@stigmer/server 3.15.2 → 3.15.3-dev.20260914100347

package/dist/domain/iampolicy/store-contract.js

@@ -0,0 +1,258 @@
+/**
+ * The IamPolicyStore PORT-CONTRACT KIT (20260913.01, T01_0_plan.md §3a;
+ * the 2a A11/A12 discipline): every behavior an implementation of store.ts
+ * must satisfy identically, as cases a driver's test iterates. Open source
+ * runs them over its own adapter (resource-store.ts) on sqlite and Postgres
+ * in __tests__/resource-store.test.ts; a composition runs the SAME cases
+ * over the store it registers as `drivers.iamPolicyStore` (the cloud's
+ * `cloud.iam_policy` store, S3), so "the port holds" is one statement
+ * proven per driver, never restated per repository.
+ *
+ * Shape. A list of declarations over the port-contract runner
+ * (store/port-contract.ts): the runner owns the fresh fixture per case,
+ * the cleanup, the rule that a failing assertion wins over a failing
+ * cleanup, and the reason a kit returns cases instead of calling vitest's
+ * `describe`. `disconnect` is the one escape hatch: the port has no
+ * lifecycle by design, yet "an outage never reads as no grant" is the line
+ * that matters most.
+ *
+ * The corners A12 taught are cases from the start, not later additions:
+ * every relation on a pair; distinct principals, not rows; the scope-tuple
+ * exclusions verbatim; unknown-id delete a no-op; a held id refused.
+ *
+ * What the kit deliberately does not carry: open source's derived-id
+ * refusal and its primary-key read, the cloud's column layout and SQLSTATE
+ * 23505 mapping — driver-physical, each driver's own tests. Every fixture
+ * row carries its triple's DERIVED id, so "a held triple" and "a held id"
+ * are one case here; a composition's legacy random ids are the grant
+ * path's by-triple read to converge (store.ts header), not a store promise.
+ *
+ * The duplicate arm checks `instanceof DuplicatePolicyError` on the
+ * exported class, because that is how the grant path's race arm catches
+ * it: a driver throwing a lookalike fails here for the reason it would
+ * fail a grant.
+ *
+ * Case names are the contract lines, in the port's words. The OSS test pins
+ * the full list, so a case cannot drop out of the kit unnoticed.
+ */
+import assert from "node:assert/strict";
+import { create, equals } from "@bufbuild/protobuf";
+import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
+import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
+import { IamPolicySpecSchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
+import { portContractCases } from "../../store/port-contract.js";
+import { IAM_POLICY_API_VERSION, IAM_POLICY_KIND, policyIdFor, } from "./constants.js";
+import { DuplicatePolicyError } from "./store.js";
+const ALICE = "ida_wtr3jcf281yfk9xx61kj59fsme";
+const BOB = "ida_0byc5k14t1e7b7kdxft7hwz1f7";
+const AGENT = "agt_01hzzzzzzzzzzzzzzzzzzzzzzz";
+function spec(principal, relation, resource) {
+    return create(IamPolicySpecSchema, {
+        principal: {
+            kind: principal.kind,
+            id: principal.id,
+            relation: principal.relation ?? "",
+        },
+        relation,
+        resource: { kind: resource.kind, id: resource.id },
+    });
+}
+/** `identity_account:<id>` holds `<relation>` on `organization:<org>`. */
+function orgRole(accountId, relation, orgId) {
+    return spec({ kind: "identity_account", id: accountId }, relation, {
+        kind: "organization",
+        id: orgId,
+    });
+}
+/**
+ * A row as the domain writes it: the contract's apiVersion and kind, the
+ * triple's derived id, and a creator stamp so two rows for one triple can
+ * be told apart ("the first row stands").
+ */
+function policyRow(policySpec, createdBy = ALICE) {
+    return create(IamPolicySchema, {
+        apiVersion: IAM_POLICY_API_VERSION,
+        kind: IAM_POLICY_KIND,
+        metadata: create(ApiResourceMetadataSchema, {
+            id: policyIdFor(policySpec),
+        }),
+        spec: policySpec,
+        status: { audit: { specAudit: { createdBy: { id: createdBy } } } },
+    });
+}
+function idOf(policy) {
+    const id = policy.metadata?.id ?? "";
+    assert.notEqual(id, "", "a fixture policy must carry an id");
+    return id;
+}
+function relationsOf(policies) {
+    return policies.map((policy) => policy.spec?.relation ?? "").sort();
+}
+async function saveAll(store, policies) {
+    for (const policy of policies) {
+        await store.save(policy);
+    }
+}
+const CASES = [
+    [
+        "save then findById round-trips the policy",
+        async ({ store }) => {
+            const policy = policyRow(orgRole(ALICE, "admin", "acme"));
+            await store.save(policy);
+            const found = await store.findById(idOf(policy));
+            assert.ok(found !== undefined, "a saved policy must be readable by id");
+            assert.ok(equals(IamPolicySchema, found, policy), "findById must return the policy exactly as it was saved");
+            assert.equal(await store.findById("iamp_00000000000000000000000000"), undefined, "an unknown id must read as undefined, not as an error");
+        },
+    ],
+    [
+        "a second save under a held triple is DuplicatePolicyError, and the first row stands",
+        async ({ store }) => {
+            const triple = orgRole(ALICE, "admin", "acme");
+            await store.save(policyRow(triple, ALICE));
+            await assert.rejects(store.save(policyRow(triple, BOB)), DuplicatePolicyError, "save under a held id must raise the exported DuplicatePolicyError, never overwrite");
+            const standing = await store.findById(policyIdFor(triple));
+            assert.equal(standing?.status?.audit?.specAudit?.createdBy?.id, ALICE, "the first writer's row must stand after a refused duplicate");
+        },
+    ],
+    [
+        "findByPrincipalAndResource answers every relation on the pair and nothing on another",
+        async ({ store }) => {
+            await saveAll(store, [
+                policyRow(orgRole(ALICE, "admin", "acme")),
+                policyRow(orgRole(ALICE, "viewer", "acme")),
+                policyRow(orgRole(ALICE, "member", "globex")),
+                policyRow(orgRole(BOB, "member", "acme")),
+            ]);
+            assert.deepEqual(relationsOf(await store.findByPrincipalAndResource("identity_account", ALICE, "organization", "acme")), ["admin", "viewer"], "the pair's rows are every relation the principal holds on the resource");
+            assert.deepEqual(await store.findByPrincipalAndResource("identity_account", BOB, "organization", "globex"), [], "a pair with no rows must answer an empty list");
+        },
+    ],
+    [
+        "findByPrincipal and findByResource answer each side of a row",
+        async ({ store }) => {
+            const structural = spec({ kind: "organization", id: "acme" }, "organization", { kind: "agent", id: AGENT });
+            await saveAll(store, [
+                policyRow(orgRole(ALICE, "owner", "acme")),
+                policyRow(structural),
+                policyRow(orgRole(BOB, "member", "globex")),
+            ]);
+            assert.deepEqual((await store.findByPrincipal("organization", "acme")).map(idOf), [policyIdFor(structural)], "findByPrincipal answers the rows where the ref is the principal");
+            assert.deepEqual((await store.findByResource("organization", "acme")).map(idOf), [policyIdFor(orgRole(ALICE, "owner", "acme"))], "findByResource answers the rows where the ref is the resource");
+            assert.deepEqual(await store.findByResource("organization", "nowhere"), [], "a resource with no rows must answer an empty list");
+        },
+    ],
+    [
+        "findByResourceWithRelations filters to the allowlist; an empty allowlist matches nothing",
+        async ({ store }) => {
+            await saveAll(store, [
+                policyRow(orgRole(ALICE, "admin", "acme")),
+                policyRow(orgRole(BOB, "member", "acme")),
+                policyRow(spec({ kind: "organization", id: "acme" }, "organization", {
+                    kind: "organization",
+                    id: "acme",
+                })),
+            ]);
+            assert.deepEqual(relationsOf(await store.findByResourceWithRelations("organization", "acme", [
+                "admin",
+                "member",
+                "viewer",
+            ])), ["admin", "member"], "only rows whose relation is in the allowlist are answered");
+            assert.deepEqual(await store.findByResourceWithRelations("organization", "acme", []), [], "an empty allowlist must match nothing on every edition");
+        },
+    ],
+    [
+        "countDistinctPrincipalsByResource counts (kind, id) pairs, not rows, optionally by principal kind",
+        async ({ store }) => {
+            const roles = ["owner", "admin", "member", "viewer"];
+            await saveAll(store, [
+                policyRow(orgRole(ALICE, "admin", "acme")),
+                policyRow(orgRole(ALICE, "viewer", "acme")),
+                policyRow(orgRole(BOB, "member", "acme")),
+                policyRow(spec({ kind: "organization", id: "globex" }, "member", {
+                    kind: "organization",
+                    id: "acme",
+                })),
+                policyRow(orgRole(BOB, "member", "globex")),
+            ]);
+            assert.equal(await store.countDistinctPrincipalsByResource("organization", "acme", undefined, roles), 3, "alice (two rows), bob and the organization principal are three principals, not four rows");
+            assert.equal(await store.countDistinctPrincipalsByResource("organization", "acme", "identity_account", roles), 2, "the principal-kind filter narrows to identity accounts");
+            assert.equal(await store.countDistinctPrincipalsByResource("organization", "acme", undefined, ["owner"]), 0, "no row in the allowlist is a count of zero");
+        },
+    ],
+    [
+        "findScopeTuple skips identity_account and team principals and owner and creator relations",
+        async ({ store }) => {
+            const scope = spec({ kind: "organization", id: "acme" }, "organization", {
+                kind: "agent",
+                id: AGENT,
+            });
+            await saveAll(store, [
+                policyRow(spec({ kind: "identity_account", id: ALICE }, "owner", {
+                    kind: "agent",
+                    id: AGENT,
+                })),
+                policyRow(spec({ kind: "team", id: "tm_1", relation: "member" }, "viewer", {
+                    kind: "agent",
+                    id: AGENT,
+                })),
+                policyRow(spec({ kind: "organization", id: "acme" }, "creator", {
+                    kind: "agent",
+                    id: AGENT,
+                })),
+                policyRow(scope),
+            ]);
+            assert.equal((await store.findScopeTuple("agent", AGENT))?.metadata?.id, policyIdFor(scope), "the one structural link is the row whose principal and relation are both structural");
+            assert.equal(await store.findScopeTuple("agent", "agt_nowhere"), undefined, "a resource with no structural link must read as undefined");
+        },
+    ],
+    [
+        "deleteById removes the row; the triple is free to be granted again",
+        async ({ store }) => {
+            const policy = policyRow(orgRole(ALICE, "admin", "acme"));
+            await store.save(policy);
+            await store.deleteById(idOf(policy));
+            assert.equal(await store.findById(idOf(policy)), undefined, "a deleted policy must not be readable by id");
+            assert.deepEqual(await store.findByPrincipalAndResource("identity_account", ALICE, "organization", "acme"), [], "a deleted policy must not be readable by its pair");
+            await assert.doesNotReject(store.save(policy), "the triple of a deleted policy must be savable again");
+        },
+    ],
+    [
+        "deleteById of an unknown id resolves",
+        async ({ store }) => {
+            await assert.doesNotReject(store.deleteById("iamp_00000000000000000000000000"), "deleting an id that is not held must resolve, not reject");
+        },
+    ],
+    [
+        "a disconnected store is an infrastructure fault, never 'not found'",
+        async (fixture) => {
+            await fixture.disconnect();
+            await assert.rejects(fixture.store.findById(policyIdFor(orgRole(ALICE, "admin", "acme"))), "an id read on a disconnected store must reject, never read as undefined");
+            await assert.rejects(fixture.store.findByPrincipalAndResource("identity_account", ALICE, "organization", "acme"), "a pair read on a disconnected store must reject, never read as an empty list");
+        },
+    ],
+    [
+        "two concurrent saves of one triple end in one row and DuplicatePolicyErrors only",
+        async ({ store }) => {
+            const triple = orgRole(ALICE, "admin", "acme");
+            const results = await Promise.allSettled([
+                store.save(policyRow(triple, ALICE)),
+                store.save(policyRow(triple, BOB)),
+            ]);
+            for (const result of results) {
+                if (result.status === "rejected") {
+                    assert.ok(result.reason instanceof DuplicatePolicyError, `a losing concurrent save must fail as DuplicatePolicyError, got ${String(result.reason)}`);
+                }
+            }
+            assert.ok(results.some((result) => result.status === "fulfilled"), "at least one of two concurrent saves must win");
+            const rows = await store.findByPrincipalAndResource("identity_account", ALICE, "organization", "acme");
+            assert.equal(rows.length, 1, "one triple must end as exactly one row");
+            assert.equal(rows[0]?.metadata?.id, policyIdFor(triple), "the surviving row carries the triple's derived id");
+        },
+    ],
+];
+/** The port's cases over `makeFixture`, one fresh fixture per case. */
+export function iamPolicyStoreContract(makeFixture) {
+    return portContractCases(CASES, makeFixture);
+}
+//# sourceMappingURL=store-contract.js.map

package/dist/domain/iampolicy/store-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-contract.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/store-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4DAA4D,CAAC;AAEvG,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAErF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAE1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAMjE,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAQlD,MAAM,KAAK,GAAG,gCAAgC,CAAC;AAC/C,MAAM,GAAG,GAAG,gCAAgC,CAAC;AAC7C,MAAM,KAAK,GAAG,gCAAgC,CAAC;AAE/C,SAAS,IAAI,CACX,SAA0D,EAC1D,QAAgB,EAChB,QAAsC;IAEtC,OAAO,MAAM,CAAC,mBAAmB,EAAE;QACjC,SAAS,EAAE;YACT,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,EAAE;SACnC;QACD,QAAQ;QACR,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE;KACnD,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,SAAS,OAAO,CACd,SAAiB,EACjB,QAAgB,EAChB,KAAa;IAEb,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE;QACjE,IAAI,EAAE,cAAc;QACpB,EAAE,EAAE,KAAK;KACV,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,UAAyB,EAAE,SAAS,GAAG,KAAK;IAC7D,OAAO,MAAM,CAAC,eAAe,EAAE;QAC7B,UAAU,EAAE,sBAAsB;QAClC,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,MAAM,CAAC,yBAAyB,EAAE;YAC1C,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC;SAC5B,CAAC;QACF,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE;KACnE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,IAAI,CAAC,MAAiB;IAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACrC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,mCAAmC,CAAC,CAAC;IAC7D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,QAAkC;IACrD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,KAAqB,EACrB,QAAkC;IAElC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,MAAM,KAAK,GAA2D;IACpE;QACE,2CAA2C;QAC3C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1D,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YACjD,MAAM,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,EAAE,uCAAuC,CAAC,CAAC;YACxE,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,CAAC,EACtC,yDAAyD,CAC1D,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,iCAAiC,CAAC,EACvD,SAAS,EACT,uDAAuD,CACxD,CAAC;QACJ,CAAC;KACF;IACD;QACE,qFAAqF;QACrF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YAC3C,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAClC,oBAAoB,EACpB,oFAAoF,CACrF,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CACV,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EACjD,KAAK,EACL,6DAA6D,CAC9D,CAAC;QACJ,CAAC;KACF;IACD;QACE,sFAAsF;QACtF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,CAAC,KAAK,EAAE;gBACnB,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC1C,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC3C,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAC7C,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;aAC1C,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CACd,WAAW,CACT,MAAM,KAAK,CAAC,0BAA0B,CACpC,kBAAkB,EAClB,KAAK,EACL,cAAc,EACd,MAAM,CACP,CACF,EACD,CAAC,OAAO,EAAE,QAAQ,CAAC,EACnB,wEAAwE,CACzE,CAAC;YACF,MAAM,CAAC,SAAS,CACd,MAAM,KAAK,CAAC,0BAA0B,CACpC,kBAAkB,EAClB,GAAG,EACH,cAAc,EACd,QAAQ,CACT,EACD,EAAE,EACF,+CAA+C,CAChD,CAAC;QACJ,CAAC;KACF;IACD;QACE,8DAA8D;QAC9D,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,UAAU,GAAG,IAAI,CACrB,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,EACpC,cAAc,EACd,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAC7B,CAAC;YACF,MAAM,OAAO,CAAC,KAAK,EAAE;gBACnB,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC1C,SAAS,CAAC,UAAU,CAAC;gBACrB,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;aAC5C,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CACd,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAC/D,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,EACzB,iEAAiE,CAClE,CAAC;YACF,MAAM,CAAC,SAAS,CACd,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAC9D,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAC9C,+DAA+D,CAChE,CAAC;YACF,MAAM,CAAC,SAAS,CACd,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,SAAS,CAAC,EACrD,EAAE,EACF,mDAAmD,CACpD,CAAC;QACJ,CAAC;KACF;IACD;QACE,0FAA0F;QAC1F,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,CAAC,KAAK,EAAE;gBACnB,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC1C,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACzC,SAAS,CACP,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE;oBACzD,IAAI,EAAE,cAAc;oBACpB,EAAE,EAAE,MAAM;iBACX,CAAC,CACH;aACF,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CACd,WAAW,CACT,MAAM,KAAK,CAAC,2BAA2B,CAAC,cAAc,EAAE,MAAM,EAAE;gBAC9D,OAAO;gBACP,QAAQ;gBACR,QAAQ;aACT,CAAC,CACH,EACD,CAAC,OAAO,EAAE,QAAQ,CAAC,EACnB,2DAA2D,CAC5D,CAAC;YACF,MAAM,CAAC,SAAS,CACd,MAAM,KAAK,CAAC,2BAA2B,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,CAAC,EACnE,EAAE,EACF,wDAAwD,CACzD,CAAC;QACJ,CAAC;KACF;IACD;QACE,mGAAmG;QACnG,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACrD,MAAM,OAAO,CAAC,KAAK,EAAE;gBACnB,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC1C,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC3C,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACzC,SAAS,CACP,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE;oBACrD,IAAI,EAAE,cAAc;oBACpB,EAAE,EAAE,MAAM;iBACX,CAAC,CACH;gBACD,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;aAC5C,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iCAAiC,CAC3C,cAAc,EACd,MAAM,EACN,SAAS,EACT,KAAK,CACN,EACD,CAAC,EACD,0FAA0F,CAC3F,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iCAAiC,CAC3C,cAAc,EACd,MAAM,EACN,kBAAkB,EAClB,KAAK,CACN,EACD,CAAC,EACD,wDAAwD,CACzD,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iCAAiC,CAC3C,cAAc,EACd,MAAM,EACN,SAAS,EACT,CAAC,OAAO,CAAC,CACV,EACD,CAAC,EACD,4CAA4C,CAC7C,CAAC;QACJ,CAAC;KACF;IACD;QACE,2FAA2F;QAC3F,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE;gBACvE,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,KAAK;aACV,CAAC,CAAC;YACH,MAAM,OAAO,CAAC,KAAK,EAAE;gBACnB,SAAS,CACP,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE;oBACrD,IAAI,EAAE,OAAO;oBACb,EAAE,EAAE,KAAK;iBACV,CAAC,CACH;gBACD,SAAS,CACP,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE;oBAC/D,IAAI,EAAE,OAAO;oBACb,EAAE,EAAE,KAAK;iBACV,CAAC,CACH;gBACD,SAAS,CACP,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE;oBACpD,IAAI,EAAE,OAAO;oBACb,EAAE,EAAE,KAAK;iBACV,CAAC,CACH;gBACD,SAAS,CAAC,KAAK,CAAC;aACjB,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAC1D,WAAW,CAAC,KAAK,CAAC,EAClB,qFAAqF,CACtF,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,EAClD,SAAS,EACT,2DAA2D,CAC5D,CAAC;QACJ,CAAC;KACF;IACD;QACE,oEAAoE;QACpE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1D,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAClC,SAAS,EACT,6CAA6C,CAC9C,CAAC;YACF,MAAM,CAAC,SAAS,CACd,MAAM,KAAK,CAAC,0BAA0B,CACpC,kBAAkB,EAClB,KAAK,EACL,cAAc,EACd,MAAM,CACP,EACD,EAAE,EACF,mDAAmD,CACpD,CAAC;YACF,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAClB,sDAAsD,CACvD,CAAC;QACJ,CAAC;KACF;IACD;QACE,sCAAsC;QACtC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,UAAU,CAAC,iCAAiC,CAAC,EACnD,0DAA0D,CAC3D,CAAC;QACJ,CAAC;KACF;IACD;QACE,oEAAoE;QACpE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EACpE,yEAAyE,CAC1E,CAAC;YACF,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,0BAA0B,CACtC,kBAAkB,EAClB,KAAK,EACL,cAAc,EACd,MAAM,CACP,EACD,8EAA8E,CAC/E,CAAC;QACJ,CAAC;KACF;IACD;QACE,kFAAkF;QAClF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;gBACvC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBACpC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;aACnC,CAAC,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBACjC,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,MAAM,YAAY,oBAAoB,EAC7C,mEAAmE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAC3F,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,CAAC,EAAE,CACP,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,EACvD,+CAA+C,CAChD,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,0BAA0B,CACjD,kBAAkB,EAClB,KAAK,EACL,cAAc,EACd,MAAM,CACP,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,wCAAwC,CAAC,CAAC;YACvE,MAAM,CAAC,KAAK,CACV,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EACrB,WAAW,CAAC,MAAM,CAAC,EACnB,mDAAmD,CACpD,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAEF,uEAAuE;AACvE,MAAM,UAAU,sBAAsB,CACpC,WAAyD;IAEzD,OAAO,iBAAiB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC"}

package/dist/domain/iampolicy/store.d.ts

@@ -0,0 +1,78 @@
+/**
+ * The IamPolicyStore PORT (20260913.01, T01_0_plan.md §3a; Q-OR-1): the
+ * storage contract the IamPolicy domain writes and reads through, cut from
+ * the cloud's row store (iam/policy/store.ts) to what BOTH editions call.
+ * The second OSS domain whose persistence is a port rather than the
+ * generic Store (the identity account was the first): the cloud serves the
+ * same controller over its own `cloud.iam_policy` table by registering an
+ * implementation as `drivers.iamPolicyStore`, so the domain's grant path
+ * and handlers take this interface, never `Store`. Open source's own
+ * implementation is resource-store.ts over the generic Store.
+ *
+ * What the port deliberately does not carry: `markSynced` and
+ * `findUnsynced` (the cloud's tuple-mirror bookkeeping and boot backfill;
+ * its store keeps them as extras) and `findByIdentityAccountInOrg` (the
+ * cloud's org-column arm of revocation — the column was never stamped by
+ * any writer, so it matched nothing; dropped, Q-OR-9). A port does not
+ * carry methods only one edition calls or no edition needs.
+ *
+ * Contract every implementation must satisfy — proven by the port-contract
+ * kit (store-contract.ts, exported), which the OSS adapter's test iterates
+ * on both drivers and a composition's driver test iterates too:
+ *   - `save` is create-only in effect: a save under a held ID raises
+ *     DuplicatePolicyError, never a silent overwrite. Under derived ids a
+ *     held triple IS a held id, which is what the kit exercises; where a
+ *     composition still holds legacy random ids, "one row per triple" is
+ *     the grant path's by-triple read (grant-path.ts), not this promise;
+ *   - `deleteById` of an unknown id resolves;
+ *   - the finds answer rows by the axes named, exactly:
+ *     `findByPrincipalAndResource` every relation on the pair;
+ *     `findByResourceWithRelations` the allowlist only, an empty allowlist
+ *     matching nothing; `countDistinctPrincipalsByResource` distinct
+ *     (kind, id) principals — not rows — over the allowlist, `undefined`
+ *     principal kind meaning any (callers normalize the wire's `""`);
+ *     `findScopeTuple` the resource's one structural link — a principal
+ *     that is not `identity_account` or `team` and a relation that is not
+ *     `owner` or `creator`, the cloud SQL's exclusion arms verbatim (`team`
+ *     is a Java-era name no ApiResourceKind carries; kept so the two
+ *     editions' filters read alike);
+ *   - a typed not-found reads as `undefined`; any other storage failure
+ *     propagates as the infrastructure fault it is (the ratified
+ *     store-fault mapping — an outage must never read as "no grant").
+ */
+import type { IamPolicy } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
+/**
+ * Raised by `save` when the id is already held, so the grant path runs its
+ * race arm (re-read the winner by triple; answer it as the duplicate).
+ * `cause` carries a driver's own error (the cloud's SQLSTATE 23505) for
+ * the logs; the message is the port's.
+ */
+export declare class DuplicatePolicyError extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+export interface IamPolicyStore {
+    /** Insert; a held id raises DuplicatePolicyError. */
+    save(policy: IamPolicy): Promise<void>;
+    /** Removes the row; no error when it does not exist. */
+    deleteById(id: string): Promise<void>;
+    findById(id: string): Promise<IamPolicy | undefined>;
+    /** Every row naming the principal — the cleanup's principal-side arm. */
+    findByPrincipal(principalKind: string, principalId: string): Promise<ReadonlyArray<IamPolicy>>;
+    /** Every row on the resource — the cleanup's resource-side arm. */
+    findByResource(resourceKind: string, resourceId: string): Promise<ReadonlyArray<IamPolicy>>;
+    /** Every relation the principal holds on the resource — the by-triple read's candidates. */
+    findByPrincipalAndResource(principalKind: string, principalId: string, resourceKind: string, resourceId: string): Promise<ReadonlyArray<IamPolicy>>;
+    /** Rows on the resource whose relation is in the allowlist (the assignable roles); an empty allowlist matches nothing. */
+    findByResourceWithRelations(resourceKind: string, resourceId: string, relations: ReadonlyArray<string>): Promise<ReadonlyArray<IamPolicy>>;
+    /** Distinct (kind, id) principals holding an allowlisted relation on the resource; `undefined` kind = any. */
+    countDistinctPrincipalsByResource(resourceKind: string, resourceId: string, principalKind: string | undefined, relations: ReadonlyArray<string>): Promise<number>;
+    /**
+     * The resource's scope tuple (the hierarchy walk's one step): a policy
+     * on the resource whose principal is structural (not identity_account
+     * or team) and whose relation is structural (not owner or creator).
+     */
+    findScopeTuple(resourceKind: string, resourceId: string): Promise<IamPolicy | undefined>;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/domain/iampolicy/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oDAAoD,CAAC;AAEpF;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAED,MAAM,WAAW,cAAc;IAC7B,qDAAqD;IACrD,IAAI,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,wDAAwD;IACxD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IACrD,yEAAyE;IACzE,eAAe,CACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACrC,mEAAmE;IACnE,cAAc,CACZ,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACrC,4FAA4F;IAC5F,0BAA0B,CACxB,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACrC,0HAA0H;IAC1H,2BAA2B,CACzB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,GAC/B,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACrC,8GAA8G;IAC9G,iCAAiC,CAC/B,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,GAC/B,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB;;;;OAIG;IACH,cAAc,CACZ,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;CACnC"}

package/dist/domain/iampolicy/store.js

@@ -0,0 +1,13 @@
+/**
+ * Raised by `save` when the id is already held, so the grant path runs its
+ * race arm (re-read the winner by triple; answer it as the duplicate).
+ * `cause` carries a driver's own error (the cloud's SQLSTATE 23505) for
+ * the logs; the message is the port's.
+ */
+export class DuplicatePolicyError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "DuplicatePolicyError";
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/domain/iampolicy/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/store.ts"],"names":[],"mappings":"AA4CA;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF"}

package/dist/domain/iampolicy/wire-refusals.d.ts

@@ -0,0 +1,25 @@
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { ApiResourceRef, IamPolicySpec } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
+/** A triple the wire may say: both refs present, both kinds resolved. */
+export interface AdmittedTriple {
+    readonly principal: ApiResourceRef;
+    readonly resource: ApiResourceRef;
+    readonly principalKind: ApiResourceKind;
+    readonly resourceKind: ApiResourceKind;
+}
+/** The kind a `resource.kind` string names, or INVALID_ARGUMENT with the cloud's sentence. */
+export declare function requireKnownResourceKind(kind: string): ApiResourceKind;
+/** The kind a `principal.kind` string names, or INVALID_ARGUMENT with the principal sentence. */
+export declare function requireKnownPrincipalKind(kind: string): ApiResourceKind;
+/**
+ * The whole triple, in the order the cloud refused it: no delimiter in any
+ * field (the canonical text would be ambiguous, Q-S2-1), then the resource
+ * kind, then the principal kind.
+ */
+export declare function requireWellFormedTriple(spec: IamPolicySpec): AdmittedTriple;
+/** Both refs, present — absence is a caller that bypassed the boundary, not wire input. */
+export declare function refsOf(spec: IamPolicySpec): {
+    principal: ApiResourceRef;
+    resource: ApiResourceRef;
+};
+//# sourceMappingURL=wire-refusals.d.ts.map

package/dist/domain/iampolicy/wire-refusals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-refusals.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/wire-refusals.ts"],"names":[],"mappings":"AAgCA,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACd,MAAM,qDAAqD,CAAC;AAU7D,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,eAAe,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;CACxC;AAED,8FAA8F;AAC9F,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAStE;AAED,iGAAiG;AACjG,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CASvE;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,cAAc,CAe3E;AAED,2FAA2F;AAC3F,wBAAgB,MAAM,CAAC,IAAI,EAAE,aAAa,GAAG;IAC3C,SAAS,EAAE,cAAc,CAAC;IAC1B,QAAQ,EAAE,cAAc,CAAC;CAC1B,CAKA"}

package/dist/domain/iampolicy/wire-refusals.js

@@ -0,0 +1,76 @@
+/**
+ * The IamPolicy domain's wire refusals (20260913.01; slice 2 ruling
+ * Q-S2-1, slice 5 ruling Q-S5-2): the ONE place a kind string that came
+ * off the wire, or a whole policy triple, is turned into INVALID_ARGUMENT
+ * with the domain's byte-pinned copy (constants.ts). Three callers share
+ * it so the rule cannot drift between them — the grant path (before any
+ * read, write or lifecycle hook), the create chain's ValidateGrantableRole
+ * step (before its role arms, so an unknown kind is never answered with a
+ * role sentence) and the query controller (checkMyPermission's resource,
+ * checkAuthorization's policy, the two listings' kind strings, the three
+ * row reads' refs).
+ *
+ * Why the match is exact (the `kindByEnumName` doctrine,
+ * pipeline/apiresource-meta.ts): an `ApiResourceRef.kind` is the enum
+ * MEMBER name and the derived policy id hashes the spec's text (Q-OR-9), so
+ * a lenient match would let "Organization" and "organization" mint two
+ * rows for one grant. Where the refusal runs (Q-S6-1, 2026-09-14): the
+ * controller calls it BEFORE position 1 on every lane, so no Authorizer in
+ * any edition is ever asked about a kind that is not a kind — a kind
+ * string that names no kind names no authorization target (the cloud's
+ * handlers kept this order; the resolver's unknown-kind deny stays as the
+ * backstop for a stored row on `get`). The grant path and the
+ * ValidateGrantableRole step keep their own calls for the callers that
+ * reach them without the controller (the lifecycle, the membership rules,
+ * the unit suites), so a garbage row never enters the store from any door.
+ *
+ * A spec missing either reference is a plain Error, not a refusal: the
+ * protovalidate boundary marks both `required`, so absence is a contract
+ * bug in a caller that bypassed it, never a client's mistake.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { kindByEnumName } from "../../pipeline/apiresource-meta.js";
+import { malformedTripleField, malformedTripleMessage, unknownPrincipalKindMessage, unknownResourceKindMessage, } from "./constants.js";
+/** The kind a `resource.kind` string names, or INVALID_ARGUMENT with the cloud's sentence. */
+export function requireKnownResourceKind(kind) {
+    const resolved = kindByEnumName(kind);
+    if (resolved === ApiResourceKind.api_resource_kind_unknown) {
+        throw new ConnectError(unknownResourceKindMessage(kind), Code.InvalidArgument);
+    }
+    return resolved;
+}
+/** The kind a `principal.kind` string names, or INVALID_ARGUMENT with the principal sentence. */
+export function requireKnownPrincipalKind(kind) {
+    const resolved = kindByEnumName(kind);
+    if (resolved === ApiResourceKind.api_resource_kind_unknown) {
+        throw new ConnectError(unknownPrincipalKindMessage(kind), Code.InvalidArgument);
+    }
+    return resolved;
+}
+/**
+ * The whole triple, in the order the cloud refused it: no delimiter in any
+ * field (the canonical text would be ambiguous, Q-S2-1), then the resource
+ * kind, then the principal kind.
+ */
+export function requireWellFormedTriple(spec) {
+    const { principal, resource } = refsOf(spec);
+    const malformed = malformedTripleField(spec);
+    if (malformed !== undefined) {
+        throw new ConnectError(malformedTripleMessage(malformed), Code.InvalidArgument);
+    }
+    return {
+        principal,
+        resource,
+        resourceKind: requireKnownResourceKind(resource.kind),
+        principalKind: requireKnownPrincipalKind(principal.kind),
+    };
+}
+/** Both refs, present — absence is a caller that bypassed the boundary, not wire input. */
+export function refsOf(spec) {
+    if (spec.principal === undefined || spec.resource === undefined) {
+        throw new Error("policy spec must carry principal and resource");
+    }
+    return { principal: spec.principal, resource: spec.resource };
+}
+//# sourceMappingURL=wire-refusals.js.map

package/dist/domain/iampolicy/wire-refusals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-refusals.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/wire-refusals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAMtH,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AAUxB,8FAA8F;AAC9F,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,eAAe,CAAC,yBAAyB,EAAE,CAAC;QAC3D,MAAM,IAAI,YAAY,CACpB,0BAA0B,CAAC,IAAI,CAAC,EAChC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,eAAe,CAAC,yBAAyB,EAAE,CAAC;QAC3D,MAAM,IAAI,YAAY,CACpB,2BAA2B,CAAC,IAAI,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAmB;IACzD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,YAAY,CACpB,sBAAsB,CAAC,SAAS,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS;QACT,QAAQ;QACR,YAAY,EAAE,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrD,aAAa,EAAE,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,MAAM,CAAC,IAAmB;IAIxC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;AAChE,CAAC"}

package/dist/domain/identityaccount/constants.d.ts

@@ -1,3 +1,36 @@
+/**
+ * Identity-account domain constants (20260911.11, T01_1_review.md A1, A2,
+ * A7): the derived account id, the one function that turns a caller into
+ * an issuer subject, and the byte-pinned wire copy.
+ *
+ * The derived id (A1). A direct account's id is a pure function of its
+ * subject: `ida_` + the top 130 bits of sha256(idp_id) as 26 lowercase
+ * Crockford-base32 characters, through `derivedId` in
+ * pipeline/steps/defaults.ts (the one encoder every derived kind shares
+ * since 20260913.01 slice 2; the IamPolicy id is the other). The shape is
+ * indistinguishable from a minted `{prefix}_{ulid}`, so nothing downstream
+ * learns a second id grammar, and the PRIMARY KEY becomes the one home of
+ * "one account per subject": the generic store has no secondary uniqueness
+ * and its save is an upsert (`store/sqlite/store.ts`), so a
+ * lookup-then-insert on a scan could never close the first-login race. Two
+ * replicas deriving the same id converge by primary key with no migration
+ * and no second copy of any field. The hash is one-way, so an issuer
+ * subject never leaks into the `created_by.id` stamps that ride on every
+ * resource. The golden vectors in __tests__/constants.test.ts are
+ * wire-adjacent contract: a change here re-addresses every direct account
+ * open source ever created.
+ *
+ * `idpIdOf` (A2) is the ONE place a CallerIdentity becomes a subject. An
+ * issuer-vouched token is read for its `sub` (already verified at
+ * position 1, so this is a read of trusted state, never a verification);
+ * a caller with no issuer and no token is the trusted-local operator,
+ * whose subject is `local|<identityId>`. It deliberately knows nothing
+ * about API keys: every verifier resolves its stamp to the account when
+ * one exists (A6), so a credential's shape is the verifier's business.
+ *
+ * The copy moved from the cloud's iam/account/handlers.ts as-is: the CLI,
+ * console and SDK show these sentences verbatim, so they are contract.
+ */
 import type { CallerIdentity } from "../../extensions/identity.js";
 /** The kind's id prefix (kind_meta `identity_account.id_prefix`). */
 export declare const ACCOUNT_ID_PREFIX = "ida";

package/dist/domain/identityaccount/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/constants.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAQvC;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAgBlD;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;;;;GASG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAKtD;AAsBD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,aAAa,CAAC;AAEjD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEvD;AAMD,uDAAuD;AACvD,eAAO,MAAM,oCAAoC,0DACQ,CAAC;AAE1D,2FAA2F;AAC3F,eAAO,MAAM,iBAAiB,kEACmC,CAAC;AAElE,qGAAqG;AACrG,eAAO,MAAM,2BAA2B,0DACiB,CAAC;AAE1D,uGAAuG;AACvG,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,yCACC,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,gFACmC,CAAC;AAEhF,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAEnE"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKlD;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;;;;GASG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAKtD;AAsBD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,aAAa,CAAC;AAEjD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEvD;AAMD,uDAAuD;AACvD,eAAO,MAAM,oCAAoC,0DACQ,CAAC;AAE1D,2FAA2F;AAC3F,eAAO,MAAM,iBAAiB,kEACmC,CAAC;AAElE,qGAAqG;AACrG,eAAO,MAAM,2BAA2B,0DACiB,CAAC;AAE1D,uGAAuG;AACvG,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,yCACC,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,gFACmC,CAAC;AAEhF,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAEnE"}

package/dist/domain/identityaccount/constants.js

@@ -1,41 +1,6 @@
-/**
- * Identity-account domain constants (20260911.11, T01_1_review.md A1, A2,
- * A7): the derived account id, the one function that turns a caller into
- * an issuer subject, and the byte-pinned wire copy.
- *
- * The derived id (A1). A direct account's id is a pure function of its
- * subject: `ida_` + the top 130 bits of sha256(idp_id) as 26 lowercase
- * Crockford-base32 characters. The shape is indistinguishable from a
- * minted `{prefix}_{ulid}`, so nothing downstream learns a second id
- * grammar, and the PRIMARY KEY becomes the one home of "one account per
- * subject": the generic store has no secondary uniqueness and its save is
- * an upsert (`store/sqlite/store.ts`), so a lookup-then-insert on a scan
- * could never close the first-login race. Two replicas deriving the same
- * id converge by primary key with no migration and no second copy of any
- * field. The hash is one-way, so an issuer subject never leaks into the
- * `created_by.id` stamps that ride on every resource. The golden vectors in
- * __tests__/constants.test.ts are wire-adjacent contract: a change here
- * re-addresses every direct account open source ever created.
- *
- * `idpIdOf` (A2) is the ONE place a CallerIdentity becomes a subject. An
- * issuer-vouched token is read for its `sub` (already verified at
- * position 1, so this is a read of trusted state, never a verification);
- * a caller with no issuer and no token is the trusted-local operator,
- * whose subject is `local|<identityId>`. It deliberately knows nothing
- * about API keys: every verifier resolves its stamp to the account when
- * one exists (A6), so a credential's shape is the verifier's business.
- *
- * The copy moved from the cloud's iam/account/handlers.ts as-is: the CLI,
- * console and SDK show these sentences verbatim, so they are contract.
- */
-import { createHash } from "node:crypto";
+import { derivedId } from "../../pipeline/steps/defaults.js";
 /** The kind's id prefix (kind_meta `identity_account.id_prefix`). */
 export const ACCOUNT_ID_PREFIX = "ida";
-/** Crockford base32, lowercased — the alphabet every minted ULID id uses. */
-const CROCKFORD_ALPHABET = "0123456789abcdefghjkmnpqrstvwxyz";
-const DERIVED_ID_CHARS = 26;
-const DERIVED_ID_BITS = BigInt(DERIVED_ID_CHARS * 5);
-const SHA256_BITS = 256n;
 /**
  * The derived account id of a direct account with subject `idpId`. Pure,
  * total over non-empty input; an empty subject has no principal and so
@@ -45,18 +10,7 @@ export function accountIdFor(idpId) {
     if (idpId === "") {
         throw new Error("idp_id must not be empty");
     }
-    const digest = createHash("sha256").update(idpId, "utf8").digest();
-    let bits = 0n;
-    for (const byte of digest) {
-        bits = (bits << 8n) | BigInt(byte);
-    }
-    let top = bits >> (SHA256_BITS - DERIVED_ID_BITS);
-    let encoded = "";
-    for (let i = 0; i < DERIVED_ID_CHARS; i++) {
-        encoded = CROCKFORD_ALPHABET[Number(top & 31n)] + encoded;
-        top >>= 5n;
-    }
-    return `${ACCOUNT_ID_PREFIX}_${encoded}`;
+    return derivedId(ACCOUNT_ID_PREFIX, idpId);
 }
 /**
  * The subject namespace of the trusted-local posture. An OIDC subject is

package/dist/domain/identityaccount/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEvC,6EAA6E;AAC7E,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;AAC9D,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,eAAe,GAAG,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC;AACrD,MAAM,WAAW,GAAG,IAAI,CAAC;AAEzB;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnE,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,WAAW,GAAG,eAAe,CAAC,CAAC;IAClD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,gBAAgB,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC;QAC1D,GAAG,KAAK,EAAE,CAAC;IACb,CAAC;IACD,OAAO,GAAG,iBAAiB,IAAI,OAAO,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAE5C,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,OAAO,GAAG,mBAAmB,GAAG,UAAU,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,OAAO,CAAC,MAAsB;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACnD,OAAO,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACxC,CAAC;QACvB,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAEjD,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;AAChD,CAAC;AAED,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,uDAAuD;AACvD,MAAM,CAAC,MAAM,oCAAoC,GAC/C,uDAAuD,CAAC;AAE1D,2FAA2F;AAC3F,MAAM,CAAC,MAAM,iBAAiB,GAC5B,+DAA+D,CAAC;AAElE,qGAAqG;AACrG,MAAM,CAAC,MAAM,2BAA2B,GACtC,uDAAuD,CAAC;AAE1D,uGAAuG;AACvG,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,OAAO,+BAA+B,MAAM,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,sCAAsC,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAC1C,6EAA6E,CAAC;AAEhF,MAAM,UAAU,8BAA8B,CAAC,MAAc;IAC3D,OAAO,GAAG,MAAM,wBAAwB,+BAA+B,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,aAAqB;IACzD,OAAO,iDAAiD,aAAa,mDAAmD,CAAC;AAC3H,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/constants.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAE7D,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEvC;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAE5C,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,OAAO,GAAG,mBAAmB,GAAG,UAAU,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,OAAO,CAAC,MAAsB;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACnD,OAAO,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACxC,CAAC;QACvB,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAEjD,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;AAChD,CAAC;AAED,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,uDAAuD;AACvD,MAAM,CAAC,MAAM,oCAAoC,GAC/C,uDAAuD,CAAC;AAE1D,2FAA2F;AAC3F,MAAM,CAAC,MAAM,iBAAiB,GAC5B,+DAA+D,CAAC;AAElE,qGAAqG;AACrG,MAAM,CAAC,MAAM,2BAA2B,GACtC,uDAAuD,CAAC;AAE1D,uGAAuG;AACvG,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,OAAO,+BAA+B,MAAM,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,sCAAsC,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAC1C,6EAA6E,CAAC;AAEhF,MAAM,UAAU,8BAA8B,CAAC,MAAc;IAC3D,OAAO,GAAG,MAAM,wBAAwB,+BAA+B,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,aAAqB;IACzD,OAAO,iDAAiD,aAAa,mDAAmD,CAAC;AAC3H,CAAC"}