@stigmer/server 3.15.2 → 3.15.3-dev.20260914100347

package/dist/domain/identityaccount/store-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"store-contract.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/store-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AACjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAE5G,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AA0BnD,0FAA0F;AAC1F,SAAS,aAAa,CAAC,SAItB;IACC,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE;YACR,EAAE,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC;YACjC,IAAI,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK;SACzC;QACD,IAAI,EAAE;YACJ,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE;YAC5B,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,EAAE;YACpC,gBAAgB,EAAE,+BAA+B,CAAC,MAAM;SACzD;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,SAGzB;IACC,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE;QACtE,IAAI,EAAE;YACJ,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,gBAAgB,EAAE,+BAA+B,CAAC,SAAS;YAC3D,mBAAmB,EAAE;gBACnB,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,eAAe,CAAC,iBAAiB;gBACvC,IAAI,EAAE,WAAW;aAClB;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,SAAS,wBAAwB;IAC/B,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,EAAE,EAAE,gCAAgC,EAAE,IAAI,EAAE,aAAa,EAAE;QACvE,IAAI,EAAE;YACJ,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,+BAA+B,CAAC,MAAM;SACzD;KACF,CAAC,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,SAAS,IAAI,CAAC,OAAwB;IACpC,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,oCAAoC,CAAC,CAAC;IAC9D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,UAAU,CAAC,QAAwC;IAC1D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,KAAK,GAA+C;IACxD;QACE,4CAA4C;QAC5C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC;gBAC5B,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,mBAAmB;aAC3B,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAClD,MAAM,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,EAAE,wCAAwC,CAAC,CAAC;YACzE,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,CAAC,EAC7C,0DAA0D,CAC3D,CAAC;QACJ,CAAC;KACF;IACD;QACE,kFAAkF;QAClF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,aAAa,CAAC;gBAC3B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAClB,qBAAqB,EACrB,qFAAqF,CACtF,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,CACV,QAAQ,EAAE,IAAI,EAAE,SAAS,EACzB,OAAO,EACP,6DAA6D,CAC9D,CAAC;QACJ,CAAC;KACF;IACD;QACE,4FAA4F;QAC5F,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACzD,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,QAAQ,EAAE,EAAE,EACjB,YAAY,CAAC,aAAa,CAAC,EAC3B,gEAAgE,CACjE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAC7C,SAAS,EACT,4DAA4D,CAC7D,CAAC;QACJ,CAAC;KACF;IACD;QACE,wDAAwD;QACxD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EACpD,YAAY,EACZ,yDAAyD,CAC1D,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,EACvC,SAAS,EACT,sEAAsE,CACvE,CAAC;QACJ,CAAC;KACF;IACD;QACE,wEAAwE;QACxE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CACd,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAClE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAChE,YAAY,EACZ,oEAAoE,CACrE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EACjD,SAAS,EACT,kEAAkE,CACnE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,EACnD,SAAS,EACT,yCAAyC,CAC1C,CAAC;QACJ,CAAC;KACF;IACD;QACE,mDAAmD;QACnD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC;gBAC5B,KAAK,EAAE,aAAa;gBACpB,SAAS,EAAE,OAAO;aACnB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,MAAM,CAChB,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAC9D,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACpD,MAAM,CAAC,KAAK,CACV,OAAO,EAAE,IAAI,EAAE,SAAS,EACxB,SAAS,EACT,uDAAuD,CACxD,CAAC;YACF,MAAM,CAAC,KAAK,CACV,OAAO,EAAE,QAAQ,EAAE,EAAE,EACrB,IAAI,CAAC,OAAO,CAAC,EACb,4CAA4C,CAC7C,CAAC;QACJ,CAAC;KACF;IACD;QACE,yEAAyE;QACzE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACxD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACtC,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EACnC,SAAS,EACT,8CAA8C,CAC/C,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAC5C,SAAS,EACT,mDAAmD,CACpD,CAAC;YACF,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EACnB,wDAAwD,CACzD,CAAC;QACJ,CAAC;KACF;IACD;QACE,2EAA2E;QAC3E,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACpD,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC;gBACV,gCAAgC;gBAChC,IAAI,CAAC,KAAK,CAAC;aACZ,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CACd,UAAU,CAAC,KAAK,CAAC,EACjB,CAAC,YAAY,EAAE,aAAa,CAAC,EAC7B,wEAAwE,CACzE,CAAC;QACJ,CAAC;KACF;IACD;QACE,oEAAoE;QACpE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAC/C,6EAA6E,CAC9E,CAAC;YACF,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EACpD,yEAAyE,CAC1E,CAAC;QACJ,CAAC;KACF;IACD;QACE,+HAA+H;QAC/H,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;gBACvC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;gBAClE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;aACnE,CAAC,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBACjC,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,MAAM,YAAY,qBAAqB,EAC9C,oEAAoE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAC5F,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,CAAC,EAAE,CACP,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,EACvD,+CAA+C,CAChD,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CACV,MAAM,EAAE,QAAQ,EAAE,EAAE,EACpB,YAAY,CAAC,YAAY,CAAC,EAC1B,4CAA4C,CAC7C,CAAC;QACJ,CAAC;KACF;IACD;QACE,6GAA6G;QAC7G,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CACd,gBAAgB,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CACnE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAC1C,SAAS,EACT,mEAAmE,CACpE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAChD,SAAS,EACT,iEAAiE,CAClE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAC9D,+BAA+B,CAAC,SAAS,EACzC,+DAA+D,CAChE,CAAC;QACJ,CAAC;KACF;IACD;QACE,8GAA8G;QAC9G,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,MAAM,CAAC,SAAS,CACd,UAAU,CACR,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CACtE,EACD,CAAC,WAAW,EAAE,YAAY,CAAC,EAC3B,uDAAuD,CACxD,CAAC;YACF,MAAM,CAAC,SAAS,CACd,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EACzB,EAAE,EACF,wDAAwD,CACzD,CAAC;QACJ,CAAC;KACF;IACD;QACE,oDAAoD;QACpD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EACjC,SAAS,EACT,0EAA0E,CAC3E,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAC5C,SAAS,EACT,+EAA+E,CAChF,CAAC;QACJ,CAAC;KACF;IACD;QACE,sCAAsC;QACtC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EAC9C,0DAA0D,CAC3D,CAAC;QACJ,CAAC;KACF;IACD;QACE,oDAAoD;QACpD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,EACtC,qFAAqF,CACtF,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAEF;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,WAA+D,EAC/D,IAAc;IAEd,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,YAAY,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,4BAA4B,CAC1C,WAA+D;IAE/D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI;QACJ,GAAG,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC;KAC1C,CAAC,CAAC,CAAC;AACN,CAAC"}
+{"version":3,"file":"store-contract.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/store-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AACjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAE5G,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAMjE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AASnD,0FAA0F;AAC1F,SAAS,aAAa,CAAC,SAItB;IACC,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE;YACR,EAAE,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC;YACjC,IAAI,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK;SACzC;QACD,IAAI,EAAE;YACJ,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE;YAC5B,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,EAAE;YACpC,gBAAgB,EAAE,+BAA+B,CAAC,MAAM;SACzD;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,SAGzB;IACC,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE;QACtE,IAAI,EAAE;YACJ,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,gBAAgB,EAAE,+BAA+B,CAAC,SAAS;YAC3D,mBAAmB,EAAE;gBACnB,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,eAAe,CAAC,iBAAiB;gBACvC,IAAI,EAAE,WAAW;aAClB;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,SAAS,wBAAwB;IAC/B,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,EAAE,EAAE,gCAAgC,EAAE,IAAI,EAAE,aAAa,EAAE;QACvE,IAAI,EAAE;YACJ,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,+BAA+B,CAAC,MAAM;SACzD;KACF,CAAC,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,SAAS,IAAI,CAAC,OAAwB;IACpC,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,oCAAoC,CAAC,CAAC;IAC9D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,UAAU,CAAC,QAAwC;IAC1D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,KAAK,GAAiE;IAC1E;QACE,4CAA4C;QAC5C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC;gBAC5B,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,mBAAmB;aAC3B,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAClD,MAAM,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,EAAE,wCAAwC,CAAC,CAAC;YACzE,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,CAAC,EAC7C,0DAA0D,CAC3D,CAAC;QACJ,CAAC;KACF;IACD;QACE,kFAAkF;QAClF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,aAAa,CAAC;gBAC3B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAClB,qBAAqB,EACrB,qFAAqF,CACtF,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,CACV,QAAQ,EAAE,IAAI,EAAE,SAAS,EACzB,OAAO,EACP,6DAA6D,CAC9D,CAAC;QACJ,CAAC;KACF;IACD;QACE,4FAA4F;QAC5F,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACzD,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,QAAQ,EAAE,EAAE,EACjB,YAAY,CAAC,aAAa,CAAC,EAC3B,gEAAgE,CACjE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAC7C,SAAS,EACT,4DAA4D,CAC7D,CAAC;QACJ,CAAC;KACF;IACD;QACE,wDAAwD;QACxD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EACpD,YAAY,EACZ,yDAAyD,CAC1D,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,EACvC,SAAS,EACT,sEAAsE,CACvE,CAAC;QACJ,CAAC;KACF;IACD;QACE,wEAAwE;QACxE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CACd,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAClE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAChE,YAAY,EACZ,oEAAoE,CACrE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EACjD,SAAS,EACT,kEAAkE,CACnE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,EACnD,SAAS,EACT,yCAAyC,CAC1C,CAAC;QACJ,CAAC;KACF;IACD;QACE,mDAAmD;QACnD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC;gBAC5B,KAAK,EAAE,aAAa;gBACpB,SAAS,EAAE,OAAO;aACnB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,MAAM,CAChB,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAC9D,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACpD,MAAM,CAAC,KAAK,CACV,OAAO,EAAE,IAAI,EAAE,SAAS,EACxB,SAAS,EACT,uDAAuD,CACxD,CAAC;YACF,MAAM,CAAC,KAAK,CACV,OAAO,EAAE,QAAQ,EAAE,EAAE,EACrB,IAAI,CAAC,OAAO,CAAC,EACb,4CAA4C,CAC7C,CAAC;QACJ,CAAC;KACF;IACD;QACE,yEAAyE;QACzE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACxD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACtC,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EACnC,SAAS,EACT,8CAA8C,CAC/C,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAC5C,SAAS,EACT,mDAAmD,CACpD,CAAC;YACF,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EACnB,wDAAwD,CACzD,CAAC;QACJ,CAAC;KACF;IACD;QACE,2EAA2E;QAC3E,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACpD,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC;gBACV,gCAAgC;gBAChC,IAAI,CAAC,KAAK,CAAC;aACZ,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CACd,UAAU,CAAC,KAAK,CAAC,EACjB,CAAC,YAAY,EAAE,aAAa,CAAC,EAC7B,wEAAwE,CACzE,CAAC;QACJ,CAAC;KACF;IACD;QACE,oEAAoE;QACpE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAC/C,6EAA6E,CAC9E,CAAC;YACF,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EACpD,yEAAyE,CAC1E,CAAC;QACJ,CAAC;KACF;IACD;QACE,+HAA+H;QAC/H,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;gBACvC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;gBAClE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;aACnE,CAAC,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBACjC,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,MAAM,YAAY,qBAAqB,EAC9C,oEAAoE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAC5F,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,CAAC,EAAE,CACP,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,EACvD,+CAA+C,CAChD,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CACV,MAAM,EAAE,QAAQ,EAAE,EAAE,EACpB,YAAY,CAAC,YAAY,CAAC,EAC1B,4CAA4C,CAC7C,CAAC;QACJ,CAAC;KACF;IACD;QACE,6GAA6G;QAC7G,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CACd,gBAAgB,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CACnE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAC1C,SAAS,EACT,mEAAmE,CACpE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAChD,SAAS,EACT,iEAAiE,CAClE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAC9D,+BAA+B,CAAC,SAAS,EACzC,+DAA+D,CAChE,CAAC;QACJ,CAAC;KACF;IACD;QACE,8GAA8G;QAC9G,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,MAAM,CAAC,SAAS,CACd,UAAU,CACR,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CACtE,EACD,CAAC,WAAW,EAAE,YAAY,CAAC,EAC3B,uDAAuD,CACxD,CAAC;YACF,MAAM,CAAC,SAAS,CACd,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EACzB,EAAE,EACF,wDAAwD,CACzD,CAAC;QACJ,CAAC;KACF;IACD;QACE,oDAAoD;QACpD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EACjC,SAAS,EACT,0EAA0E,CAC3E,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAC5C,SAAS,EACT,+EAA+E,CAChF,CAAC;QACJ,CAAC;KACF;IACD;QACE,sCAAsC;QACtC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EAC9C,0DAA0D,CAC3D,CAAC;QACJ,CAAC;KACF;IACD;QACE,oDAAoD;QACpD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,EACtC,qFAAqF,CACtF,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAEF,uEAAuE;AACvE,MAAM,UAAU,4BAA4B,CAC1C,WAA+D;IAE/D,OAAO,iBAAiB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC"}

package/dist/extensions/authorization-queries.d.ts

@@ -0,0 +1,81 @@
+/**
+ * The authorization-query capability (20260913.01, T01_1_review.md Q-OR-8):
+ * the TUPLE half of the IamPolicy query surface — the questions only an
+ * authorization engine can answer over its own graph, as opposed to the
+ * ROW half (who holds which role on what) that every edition answers from
+ * IamPolicy rows. Single instance, registered as
+ * `drivers.authorizationQueries` (the identityFederation shape: a driver
+ * point that is open source's own behaviour when absent).
+ *
+ * Absent, the IamPolicy query controller refuses `checkAuthorization`,
+ * `listAuthorizedResourceIds`, `listAuthorizedPrincipalIds`, and a
+ * `checkMyPermission` that carries contextual policies, UNIMPLEMENTED with
+ * the edition reason (domain/iampolicy/constants.ts
+ * AUTHORIZATION_QUERIES_UNIMPLEMENTED_MESSAGE) — never INTERNAL, the
+ * organization directory's absent-method precedent. Present, the
+ * controller still owns everything that is not the graph question: the
+ * annotation's Authorize step, `checkAuthorization`'s principal-trust rule
+ * (a user asks only about their own account; machine and internal about
+ * anyone), the UNAUTHENTICATED refusal, and the plain
+ * `checkMyPermission` that rides the composed Authorizer instead. The
+ * engine receives boundary-validated refs and never asks who is calling.
+ *
+ * The engine speaks the CONTRACT's vocabulary, not a backend's (Q-S3-1,
+ * 2026-09-13): `ApiResourceRef` for a principal or resource (kind = the
+ * enum member name, id, and for a principal an optional relation — the
+ * userset form `organization:X#member`), `IamPolicySpec` for a policy and
+ * for the what-if policies every query may carry, and the relation and
+ * kind strings as the wire sends them. The cloud's driver renders these to
+ * OpenFGA's `type:id#relation` strings itself; that grammar belongs to the
+ * store that runs it and never enters this library.
+ *
+ * Semantics the controller and the conformance suite rely on (the Java
+ * check-handler posture the cloud's client already implements):
+ *
+ *   - `check` answers a public grant (a wildcard principal resolves), so
+ *     "may I read this public agent" is true for anyone.
+ *   - the two listings never expand wildcards, and `listPrincipalIds`
+ *     answers DIRECT principals only — a listing is an inventory of who
+ *     was named, never a resolution of who could reach.
+ *   - contextual policies are evaluated as if held, and nothing is written.
+ *
+ * Error doctrine (the ListReadScope rule, verbatim in spirit: a seam that
+ * cannot answer THROWS — never an empty set, never false): `false` and
+ * `[]` are REAL answers. A backend outage surfaces as a throw; a
+ * ConnectError keeps its code (the cloud maps its three OpenFGA wire arms —
+ * DEADLINE_EXCEEDED, UNAVAILABLE, INTERNAL — before throwing), any other
+ * throw is INTERNAL through the pipeline's boundary. A denial dressed as
+ * an outage, or an outage dressed as a denial, is the fail-open class this
+ * contract exists to refuse.
+ *
+ * Why this is not `ListReadScope`: the read scope narrows the server's OWN
+ * list lanes for the calling identity with no what-if input; this engine
+ * answers the wire's explicit queries about an ARBITRARY principal with
+ * contextual policies. Both are ratified seams with distinct consumers;
+ * a cloud driver may wrap one client for both, and that is its business.
+ */
+import type { ApiResourceRef, IamPolicySpec } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
+/** The query-engine contract (single-instance point, ExtensionDrivers.authorizationQueries). */
+export interface AuthorizationQueryEngine {
+    /**
+     * Whether `policy` is effectively held — its principal has its relation
+     * on its resource — given `contextualPolicies` evaluated as if held.
+     * The proto's CheckAuthorizationInput shape; `checkMyPermission` builds
+     * the spec from the caller's account ref. The spec's refs are present
+     * (boundary-validated, or controller-built).
+     */
+    check(policy: IamPolicySpec, contextualPolicies: ReadonlyArray<IamPolicySpec>): Promise<boolean>;
+    /**
+     * The ids of `resourceKind` resources on which `principal` holds
+     * `relation` (ListAuthorizedResourceIdsInput's field order). Wildcards
+     * are not expanded.
+     */
+    listResourceIds(principal: ApiResourceRef, relation: string, resourceKind: string, contextualPolicies: ReadonlyArray<IamPolicySpec>): Promise<ReadonlyArray<string>>;
+    /**
+     * The ids of `principalKind` principals holding `relation` on `resource`
+     * (ListAuthorizedPrincipalIdsInput's field order). Direct principals
+     * only; wildcards are not expanded.
+     */
+    listPrincipalIds(resource: ApiResourceRef, relation: string, principalKind: string, contextualPolicies: ReadonlyArray<IamPolicySpec>): Promise<ReadonlyArray<string>>;
+}
+//# sourceMappingURL=authorization-queries.d.ts.map

package/dist/extensions/authorization-queries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-queries.d.ts","sourceRoot":"","sources":["../../src/extensions/authorization-queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACd,MAAM,qDAAqD,CAAC;AAE7D,gGAAgG;AAChG,MAAM,WAAW,wBAAwB;IACvC;;;;;;OAMG;IACH,KAAK,CACH,MAAM,EAAE,aAAa,EACrB,kBAAkB,EAAE,aAAa,CAAC,aAAa,CAAC,GAC/C,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB;;;;OAIG;IACH,eAAe,CACb,SAAS,EAAE,cAAc,EACzB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,kBAAkB,EAAE,aAAa,CAAC,aAAa,CAAC,GAC/C,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAClC;;;;OAIG;IACH,gBAAgB,CACd,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,kBAAkB,EAAE,aAAa,CAAC,aAAa,CAAC,GAC/C,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;CACnC"}

package/dist/extensions/authorization-queries.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=authorization-queries.js.map

package/dist/extensions/authorization-queries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-queries.js","sourceRoot":"","sources":["../../src/extensions/authorization-queries.ts"],"names":[],"mappings":""}

package/dist/extensions/drivers.d.ts

@@ -26,6 +26,11 @@
  *   - identity-account store + identity federation (the first domain
  *     whose persistence is a PORT, and the four federated RPC arms only
  *     one edition serves) — landed with 20260911.11, gate ruling Q-IA-9
+ *   - IamPolicy store + policy grant scope + authorization queries (the
+ *     IamPolicy domain's row half served in every edition; the store
+ *     port, which kinds an edition grants on, and the tuple-half query
+ *     engine only an authorization backend can answer) — landed with
+ *     20260913.01, gate ruling Q-OR-10
  *
  * Merge rules (enforced by resolveExtensions, DD-006 §2b): the two
  * provider kinds are single-instance points — a second declaring unit is
@@ -40,14 +45,17 @@
 import type { ArtifactStorageDriverFactory } from "../artifactstorage/artifact-storage.js";
 import type { ChannelRuntime } from "../domain/agentchannel/channel-runtime.js";
 import type { IdentityAccountStore } from "../domain/identityaccount/store.js";
+import type { IamPolicyStore } from "../domain/iampolicy/store.js";
 import type { SecretCodec } from "../encryption/codec.js";
 import type { ModelCatalogProvider } from "../domain/workflow/registry/model-catalog-provider.js";
 import type { VisitorErrorPolicy } from "../pipeline/interceptors/error-boundary.js";
 import type { RunnerCredentialProvider } from "../runnerauth/runner-credential-provider.js";
 import type { SandboxProvisionerFactory } from "../sandbox/provisioner.js";
+import type { AuthorizationQueryEngine } from "./authorization-queries.js";
 import type { IdentityFederation } from "./identity-federation.js";
 import type { ListReadScope } from "./list-read-scope.js";
 import type { OrganizationDirectory } from "./organization-directory.js";
+import type { PolicyGrantScope } from "./policy-grant-scope.js";
 import type { ResourceAuthorizationLifecycle } from "./resource-authorization.js";
 import type { ScheduleFireCallerMint } from "./schedule-fire-caller.js";
 /** The driver contributions of one extension unit. */
@@ -83,8 +91,13 @@ export interface ExtensionDrivers {
      * The resource-authorization lifecycle seam (C2, ruling Q2;
      * single-instance point). When composed, the three shared tuple steps
      * (CreateAuthorizationTuples / CleanupIamPolicies /
-     * UpdateVisibilityTuples) deliver resolved events to it; when absent,
-     * those steps no-op — OSS behavior byte-identical.
+     * UpdateVisibilityTuples) deliver resolved events to it, and the
+     * IamPolicy grant path delivers the two policy hooks. Corrected
+     * 2026-09-13 (20260913.01 Q-OR-6): when absent, the steps no-op, but
+     * open source is no longer record-less — the composition root installs
+     * the built-in role lifecycle (domain/iampolicy/role-lifecycle.ts, the
+     * entry's slice 4), which writes IamPolicy rows, whenever no extension
+     * registers an Authorizer (resource-authorization.ts header).
      */
     readonly resourceAuthorizationLifecycle?: ResourceAuthorizationLifecycle;
     /**
@@ -162,5 +175,39 @@ export interface ExtensionDrivers {
      * edition reason — the organizationDirectory absent-method shape.
      */
     readonly identityFederation?: IdentityFederation;
+    /**
+     * The IamPolicy store driver (20260913.01, Q-OR-10; single-instance
+     * point). The IamPolicy domain's persistence is a PORT like the
+     * identity-account domain's: when composed, every row the one grant
+     * path writes, deletes or reads — user grants, the structural
+     * bootstrap lanes, the access lists and counts — goes through this
+     * driver (the cloud serves the domain over its own `cloud.iam_policy`
+     * table this way, legacy random ids included). When absent, the OSS
+     * adapter over the generic Store installs at the compose.ts
+     * consumption site — OSS behavior byte-identical.
+     */
+    readonly iamPolicyStore?: IamPolicyStore;
+    /**
+     * The policy grant scope (20260913.01, Q-OR-3; single-instance point):
+     * which kinds a user may grant a role on in this edition, with which
+     * roles. Narrows the proto's `grantable_roles`, total over the enum,
+     * synchronous (policy-grant-scope.ts carries the reasons). When
+     * composed, ValidateGrantableRole and checkMyPermission's
+     * `can_grant_access` arm read it; when absent, open source's
+     * organization-only default installs at the compose.ts consumption
+     * site — the organization grants its four proto roles, nothing else
+     * grants anything.
+     */
+    readonly policyGrantScope?: PolicyGrantScope;
+    /**
+     * The authorization-query engine (20260913.01, Q-OR-8; single-instance
+     * point): the tuple-half questions — checkAuthorization, the two
+     * listAuthorized*Ids, a checkMyPermission with contextual policies —
+     * only an authorization backend can answer over its own graph. When
+     * composed, the IamPolicy query controller dispatches to it after its
+     * own trust checks; when absent, those RPC arms refuse UNIMPLEMENTED
+     * with the edition reason — the identityFederation absent shape.
+     */
+    readonly authorizationQueries?: AuthorizationQueryEngine;
 }
 //# sourceMappingURL=drivers.d.ts.map

package/dist/extensions/drivers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"drivers.d.ts","sourceRoot":"","sources":["../../src/extensions/drivers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,WAAW,CAC3C,MAAM,EACN,4BAA4B,CAC7B,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,WAAW,CAC9C,MAAM,EACN,yBAAyB,CAC1B,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC;IACzE;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IACrD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CAClD"}
+{"version":3,"file":"drivers.d.ts","sourceRoot":"","sources":["../../src/extensions/drivers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,WAAW,CAC3C,MAAM,EACN,4BAA4B,CAC7B,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,WAAW,CAC9C,MAAM,EACN,yBAAyB,CAC1B,CAAC;IACF;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC;IACzE;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IACrD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,wBAAwB,CAAC;CAC1D"}

package/dist/extensions/identity.d.ts

@@ -88,4 +88,18 @@ export interface IdentityVerifier {
      */
     verify(token: string): Promise<CallerIdentity | null>;
 }
+/**
+ * Whether `caller` is one of the platform's own pipelines — the admission
+ * rule of the RPCs a person must never reach directly, stated ONCE
+ * (20260911.11 A7 for the identity-account `create` RPC; 20260913.01
+ * Q-OR-7 and Q-S5-10 for the three IamPolicy system RPCs): a `machine`
+ * account (the platform's service accounts), the `internal` class (the
+ * server acting as itself over the in-process transport) or ANY identity
+ * that entered through that transport (a propagated user the server is
+ * composing a request for). A wire `user`, a `runner` and a composition's
+ * own classes are refused by the RPC that reads this — under the
+ * permissive Authorizer the annotation alone would admit anyone, so the
+ * rule is load-bearing in open source.
+ */
+export declare function isPlatformPipelineCaller(caller: CallerIdentity): boolean;
 //# sourceMappingURL=identity.d.ts.map

package/dist/extensions/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/extensions/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,SAAS,GACT,QAAQ,GACR,UAAU,GACV,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,YAAY,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;CACvD"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/extensions/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,SAAS,GACT,QAAQ,GACR,UAAU,GACV,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,YAAY,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAMxE"}

package/dist/extensions/identity.js

@@ -12,5 +12,22 @@
  * HandlerContext.values (never ambient state — the every-dependency-
  * explicit doctrine).
  */
-export {};
+/**
+ * Whether `caller` is one of the platform's own pipelines — the admission
+ * rule of the RPCs a person must never reach directly, stated ONCE
+ * (20260911.11 A7 for the identity-account `create` RPC; 20260913.01
+ * Q-OR-7 and Q-S5-10 for the three IamPolicy system RPCs): a `machine`
+ * account (the platform's service accounts), the `internal` class (the
+ * server acting as itself over the in-process transport) or ANY identity
+ * that entered through that transport (a propagated user the server is
+ * composing a request for). A wire `user`, a `runner` and a composition's
+ * own classes are refused by the RPC that reads this — under the
+ * permissive Authorizer the annotation alone would admit anyone, so the
+ * rule is load-bearing in open source.
+ */
+export function isPlatformPipelineCaller(caller) {
+    return (caller.callerClass === "machine" ||
+        caller.callerClass === "internal" ||
+        caller.origin === "in-process");
+}
 //# sourceMappingURL=identity.js.map

package/dist/extensions/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/extensions/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/extensions/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAuFH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAsB;IAC7D,OAAO,CACL,MAAM,CAAC,WAAW,KAAK,SAAS;QAChC,MAAM,CAAC,WAAW,KAAK,UAAU;QACjC,MAAM,CAAC,MAAM,KAAK,YAAY,CAC/B,CAAC;AACJ,CAAC"}

package/dist/extensions/policy-grant-scope.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The policy-grant-scope driver point (20260913.01; the P1 gate's Q7 iii,
+ * T01_1_review.md Q-OR-3): WHICH kinds a user may grant a role on in this
+ * edition, and with which roles. Single instance, registered as
+ * `drivers.policyGrantScope` (the identityFederation shape: a driver point
+ * whose absence is open source's own behaviour). Absent, the composition
+ * root installs `newOrganizationOnlyGrantScope()`
+ * (domain/iampolicy/grant-scope.ts): the organization grants the roles its
+ * `kind_meta` lists — owner, admin, member, viewer (Q-OR-4) — and no other
+ * kind grants anything. Per-resource grants (a viewer on one agent) are
+ * what the Enterprise and Cloud editions add by registering a wider scope;
+ * the cloud registers every kind's `kind_meta` roles.
+ *
+ * Who reads it: the IamPolicy command controller's ValidateGrantableRole on
+ * `create` — AFTER the proto (`grantableRolesFor` in
+ * pipeline/apiresource-meta.ts, the source of "what can be granted at
+ * all"; a kind that lists no roles is system-managed in every edition and
+ * refused before the scope is asked) and never on `bootstrapPolicy`, the
+ * structural lane — and `checkMyPermission`'s second arm, which answers
+ * `can_grant_access` false for a kind outside the scope so the console's
+ * existing PermissionGate hides grant controls without a new SDK surface
+ * (Q-OR-5).
+ *
+ * The contract every scope is held to (Q-S3-3, 2026-09-13):
+ *
+ *   - It NARROWS the proto, never widens it. A scope's answer for a kind is
+ *     read as a subset of `kind_meta.authorization.grantable_roles`;
+ *     ValidateGrantableRole intersects the two, so a driver cannot admit a
+ *     role the contract does not list by accident.
+ *   - It is TOTAL over ApiResourceKind, the unknown kind included: a kind
+ *     it does not admit answers the empty list, never a throw.
+ *     checkMyPermission asks about a kind that came off the wire and was
+ *     resolved by `kindByEnumName`, which yields the unknown kind rather
+ *     than failing (apiresource-meta.ts header).
+ *   - It is SYNCHRONOUS: an edition's grant scope is a fact about the
+ *     edition, a proto read at most, never I/O. A scope that would need a
+ *     network to answer is a different seam.
+ */
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+/** The grant-scope contract (single-instance point, ExtensionDrivers.policyGrantScope). */
+export interface PolicyGrantScope {
+    /**
+     * The roles a user may grant on a resource of `kind` in this edition — a
+     * subset of the kind's proto `grantable_roles`; empty when the edition
+     * grants nothing on the kind (or the kind is unknown). Never throws.
+     */
+    grantableRoles(kind: ApiResourceKind): ReadonlyArray<IamRole>;
+}
+//# sourceMappingURL=policy-grant-scope.d.ts.map

package/dist/extensions/policy-grant-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-grant-scope.d.ts","sourceRoot":"","sources":["../../src/extensions/policy-grant-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAC3H,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAEzE,2FAA2F;AAC3F,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;CAC/D"}

package/dist/extensions/policy-grant-scope.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=policy-grant-scope.js.map

package/dist/extensions/policy-grant-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-grant-scope.js","sourceRoot":"","sources":["../../src/extensions/policy-grant-scope.ts"],"names":[],"mappings":""}

package/dist/extensions/registry.d.ts

@@ -34,7 +34,10 @@
  * points (20260911.11) at the identity-accounts stage (the store driver,
  * ahead of the boot-time operator ensure) and the routes stage (the
  * federation capability and the provision slot's steps, into the
- * identity-account controller).
+ * identity-account controller); the IamPolicy points (20260913.01) at
+ * the same two stages — the store driver where the grant path is built,
+ * beside the identity-account store, and the grant scope and the query
+ * engine into the IamPolicy controller at the routes stage.
  */
 import type { DescMessage } from "@bufbuild/protobuf";
 import type { ConnectRouter } from "@connectrpc/connect";
@@ -42,9 +45,12 @@ import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_inf
 import type { ArtifactStorageDriverFactory } from "../artifactstorage/artifact-storage.js";
 import type { ChannelRuntime } from "../domain/agentchannel/channel-runtime.js";
 import type { IdentityAccountStore } from "../domain/identityaccount/store.js";
+import type { IamPolicyStore } from "../domain/iampolicy/store.js";
 import type { SecretCodec } from "../encryption/codec.js";
+import type { AuthorizationQueryEngine } from "./authorization-queries.js";
 import type { IdentityFederation } from "./identity-federation.js";
 import type { ListReadScope } from "./list-read-scope.js";
+import type { PolicyGrantScope } from "./policy-grant-scope.js";
 import type { ModelCatalogProvider } from "../domain/workflow/registry/model-catalog-provider.js";
 import type { VisitorErrorPolicy } from "../pipeline/interceptors/error-boundary.js";
 import type { PipelineStep } from "../pipeline/pipeline.js";
@@ -227,6 +233,22 @@ export interface ResolvedExtensionDrivers {
      * four federated RPCs refuse UNIMPLEMENTED with the edition reason.
      */
     readonly identityFederation: IdentityFederation | undefined;
+    /**
+     * The 20260913.01 IamPolicy store driver — undefined = the compose.ts
+     * stage that builds the grant path installs the OSS adapter over the
+     * generic Store, OSS behavior byte-identical.
+     */
+    readonly iamPolicyStore: IamPolicyStore | undefined;
+    /**
+     * The 20260913.01 policy grant scope — undefined = compose.ts installs
+     * open source's organization-only default.
+     */
+    readonly policyGrantScope: PolicyGrantScope | undefined;
+    /**
+     * The 20260913.01 authorization-query engine — undefined = the
+     * tuple-half RPC arms refuse UNIMPLEMENTED with the edition reason.
+     */
+    readonly authorizationQueries: AuthorizationQueryEngine | undefined;
 }
 /**
  * Merges the composed units, enforcing the §2b loud-fail rules. Runs

package/dist/extensions/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/extensions/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAE3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,KAAK,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC7B,MAAM,mBAAmB,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;AAE3E;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAC9B,YAAY,EACZ,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CACzC,CAAC;IACF,oEAAoE;IACpE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,yBAAyB,CAAC;IAC3D,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IAChE,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CACjD;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC5E;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC5D,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAClD,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IACtE,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,+BAA+B,CAAC,CAAC;IAC5E,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IAC/D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,wBAAwB,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACxE,0EAA0E;IAC1E,QAAQ,CAAC,8BAA8B,EACnC,8BAA8B,GAC9B,SAAS,CAAC;IACd,sEAAsE;IACtE,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAClE,uEAAuE;IACvE,QAAQ,CAAC,sBAAsB,EAAE,WAAW,CAC1C,MAAM,EACN,4BAA4B,CAC7B,CAAC;IACF,6EAA6E;IAC7E,QAAQ,CAAC,yBAAyB,EAAE,WAAW,CAC7C,MAAM,EACN,yBAAyB,CAC1B,CAAC;IACF;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,SAAS,CAAC;IACpD,uEAAuE;IACvE,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC5D;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAChE;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAChE;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAC7D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,GAAE,aAAa,CAAC,eAAe,CAAM,GACzC,kBAAkB,CAoUpB"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/extensions/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAE3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,KAAK,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC7B,MAAM,mBAAmB,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;AAE3E;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAC9B,YAAY,EACZ,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CACzC,CAAC;IACF,oEAAoE;IACpE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,yBAAyB,CAAC;IAC3D,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IAChE,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CACjD;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC5E;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC5D,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAClD,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IACtE,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,+BAA+B,CAAC,CAAC;IAC5E,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IAC/D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,wBAAwB,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACxE,0EAA0E;IAC1E,QAAQ,CAAC,8BAA8B,EACnC,8BAA8B,GAC9B,SAAS,CAAC;IACd,sEAAsE;IACtE,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAClE,uEAAuE;IACvE,QAAQ,CAAC,sBAAsB,EAAE,WAAW,CAC1C,MAAM,EACN,4BAA4B,CAC7B,CAAC;IACF,6EAA6E;IAC7E,QAAQ,CAAC,yBAAyB,EAAE,WAAW,CAC7C,MAAM,EACN,yBAAyB,CAC1B,CAAC;IACF;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,SAAS,CAAC;IACpD,uEAAuE;IACvE,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC5D;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAChE;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAChE;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC5D;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,SAAS,CAAC;IACpD;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACxD;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,EAAE,wBAAwB,GAAG,SAAS,CAAC;CACrE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,GAAE,aAAa,CAAC,eAAe,CAAM,GACzC,kBAAkB,CA2WpB"}

package/dist/extensions/registry.js

@@ -43,6 +43,12 @@ export function resolveExtensions(units = []) {
     let identityAccountStoreDeclaredBy;
     let identityFederation;
     let identityFederationDeclaredBy;
+    let iamPolicyStore;
+    let iamPolicyStoreDeclaredBy;
+    let policyGrantScope;
+    let policyGrantScopeDeclaredBy;
+    let authorizationQueries;
+    let authorizationQueriesDeclaredBy;
     const artifactStorageDrivers = new Map();
     const storageDriverDeclaredBy = new Map();
     const sandboxProvisionerDrivers = new Map();
@@ -151,6 +157,27 @@ export function resolveExtensions(units = []) {
             identityFederation = unit.drivers.identityFederation;
             identityFederationDeclaredBy = unit.name;
         }
+        if (unit.drivers?.iamPolicyStore !== undefined) {
+            if (iamPolicyStoreDeclaredBy !== undefined) {
+                throw new Error(`extension '${unit.name}' registers an IamPolicyStore, but '${iamPolicyStoreDeclaredBy}' already did — exactly one may be composed`);
+            }
+            iamPolicyStore = unit.drivers.iamPolicyStore;
+            iamPolicyStoreDeclaredBy = unit.name;
+        }
+        if (unit.drivers?.policyGrantScope !== undefined) {
+            if (policyGrantScopeDeclaredBy !== undefined) {
+                throw new Error(`extension '${unit.name}' registers a PolicyGrantScope, but '${policyGrantScopeDeclaredBy}' already did — exactly one may be composed`);
+            }
+            policyGrantScope = unit.drivers.policyGrantScope;
+            policyGrantScopeDeclaredBy = unit.name;
+        }
+        if (unit.drivers?.authorizationQueries !== undefined) {
+            if (authorizationQueriesDeclaredBy !== undefined) {
+                throw new Error(`extension '${unit.name}' registers an AuthorizationQueryEngine, but '${authorizationQueriesDeclaredBy}' already did — exactly one may be composed`);
+            }
+            authorizationQueries = unit.drivers.authorizationQueries;
+            authorizationQueriesDeclaredBy = unit.name;
+        }
         if (unit.drivers?.artifactStorageDrivers !== undefined) {
             for (const [name, factory] of unit.drivers.artifactStorageDrivers) {
                 if (BUILT_IN_STORAGE_TYPES.includes(name)) {
@@ -242,6 +269,9 @@ export function resolveExtensions(units = []) {
             scheduleFireCaller,
             identityAccountStore,
             identityFederation,
+            iamPolicyStore,
+            policyGrantScope,
+            authorizationQueries,
         },
         services,
         workers,

package/dist/extensions/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/extensions/registry.ts"],"names":[],"mappings":"AAyCA,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAGtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAIhF,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AASvD,OAAO,EAAE,kCAAkC,EAAE,MAAM,2BAA2B,CAAC;AAK/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAgMtD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAwC,EAAE;IAE1C,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,iBAAiB,GAAuB,EAAE,CAAC;IACjD,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC9E,MAAM,eAAe,GAAmC,EAAE,CAAC;IAC3D,MAAM,kBAAkB,GAAsC,EAAE,CAAC;IACjE,MAAM,QAAQ,GAAmC,EAAE,CAAC;IACpD,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,IAAI,OAAkC,CAAC;IACvC,IAAI,iBAAqC,CAAC;IAC1C,IAAI,+BAAmD,CAAC;IACxD,IAAI,UAAkC,CAAC;IACvC,IAAI,oBAAwC,CAAC;IAC7C,IAAI,oBAAsD,CAAC;IAC3D,IAAI,iBAAqC,CAAC;IAC1C,IAAI,wBAA8D,CAAC;IACnE,IAAI,oBAAwC,CAAC;IAC7C,IAAI,8BAES,CAAC;IACd,IAAI,gCAAoD,CAAC;IACzD,IAAI,qBAAwD,CAAC;IAC7D,IAAI,+BAAmD,CAAC;IACxD,IAAI,cAA0C,CAAC;IAC/C,IAAI,wBAA4C,CAAC;IACjD,IAAI,aAAwC,CAAC;IAC7C,IAAI,uBAA2C,CAAC;IAChD,IAAI,kBAAkD,CAAC;IACvD,IAAI,4BAAgD,CAAC;IACrD,IAAI,kBAAsD,CAAC;IAC3D,IAAI,4BAAgD,CAAC;IACrD,IAAI,oBAAsD,CAAC;IAC3D,IAAI,8BAAkD,CAAC;IACvD,IAAI,kBAAkD,CAAC;IACvD,IAAI,4BAAgD,CAAC;IACrD,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAGnC,CAAC;IACJ,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1D,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAGtC,CAAC;IACJ,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAExD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,uHAAuH,CACxH,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,CAAC,IAAI,4DAA4D,CACnG,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE1B,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,OAAO,KAAK,aAAa,CAAC,0BAA0B,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,gGAAgG,CACxH,CAAC;YACJ,CAAC;YACD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,uCAAuC,iBAAiB,+DAA+D,CAC/I,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YACvB,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC;QAChC,CAAC;QAED,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YAC7C,IAAI,+BAA+B,KAAK,SAAS,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,uDAAuD,+BAA+B,sDAAsD,CACpK,CAAC;YACJ,CAAC;YACD,+BAA+B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC9C,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,mCAAmC,oBAAoB,wDAAwD,CACvI,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YAC7B,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACrD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,4CAA4C,iBAAiB,6CAA6C,CAClI,CAAC;YACJ,CAAC;YACD,oBAAoB,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;YACzD,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC;QAChC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,wBAAwB,KAAK,SAAS,EAAE,CAAC;YACzD,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,gDAAgD,oBAAoB,6CAA6C,CACzI,CAAC;YACJ,CAAC;YACD,wBAAwB,GAAG,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC;YACjE,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,8BAA8B,KAAK,SAAS,EAAE,CAAC;YAC/D,IAAI,gCAAgC,KAAK,SAAS,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,sDAAsD,gCAAgC,6CAA6C,CAC3J,CAAC;YACJ,CAAC;YACD,8BAA8B;gBAC5B,IAAI,CAAC,OAAO,CAAC,8BAA8B,CAAC;YAC9C,gCAAgC,GAAG,IAAI,CAAC,IAAI,CAAC;QAC/C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,qBAAqB,KAAK,SAAS,EAAE,CAAC;YACtD,IAAI,+BAA+B,KAAK,SAAS,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,8CAA8C,+BAA+B,6CAA6C,CAClJ,CAAC;YACJ,CAAC;YACD,qBAAqB,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC;YAC3D,+BAA+B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC9C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,cAAc,KAAK,SAAS,EAAE,CAAC;YAC/C,IAAI,wBAAwB,KAAK,SAAS,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,sCAAsC,wBAAwB,6CAA6C,CACnI,CAAC;YACJ,CAAC;YACD,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YAC7C,wBAAwB,GAAG,IAAI,CAAC,IAAI,CAAC;QACvC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,aAAa,KAAK,SAAS,EAAE,CAAC;YAC9C,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,qCAAqC,uBAAuB,6CAA6C,CACjI,CAAC;YACJ,CAAC;YACD,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;YAC3C,uBAAuB,GAAG,IAAI,CAAC,IAAI,CAAC;QACtC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,4BAA4B,KAAK,SAAS,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,0CAA0C,4BAA4B,6CAA6C,CAC3I,CAAC;YACJ,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACrD,4BAA4B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC3C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,4BAA4B,KAAK,SAAS,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,8CAA8C,4BAA4B,6CAA6C,CAC/I,CAAC;YACJ,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACrD,4BAA4B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC3C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACrD,IAAI,8BAA8B,KAAK,SAAS,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,6CAA6C,8BAA8B,6CAA6C,CAChJ,CAAC;YACJ,CAAC;YACD,oBAAoB,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;YACzD,8BAA8B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC7C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,4BAA4B,KAAK,SAAS,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,2CAA2C,4BAA4B,6CAA6C,CAC5I,CAAC;YACJ,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACrD,4BAA4B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC3C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,sBAAsB,KAAK,SAAS,EAAE,CAAC;YACvD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;gBAClE,IAAK,sBAAgD,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrE,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,wCAAwC,IAAI,mEAAmE,CACvI,CAAC;gBACJ,CAAC;gBACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,wCAAwC,IAAI,WAAW,UAAU,qEAAqE,CAC9J,CAAC;gBACJ,CAAC;gBACD,sBAAsB,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC1C,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,yBAAyB,KAAK,SAAS,EAAE,CAAC;YAC1D,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;gBACrE,IAEI,kCACD,CAAC,QAAQ,CAAC,IAAI,CAAC,EAChB,CAAC;oBACD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,oCAAoC,IAAI,kEAAkE,CAClI,CAAC;gBACJ,CAAC;gBACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,oCAAoC,IAAI,WAAW,UAAU,qEAAqE,CAC1J,CAAC;gBACJ,CAAC;gBACD,yBAAyB,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC7C,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;YAC7C,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBACzD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,6BAA6B,OAAO,2EAA2E,CACvI,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;oBACzD,8DAA8D;oBAC9D,4DAA4D;oBAC5D,4DAA4D;oBAC5D,WAAW;oBACX,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,6BAA6B,OAAO,sBAAsB,KAAK,CAAC,OAAO,kEAAkE,CACjK,CAAC;gBACJ,CAAC;gBACD,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACtD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,6BAA6B,OAAO,WAAW,UAAU,uEAAuE,CACxJ,CAAC;gBACJ,CAAC;gBACD,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACjC,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC3C,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,MAAM,QAAQ,GACZ,mBAAmB,CAAC,IAAI,GAAG,CAAC;wBAC1B,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;wBAC9C,CAAC,CAAC,EAAE,CAAC;oBACT,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,8CAA8C,IAAI,uBACvE,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,QAAQ,GACzD,EAAE,CACH,CAAC;gBACJ,CAAC;gBACD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC3C,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1D,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QAChD,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,kBAAkB,CAAC,IAAI,CACrB,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAC1D,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,OAAO;QACL,SAAS;QACT,OAAO,EAAE,OAAO,IAAI,aAAa,CAAC,GAAG;QACrC,qBAAqB,EACnB,+BAA+B,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE,UAAU,EAAE,+BAA+B,EAAE;YACjD,CAAC,CAAC,SAAS;QACf,UAAU;QACV,iBAAiB;QACjB,YAAY;QACZ,SAAS;QACT,eAAe;QACf,kBAAkB;QAClB,OAAO,EAAE;YACP,oBAAoB;YACpB,wBAAwB;YACxB,8BAA8B;YAC9B,qBAAqB;YACrB,sBAAsB;YACtB,yBAAyB;YACzB,cAAc;YACd,aAAa;YACb,kBAAkB;YAClB,YAAY;YACZ,kBAAkB;YAClB,oBAAoB;YACpB,kBAAkB;SACnB;QACD,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/extensions/registry.ts"],"names":[],"mappings":"AA4CA,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAGtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAKhF,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAWvD,OAAO,EAAE,kCAAkC,EAAE,MAAM,2BAA2B,CAAC;AAK/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAgNtD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAwC,EAAE;IAE1C,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,iBAAiB,GAAuB,EAAE,CAAC;IACjD,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC9E,MAAM,eAAe,GAAmC,EAAE,CAAC;IAC3D,MAAM,kBAAkB,GAAsC,EAAE,CAAC;IACjE,MAAM,QAAQ,GAAmC,EAAE,CAAC;IACpD,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,IAAI,OAAkC,CAAC;IACvC,IAAI,iBAAqC,CAAC;IAC1C,IAAI,+BAAmD,CAAC;IACxD,IAAI,UAAkC,CAAC;IACvC,IAAI,oBAAwC,CAAC;IAC7C,IAAI,oBAAsD,CAAC;IAC3D,IAAI,iBAAqC,CAAC;IAC1C,IAAI,wBAA8D,CAAC;IACnE,IAAI,oBAAwC,CAAC;IAC7C,IAAI,8BAES,CAAC;IACd,IAAI,gCAAoD,CAAC;IACzD,IAAI,qBAAwD,CAAC;IAC7D,IAAI,+BAAmD,CAAC;IACxD,IAAI,cAA0C,CAAC;IAC/C,IAAI,wBAA4C,CAAC;IACjD,IAAI,aAAwC,CAAC;IAC7C,IAAI,uBAA2C,CAAC;IAChD,IAAI,kBAAkD,CAAC;IACvD,IAAI,4BAAgD,CAAC;IACrD,IAAI,kBAAsD,CAAC;IAC3D,IAAI,4BAAgD,CAAC;IACrD,IAAI,oBAAsD,CAAC;IAC3D,IAAI,8BAAkD,CAAC;IACvD,IAAI,kBAAkD,CAAC;IACvD,IAAI,4BAAgD,CAAC;IACrD,IAAI,cAA0C,CAAC;IAC/C,IAAI,wBAA4C,CAAC;IACjD,IAAI,gBAA8C,CAAC;IACnD,IAAI,0BAA8C,CAAC;IACnD,IAAI,oBAA0D,CAAC;IAC/D,IAAI,8BAAkD,CAAC;IACvD,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAGnC,CAAC;IACJ,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1D,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAGtC,CAAC;IACJ,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAExD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,uHAAuH,CACxH,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,CAAC,IAAI,4DAA4D,CACnG,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE1B,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,OAAO,KAAK,aAAa,CAAC,0BAA0B,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,gGAAgG,CACxH,CAAC;YACJ,CAAC;YACD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,uCAAuC,iBAAiB,+DAA+D,CAC/I,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YACvB,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC;QAChC,CAAC;QAED,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YAC7C,IAAI,+BAA+B,KAAK,SAAS,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,uDAAuD,+BAA+B,sDAAsD,CACpK,CAAC;YACJ,CAAC;YACD,+BAA+B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC9C,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,mCAAmC,oBAAoB,wDAAwD,CACvI,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YAC7B,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACrD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,4CAA4C,iBAAiB,6CAA6C,CAClI,CAAC;YACJ,CAAC;YACD,oBAAoB,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;YACzD,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC;QAChC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,wBAAwB,KAAK,SAAS,EAAE,CAAC;YACzD,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,gDAAgD,oBAAoB,6CAA6C,CACzI,CAAC;YACJ,CAAC;YACD,wBAAwB,GAAG,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC;YACjE,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,8BAA8B,KAAK,SAAS,EAAE,CAAC;YAC/D,IAAI,gCAAgC,KAAK,SAAS,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,sDAAsD,gCAAgC,6CAA6C,CAC3J,CAAC;YACJ,CAAC;YACD,8BAA8B;gBAC5B,IAAI,CAAC,OAAO,CAAC,8BAA8B,CAAC;YAC9C,gCAAgC,GAAG,IAAI,CAAC,IAAI,CAAC;QAC/C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,qBAAqB,KAAK,SAAS,EAAE,CAAC;YACtD,IAAI,+BAA+B,KAAK,SAAS,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,8CAA8C,+BAA+B,6CAA6C,CAClJ,CAAC;YACJ,CAAC;YACD,qBAAqB,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC;YAC3D,+BAA+B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC9C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,cAAc,KAAK,SAAS,EAAE,CAAC;YAC/C,IAAI,wBAAwB,KAAK,SAAS,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,sCAAsC,wBAAwB,6CAA6C,CACnI,CAAC;YACJ,CAAC;YACD,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YAC7C,wBAAwB,GAAG,IAAI,CAAC,IAAI,CAAC;QACvC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,aAAa,KAAK,SAAS,EAAE,CAAC;YAC9C,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,qCAAqC,uBAAuB,6CAA6C,CACjI,CAAC;YACJ,CAAC;YACD,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;YAC3C,uBAAuB,GAAG,IAAI,CAAC,IAAI,CAAC;QACtC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,4BAA4B,KAAK,SAAS,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,0CAA0C,4BAA4B,6CAA6C,CAC3I,CAAC;YACJ,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACrD,4BAA4B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC3C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,4BAA4B,KAAK,SAAS,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,8CAA8C,4BAA4B,6CAA6C,CAC/I,CAAC;YACJ,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACrD,4BAA4B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC3C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACrD,IAAI,8BAA8B,KAAK,SAAS,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,6CAA6C,8BAA8B,6CAA6C,CAChJ,CAAC;YACJ,CAAC;YACD,oBAAoB,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;YACzD,8BAA8B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC7C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,4BAA4B,KAAK,SAAS,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,2CAA2C,4BAA4B,6CAA6C,CAC5I,CAAC;YACJ,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACrD,4BAA4B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC3C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,cAAc,KAAK,SAAS,EAAE,CAAC;YAC/C,IAAI,wBAAwB,KAAK,SAAS,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,uCAAuC,wBAAwB,6CAA6C,CACpI,CAAC;YACJ,CAAC;YACD,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YAC7C,wBAAwB,GAAG,IAAI,CAAC,IAAI,CAAC;QACvC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACjD,IAAI,0BAA0B,KAAK,SAAS,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,wCAAwC,0BAA0B,6CAA6C,CACvI,CAAC;YACJ,CAAC;YACD,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;YACjD,0BAA0B,GAAG,IAAI,CAAC,IAAI,CAAC;QACzC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACrD,IAAI,8BAA8B,KAAK,SAAS,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,iDAAiD,8BAA8B,6CAA6C,CACpJ,CAAC;YACJ,CAAC;YACD,oBAAoB,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;YACzD,8BAA8B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC7C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,sBAAsB,KAAK,SAAS,EAAE,CAAC;YACvD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;gBAClE,IAAK,sBAAgD,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrE,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,wCAAwC,IAAI,mEAAmE,CACvI,CAAC;gBACJ,CAAC;gBACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,wCAAwC,IAAI,WAAW,UAAU,qEAAqE,CAC9J,CAAC;gBACJ,CAAC;gBACD,sBAAsB,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC1C,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,yBAAyB,KAAK,SAAS,EAAE,CAAC;YAC1D,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;gBACrE,IAEI,kCACD,CAAC,QAAQ,CAAC,IAAI,CAAC,EAChB,CAAC;oBACD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,oCAAoC,IAAI,kEAAkE,CAClI,CAAC;gBACJ,CAAC;gBACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,oCAAoC,IAAI,WAAW,UAAU,qEAAqE,CAC1J,CAAC;gBACJ,CAAC;gBACD,yBAAyB,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC7C,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;YAC7C,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBACzD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,6BAA6B,OAAO,2EAA2E,CACvI,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;oBACzD,8DAA8D;oBAC9D,4DAA4D;oBAC5D,4DAA4D;oBAC5D,WAAW;oBACX,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,6BAA6B,OAAO,sBAAsB,KAAK,CAAC,OAAO,kEAAkE,CACjK,CAAC;gBACJ,CAAC;gBACD,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACtD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,6BAA6B,OAAO,WAAW,UAAU,uEAAuE,CACxJ,CAAC;gBACJ,CAAC;gBACD,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACjC,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC3C,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,MAAM,QAAQ,GACZ,mBAAmB,CAAC,IAAI,GAAG,CAAC;wBAC1B,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;wBAC9C,CAAC,CAAC,EAAE,CAAC;oBACT,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,8CAA8C,IAAI,uBACvE,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,QAAQ,GACzD,EAAE,CACH,CAAC;gBACJ,CAAC;gBACD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC3C,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1D,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QAChD,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,kBAAkB,CAAC,IAAI,CACrB,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAC1D,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,OAAO;QACL,SAAS;QACT,OAAO,EAAE,OAAO,IAAI,aAAa,CAAC,GAAG;QACrC,qBAAqB,EACnB,+BAA+B,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE,UAAU,EAAE,+BAA+B,EAAE;YACjD,CAAC,CAAC,SAAS;QACf,UAAU;QACV,iBAAiB;QACjB,YAAY;QACZ,SAAS;QACT,eAAe;QACf,kBAAkB;QAClB,OAAO,EAAE;YACP,oBAAoB;YACpB,wBAAwB;YACxB,8BAA8B;YAC9B,qBAAqB;YACrB,sBAAsB;YACtB,yBAAyB;YACzB,cAAc;YACd,aAAa;YACb,kBAAkB;YAClB,YAAY;YACZ,kBAAkB;YAClB,oBAAoB;YACpB,kBAAkB;YAClB,cAAc;YACd,gBAAgB;YAChB,oBAAoB;SACrB;QACD,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/extensions/resource-authorization.d.ts

@@ -26,9 +26,37 @@
  *   - onVisibilityChanged: SYNCHRONOUS, post-persist; a throw fails the
  *     request (metadata may be persisted with tuples lagging — retrying
  *     the same transition converges, the set-diff is idempotent).
+ *
+ * Corrected 2026-09-13 (20260913.01, T01_1_review.md Q-OR-6, Q-OR-10):
+ * "no driver composed = OSS behavior byte-identical" described the seam
+ * while the only writer of authorization records was the cloud's tuple
+ * driver. The seam now records authorization at lifecycle points in EVERY
+ * edition: open source's built-in role lifecycle
+ * (domain/iampolicy/role-lifecycle.ts, the entry's slice 4) writes
+ * IamPolicy rows (the organization creator's `owner` row; cleanup on
+ * delete), and a composed driver writes tuples too. The two POLICY hooks below are the
+ * other direction of the same seam — the IamPolicy domain's one grant and
+ * revoke path (domain/iampolicy/grant-path.ts) telling the driver that a
+ * row was written or is about to be deleted, so a composition can mirror
+ * the row as a tuple. Their order is the cloud#425 invariant, fixed by the
+ * path and stated on each event:
+ *   - onPolicyGranted: SYNCHRONOUS, AFTER the row is persisted; fires on
+ *     the duplicate arm too (the inline heal for a row whose tuple never
+ *     landed). A throw fails the request with the row in place — the
+ *     caller's retry or a boot backfill heals it.
+ *   - onPolicyRevoked: SYNCHRONOUS, BEFORE the row is deleted. A throw
+ *     leaves row and tuple, so a retry converges; the reverse order was
+ *     the fail-open incident class ("revoke" silently becoming "keep").
+ *     On the absent arm (no row for the spec) it fires with the spec and
+ *     no policy, so a composition can still delete a bare tuple written
+ *     before the row mirror existed.
+ * Absent method = no mirror is written (the OSS posture: rows are the
+ * record).
  */
 import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { OwnerAttributionType } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
+import type { IamPolicy } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
+import type { IamPolicySpec } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
 import type { CallerIdentity } from "./identity.js";
 /**
  * The visibility tuple shapes of the shared FGA model, named
@@ -114,6 +142,29 @@ export interface DefaultInstanceLinkedEvent {
     readonly blueprintKind: ApiResourceKind;
     readonly blueprintId: string;
 }
+/**
+ * Fired synchronously AFTER an IamPolicy row is persisted by the domain's
+ * grant path — and on the duplicate arm, when the triple was already held
+ * and no row was written, so a composition heals a row whose tuple never
+ * landed (cloud#425's inline heal). `policy` is the row as stored: on the
+ * duplicate arm the FIRST writer's row, whose id may be a legacy random
+ * one on a composition that predates derived ids.
+ */
+export interface PolicyGrantedEvent {
+    readonly policy: IamPolicy;
+    /** True when the triple was already held and this grant wrote nothing. */
+    readonly duplicate: boolean;
+}
+/**
+ * Fired synchronously BEFORE an IamPolicy row is deleted by the domain's
+ * grant path. `spec` is always the triple being revoked; `policy` is the
+ * row found for it, or `undefined` on the absent arm — the spec alone is
+ * enough to name the tuple a composition still deletes then.
+ */
+export interface PolicyRevokedEvent {
+    readonly spec: IamPolicySpec;
+    readonly policy: IamPolicy | undefined;
+}
 /**
  * The driver interface (single-instance point, registered via
  * ExtensionDrivers.resourceAuthorizationLifecycle). Implementations must
@@ -131,5 +182,17 @@ export interface ResourceAuthorizationLifecycle {
      * (the OSS posture: local access control needs none).
      */
     onDefaultInstanceLinked?(event: DefaultInstanceLinkedEvent): Promise<void>;
+    /**
+     * OPTIONAL (added 20260913.01 slice 2): synchronous, AFTER the row
+     * persist, on the duplicate arm too; a throw fails the grant with the
+     * row in place. Absent method = rows are the record (the OSS posture).
+     */
+    onPolicyGranted?(event: PolicyGrantedEvent): Promise<void>;
+    /**
+     * OPTIONAL (added 20260913.01 slice 2): synchronous, BEFORE the row
+     * delete; a throw leaves row and tuple for the retry. Absent method =
+     * rows are the record (the OSS posture).
+     */
+    onPolicyRevoked?(event: PolicyRevokedEvent): Promise<void>;
 }
 //# sourceMappingURL=resource-authorization.d.ts.map