@stigmer/server 3.15.2 → 3.15.3-dev.20260914121148

package/dist/domain/identityaccount/store-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"store-contract.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/store-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AACjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAE5G,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AA0BnD,0FAA0F;AAC1F,SAAS,aAAa,CAAC,SAItB;IACC,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE;YACR,EAAE,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC;YACjC,IAAI,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK;SACzC;QACD,IAAI,EAAE;YACJ,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE;YAC5B,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,EAAE;YACpC,gBAAgB,EAAE,+BAA+B,CAAC,MAAM;SACzD;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,SAGzB;IACC,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE;QACtE,IAAI,EAAE;YACJ,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,gBAAgB,EAAE,+BAA+B,CAAC,SAAS;YAC3D,mBAAmB,EAAE;gBACnB,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,eAAe,CAAC,iBAAiB;gBACvC,IAAI,EAAE,WAAW;aAClB;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,SAAS,wBAAwB;IAC/B,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,EAAE,EAAE,gCAAgC,EAAE,IAAI,EAAE,aAAa,EAAE;QACvE,IAAI,EAAE;YACJ,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,+BAA+B,CAAC,MAAM;SACzD;KACF,CAAC,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,SAAS,IAAI,CAAC,OAAwB;IACpC,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,oCAAoC,CAAC,CAAC;IAC9D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,UAAU,CAAC,QAAwC;IAC1D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,KAAK,GAA+C;IACxD;QACE,4CAA4C;QAC5C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC;gBAC5B,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,mBAAmB;aAC3B,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAClD,MAAM,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,EAAE,wCAAwC,CAAC,CAAC;YACzE,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,CAAC,EAC7C,0DAA0D,CAC3D,CAAC;QACJ,CAAC;KACF;IACD;QACE,kFAAkF;QAClF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,aAAa,CAAC;gBAC3B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAClB,qBAAqB,EACrB,qFAAqF,CACtF,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,CACV,QAAQ,EAAE,IAAI,EAAE,SAAS,EACzB,OAAO,EACP,6DAA6D,CAC9D,CAAC;QACJ,CAAC;KACF;IACD;QACE,4FAA4F;QAC5F,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACzD,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,QAAQ,EAAE,EAAE,EACjB,YAAY,CAAC,aAAa,CAAC,EAC3B,gEAAgE,CACjE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAC7C,SAAS,EACT,4DAA4D,CAC7D,CAAC;QACJ,CAAC;KACF;IACD;QACE,wDAAwD;QACxD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EACpD,YAAY,EACZ,yDAAyD,CAC1D,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,EACvC,SAAS,EACT,sEAAsE,CACvE,CAAC;QACJ,CAAC;KACF;IACD;QACE,wEAAwE;QACxE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CACd,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAClE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAChE,YAAY,EACZ,oEAAoE,CACrE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EACjD,SAAS,EACT,kEAAkE,CACnE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,EACnD,SAAS,EACT,yCAAyC,CAC1C,CAAC;QACJ,CAAC;KACF;IACD;QACE,mDAAmD;QACnD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC;gBAC5B,KAAK,EAAE,aAAa;gBACpB,SAAS,EAAE,OAAO;aACnB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,MAAM,CAChB,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAC9D,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACpD,MAAM,CAAC,KAAK,CACV,OAAO,EAAE,IAAI,EAAE,SAAS,EACxB,SAAS,EACT,uDAAuD,CACxD,CAAC;YACF,MAAM,CAAC,KAAK,CACV,OAAO,EAAE,QAAQ,EAAE,EAAE,EACrB,IAAI,CAAC,OAAO,CAAC,EACb,4CAA4C,CAC7C,CAAC;QACJ,CAAC;KACF;IACD;QACE,yEAAyE;QACzE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACxD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACtC,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EACnC,SAAS,EACT,8CAA8C,CAC/C,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAC5C,SAAS,EACT,mDAAmD,CACpD,CAAC;YACF,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EACnB,wDAAwD,CACzD,CAAC;QACJ,CAAC;KACF;IACD;QACE,2EAA2E;QAC3E,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACpD,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC;gBACV,gCAAgC;gBAChC,IAAI,CAAC,KAAK,CAAC;aACZ,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CACd,UAAU,CAAC,KAAK,CAAC,EACjB,CAAC,YAAY,EAAE,aAAa,CAAC,EAC7B,wEAAwE,CACzE,CAAC;QACJ,CAAC;KACF;IACD;QACE,oEAAoE;QACpE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAC/C,6EAA6E,CAC9E,CAAC;YACF,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EACpD,yEAAyE,CAC1E,CAAC;QACJ,CAAC;KACF;IACD;QACE,+HAA+H;QAC/H,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;gBACvC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;gBAClE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;aACnE,CAAC,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBACjC,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,MAAM,YAAY,qBAAqB,EAC9C,oEAAoE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAC5F,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,CAAC,EAAE,CACP,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,EACvD,+CAA+C,CAChD,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CACV,MAAM,EAAE,QAAQ,EAAE,EAAE,EACpB,YAAY,CAAC,YAAY,CAAC,EAC1B,4CAA4C,CAC7C,CAAC;QACJ,CAAC;KACF;IACD;QACE,6GAA6G;QAC7G,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CACd,gBAAgB,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CACnE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAC1C,SAAS,EACT,mEAAmE,CACpE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAChD,SAAS,EACT,iEAAiE,CAClE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAC9D,+BAA+B,CAAC,SAAS,EACzC,+DAA+D,CAChE,CAAC;QACJ,CAAC;KACF;IACD;QACE,8GAA8G;QAC9G,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,MAAM,CAAC,SAAS,CACd,UAAU,CACR,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CACtE,EACD,CAAC,WAAW,EAAE,YAAY,CAAC,EAC3B,uDAAuD,CACxD,CAAC;YACF,MAAM,CAAC,SAAS,CACd,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EACzB,EAAE,EACF,wDAAwD,CACzD,CAAC;QACJ,CAAC;KACF;IACD;QACE,oDAAoD;QACpD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EACjC,SAAS,EACT,0EAA0E,CAC3E,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAC5C,SAAS,EACT,+EAA+E,CAChF,CAAC;QACJ,CAAC;KACF;IACD;QACE,sCAAsC;QACtC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EAC9C,0DAA0D,CAC3D,CAAC;QACJ,CAAC;KACF;IACD;QACE,oDAAoD;QACpD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,EACtC,qFAAqF,CACtF,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAEF;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,WAA+D,EAC/D,IAAc;IAEd,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,YAAY,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,4BAA4B,CAC1C,WAA+D;IAE/D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI;QACJ,GAAG,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC;KAC1C,CAAC,CAAC,CAAC;AACN,CAAC"}
+{"version":3,"file":"store-contract.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/store-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AACjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAE5G,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAMjE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AASnD,0FAA0F;AAC1F,SAAS,aAAa,CAAC,SAItB;IACC,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE;YACR,EAAE,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC;YACjC,IAAI,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK;SACzC;QACD,IAAI,EAAE;YACJ,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE;YAC5B,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,EAAE;YACpC,gBAAgB,EAAE,+BAA+B,CAAC,MAAM;SACzD;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,SAGzB;IACC,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE;QACtE,IAAI,EAAE;YACJ,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,gBAAgB,EAAE,+BAA+B,CAAC,SAAS;YAC3D,mBAAmB,EAAE;gBACnB,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,eAAe,CAAC,iBAAiB;gBACvC,IAAI,EAAE,WAAW;aAClB;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,SAAS,wBAAwB;IAC/B,OAAO,MAAM,CAAC,qBAAqB,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,EAAE,EAAE,gCAAgC,EAAE,IAAI,EAAE,aAAa,EAAE;QACvE,IAAI,EAAE;YACJ,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,+BAA+B,CAAC,MAAM;SACzD;KACF,CAAC,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,SAAS,IAAI,CAAC,OAAwB;IACpC,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,oCAAoC,CAAC,CAAC;IAC9D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,UAAU,CAAC,QAAwC;IAC1D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,KAAK,GAAiE;IAC1E;QACE,4CAA4C;QAC5C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC;gBAC5B,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,mBAAmB;aAC3B,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAClD,MAAM,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,EAAE,wCAAwC,CAAC,CAAC;YACzE,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,CAAC,EAC7C,0DAA0D,CAC3D,CAAC;QACJ,CAAC;KACF;IACD;QACE,kFAAkF;QAClF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,aAAa,CAAC;gBAC3B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAClB,qBAAqB,EACrB,qFAAqF,CACtF,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,CACV,QAAQ,EAAE,IAAI,EAAE,SAAS,EACzB,OAAO,EACP,6DAA6D,CAC9D,CAAC;QACJ,CAAC;KACF;IACD;QACE,4FAA4F;QAC5F,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACzD,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,QAAQ,EAAE,EAAE,EACjB,YAAY,CAAC,aAAa,CAAC,EAC3B,gEAAgE,CACjE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAC7C,SAAS,EACT,4DAA4D,CAC7D,CAAC;QACJ,CAAC;KACF;IACD;QACE,wDAAwD;QACxD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EACpD,YAAY,EACZ,yDAAyD,CAC1D,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,EACvC,SAAS,EACT,sEAAsE,CACvE,CAAC;QACJ,CAAC;KACF;IACD;QACE,wEAAwE;QACxE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CACd,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAClE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAChE,YAAY,EACZ,oEAAoE,CACrE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EACjD,SAAS,EACT,kEAAkE,CACnE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,EACnD,SAAS,EACT,yCAAyC,CAC1C,CAAC;QACJ,CAAC;KACF;IACD;QACE,mDAAmD;QACnD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC;gBAC5B,KAAK,EAAE,aAAa;gBACpB,SAAS,EAAE,OAAO;aACnB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,MAAM,CAChB,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAC9D,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACpD,MAAM,CAAC,KAAK,CACV,OAAO,EAAE,IAAI,EAAE,SAAS,EACxB,SAAS,EACT,uDAAuD,CACxD,CAAC;YACF,MAAM,CAAC,KAAK,CACV,OAAO,EAAE,QAAQ,EAAE,EAAE,EACrB,IAAI,CAAC,OAAO,CAAC,EACb,4CAA4C,CAC7C,CAAC;QACJ,CAAC;KACF;IACD;QACE,yEAAyE;QACzE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACxD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACtC,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EACnC,SAAS,EACT,8CAA8C,CAC/C,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAC5C,SAAS,EACT,mDAAmD,CACpD,CAAC;YACF,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EACnB,wDAAwD,CACzD,CAAC;QACJ,CAAC;KACF;IACD;QACE,2EAA2E;QAC3E,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACpD,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC;gBACV,gCAAgC;gBAChC,IAAI,CAAC,KAAK,CAAC;aACZ,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CACd,UAAU,CAAC,KAAK,CAAC,EACjB,CAAC,YAAY,EAAE,aAAa,CAAC,EAC7B,wEAAwE,CACzE,CAAC;QACJ,CAAC;KACF;IACD;QACE,oEAAoE;QACpE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAC/C,6EAA6E,CAC9E,CAAC;YACF,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EACpD,yEAAyE,CAC1E,CAAC;QACJ,CAAC;KACF;IACD;QACE,+HAA+H;QAC/H,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;gBACvC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;gBAClE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;aACnE,CAAC,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBACjC,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,MAAM,YAAY,qBAAqB,EAC9C,oEAAoE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAC5F,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,CAAC,EAAE,CACP,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,EACvD,+CAA+C,CAChD,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CACV,MAAM,EAAE,QAAQ,EAAE,EAAE,EACpB,YAAY,CAAC,YAAY,CAAC,EAC1B,4CAA4C,CAC7C,CAAC;QACJ,CAAC;KACF;IACD;QACE,6GAA6G;QAC7G,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,CAAC,IAAI,CACd,gBAAgB,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CACnE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAC1C,SAAS,EACT,mEAAmE,CACpE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAChD,SAAS,EACT,iEAAiE,CAClE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAC9D,+BAA+B,CAAC,SAAS,EACzC,+DAA+D,CAChE,CAAC;QACJ,CAAC;KACF;IACD;QACE,8GAA8G;QAC9G,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,MAAM,CAAC,SAAS,CACd,UAAU,CACR,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CACtE,EACD,CAAC,WAAW,EAAE,YAAY,CAAC,EAC3B,uDAAuD,CACxD,CAAC;YACF,MAAM,CAAC,SAAS,CACd,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EACzB,EAAE,EACF,wDAAwD,CACzD,CAAC;QACJ,CAAC;KACF;IACD;QACE,oDAAoD;QACpD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EACjC,SAAS,EACT,0EAA0E,CAC3E,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAC5C,SAAS,EACT,+EAA+E,CAChF,CAAC;QACJ,CAAC;KACF;IACD;QACE,sCAAsC;QACtC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EAC9C,0DAA0D,CAC3D,CAAC;QACJ,CAAC;KACF;IACD;QACE,oDAAoD;QACpD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,EACtC,qFAAqF,CACtF,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAEF,uEAAuE;AACvE,MAAM,UAAU,4BAA4B,CAC1C,WAA+D;IAE/D,OAAO,iBAAiB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC"}

package/dist/extensions/authorization-queries.d.ts

@@ -0,0 +1,81 @@
+/**
+ * The authorization-query capability (20260913.01, T01_1_review.md Q-OR-8):
+ * the TUPLE half of the IamPolicy query surface — the questions only an
+ * authorization engine can answer over its own graph, as opposed to the
+ * ROW half (who holds which role on what) that every edition answers from
+ * IamPolicy rows. Single instance, registered as
+ * `drivers.authorizationQueries` (the identityFederation shape: a driver
+ * point that is open source's own behaviour when absent).
+ *
+ * Absent, the IamPolicy query controller refuses `checkAuthorization`,
+ * `listAuthorizedResourceIds`, `listAuthorizedPrincipalIds`, and a
+ * `checkMyPermission` that carries contextual policies, UNIMPLEMENTED with
+ * the edition reason (domain/iampolicy/constants.ts
+ * AUTHORIZATION_QUERIES_UNIMPLEMENTED_MESSAGE) — never INTERNAL, the
+ * organization directory's absent-method precedent. Present, the
+ * controller still owns everything that is not the graph question: the
+ * annotation's Authorize step, `checkAuthorization`'s principal-trust rule
+ * (a user asks only about their own account; machine and internal about
+ * anyone), the UNAUTHENTICATED refusal, and the plain
+ * `checkMyPermission` that rides the composed Authorizer instead. The
+ * engine receives boundary-validated refs and never asks who is calling.
+ *
+ * The engine speaks the CONTRACT's vocabulary, not a backend's (Q-S3-1,
+ * 2026-09-13): `ApiResourceRef` for a principal or resource (kind = the
+ * enum member name, id, and for a principal an optional relation — the
+ * userset form `organization:X#member`), `IamPolicySpec` for a policy and
+ * for the what-if policies every query may carry, and the relation and
+ * kind strings as the wire sends them. The cloud's driver renders these to
+ * OpenFGA's `type:id#relation` strings itself; that grammar belongs to the
+ * store that runs it and never enters this library.
+ *
+ * Semantics the controller and the conformance suite rely on (the Java
+ * check-handler posture the cloud's client already implements):
+ *
+ *   - `check` answers a public grant (a wildcard principal resolves), so
+ *     "may I read this public agent" is true for anyone.
+ *   - the two listings never expand wildcards, and `listPrincipalIds`
+ *     answers DIRECT principals only — a listing is an inventory of who
+ *     was named, never a resolution of who could reach.
+ *   - contextual policies are evaluated as if held, and nothing is written.
+ *
+ * Error doctrine (the ListReadScope rule, verbatim in spirit: a seam that
+ * cannot answer THROWS — never an empty set, never false): `false` and
+ * `[]` are REAL answers. A backend outage surfaces as a throw; a
+ * ConnectError keeps its code (the cloud maps its three OpenFGA wire arms —
+ * DEADLINE_EXCEEDED, UNAVAILABLE, INTERNAL — before throwing), any other
+ * throw is INTERNAL through the pipeline's boundary. A denial dressed as
+ * an outage, or an outage dressed as a denial, is the fail-open class this
+ * contract exists to refuse.
+ *
+ * Why this is not `ListReadScope`: the read scope narrows the server's OWN
+ * list lanes for the calling identity with no what-if input; this engine
+ * answers the wire's explicit queries about an ARBITRARY principal with
+ * contextual policies. Both are ratified seams with distinct consumers;
+ * a cloud driver may wrap one client for both, and that is its business.
+ */
+import type { ApiResourceRef, IamPolicySpec } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
+/** The query-engine contract (single-instance point, ExtensionDrivers.authorizationQueries). */
+export interface AuthorizationQueryEngine {
+    /**
+     * Whether `policy` is effectively held — its principal has its relation
+     * on its resource — given `contextualPolicies` evaluated as if held.
+     * The proto's CheckAuthorizationInput shape; `checkMyPermission` builds
+     * the spec from the caller's account ref. The spec's refs are present
+     * (boundary-validated, or controller-built).
+     */
+    check(policy: IamPolicySpec, contextualPolicies: ReadonlyArray<IamPolicySpec>): Promise<boolean>;
+    /**
+     * The ids of `resourceKind` resources on which `principal` holds
+     * `relation` (ListAuthorizedResourceIdsInput's field order). Wildcards
+     * are not expanded.
+     */
+    listResourceIds(principal: ApiResourceRef, relation: string, resourceKind: string, contextualPolicies: ReadonlyArray<IamPolicySpec>): Promise<ReadonlyArray<string>>;
+    /**
+     * The ids of `principalKind` principals holding `relation` on `resource`
+     * (ListAuthorizedPrincipalIdsInput's field order). Direct principals
+     * only; wildcards are not expanded.
+     */
+    listPrincipalIds(resource: ApiResourceRef, relation: string, principalKind: string, contextualPolicies: ReadonlyArray<IamPolicySpec>): Promise<ReadonlyArray<string>>;
+}
+//# sourceMappingURL=authorization-queries.d.ts.map

package/dist/extensions/authorization-queries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-queries.d.ts","sourceRoot":"","sources":["../../src/extensions/authorization-queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACd,MAAM,qDAAqD,CAAC;AAE7D,gGAAgG;AAChG,MAAM,WAAW,wBAAwB;IACvC;;;;;;OAMG;IACH,KAAK,CACH,MAAM,EAAE,aAAa,EACrB,kBAAkB,EAAE,aAAa,CAAC,aAAa,CAAC,GAC/C,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB;;;;OAIG;IACH,eAAe,CACb,SAAS,EAAE,cAAc,EACzB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,kBAAkB,EAAE,aAAa,CAAC,aAAa,CAAC,GAC/C,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAClC;;;;OAIG;IACH,gBAAgB,CACd,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,kBAAkB,EAAE,aAAa,CAAC,aAAa,CAAC,GAC/C,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;CACnC"}

package/dist/extensions/authorization-queries.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=authorization-queries.js.map

package/dist/extensions/authorization-queries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-queries.js","sourceRoot":"","sources":["../../src/extensions/authorization-queries.ts"],"names":[],"mappings":""}

package/dist/extensions/drivers.d.ts

@@ -26,6 +26,11 @@
  *   - identity-account store + identity federation (the first domain
  *     whose persistence is a PORT, and the four federated RPC arms only
  *     one edition serves) — landed with 20260911.11, gate ruling Q-IA-9
+ *   - IamPolicy store + policy grant scope + authorization queries (the
+ *     IamPolicy domain's row half served in every edition; the store
+ *     port, which kinds an edition grants on, and the tuple-half query
+ *     engine only an authorization backend can answer) — landed with
+ *     20260913.01, gate ruling Q-OR-10
  *
  * Merge rules (enforced by resolveExtensions, DD-006 §2b): the two
  * provider kinds are single-instance points — a second declaring unit is
@@ -40,14 +45,17 @@
 import type { ArtifactStorageDriverFactory } from "../artifactstorage/artifact-storage.js";
 import type { ChannelRuntime } from "../domain/agentchannel/channel-runtime.js";
 import type { IdentityAccountStore } from "../domain/identityaccount/store.js";
+import type { IamPolicyStore } from "../domain/iampolicy/store.js";
 import type { SecretCodec } from "../encryption/codec.js";
 import type { ModelCatalogProvider } from "../domain/workflow/registry/model-catalog-provider.js";
 import type { VisitorErrorPolicy } from "../pipeline/interceptors/error-boundary.js";
 import type { RunnerCredentialProvider } from "../runnerauth/runner-credential-provider.js";
 import type { SandboxProvisionerFactory } from "../sandbox/provisioner.js";
+import type { AuthorizationQueryEngine } from "./authorization-queries.js";
 import type { IdentityFederation } from "./identity-federation.js";
 import type { ListReadScope } from "./list-read-scope.js";
 import type { OrganizationDirectory } from "./organization-directory.js";
+import type { PolicyGrantScope } from "./policy-grant-scope.js";
 import type { ResourceAuthorizationLifecycle } from "./resource-authorization.js";
 import type { ScheduleFireCallerMint } from "./schedule-fire-caller.js";
 /** The driver contributions of one extension unit. */
@@ -83,8 +91,13 @@ export interface ExtensionDrivers {
      * The resource-authorization lifecycle seam (C2, ruling Q2;
      * single-instance point). When composed, the three shared tuple steps
      * (CreateAuthorizationTuples / CleanupIamPolicies /
-     * UpdateVisibilityTuples) deliver resolved events to it; when absent,
-     * those steps no-op — OSS behavior byte-identical.
+     * UpdateVisibilityTuples) deliver resolved events to it, and the
+     * IamPolicy grant path delivers the two policy hooks. Corrected
+     * 2026-09-13 (20260913.01 Q-OR-6): when absent, the steps no-op, but
+     * open source is no longer record-less — the composition root installs
+     * the built-in role lifecycle (domain/iampolicy/role-lifecycle.ts, the
+     * entry's slice 4), which writes IamPolicy rows, whenever no extension
+     * registers an Authorizer (resource-authorization.ts header).
      */
     readonly resourceAuthorizationLifecycle?: ResourceAuthorizationLifecycle;
     /**
@@ -162,5 +175,39 @@ export interface ExtensionDrivers {
      * edition reason — the organizationDirectory absent-method shape.
      */
     readonly identityFederation?: IdentityFederation;
+    /**
+     * The IamPolicy store driver (20260913.01, Q-OR-10; single-instance
+     * point). The IamPolicy domain's persistence is a PORT like the
+     * identity-account domain's: when composed, every row the one grant
+     * path writes, deletes or reads — user grants, the structural
+     * bootstrap lanes, the access lists and counts — goes through this
+     * driver (the cloud serves the domain over its own `cloud.iam_policy`
+     * table this way, legacy random ids included). When absent, the OSS
+     * adapter over the generic Store installs at the compose.ts
+     * consumption site — OSS behavior byte-identical.
+     */
+    readonly iamPolicyStore?: IamPolicyStore;
+    /**
+     * The policy grant scope (20260913.01, Q-OR-3; single-instance point):
+     * which kinds a user may grant a role on in this edition, with which
+     * roles. Narrows the proto's `grantable_roles`, total over the enum,
+     * synchronous (policy-grant-scope.ts carries the reasons). When
+     * composed, ValidateGrantableRole and checkMyPermission's
+     * `can_grant_access` arm read it; when absent, open source's
+     * organization-only default installs at the compose.ts consumption
+     * site — the organization grants its four proto roles, nothing else
+     * grants anything.
+     */
+    readonly policyGrantScope?: PolicyGrantScope;
+    /**
+     * The authorization-query engine (20260913.01, Q-OR-8; single-instance
+     * point): the tuple-half questions — checkAuthorization, the two
+     * listAuthorized*Ids, a checkMyPermission with contextual policies —
+     * only an authorization backend can answer over its own graph. When
+     * composed, the IamPolicy query controller dispatches to it after its
+     * own trust checks; when absent, those RPC arms refuse UNIMPLEMENTED
+     * with the edition reason — the identityFederation absent shape.
+     */
+    readonly authorizationQueries?: AuthorizationQueryEngine;
 }
 //# sourceMappingURL=drivers.d.ts.map

package/dist/extensions/drivers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"drivers.d.ts","sourceRoot":"","sources":["../../src/extensions/drivers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,WAAW,CAC3C,MAAM,EACN,4BAA4B,CAC7B,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,WAAW,CAC9C,MAAM,EACN,yBAAyB,CAC1B,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC;IACzE;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IACrD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CAClD"}
+{"version":3,"file":"drivers.d.ts","sourceRoot":"","sources":["../../src/extensions/drivers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,WAAW,CAC3C,MAAM,EACN,4BAA4B,CAC7B,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,WAAW,CAC9C,MAAM,EACN,yBAAyB,CAC1B,CAAC;IACF;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC;IACzE;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IACrD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,wBAAwB,CAAC;CAC1D"}

package/dist/extensions/identity.d.ts

@@ -88,4 +88,18 @@ export interface IdentityVerifier {
      */
     verify(token: string): Promise<CallerIdentity | null>;
 }
+/**
+ * Whether `caller` is one of the platform's own pipelines — the admission
+ * rule of the RPCs a person must never reach directly, stated ONCE
+ * (20260911.11 A7 for the identity-account `create` RPC; 20260913.01
+ * Q-OR-7 and Q-S5-10 for the three IamPolicy system RPCs): a `machine`
+ * account (the platform's service accounts), the `internal` class (the
+ * server acting as itself over the in-process transport) or ANY identity
+ * that entered through that transport (a propagated user the server is
+ * composing a request for). A wire `user`, a `runner` and a composition's
+ * own classes are refused by the RPC that reads this — under the
+ * permissive Authorizer the annotation alone would admit anyone, so the
+ * rule is load-bearing in open source.
+ */
+export declare function isPlatformPipelineCaller(caller: CallerIdentity): boolean;
 //# sourceMappingURL=identity.d.ts.map

package/dist/extensions/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/extensions/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,SAAS,GACT,QAAQ,GACR,UAAU,GACV,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,YAAY,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;CACvD"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/extensions/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,SAAS,GACT,QAAQ,GACR,UAAU,GACV,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,YAAY,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAMxE"}

package/dist/extensions/identity.js

@@ -12,5 +12,22 @@
  * HandlerContext.values (never ambient state — the every-dependency-
  * explicit doctrine).
  */
-export {};
+/**
+ * Whether `caller` is one of the platform's own pipelines — the admission
+ * rule of the RPCs a person must never reach directly, stated ONCE
+ * (20260911.11 A7 for the identity-account `create` RPC; 20260913.01
+ * Q-OR-7 and Q-S5-10 for the three IamPolicy system RPCs): a `machine`
+ * account (the platform's service accounts), the `internal` class (the
+ * server acting as itself over the in-process transport) or ANY identity
+ * that entered through that transport (a propagated user the server is
+ * composing a request for). A wire `user`, a `runner` and a composition's
+ * own classes are refused by the RPC that reads this — under the
+ * permissive Authorizer the annotation alone would admit anyone, so the
+ * rule is load-bearing in open source.
+ */
+export function isPlatformPipelineCaller(caller) {
+    return (caller.callerClass === "machine" ||
+        caller.callerClass === "internal" ||
+        caller.origin === "in-process");
+}
 //# sourceMappingURL=identity.js.map

package/dist/extensions/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/extensions/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/extensions/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAuFH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAsB;IAC7D,OAAO,CACL,MAAM,CAAC,WAAW,KAAK,SAAS;QAChC,MAAM,CAAC,WAAW,KAAK,UAAU;QACjC,MAAM,CAAC,MAAM,KAAK,YAAY,CAC/B,CAAC;AACJ,CAAC"}

package/dist/extensions/list-read-scope.d.ts

@@ -71,19 +71,49 @@
  *     untouched with the org unconsulted (the first line above). Two lanes
  *     have no org on the wire (`session.list`, `apiKey.findAll`) and offer
  *     the kind until P1 entry 12 pages them.
+ *   - A KIND WHOSE AUTHORIZATION IS ITS PARENT'S CARRIES THAT PARENT ON
+ *     EVERY CANDIDATE (stigmer-cloud 20260913.04 T04, Q-LB-33..36). When
+ *     `kind_meta` declares PARENT scope with INHERITED owner
+ *     (`inheritedAuthorizationParentOf`; today agent_execution → session),
+ *     the helper fills `ListEntryMeta.authorizationParent` from the row's
+ *     spec through the same read the tuple lifecycle wrote the parent link
+ *     with. A driver MAY answer the parent's question in place of the
+ *     child's: by the model's construction the two answers are identical
+ *     (the child's `owner`, `viewer` and `can_view` are all `from` the
+ *     parent), and the parent's resolution is direct tuples where the
+ *     child's walks the parent's whole set (OpenFGA's learned `weight2`
+ *     strategy read the founder's 423 sessions per execution; that is what
+ *     rolled back twice on 2026-09-14). A driver that ignores the field is
+ *     still correct. The one observable difference is stated, not hidden:
+ *     a row whose parent tuple never landed (the create chain's "row
+ *     survives, tuple write failed" state, healed by retry) is hidden by
+ *     the child's check and shown by the parent's — the row's truth, read
+ *     from the field the tuple was derived from, and no widening: nobody
+ *     reaches a parent through it who could not create the row in it.
  */
 import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { CallerIdentity } from "./identity.js";
+import type { ResolvedParentLink } from "./resource-authorization.js";
 /**
  * The candidate metadata a post-scan lane offers the scope — the three
  * fields the cloud driver's rules key on (id for the FGA intersection,
  * labels for the guest cookie rule; org rides along for symmetry with
- * the consumer-owned intersection, so a driver can log or assert on it).
+ * the consumer-owned intersection, so a driver can log or assert on it),
+ * plus the parent for kinds whose authorization is their parent's.
  */
 export interface ListEntryMeta {
     readonly id: string;
     readonly org: string;
     readonly labels: Readonly<Record<string, string>>;
+    /**
+     * OPTIONAL (added 20260913.04 T04): the parent this row's authorization
+     * IS — present only for a kind whose `kind_meta` is PARENT scope with
+     * INHERITED owner (the header's last contract line), the same
+     * `ResolvedParentLink` the tuple lifecycle wrote for the row. Absent for
+     * every other kind, and absent when the row's spec does not name its
+     * parent — a driver then asks about the row itself, never drops it.
+     */
+    readonly authorizationParent?: ResolvedParentLink;
 }
 /** The scope contract (single-instance point, ExtensionDrivers.listReadScope). */
 export interface ListReadScope {
@@ -105,7 +135,10 @@ export interface ListReadScope {
 }
 /**
  * The shape every stored API resource message presents to the shared
- * helper — the metadata fields the scope's candidates are built from.
+ * helper — the metadata fields the scope's candidates are built from, and
+ * the spec the parent is read from (structurally, by `kind_meta`'s
+ * `spec_field`; typed loosely because the field differs per kind and the
+ * read is `parentIdOf`'s).
  */
 export interface ScopedListResource {
     metadata?: {
@@ -113,6 +146,7 @@ export interface ScopedListResource {
         org?: string;
         labels?: Record<string, string>;
     };
+    spec?: object;
 }
 /**
  * The ONE consumption idiom for post-scan lanes (the shared-step
@@ -128,8 +162,11 @@ export interface ScopedListResource {
  *     permission-bounded across orgs, verified per lane in the entry's
  *     census — lanes Java does not org-narrow pass ""), then to the kept
  *     ids. The same set either way (both are per-row predicates); the
- *     order is the header's last contract line: the scope sees the org's
- *     rows, not the kind's.
+ *     order is the header's second-to-last contract line: the scope sees
+ *     the org's rows, not the kind's;
+ *   - the candidates of a kind whose authorization is its parent's carry
+ *     `authorizationParent` (the header's last line), resolved once per
+ *     call from `kind_meta` and once per row from the spec.
  */
 export declare function restrictListByReadScope<T extends ScopedListResource>(scope: ListReadScope | undefined, caller: CallerIdentity, kind: ApiResourceKind, resources: ReadonlyArray<T>, requestOrg: string): Promise<T[]>;
 //# sourceMappingURL=list-read-scope.d.ts.map

package/dist/extensions/list-read-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-read-scope.d.ts","sourceRoot":"","sources":["../../src/extensions/list-read-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyEG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAE3H,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACnD;AAED,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,qBAAqB,CACnB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhC;;;;;OAKG;IACH,mBAAmB,CACjB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,GACpC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE;QACT,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,CAAC;CACH;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,uBAAuB,CAAC,CAAC,SAAS,kBAAkB,EACxE,KAAK,EAAE,aAAa,GAAG,SAAS,EAChC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,EACrB,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,EAC3B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,EAAE,CAAC,CAed"}
+{"version":3,"file":"list-read-scope.d.ts","sourceRoot":"","sources":["../../src/extensions/list-read-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4FG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAY3H,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD;;;;;;;OAOG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;CACnD;AAED,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,qBAAqB,CACnB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhC;;;;;OAKG;IACH,mBAAmB,CACjB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,GACpC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;CACjC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE;QACT,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CAAC,CAAC,SAAS,kBAAkB,EACxE,KAAK,EAAE,aAAa,GAAG,SAAS,EAChC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,EACrB,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,EAC3B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,EAAE,CAAC,CAsBd"}

package/dist/extensions/list-read-scope.js

@@ -1,3 +1,9 @@
+// The first VALUE imports from extensions/ into pipeline/ (every other
+// crossing is a type): two pure leaf modules that import nothing but
+// protos, so there is no cycle. Deliberate — one resolver for the tuple
+// writer and the list reader beats a copy in the seam.
+import { getKindEnum, inheritedAuthorizationParentOf, } from "../pipeline/apiresource-meta.js";
+import { parentIdOf } from "../pipeline/steps/shapes.js";
 /**
  * The ONE consumption idiom for post-scan lanes (the shared-step
  * discipline of pipeline/steps/authorization-tuples.ts, rendered as a
@@ -12,8 +18,11 @@
  *     permission-bounded across orgs, verified per lane in the entry's
  *     census — lanes Java does not org-narrow pass ""), then to the kept
  *     ids. The same set either way (both are per-row predicates); the
- *     order is the header's last contract line: the scope sees the org's
- *     rows, not the kind's.
+ *     order is the header's second-to-last contract line: the scope sees
+ *     the org's rows, not the kind's;
+ *   - the candidates of a kind whose authorization is its parent's carry
+ *     `authorizationParent` (the header's last line), resolved once per
+ *     call from `kind_meta` and once per row from the spec.
  */
 export async function restrictListByReadScope(scope, caller, kind, resources, requestOrg) {
     if (scope === undefined) {
@@ -22,12 +31,40 @@ export async function restrictListByReadScope(scope, caller, kind, resources, re
     const offered = requestOrg === ""
         ? resources
         : resources.filter((resource) => resource.metadata?.org === requestOrg);
-    const entries = offered.map((resource) => ({
-        id: resource.metadata?.id ?? "",
-        org: resource.metadata?.org ?? "",
-        labels: resource.metadata?.labels ?? {},
-    }));
+    const parentOf = authorizationParentReader(kind);
+    const entries = offered.map((resource) => {
+        const entry = {
+            id: resource.metadata?.id ?? "",
+            org: resource.metadata?.org ?? "",
+            labels: resource.metadata?.labels ?? {},
+        };
+        const authorizationParent = parentOf(resource);
+        return authorizationParent === undefined
+            ? entry
+            : { ...entry, authorizationParent };
+    });
     const keptIds = await scope.restrictListEntries(caller, kind, entries);
     return offered.filter((resource) => keptIds.has(resource.metadata?.id ?? ""));
 }
+/**
+ * The per-row parent reader for `kind`: a constant `undefined` for the 27
+ * kinds whose authorization is their own, and for the kind whose
+ * authorization is its parent's, the `ResolvedParentLink` the tuple
+ * lifecycle wrote — or undefined for a row whose spec does not name it
+ * (never a throw: a list is not a create). `kind_meta` is consulted once
+ * per call, not once per row.
+ */
+function authorizationParentReader(kind) {
+    const parent = inheritedAuthorizationParentOf(kind);
+    if (parent === undefined) {
+        return () => undefined;
+    }
+    const parentKind = getKindEnum(parent.kind);
+    return (resource) => {
+        const parentId = parentIdOf(resource, parent.specField);
+        return parentId === ""
+            ? undefined
+            : { relation: parent.relation, parentKind, parentId };
+    };
+}
 //# sourceMappingURL=list-read-scope.js.map

package/dist/extensions/list-read-scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-read-scope.js","sourceRoot":"","sources":["../../src/extensions/list-read-scope.ts"],"names":[],"mappings":"AAiIA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAgC,EAChC,MAAsB,EACtB,IAAqB,EACrB,SAA2B,EAC3B,UAAkB;IAElB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,OAAO,GACX,UAAU,KAAK,EAAE;QACf,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAoB,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC1D,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;QAC/B,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE;KACxC,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC"}
+{"version":3,"file":"list-read-scope.js","sourceRoot":"","sources":["../../src/extensions/list-read-scope.ts"],"names":[],"mappings":"AA+FA,uEAAuE;AACvE,qEAAqE;AACrE,wEAAwE;AACxE,uDAAuD;AACvD,OAAO,EACL,WAAW,EACX,8BAA8B,GAC/B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAsEzD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAgC,EAChC,MAAsB,EACtB,IAAqB,EACrB,SAA2B,EAC3B,UAAkB;IAElB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,OAAO,GACX,UAAU,KAAK,EAAE;QACf,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,OAAO,GAAoB,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACxD,MAAM,KAAK,GAAkB;YAC3B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;YAC/B,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE;SACxC,CAAC;QACF,MAAM,mBAAmB,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/C,OAAO,mBAAmB,KAAK,SAAS;YACtC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,yBAAyB,CAChC,IAAqB;IAErB,MAAM,MAAM,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IACzB,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO,CAAC,QAAQ,EAAE,EAAE;QAClB,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,QAAQ,KAAK,EAAE;YACpB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IAC1D,CAAC,CAAC;AACJ,CAAC"}

package/dist/extensions/policy-grant-scope.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The policy-grant-scope driver point (20260913.01; the P1 gate's Q7 iii,
+ * T01_1_review.md Q-OR-3): WHICH kinds a user may grant a role on in this
+ * edition, and with which roles. Single instance, registered as
+ * `drivers.policyGrantScope` (the identityFederation shape: a driver point
+ * whose absence is open source's own behaviour). Absent, the composition
+ * root installs `newOrganizationOnlyGrantScope()`
+ * (domain/iampolicy/grant-scope.ts): the organization grants the roles its
+ * `kind_meta` lists — owner, admin, member, viewer (Q-OR-4) — and no other
+ * kind grants anything. Per-resource grants (a viewer on one agent) are
+ * what the Enterprise and Cloud editions add by registering a wider scope;
+ * the cloud registers every kind's `kind_meta` roles.
+ *
+ * Who reads it: the IamPolicy command controller's ValidateGrantableRole on
+ * `create` — AFTER the proto (`grantableRolesFor` in
+ * pipeline/apiresource-meta.ts, the source of "what can be granted at
+ * all"; a kind that lists no roles is system-managed in every edition and
+ * refused before the scope is asked) and never on `bootstrapPolicy`, the
+ * structural lane — and `checkMyPermission`'s second arm, which answers
+ * `can_grant_access` false for a kind outside the scope so the console's
+ * existing PermissionGate hides grant controls without a new SDK surface
+ * (Q-OR-5).
+ *
+ * The contract every scope is held to (Q-S3-3, 2026-09-13):
+ *
+ *   - It NARROWS the proto, never widens it. A scope's answer for a kind is
+ *     read as a subset of `kind_meta.authorization.grantable_roles`;
+ *     ValidateGrantableRole intersects the two, so a driver cannot admit a
+ *     role the contract does not list by accident.
+ *   - It is TOTAL over ApiResourceKind, the unknown kind included: a kind
+ *     it does not admit answers the empty list, never a throw.
+ *     checkMyPermission asks about a kind that came off the wire and was
+ *     resolved by `kindByEnumName`, which yields the unknown kind rather
+ *     than failing (apiresource-meta.ts header).
+ *   - It is SYNCHRONOUS: an edition's grant scope is a fact about the
+ *     edition, a proto read at most, never I/O. A scope that would need a
+ *     network to answer is a different seam.
+ */
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+/** The grant-scope contract (single-instance point, ExtensionDrivers.policyGrantScope). */
+export interface PolicyGrantScope {
+    /**
+     * The roles a user may grant on a resource of `kind` in this edition — a
+     * subset of the kind's proto `grantable_roles`; empty when the edition
+     * grants nothing on the kind (or the kind is unknown). Never throws.
+     */
+    grantableRoles(kind: ApiResourceKind): ReadonlyArray<IamRole>;
+}
+//# sourceMappingURL=policy-grant-scope.d.ts.map

package/dist/extensions/policy-grant-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-grant-scope.d.ts","sourceRoot":"","sources":["../../src/extensions/policy-grant-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAC3H,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAEzE,2FAA2F;AAC3F,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;CAC/D"}

package/dist/extensions/policy-grant-scope.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=policy-grant-scope.js.map

package/dist/extensions/policy-grant-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-grant-scope.js","sourceRoot":"","sources":["../../src/extensions/policy-grant-scope.ts"],"names":[],"mappings":""}

package/dist/extensions/registry.d.ts

@@ -34,7 +34,10 @@
  * points (20260911.11) at the identity-accounts stage (the store driver,
  * ahead of the boot-time operator ensure) and the routes stage (the
  * federation capability and the provision slot's steps, into the
- * identity-account controller).
+ * identity-account controller); the IamPolicy points (20260913.01) at
+ * the same two stages — the store driver where the grant path is built,
+ * beside the identity-account store, and the grant scope and the query
+ * engine into the IamPolicy controller at the routes stage.
  */
 import type { DescMessage } from "@bufbuild/protobuf";
 import type { ConnectRouter } from "@connectrpc/connect";
@@ -42,9 +45,12 @@ import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_inf
 import type { ArtifactStorageDriverFactory } from "../artifactstorage/artifact-storage.js";
 import type { ChannelRuntime } from "../domain/agentchannel/channel-runtime.js";
 import type { IdentityAccountStore } from "../domain/identityaccount/store.js";
+import type { IamPolicyStore } from "../domain/iampolicy/store.js";
 import type { SecretCodec } from "../encryption/codec.js";
+import type { AuthorizationQueryEngine } from "./authorization-queries.js";
 import type { IdentityFederation } from "./identity-federation.js";
 import type { ListReadScope } from "./list-read-scope.js";
+import type { PolicyGrantScope } from "./policy-grant-scope.js";
 import type { ModelCatalogProvider } from "../domain/workflow/registry/model-catalog-provider.js";
 import type { VisitorErrorPolicy } from "../pipeline/interceptors/error-boundary.js";
 import type { PipelineStep } from "../pipeline/pipeline.js";
@@ -227,6 +233,22 @@ export interface ResolvedExtensionDrivers {
      * four federated RPCs refuse UNIMPLEMENTED with the edition reason.
      */
     readonly identityFederation: IdentityFederation | undefined;
+    /**
+     * The 20260913.01 IamPolicy store driver — undefined = the compose.ts
+     * stage that builds the grant path installs the OSS adapter over the
+     * generic Store, OSS behavior byte-identical.
+     */
+    readonly iamPolicyStore: IamPolicyStore | undefined;
+    /**
+     * The 20260913.01 policy grant scope — undefined = compose.ts installs
+     * open source's organization-only default.
+     */
+    readonly policyGrantScope: PolicyGrantScope | undefined;
+    /**
+     * The 20260913.01 authorization-query engine — undefined = the
+     * tuple-half RPC arms refuse UNIMPLEMENTED with the edition reason.
+     */
+    readonly authorizationQueries: AuthorizationQueryEngine | undefined;
 }
 /**
  * Merges the composed units, enforcing the §2b loud-fail rules. Runs

package/dist/extensions/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/extensions/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAE3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,KAAK,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC7B,MAAM,mBAAmB,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;AAE3E;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAC9B,YAAY,EACZ,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CACzC,CAAC;IACF,oEAAoE;IACpE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,yBAAyB,CAAC;IAC3D,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IAChE,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CACjD;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC5E;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC5D,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAClD,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IACtE,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,+BAA+B,CAAC,CAAC;IAC5E,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IAC/D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,wBAAwB,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACxE,0EAA0E;IAC1E,QAAQ,CAAC,8BAA8B,EACnC,8BAA8B,GAC9B,SAAS,CAAC;IACd,sEAAsE;IACtE,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAClE,uEAAuE;IACvE,QAAQ,CAAC,sBAAsB,EAAE,WAAW,CAC1C,MAAM,EACN,4BAA4B,CAC7B,CAAC;IACF,6EAA6E;IAC7E,QAAQ,CAAC,yBAAyB,EAAE,WAAW,CAC7C,MAAM,EACN,yBAAyB,CAC1B,CAAC;IACF;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,SAAS,CAAC;IACpD,uEAAuE;IACvE,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC5D;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAChE;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAChE;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAC7D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,GAAE,aAAa,CAAC,eAAe,CAAM,GACzC,kBAAkB,CAoUpB"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/extensions/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAE3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,KAAK,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC7B,MAAM,mBAAmB,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;AAE3E;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAC9B,YAAY,EACZ,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CACzC,CAAC;IACF,oEAAoE;IACpE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,yBAAyB,CAAC;IAC3D,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IAChE,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CACjD;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC5E;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC5D,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAClD,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IACtE,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,+BAA+B,CAAC,CAAC;IAC5E,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IAC/D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,wBAAwB,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACxE,0EAA0E;IAC1E,QAAQ,CAAC,8BAA8B,EACnC,8BAA8B,GAC9B,SAAS,CAAC;IACd,sEAAsE;IACtE,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAClE,uEAAuE;IACvE,QAAQ,CAAC,sBAAsB,EAAE,WAAW,CAC1C,MAAM,EACN,4BAA4B,CAC7B,CAAC;IACF,6EAA6E;IAC7E,QAAQ,CAAC,yBAAyB,EAAE,WAAW,CAC7C,MAAM,EACN,yBAAyB,CAC1B,CAAC;IACF;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,SAAS,CAAC;IACpD,uEAAuE;IACvE,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC5D;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAChE;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAChE;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC5D;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,SAAS,CAAC;IACpD;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACxD;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,EAAE,wBAAwB,GAAG,SAAS,CAAC;CACrE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,GAAE,aAAa,CAAC,eAAe,CAAM,GACzC,kBAAkB,CA2WpB"}