"}

package/dist/domain/iampolicy/specs.d.ts

@@ -0,0 +1,7 @@
+import type { IamPolicySpec } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+/** The relation string a role grants — the enum member's own name. */
+export declare function relationOf(role: IamRole): string;
+/** `identity_account:<accountId>` holds `<role>` on `organization:<organizationId>` — the organization role. */
+export declare function organizationRole(accountId: string, role: IamRole, organizationId: string): IamPolicySpec;
+//# sourceMappingURL=specs.d.ts.map

package/dist/domain/iampolicy/specs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"specs.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/specs.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qDAAqD,CAAC;AAEzF,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAIpE,sEAAsE;AACtE,wBAAgB,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAKhD;AAED,gHAAgH;AAChH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,EACb,cAAc,EAAE,MAAM,GACrB,aAAa,CAYf"}

package/dist/domain/iampolicy/specs.js

@@ -0,0 +1,45 @@
+/**
+ * The IamPolicy specs server code builds ITSELF, spelled once
+ * (20260913.01 slice 4). A wire caller hands the domain a spec; the
+ * built-in role lifecycle, the membership rules and slice 5's
+ * `revokeOrgAccess` and contextual `checkMyPermission` build their own.
+ * The derived policy id hashes the spec's exact text (constants.ts
+ * `policyIdFor`), so two spellings of one triple would be two rows — this
+ * module is where "identity_account:<id> holds <role> on
+ * organization:<org>" has one spelling in production code, the way the
+ * test support's `orgRole` is that spelling for tests.
+ *
+ * Kinds are spelled through `kindEnumName` (the ApiResourceRef vocabulary,
+ * pipeline/apiresource-meta.ts); relations are the `IamRole` member names,
+ * which are the FGA model's relation names and the proto's grantable-role
+ * vocabulary. The zero value `iam_role_unspecified` is not a relation and
+ * is refused (the `accountIdFor("")` precedent): hashing it would mint a
+ * real row for a role nobody holds.
+ */
+import { create } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPolicySpecSchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { kindEnumName } from "../../pipeline/apiresource-meta.js";
+/** The relation string a role grants — the enum member's own name. */
+export function relationOf(role) {
+    if (role === IamRole.iam_role_unspecified) {
+        throw new Error("iam_role_unspecified is not a relation");
+    }
+    return IamRole[role];
+}
+/** `identity_account:<accountId>` holds `<role>` on `organization:<organizationId>` — the organization role. */
+export function organizationRole(accountId, role, organizationId) {
+    return create(IamPolicySpecSchema, {
+        principal: {
+            kind: kindEnumName(ApiResourceKind.identity_account),
+            id: accountId,
+        },
+        relation: relationOf(role),
+        resource: {
+            kind: kindEnumName(ApiResourceKind.organization),
+            id: organizationId,
+        },
+    });
+}
+//# sourceMappingURL=specs.js.map

package/dist/domain/iampolicy/specs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"specs.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAC1F,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAEpE,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAElE,sEAAsE;AACtE,MAAM,UAAU,UAAU,CAAC,IAAa;IACtC,IAAI,IAAI,KAAK,OAAO,CAAC,oBAAoB,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,IAAa,EACb,cAAsB;IAEtB,OAAO,MAAM,CAAC,mBAAmB,EAAE;QACjC,SAAS,EAAE;YACT,IAAI,EAAE,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC;YACpD,EAAE,EAAE,SAAS;SACd;QACD,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC;QAC1B,QAAQ,EAAE;YACR,IAAI,EAAE,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC;YAChD,EAAE,EAAE,cAAc;SACnB;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/domain/iampolicy/steps.d.ts

@@ -0,0 +1,18 @@
+import type { RevokeOrgAccessInputSchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/io_pb";
+import type { ApiResourceRefSchema, IamPolicySpecSchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
+import type { PolicyGrantScope } from "../../extensions/policy-grant-scope.js";
+import type { PipelineStep } from "../../pipeline/pipeline.js";
+import type { IamPolicyGrantPath } from "./grant-path.js";
+/** The row a write chain answers — the granted row, or the revoked row (the default instance when there was none). */
+export declare const POLICY_RESULT_KEY = "policyResult";
+/** The `create` chain's role check; see the module header for the four arms. */
+export declare function newValidateGrantableRoleStep(scope: PolicyGrantScope): PipelineStep<typeof IamPolicySpecSchema>;
+/** Grant the spec as the chain's caller; the row (fresh or held) is the result. */
+export declare function newGrantStep(grantPath: IamPolicyGrantPath): PipelineStep<typeof IamPolicySpecSchema>;
+/** Revoke the spec's row; absent, the default instance is the result (Java's idempotent delete). */
+export declare function newRevokeStep(grantPath: IamPolicyGrantPath): PipelineStep<typeof IamPolicySpecSchema>;
+/** Revoke every relation the account holds directly on the organization. */
+export declare function newRevokeOrgAccessStep(grantPath: IamPolicyGrantPath): PipelineStep<typeof RevokeOrgAccessInputSchema>;
+/** Revoke every row naming the ref as resource or principal — the deleted resource's cleanup. */
+export declare function newCleanupResourceStep(grantPath: IamPolicyGrantPath): PipelineStep<typeof ApiResourceRefSchema>;
+//# sourceMappingURL=steps.d.ts.map

package/dist/domain/iampolicy/steps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/steps.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AACpG,OAAO,KAAK,EAEV,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,qDAAqD,CAAC;AAG7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAE/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAS/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAM1D,sHAAsH;AACtH,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,gFAAgF;AAChF,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,gBAAgB,GACtB,YAAY,CAAC,OAAO,mBAAmB,CAAC,CA0C1C;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAC1B,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAU1C;AAED,oGAAoG;AACpG,wBAAgB,aAAa,CAC3B,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAU1C;AAED,4EAA4E;AAC5E,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,0BAA0B,CAAC,CAYjD;AAED,iGAAiG;AACjG,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,oBAAoB,CAAC,CAQ3C"}

package/dist/domain/iampolicy/steps.js

@@ -0,0 +1,117 @@
+/**
+ * IamPolicy pipeline steps (20260913.01 slice 5; Q-S5-1): the domain-local
+ * steps the six command chains splice after the shared `Authorize` and
+ * `ValidateProto`. The write itself is never here — every step that writes
+ * calls the ONE grant and revoke path (grant-path.ts, which owns the
+ * cloud#425 orderings, the by-triple read and the wire refusals) and leaves
+ * its answer under POLICY_RESULT_KEY for the handler. The chains are
+ * deliberately short: `Authorize → ValidateProto → <one of these>`, so the
+ * pipeline executor's fault mapping (a step's ConnectError keeps its code;
+ * a raw store fault becomes the sanitized INTERNAL) covers the path's two
+ * error shapes with no second idiom in the handlers.
+ *
+ * ValidateGrantableRole (the `create` chain only; `bootstrapPolicy` is the
+ * structural lane and skips it) is the one step with branching logic. It
+ * runs BEFORE Grant — the cloud's validate-before-write order, so a held
+ * legacy row under a role the kind does not grant is refused rather than
+ * answered as a duplicate — and reads, in this order (Q-OR-3 as refined;
+ * Q-S3-3):
+ *   1. the wire refusals: an unknown resource kind is `Unknown resource
+ *      kind`, never a role sentence — the second line behind the
+ *      controller's pre-position-1 refusal (Q-S6-1), kept so the step's
+ *      own contract holds for whoever splices it;
+ *   2. the PROTO (`grantableRolesFor`): a kind that lists no role is
+ *      system-managed in every edition — the cloud's byte-pinned copy,
+ *      whatever the composed scope claims;
+ *   3. the composed SCOPE: a kind it lists nothing for is a per-resource
+ *      grant this edition does not serve — UNIMPLEMENTED naming the
+ *      editions that do;
+ *   4. proto ∩ scope, in proto order: the role must be in the
+ *      intersection — the cloud's second copy listing it. Intersecting is
+ *      what keeps a scope from WIDENING the contract by accident;
+ *   5. the PRINCIPAL (Q-S9-2, 2026-09-14; constants.ts
+ *      USER_GRANT_PRINCIPAL_KINDS): a person grants roles to people — the
+ *      identity account — and to nothing else. A row whose principal is a
+ *      resource is a structural link (the hierarchy walk's parent edge),
+ *      which is `bootstrapPolicy`'s to write; through this lane it would
+ *      let a right on one organization read another's members. Last, so
+ *      every answer the cloud's create gives today is unchanged and only
+ *      the row it should never have written is refused.
+ */
+import { create } from "@bufbuild/protobuf";
+import { Code, ConnectError } from "@connectrpc/connect";
+import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { grantableRolesFor } from "../../pipeline/apiresource-meta.js";
+import { PER_RESOURCE_GRANTS_UNIMPLEMENTED_MESSAGE, USER_GRANT_PRINCIPAL_KINDS, noGrantableRolesMessage, principalNotGrantableMessage, roleNotGrantableMessage, } from "./constants.js";
+import { requireKnownPrincipalKind, requireKnownResourceKind, } from "./wire-refusals.js";
+/** The row a write chain answers — the granted row, or the revoked row (the default instance when there was none). */
+export const POLICY_RESULT_KEY = "policyResult";
+/** The `create` chain's role check; see the module header for the four arms. */
+export function newValidateGrantableRoleStep(scope) {
+    return {
+        name: "ValidateGrantableRole",
+        execute(ctx) {
+            const spec = ctx.input;
+            const kindName = spec.resource?.kind ?? "";
+            const kind = requireKnownResourceKind(kindName);
+            const contract = grantableRolesFor(kind);
+            if (contract.length === 0) {
+                throw new ConnectError(noGrantableRolesMessage(kindName), Code.InvalidArgument);
+            }
+            const scoped = new Set(scope.grantableRoles(kind));
+            if (scoped.size === 0) {
+                throw new ConnectError(PER_RESOURCE_GRANTS_UNIMPLEMENTED_MESSAGE, Code.Unimplemented);
+            }
+            const grantable = contract.filter((role) => scoped.has(role));
+            if (!grantable.some((role) => IamRole[role] === spec.relation)) {
+                throw new ConnectError(roleNotGrantableMessage(spec.relation, kindName, grantable.map((role) => IamRole[role])), Code.InvalidArgument);
+            }
+            const principalKindName = spec.principal?.kind ?? "";
+            const principalKind = requireKnownPrincipalKind(principalKindName);
+            if (!USER_GRANT_PRINCIPAL_KINDS.includes(principalKind)) {
+                throw new ConnectError(principalNotGrantableMessage(principalKindName), Code.InvalidArgument);
+            }
+        },
+    };
+}
+/** Grant the spec as the chain's caller; the row (fresh or held) is the result. */
+export function newGrantStep(grantPath) {
+    return {
+        name: "Grant",
+        async execute(ctx) {
+            const { policy } = await grantPath.grant(ctx.input, ctx.callerIdentity);
+            ctx.set(POLICY_RESULT_KEY, policy);
+        },
+    };
+}
+/** Revoke the spec's row; absent, the default instance is the result (Java's idempotent delete). */
+export function newRevokeStep(grantPath) {
+    return {
+        name: "Revoke",
+        async execute(ctx) {
+            const revoked = await grantPath.revokeBySpec(ctx.input);
+            ctx.set(POLICY_RESULT_KEY, revoked ?? create(IamPolicySchema));
+        },
+    };
+}
+/** Revoke every relation the account holds directly on the organization. */
+export function newRevokeOrgAccessStep(grantPath) {
+    return {
+        name: "RevokeOrgAccess",
+        execute(ctx) {
+            return grantPath.revokeOrgAccess(ctx.input.identityAccountId, ctx.input.organizationId);
+        },
+    };
+}
+/** Revoke every row naming the ref as resource or principal — the deleted resource's cleanup. */
+export function newCleanupResourceStep(grantPath) {
+    return {
+        name: "CleanupResource",
+        execute(ctx) {
+            const ref = ctx.input;
+            return grantPath.cleanupResource(ref);
+        },
+    };
+}
+//# sourceMappingURL=steps.js.map

package/dist/domain/iampolicy/steps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAOrF,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAGpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAGvE,OAAO,EACL,yCAAyC,EACzC,0BAA0B,EAC1B,uBAAuB,EACvB,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAE5B,sHAAsH;AACtH,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEhD,gFAAgF;AAChF,MAAM,UAAU,4BAA4B,CAC1C,KAAuB;IAEvB,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,OAAO,CAAC,GAA+C;YACrD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,YAAY,CACpB,uBAAuB,CAAC,QAAQ,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CACpB,yCAAyC,EACzC,IAAI,CAAC,aAAa,CACnB,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,YAAY,CACpB,uBAAuB,CACrB,IAAI,CAAC,QAAQ,EACb,QAAQ,EACR,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CACvC,EACD,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;YACrD,MAAM,aAAa,GAAG,yBAAyB,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,YAAY,CACpB,4BAA4B,CAAC,iBAAiB,CAAC,EAC/C,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAC1B,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,OAAO,CACX,GAA+C;YAE/C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YACxE,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,aAAa,CAC3B,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CACX,GAA+C;YAE/C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACxD,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sBAAsB,CACpC,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,CACL,GAAsD;YAEtD,OAAO,SAAS,CAAC,eAAe,CAC9B,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAC3B,GAAG,CAAC,KAAK,CAAC,cAAc,CACzB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,sBAAsB,CACpC,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,CAAC,GAAgD;YACtD,MAAM,GAAG,GAAmB,GAAG,CAAC,KAAK,CAAC;YACtC,OAAO,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/iampolicy/store-contract.d.ts

@@ -0,0 +1,8 @@
+import type { PortContractCase, PortContractFixture } from "../../store/port-contract.js";
+import type { IamPolicyStore } from "./store.js";
+/** The runner's fixture over this port — the name a driver's test and the barrel know it by. */
+export type IamPolicyStoreContractFixture = PortContractFixture<IamPolicyStore>;
+export type IamPolicyStoreContractCase = PortContractCase;
+/** The port's cases over `makeFixture`, one fresh fixture per case. */
+export declare function iamPolicyStoreContract(makeFixture: () => Promise<IamPolicyStoreContractFixture>): ReadonlyArray<IamPolicyStoreContractCase>;
+//# sourceMappingURL=store-contract.d.ts.map

package/dist/domain/iampolicy/store-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-contract.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/store-contract.ts"],"names":[],"mappings":"AAgDA,OAAO,KAAK,EACV,gBAAgB,EAEhB,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AAOtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,gGAAgG;AAChG,MAAM,MAAM,6BAA6B,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;AAEhF,MAAM,MAAM,0BAA0B,GAAG,gBAAgB,CAAC;AA4X1D,uEAAuE;AACvE,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,OAAO,CAAC,6BAA6B,CAAC,GACxD,aAAa,CAAC,0BAA0B,CAAC,CAE3C"}