@stigmer/server 3.26.0 → 3.27.1

package/dist/domain/iampolicy/constants.js

@@ -36,7 +36,9 @@
  * console and SDK show these sentences verbatim, so they are contract. The
  * new sentences are the two edition refusals (the federation shape), the
  * unknown permission, the unknown principal kind (the resource sentence's
- * shape) and the malformed triple.
+ * shape), the malformed triple, and the four principal refusals a team
+ * grantee brought (a person's qualifier, a team's qualifier, a kind no
+ * team may be granted, a role a team may not hold).
  */
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { kindEnumName } from "../../pipeline/apiresource-meta.js";
@@ -135,8 +137,8 @@ export const ROLES_RECONCILED_KEY = "membership_rules_reconciled";
 /**
  * The principal kinds a PERSON may grant a role to — the user `create`
  * lane's grantee vocabulary (2026-09-14, session 9 ruling Q-S9-2; the
- * security read's finding 41). A role names a person, so the one grantee
- * is the identity account. A row whose principal is a RESOURCE
+ * security read's finding 41): a person (the identity account) and a team
+ * of people. A row whose principal is a RESOURCE
  * (`organization:A#organization@platform_client:X`, `#managed_org`) is a
  * structural link, and structural links are `bootstrapPolicy`'s — the
  * platform's own lane, which skips role validation by design.
@@ -147,13 +149,25 @@ export const ROLES_RECONCILED_KEY = "membership_rules_reconciled";
  * two cannot drift), and the hierarchy walk follows it. Without the arm, a
  * person with `can_grant_access` on organization B could write
  * `organization:A#member@organization:B` and B's Members page, asked for
- * inherited access, would list A's people. The cloud's `create` had the
- * same gap; the store's exclusion also keeps the cloud's Java-era `team`,
- * which is not an ApiResourceKind and so no wire spec can name.
+ * inherited access, would list A's people.
+ *
+ * Each kind grants through its own list: a person the kind's
+ * `grantable_roles`, a team its `team_grantable_roles`, always as the
+ * team's members (`TEAM_MEMBERS_RELATION`). A kind that lists no team role
+ * — `organization` among them, so open source's organization-only scope —
+ * grants a team nothing.
  */
 export const USER_GRANT_PRINCIPAL_KINDS = [
     ApiResourceKind.identity_account,
+    ApiResourceKind.team,
 ];
+/**
+ * The one relation a team principal names: the team's members. A grant to
+ * `team:<id>#member` is a grant to every member, and membership is bounded
+ * by organization membership in the model, so leaving the organization
+ * ends the grant with no cleanup.
+ */
+export const TEAM_MEMBERS_RELATION = "member";
 // ---------------------------------------------------------------------------
 // Byte-pinned copy (the cloud handlers' sentences, moved as-is).
 // ---------------------------------------------------------------------------
@@ -207,6 +221,27 @@ export function principalNotGrantableMessage(kind) {
     const grantable = USER_GRANT_PRINCIPAL_KINDS.map((k) => kindEnumName(k));
     return `Principal kind '${kind}' cannot be granted a role. Grantable principal kinds: [${grantable.join(", ")}]`;
 }
+/**
+ * A person principal carrying a relation qualifier (INVALID_ARGUMENT). A
+ * person is granted a role directly; `identity_account:<id>#<relation>`
+ * names no one, and OpenFGA would refuse the tuple after the row was
+ * written.
+ */
+export function personQualifierMessage(relation) {
+    return `Principal kind 'identity_account' takes no relation; got '${relation}'`;
+}
+/** A team principal naming a relation other than its members (INVALID_ARGUMENT). */
+export function teamQualifierMessage(relation) {
+    return `A team principal must name the relation '${TEAM_MEMBERS_RELATION}' (the team's members); got '${relation}'`;
+}
+/** A team grant on a kind that lists no team role (INVALID_ARGUMENT). */
+export function teamNotGrantableMessage(kind) {
+    return `A team cannot be granted access to resource kind '${kind}'.`;
+}
+/** A team grant of a role the kind does not let a team hold (INVALID_ARGUMENT); the list in kind_meta order. */
+export function teamRoleNotGrantableMessage(role, kind, grantable) {
+    return `Role '${role}' cannot be granted to a team on resource kind '${kind}'. Roles a team can hold: [${grantable.join(", ")}]`;
+}
 /** A triple field holding a canonical-text delimiter (INVALID_ARGUMENT; Q-S2-1). */
 export function malformedTripleMessage(field) {
     return `policy ${field} must not contain ':', '#' or '@'`;

package/dist/domain/iampolicy/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAMtH,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAE7D,+DAA+D;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAC1D,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAE3C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,iBAAiB,GAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AASxE,SAAS,cAAc,CAAC,IAAmB;IACzC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAmB;IACrD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;AAC/G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAmB;IACtD,MAAM,MAAM,GAA0D;QACpE,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;QAC9C,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;QACtD,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;QAC5C,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QACxC,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;KAC5B,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAmB;IAC7C,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAmC;IAC7D,eAAe,CAAC,KAAK;IACrB,eAAe,CAAC,QAAQ;IACxB,eAAe,CAAC,KAAK;IACrB,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,WAAW;IAC3B,eAAe,CAAC,QAAQ;CACzB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAElE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAmC;IACxE,eAAe,CAAC,gBAAgB;CACjC,CAAC;AAEF,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,2CAA2C;AAC3C,MAAM,UAAU,qBAAqB,CAAC,EAAU;IAC9C,OAAO,yBAAyB,EAAE,EAAE,CAAC;AACvC,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,6CAA6C,IAAI,gEAAgE,CAAC;AAC3H,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,uBAAuB,CACrC,IAAY,EACZ,IAAY,EACZ,SAAgC;IAEhC,OAAO,SAAS,IAAI,yCAAyC,IAAI,wBAAwB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACnH,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,+BAA+B,GAC1C,8CAA8C,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACrD,OAAO,2BAA2B,IAAI,GAAG,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,yCAAyC,GACpD,4EAA4E,CAAC;AAE/E,mGAAmG;AACnG,MAAM,CAAC,MAAM,2CAA2C,GACtD,uEAAuE,CAAC;AAE1E,0FAA0F;AAC1F,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,OAAO,uBAAuB,QAAQ,GAAG,CAAC;AAC5C,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,OAAO,4BAA4B,IAAI,GAAG,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,MAAM,SAAS,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,mBAAmB,IAAI,2DAA2D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACnH,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,UAAU,KAAK,mCAAmC,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAMtH,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAE7D,+DAA+D;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAC1D,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAE3C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,iBAAiB,GAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AASxE,SAAS,cAAc,CAAC,IAAmB;IACzC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAmB;IACrD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;AAC/G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAmB;IACtD,MAAM,MAAM,GAA0D;QACpE,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;QAC9C,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;QACtD,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;QAC5C,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QACxC,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;KAC5B,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAmB;IAC7C,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAmC;IAC7D,eAAe,CAAC,KAAK;IACrB,eAAe,CAAC,QAAQ;IACxB,eAAe,CAAC,KAAK;IACrB,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,WAAW;IAC3B,eAAe,CAAC,QAAQ;CACzB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAmC;IACxE,eAAe,CAAC,gBAAgB;IAChC,eAAe,CAAC,IAAI;CACrB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC;AAE9C,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,2CAA2C;AAC3C,MAAM,UAAU,qBAAqB,CAAC,EAAU;IAC9C,OAAO,yBAAyB,EAAE,EAAE,CAAC;AACvC,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,6CAA6C,IAAI,gEAAgE,CAAC;AAC3H,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,uBAAuB,CACrC,IAAY,EACZ,IAAY,EACZ,SAAgC;IAEhC,OAAO,SAAS,IAAI,yCAAyC,IAAI,wBAAwB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACnH,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,+BAA+B,GAC1C,8CAA8C,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACrD,OAAO,2BAA2B,IAAI,GAAG,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,yCAAyC,GACpD,4EAA4E,CAAC;AAE/E,mGAAmG;AACnG,MAAM,CAAC,MAAM,2CAA2C,GACtD,uEAAuE,CAAC;AAE1E,0FAA0F;AAC1F,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,OAAO,uBAAuB,QAAQ,GAAG,CAAC;AAC5C,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,OAAO,4BAA4B,IAAI,GAAG,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,MAAM,SAAS,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,mBAAmB,IAAI,2DAA2D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACnH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,OAAO,6DAA6D,QAAQ,GAAG,CAAC;AAClF,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO,4CAA4C,qBAAqB,gCAAgC,QAAQ,GAAG,CAAC;AACtH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,qDAAqD,IAAI,IAAI,CAAC;AACvE,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,2BAA2B,CACzC,IAAY,EACZ,IAAY,EACZ,SAAgC;IAEhC,OAAO,SAAS,IAAI,mDAAmD,IAAI,8BAA8B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACnI,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,UAAU,KAAK,mCAAmC,CAAC;AAC5D,CAAC"}

package/dist/domain/iampolicy/controller.d.ts

@@ -3,7 +3,9 @@ import type { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/serve
 import type { Logger } from "../../boot/logger.js";
 import type { AuthorizationQueryEngine } from "../../extensions/authorization-queries.js";
 import type { Authorizer } from "../../extensions/authorizer.js";
+import type { ResolvedGateSteps } from "../../extensions/gate-slots.js";
 import type { PolicyGrantScope } from "../../extensions/policy-grant-scope.js";
+import type { PrincipalDisplay } from "../../extensions/principal-display.js";
 import type { AccountsByCaller } from "../identityaccount/resolve.js";
 import type { AccountsByIds } from "./display-resolver.js";
 import type { IamPolicyGrantPath } from "./grant-path.js";
@@ -20,6 +22,10 @@ export interface IamPolicyControllerDeps {
     readonly grantScope: PolicyGrantScope;
     /** The composed query engine — undefined = the tuple-half RPCs refuse UNIMPLEMENTED. */
     readonly queries: AuthorizationQueryEngine | undefined;
+    /** The composed principal display — undefined = a non-person grantee renders in the id fallback shape. */
+    readonly principalDisplay: PrincipalDisplay | undefined;
+    /** The merged gate steps; `create` splices `iam-policy-create:pre-side-effect-gate`. */
+    readonly gateSteps: ResolvedGateSteps;
     /** The served edition — `checkMyPermission`'s first arm reads a kind's tier against it. */
     readonly edition: ServerEdition;
     readonly logger: Logger;

package/dist/domain/iampolicy/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/controller.ts"],"names":[],"mappings":"AAgGA,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAqCzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAE3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAGjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAmB/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAStE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAe1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAcjD,iHAAiH;AACjH,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,GAAG,aAAa,CAAC;AAEjE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,4GAA4G;IAC5G,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,sHAAsH;IACtH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACvD,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,sEAAsE;AACtE,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,uBAAuB,GAC5B,IAAI,CA0CN"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/controller.ts"],"names":[],"mappings":"AAkGA,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAqCzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAE3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAGxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAmB9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAStE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAe1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAcjD,iHAAiH;AACjH,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,GAAG,aAAa,CAAC;AAEjE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,4GAA4G;IAC5G,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,sHAAsH;IACtH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACvD,0GAA0G;IAC1G,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACxD,wFAAwF;IACxF,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,sEAAsE;AACtE,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,uBAAuB,GAC5B,IAAI,CA0CN"}

package/dist/domain/iampolicy/controller.js

@@ -31,9 +31,11 @@
  *     triple — strictly safer than the cloud's silent default instance.
  *   - `create` validates the role BEFORE it writes (the cloud's order): a
  *     held row under a role the kind does not grant is refused, never
- *     answered as a duplicate. It also grants to PEOPLE only (Q-S9-2,
- *     2026-09-14): a principal that is not an identity account is
- *     INVALID_ARGUMENT — a row naming a resource as its principal is the
+ *     answered as a duplicate. It also grants to PEOPLE and TEAMS only
+ *     (Q-S9-2, 2026-09-14): any other principal is INVALID_ARGUMENT, and a
+ *     team only on the roles its kind lets a team hold (steps.ts) and,
+ *     where an edition serves teams, only a team the create gate slot
+ *     admits — a row naming a resource as its principal is the
  *     structural link the hierarchy walk follows, `bootstrapPolicy`'s to
  *     write, and through this lane would have let a right on one
  *     organization list another's members. The cloud's create had the
@@ -99,6 +101,7 @@ import { AuthorizedPrincipalIdsListSchema, AuthorizedResourceIdsListSchema, Chec
 import { IamPolicyQueryController } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/query_pb";
 import { ApiResourceRefSchema, IamPolicySpecSchema, } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
 import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { stepsForSlot } from "../../extensions/gate-slots.js";
 import { isPlatformPipelineCaller } from "../../extensions/identity.js";
 import { kindByEnumName, kindEnumName, kindServedByEdition, } from "../../pipeline/apiresource-meta.js";
 import { internalError } from "../../pipeline/errors.js";
@@ -170,15 +173,18 @@ function guardSystemRpc(method, caller) {
 // ---------------------------------------------------------------------------
 // The command chains
 // ---------------------------------------------------------------------------
-/** `create`: the wire refusal, then Authorize → ValidateProto → ValidateGrantableRole → Grant. */
+/**
+ * `create`: the wire refusal, then Authorize → ValidateProto →
+ * ValidateGrantableRole → [iam-policy-create:pre-side-effect-gate] → Grant.
+ */
 function createPolicy(deps, spec, ctx) {
     requireWellFormedTriple(spec);
     return grantThroughChain(deps, IamPolicyCommandController.method.create, spec, ctx, true);
 }
 /**
  * The grant chain both `create` and `bootstrapPolicy` run; only the user
- * lane validates the role — bootstrap writes structural relations no
- * scope would admit.
+ * lane validates the role and runs the create gate slot — bootstrap writes
+ * structural relations no scope would admit and no edition gates.
  */
 async function grantThroughChain(deps, method, spec, ctx, validateRole) {
     const reqCtx = new RequestContext(IamPolicySpecSchema, spec, callerIdentityOf(ctx), kindOf(ctx));
@@ -187,6 +193,9 @@ async function grantThroughChain(deps, method, spec, ctx, validateRole) {
         .addStep(newValidateProtoStep());
     if (validateRole) {
         pipeline.addStep(newValidateGrantableRoleStep(deps.grantScope));
+        for (const step of stepsForSlot(deps.gateSteps, "iam-policy-create:pre-side-effect-gate")) {
+            pipeline.addStep(step);
+        }
     }
     await pipeline.addStep(newGrantStep(deps.grantPath)).build().execute(reqCtx);
     return policyResultOf(reqCtx, method);
@@ -340,7 +349,7 @@ async function listResourceAccessByPrincipal(deps, displayResolver, input, ctx)
     await authorizeDirect(IamPolicyQueryController.method.listResourceAccessByPrincipal, deps.authorizer, callerIdentityOf(ctx), input);
     const entries = await read(async () => {
         const hierarchy = await resolveHierarchy(deps.policies, resource.kind, resource.id, input.includeInherited);
-        return buildPrincipalAccessList(deps.policies, displayResolver, hierarchy);
+        return buildPrincipalAccessList(deps.policies, displayResolver, deps.principalDisplay, hierarchy);
     }, "failed to list resource access");
     return create(ResourceAccessByPrincipalListSchema, {
         entries: [...entries],

package/dist/domain/iampolicy/controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,MAAM,IAAI,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAE5G,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AAapG,OAAO,EACL,gCAAgC,EAChC,+BAA+B,EAC/B,8BAA8B,EAC9B,4BAA4B,EAC5B,qBAAqB,EACrB,mCAAmC,EACnC,0BAA0B,GAC3B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sDAAsD,CAAC;AAKhG,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAM1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAGxE,OAAO,EACL,cAAc,EACd,YAAY,EACZ,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EACL,iCAAiC,EACjC,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EACL,+BAA+B,EAC/B,2CAA2C,EAC3C,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAGlE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,4BAA4B,GAC7B,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,MAAM,EACN,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAoBlC,sEAAsE;AACtE,MAAM,UAAU,yBAAyB,CACvC,MAAqB,EACrB,IAA6B;IAE7B,MAAM,eAAe,GAAG,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC;IAElD,MAAM,CAAC,OAAO,CAAC,0BAA0B,EAAE;QACzC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACpD,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACpD,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC7B,cAAc,CAAC,OAAO,CAAC,eAAe,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC;QACD,uBAAuB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpC,cAAc,CAAC,OAAO,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YACvE,OAAO,uBAAuB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,eAAe,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC9B,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,CAAC;QAC5D,wBAAwB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACvC,cAAc,CAAC,OAAO,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YACxE,OAAO,eAAe,CACpB,IAAI,EACJ,OAAO,CAAC,wBAAwB,EAChC,KAAK,EACL,GAAG,CACJ,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE;QACvC,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,iBAAiB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACtE,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACxE,yBAAyB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxC,yBAAyB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC7C,0BAA0B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACzC,0BAA0B,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC9C,6BAA6B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC5C,6BAA6B,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,CAAC;QAClE,yBAAyB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxC,yBAAyB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC7C,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAkB,EAAE,MAAsB;IAChE,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO;IACT,CAAC;IACD,MAAM,IAAI,YAAY,CACpB,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,QAAQ,EAClD,IAAI,CAAC,gBAAgB,CACtB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,kGAAkG;AAClG,SAAS,YAAY,CACnB,IAA6B,EAC7B,IAAmB,EACnB,GAAmB;IAEnB,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,iBAAiB,CACtB,IAAI,EACJ,0BAA0B,CAAC,MAAM,CAAC,MAAM,EACxC,IAAI,EACJ,GAAG,EACH,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,MAAkB,EAClB,IAAmB,EACnB,GAAmB,EACnB,YAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,mBAAmB,EACnB,IAAI,EACJ,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,CAC1B,aAAa,MAAM,CAAC,SAAS,EAAE,EAC/B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnC,IAAI,YAAY,EAAE,CAAC;QACjB,QAAQ,CAAC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7E,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,qHAAqH;AACrH,KAAK,UAAU,YAAY,CACzB,IAA6B,EAC7B,IAAmB,EACnB,GAAmB;IAEnB,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,mBAAmB,EACnB,IAAI,EACJ,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAA6B,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC;SAC3E,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SACtC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,eAAe,CAC5B,IAA6B,EAC7B,MAAkB,EAClB,KAA2B,EAC3B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,0BAA0B,EAC1B,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,aAAa,MAAM,CAAC,SAAS,EAAE,EAC/B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SAC/C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,IAA6B,EAC7B,GAAmB,EACnB,GAAmB;IAEnB,MAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,uBAAuB,CAAC;IACzE,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,oBAAoB,EACpB,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,mCAAmC,EACnC,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SAC/C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,cAAc,CACrB,MAA4B,EAC5B,MAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,SAAS,sCAAsC,CAAC,EACpE,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,MAAmB,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,qEAAqE;AACrE,KAAK,UAAU,GAAG,CAChB,IAA6B,EAC7B,EAAe,EACf,GAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,EACtC,2BAA2B,CAC5B,CAAC;IACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,qBAAqB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;IACD,sEAAsE;IACtE,qEAAqE;IACrE,wDAAwD;IACxD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,GAAG,EACnC,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,EAAE,EACF,EAAE,YAAY,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CACzE,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,EACxC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE7D,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,CAAC,oBAAoB,EAAE;YAC7C,IAAI,EAAE,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC;YACpD,EAAE,EAAE,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,EAAE;YACzC,SAAS;YACT,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,0EAA0E;IAC1E,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,yEAAyE;IACzE,IACE,UAAU,KAAK,aAAa,CAAC,gBAAgB;QAC7C,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EACzD,CAAC;QACD,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,qEAAqE;IACrE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE;QACjE,UAAU;QACV,YAAY;QACZ,UAAU,EAAE,QAAQ,CAAC,EAAE;KACxB,CAAC,CAAC;IACH,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,KAAK,aAAa;YAChB,MAAM,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAC3D,iCAAiC,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAA6B,EAC7B,KAA8B,EAC9B,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,yBAAyB,CACtC,IAA6B,EAC7B,KAAqC,EACrC,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACrD,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,eAAe,CAC9C,SAAS,EACT,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,OAAO,MAAM,CAAC,+BAA+B,EAAE;QAC7C,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,IAA6B,EAC7B,KAAsC,EACtC,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,yBAAyB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,0BAA0B,EAC1D,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAChD,QAAQ,EACR,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,OAAO,MAAM,CAAC,gCAAgC,EAAE;QAC9C,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,IAA6B,EAC7B,eAA6D,EAC7D,KAA8B,EAC9B,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,6BAA6B,EAC7D,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,IAAI,EAAE;QACpC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CACtC,IAAI,CAAC,QAAQ,EACb,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,EACX,KAAK,CAAC,gBAAgB,CACvB,CAAC;QACF,OAAO,wBAAwB,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;IAC7E,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,mCAAmC,EAAE;QACjD,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;KACtB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,IAA6B,EAC7B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,yBAAyB,EACzD,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,IAAI,CACrB,GAAG,EAAE,CACH,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CACtC,SAAS,CAAC,IAAI,EACd,SAAS,CAAC,EAAE,EACZ,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,CACZ,EACH,gCAAgC,CACjC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI;SACf,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;SAC5C,MAAM,CAAC,gBAAgB,CAAC;SACxB,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAA6B,EAC7B,KAA8B,EAC9B,GAAmB;IAEnB,mEAAmE;IACnE,MAAM,aAAa,GACjB,KAAK,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAC/D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,yBAAyB,CAAC,aAAa,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,kBAAkB,EAClD,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,GAAG,EAAE,CACH,IAAI,CAAC,QAAQ,CAAC,iCAAiC,CAC7C,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,EAC1C,KAAK,CAAC,KAAK,EACX,aAAa,EACb,mBAAmB,EAAE,CACtB,EACH,4BAA4B,CAC7B,CAAC;IACF,OAAO,MAAM,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,sEAAsE;AACtE,SAAS,oBAAoB,CAAC,MAAsB;IAClD,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,+BAA+B,EAC/B,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,MAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,IAAI,CACxB,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAC7C,wCAAwC,CACzC,CAAC;IACF,OAAO,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAClC,IAA6B,EAC7B,MAAsB,EACtB,SAAqC;IAErC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC1E,OAAO;IACT,CAAC;IACD,IAAI,SAAS,EAAE,IAAI,KAAK,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,YAAY,CACpB,4DAA4D,EAC5D,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,SAAS,CAAC,EAAE,CAAC;IACjC,IAAI,WAAW,KAAK,EAAE,IAAI,WAAW,KAAK,iBAAiB,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CACpB,QAAQ,iBAAiB,uCAAuC;YAC9D,kDAAkD,EACpD,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,KAAK,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CACpB,4CAA4C,EAC5C,IAAI,CAAC,gBAAgB,CACtB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,kBAAkB,CACzB,IAA6B;IAE7B,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CACpB,2CAA2C,EAC3C,IAAI,CAAC,aAAa,CACnB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,GAA+B;IACjD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,sDAAsD,CAAC,EACjE,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,MAAiC;IAC3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,mDAAmD,CAAC,EAC9D,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2FAA2F;AAC3F,SAAS,SAAS,CAAC,MAAiB;IAClC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,UAAU,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,GAAG,4BAA4B,CACjE,EACD,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,mGAAmG;AACnG,KAAK,UAAU,IAAI,CACjB,SAA2B,EAC3B,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2FG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,MAAM,IAAI,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAE5G,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AAapG,OAAO,EACL,gCAAgC,EAChC,+BAA+B,EAC/B,8BAA8B,EAC9B,4BAA4B,EAC5B,qBAAqB,EACrB,mCAAmC,EACnC,0BAA0B,GAC3B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sDAAsD,CAAC;AAKhG,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAM1E,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAIxE,OAAO,EACL,cAAc,EACd,YAAY,EACZ,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EACL,iCAAiC,EACjC,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EACL,+BAA+B,EAC/B,2CAA2C,EAC3C,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAGlE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,4BAA4B,GAC7B,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,MAAM,EACN,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAwBlC,sEAAsE;AACtE,MAAM,UAAU,yBAAyB,CACvC,MAAqB,EACrB,IAA6B;IAE7B,MAAM,eAAe,GAAG,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC;IAElD,MAAM,CAAC,OAAO,CAAC,0BAA0B,EAAE;QACzC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACpD,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACpD,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC7B,cAAc,CAAC,OAAO,CAAC,eAAe,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC;QACD,uBAAuB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpC,cAAc,CAAC,OAAO,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YACvE,OAAO,uBAAuB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,eAAe,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC9B,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,CAAC;QAC5D,wBAAwB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACvC,cAAc,CAAC,OAAO,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YACxE,OAAO,eAAe,CACpB,IAAI,EACJ,OAAO,CAAC,wBAAwB,EAChC,KAAK,EACL,GAAG,CACJ,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE;QACvC,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,iBAAiB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACtE,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACxE,yBAAyB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxC,yBAAyB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC7C,0BAA0B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACzC,0BAA0B,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC9C,6BAA6B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC5C,6BAA6B,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,CAAC;QAClE,yBAAyB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxC,yBAAyB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC7C,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAkB,EAAE,MAAsB;IAChE,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO;IACT,CAAC;IACD,MAAM,IAAI,YAAY,CACpB,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,QAAQ,EAClD,IAAI,CAAC,gBAAgB,CACtB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,YAAY,CACnB,IAA6B,EAC7B,IAAmB,EACnB,GAAmB;IAEnB,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,iBAAiB,CACtB,IAAI,EACJ,0BAA0B,CAAC,MAAM,CAAC,MAAM,EACxC,IAAI,EACJ,GAAG,EACH,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,MAAkB,EAClB,IAAmB,EACnB,GAAmB,EACnB,YAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,mBAAmB,EACnB,IAAI,EACJ,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,CAC1B,aAAa,MAAM,CAAC,SAAS,EAAE,EAC/B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnC,IAAI,YAAY,EAAE,CAAC;QACjB,QAAQ,CAAC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAChE,KAAK,MAAM,IAAI,IAAI,YAAY,CAC7B,IAAI,CAAC,SAAS,EACd,wCAAwC,CACzC,EAAE,CAAC;YACF,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7E,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,qHAAqH;AACrH,KAAK,UAAU,YAAY,CACzB,IAA6B,EAC7B,IAAmB,EACnB,GAAmB;IAEnB,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,mBAAmB,EACnB,IAAI,EACJ,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAA6B,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC;SAC3E,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SACtC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,eAAe,CAC5B,IAA6B,EAC7B,MAAkB,EAClB,KAA2B,EAC3B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,0BAA0B,EAC1B,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,aAAa,MAAM,CAAC,SAAS,EAAE,EAC/B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SAC/C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,IAA6B,EAC7B,GAAmB,EACnB,GAAmB;IAEnB,MAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,uBAAuB,CAAC;IACzE,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,oBAAoB,EACpB,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,mCAAmC,EACnC,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SAC/C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,cAAc,CACrB,MAA4B,EAC5B,MAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,SAAS,sCAAsC,CAAC,EACpE,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,MAAmB,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,qEAAqE;AACrE,KAAK,UAAU,GAAG,CAChB,IAA6B,EAC7B,EAAe,EACf,GAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,EACtC,2BAA2B,CAC5B,CAAC;IACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,qBAAqB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;IACD,sEAAsE;IACtE,qEAAqE;IACrE,wDAAwD;IACxD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,GAAG,EACnC,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,EAAE,EACF,EAAE,YAAY,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CACzE,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,EACxC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE7D,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,CAAC,oBAAoB,EAAE;YAC7C,IAAI,EAAE,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC;YACpD,EAAE,EAAE,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,EAAE;YACzC,SAAS;YACT,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,0EAA0E;IAC1E,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,yEAAyE;IACzE,IACE,UAAU,KAAK,aAAa,CAAC,gBAAgB;QAC7C,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EACzD,CAAC;QACD,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,qEAAqE;IACrE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE;QACjE,UAAU;QACV,YAAY;QACZ,UAAU,EAAE,QAAQ,CAAC,EAAE;KACxB,CAAC,CAAC;IACH,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,KAAK,aAAa;YAChB,MAAM,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAC3D,iCAAiC,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAA6B,EAC7B,KAA8B,EAC9B,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,yBAAyB,CACtC,IAA6B,EAC7B,KAAqC,EACrC,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACrD,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,eAAe,CAC9C,SAAS,EACT,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,OAAO,MAAM,CAAC,+BAA+B,EAAE;QAC7C,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,IAA6B,EAC7B,KAAsC,EACtC,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,yBAAyB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,0BAA0B,EAC1D,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAChD,QAAQ,EACR,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,OAAO,MAAM,CAAC,gCAAgC,EAAE;QAC9C,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,IAA6B,EAC7B,eAA6D,EAC7D,KAA8B,EAC9B,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,6BAA6B,EAC7D,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,IAAI,EAAE;QACpC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CACtC,IAAI,CAAC,QAAQ,EACb,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,EACX,KAAK,CAAC,gBAAgB,CACvB,CAAC;QACF,OAAO,wBAAwB,CAC7B,IAAI,CAAC,QAAQ,EACb,eAAe,EACf,IAAI,CAAC,gBAAgB,EACrB,SAAS,CACV,CAAC;IACJ,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,mCAAmC,EAAE;QACjD,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;KACtB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,IAA6B,EAC7B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,yBAAyB,EACzD,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,IAAI,CACrB,GAAG,EAAE,CACH,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CACtC,SAAS,CAAC,IAAI,EACd,SAAS,CAAC,EAAE,EACZ,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,CACZ,EACH,gCAAgC,CACjC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI;SACf,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;SAC5C,MAAM,CAAC,gBAAgB,CAAC;SACxB,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAA6B,EAC7B,KAA8B,EAC9B,GAAmB;IAEnB,mEAAmE;IACnE,MAAM,aAAa,GACjB,KAAK,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAC/D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,yBAAyB,CAAC,aAAa,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,kBAAkB,EAClD,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,GAAG,EAAE,CACH,IAAI,CAAC,QAAQ,CAAC,iCAAiC,CAC7C,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,EAC1C,KAAK,CAAC,KAAK,EACX,aAAa,EACb,mBAAmB,EAAE,CACtB,EACH,4BAA4B,CAC7B,CAAC;IACF,OAAO,MAAM,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,sEAAsE;AACtE,SAAS,oBAAoB,CAAC,MAAsB;IAClD,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,+BAA+B,EAC/B,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,MAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,IAAI,CACxB,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAC7C,wCAAwC,CACzC,CAAC;IACF,OAAO,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAClC,IAA6B,EAC7B,MAAsB,EACtB,SAAqC;IAErC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC1E,OAAO;IACT,CAAC;IACD,IAAI,SAAS,EAAE,IAAI,KAAK,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,YAAY,CACpB,4DAA4D,EAC5D,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,SAAS,CAAC,EAAE,CAAC;IACjC,IAAI,WAAW,KAAK,EAAE,IAAI,WAAW,KAAK,iBAAiB,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CACpB,QAAQ,iBAAiB,uCAAuC;YAC9D,kDAAkD,EACpD,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,KAAK,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CACpB,4CAA4C,EAC5C,IAAI,CAAC,gBAAgB,CACtB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,kBAAkB,CACzB,IAA6B;IAE7B,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CACpB,2CAA2C,EAC3C,IAAI,CAAC,aAAa,CACnB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,GAA+B;IACjD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,sDAAsD,CAAC,EACjE,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,MAAiC;IAC3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,mDAAmD,CAAC,EAC9D,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2FAA2F;AAC3F,SAAS,SAAS,CAAC,MAAiB;IAClC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,UAAU,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,GAAG,4BAA4B,CACjE,EACD,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,mGAAmG;AACnG,KAAK,UAAU,IAAI,CACjB,SAA2B,EAC3B,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}

package/dist/domain/iampolicy/resource-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-store.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/resource-store.ts"],"names":[],"mappings":"AA2CA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAGtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAmBjD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,KAAK,GAAG,cAAc,CAwGtE"}
+{"version":3,"file":"resource-store.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/resource-store.ts"],"names":[],"mappings":"AA2CA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAGtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAgBjD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,KAAK,GAAG,cAAc,CAwGtE"}

package/dist/domain/iampolicy/resource-store.js

@@ -47,13 +47,9 @@ const KIND = ApiResourceKind.iam_policy;
  * principal half is derived from the user lane's grantee vocabulary
  * (constants.ts USER_GRANT_PRINCIPAL_KINDS; Q-S9-2) so the writer's "who a
  * person may grant to" and the reader's "what is a person, not a parent"
- * are one definition; `team` stays for the cloud's Java-era rows (not an
- * ApiResourceKind, so no wire spec names it).
+ * are one definition: the identity account and the team.
  */
-const NON_STRUCTURAL_PRINCIPAL_KINDS = [
-    ...USER_GRANT_PRINCIPAL_KINDS.map((kind) => kindEnumName(kind)),
-    "team",
-];
+const NON_STRUCTURAL_PRINCIPAL_KINDS = USER_GRANT_PRINCIPAL_KINDS.map((kind) => kindEnumName(kind));
 const NON_STRUCTURAL_RELATIONS = ["owner", "creator"];
 export function newResourceIamPolicyStore(store) {
     async function readById(id) {

package/dist/domain/iampolicy/resource-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-store.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/resource-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAErF,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAGlD,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC;AAExC;;;;;;;;GAQG;AACH,MAAM,8BAA8B,GAA0B;IAC5D,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM;CACP,CAAC;AACF,MAAM,wBAAwB,GAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAE7E,MAAM,UAAU,yBAAyB,CAAC,KAAY;IACpD,KAAK,UAAU,QAAQ,CAAC,EAAU;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,KAAK,UAAU,GAAG;QAChB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,UAAU,KAAK,CAClB,SAAyC;QAEzC,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YACrC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,KAAK,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,oBAAoB,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE;YACjB,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC;QAED,QAAQ,EAAE,QAAQ;QAElB,eAAe,CAAC,aAAa,EAAE,WAAW;YACxC,OAAO,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;QAC5E,CAAC;QAED,cAAc,CAAC,YAAY,EAAE,UAAU;YACrC,OAAO,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;QACzE,CAAC;QAED,0BAA0B,CACxB,aAAa,EACb,WAAW,EACX,YAAY,EACZ,UAAU;YAEV,OAAO,KAAK,CACV,CAAC,MAAM,EAAE,EAAE,CACT,WAAW,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC;gBAC/C,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAC/C,CAAC;QACJ,CAAC;QAED,2BAA2B,CAAC,YAAY,EAAE,UAAU,EAAE,SAAS;YAC7D,OAAO,KAAK,CACV,CAAC,MAAM,EAAE,EAAE,CACT,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC;gBAC5C,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CACzC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,iCAAiC,CACrC,YAAY,EACZ,UAAU,EACV,aAAa,EACb,SAAS;YAET,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;YACrC,KAAK,MAAM,MAAM,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;gBACjC,IACE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC;oBAC5C,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;oBACtC,CAAC,aAAa,KAAK,SAAS;wBAC1B,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,aAAa,CAAC,EACjD,CAAC;oBACD,UAAU,CAAC,GAAG,CACZ,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,CAC5E,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,UAAU,CAAC,IAAI,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,YAAY,EAAE,UAAU;YAC3C,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,IAAI,CACvB,CAAC,MAAM,EAAE,EAAE,CACT,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC;gBAC5C,CAAC,8BAA8B,CAAC,QAAQ,CACtC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CACnC;gBACD,CAAC,wBAAwB,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CACzD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAiB,EAAE,IAAY,EAAE,EAAU;IAC9D,OAAO,CACL,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAiB,EAAE,IAAY,EAAE,EAAU;IAC7D,OAAO,CACL,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,CACzE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAiB;IACnC,OAAO,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACrC,CAAC"}
+{"version":3,"file":"resource-store.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/resource-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAErF,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAGlD,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,8BAA8B,GAClC,0BAA0B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,MAAM,wBAAwB,GAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAE7E,MAAM,UAAU,yBAAyB,CAAC,KAAY;IACpD,KAAK,UAAU,QAAQ,CAAC,EAAU;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,KAAK,UAAU,GAAG;QAChB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,UAAU,KAAK,CAClB,SAAyC;QAEzC,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YACrC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,KAAK,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,oBAAoB,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE;YACjB,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC;QAED,QAAQ,EAAE,QAAQ;QAElB,eAAe,CAAC,aAAa,EAAE,WAAW;YACxC,OAAO,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;QAC5E,CAAC;QAED,cAAc,CAAC,YAAY,EAAE,UAAU;YACrC,OAAO,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;QACzE,CAAC;QAED,0BAA0B,CACxB,aAAa,EACb,WAAW,EACX,YAAY,EACZ,UAAU;YAEV,OAAO,KAAK,CACV,CAAC,MAAM,EAAE,EAAE,CACT,WAAW,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC;gBAC/C,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAC/C,CAAC;QACJ,CAAC;QAED,2BAA2B,CAAC,YAAY,EAAE,UAAU,EAAE,SAAS;YAC7D,OAAO,KAAK,CACV,CAAC,MAAM,EAAE,EAAE,CACT,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC;gBAC5C,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CACzC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,iCAAiC,CACrC,YAAY,EACZ,UAAU,EACV,aAAa,EACb,SAAS;YAET,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;YACrC,KAAK,MAAM,MAAM,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;gBACjC,IACE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC;oBAC5C,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;oBACtC,CAAC,aAAa,KAAK,SAAS;wBAC1B,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,aAAa,CAAC,EACjD,CAAC;oBACD,UAAU,CAAC,GAAG,CACZ,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,CAC5E,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,UAAU,CAAC,IAAI,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,YAAY,EAAE,UAAU;YAC3C,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,IAAI,CACvB,CAAC,MAAM,EAAE,EAAE,CACT,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC;gBAC5C,CAAC,8BAA8B,CAAC,QAAQ,CACtC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CACnC;gBACD,CAAC,wBAAwB,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CACzD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAiB,EAAE,IAAY,EAAE,EAAU;IAC9D,OAAO,CACL,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAiB,EAAE,IAAY,EAAE,EAAU;IAC7D,OAAO,CACL,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,CACzE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAiB;IACnC,OAAO,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACrC,CAAC"}

package/dist/domain/iampolicy/steps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/steps.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AACpG,OAAO,KAAK,EAEV,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,qDAAqD,CAAC;AAG7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAE/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAS/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAM1D,sHAAsH;AACtH,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,gFAAgF;AAChF,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,gBAAgB,GACtB,YAAY,CAAC,OAAO,mBAAmB,CAAC,CA0C1C;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAC1B,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAU1C;AAED,oGAAoG;AACpG,wBAAgB,aAAa,CAC3B,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAU1C;AAED,4EAA4E;AAC5E,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,0BAA0B,CAAC,CAYjD;AAED,iGAAiG;AACjG,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,oBAAoB,CAAC,CAQ3C"}
+{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/steps.ts"],"names":[],"mappings":"AA2DA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AACpG,OAAO,KAAK,EAEV,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,qDAAqD,CAAC;AAG7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAM/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAa/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAM1D,sHAAsH;AACtH,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,gFAAgF;AAChF,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,gBAAgB,GACtB,YAAY,CAAC,OAAO,mBAAmB,CAAC,CA4D1C;AA2CD,mFAAmF;AACnF,wBAAgB,YAAY,CAC1B,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAU1C;AAED,oGAAoG;AACpG,wBAAgB,aAAa,CAC3B,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAU1C;AAED,4EAA4E;AAC5E,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,0BAA0B,CAAC,CAYjD;AAED,iGAAiG;AACjG,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,oBAAoB,CAAC,CAQ3C"}

package/dist/domain/iampolicy/steps.js

@@ -30,20 +30,35 @@
  *      intersection — the cloud's second copy listing it. Intersecting is
  *      what keeps a scope from WIDENING the contract by accident;
  *   5. the PRINCIPAL (Q-S9-2, 2026-09-14; constants.ts
- *      USER_GRANT_PRINCIPAL_KINDS): a person grants roles to people — the
- *      identity account — and to nothing else. A row whose principal is a
+ *      USER_GRANT_PRINCIPAL_KINDS): a person grants roles to people and to
+ *      teams of people, and to nothing else. A row whose principal is a
  *      resource is a structural link (the hierarchy walk's parent edge),
  *      which is `bootstrapPolicy`'s to write; through this lane it would
  *      let a right on one organization read another's members. Last, so
  *      every answer the cloud's create gives today is unchanged and only
- *      the row it should never have written is refused.
+ *      the row it should never have written is refused. A person names no
+ *      relation qualifier: `identity_account:<id>#<anything>` names
+ *      nobody, and OpenFGA would refuse the tuple after the row was
+ *      written, a grant on paper that is denied in practice.
+ *
+ * A TEAM principal takes its own list in place of arm 4: the kind's
+ * `team_grantable_roles` ∩ scope, never the person list, because a team
+ * is granted only what its members could each be granted and never
+ * ownership. It must name the team's members (`TEAM_MEMBERS_RELATION`).
+ * A kind that lists no team role refuses a team whatever the role, so
+ * open source (organization-only scope, and `organization` lists none)
+ * grants a team nothing without a branch of its own. Whether the team
+ * exists and belongs to the resource's organization needs a read, which
+ * this synchronous step does not make: that is the
+ * `iam-policy-create:pre-side-effect-gate` slot's, spliced after it.
  */
 import { create } from "@bufbuild/protobuf";
 import { Code, ConnectError } from "@connectrpc/connect";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
 import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
-import { grantableRolesFor } from "../../pipeline/apiresource-meta.js";
-import { PER_RESOURCE_GRANTS_UNIMPLEMENTED_MESSAGE, USER_GRANT_PRINCIPAL_KINDS, noGrantableRolesMessage, principalNotGrantableMessage, roleNotGrantableMessage, } from "./constants.js";
+import { grantableRolesFor, kindEnumName, teamGrantableRolesFor, } from "../../pipeline/apiresource-meta.js";
+import { PER_RESOURCE_GRANTS_UNIMPLEMENTED_MESSAGE, TEAM_MEMBERS_RELATION, noGrantableRolesMessage, personQualifierMessage, principalNotGrantableMessage, roleNotGrantableMessage, teamNotGrantableMessage, teamQualifierMessage, teamRoleNotGrantableMessage, } from "./constants.js";
 import { requireKnownPrincipalKind, requireKnownResourceKind, } from "./wire-refusals.js";
 /** The row a write chain answers — the granted row, or the revoked row (the default instance when there was none). */
 export const POLICY_RESULT_KEY = "policyResult";
@@ -63,18 +78,45 @@ export function newValidateGrantableRoleStep(scope) {
             if (scoped.size === 0) {
                 throw new ConnectError(PER_RESOURCE_GRANTS_UNIMPLEMENTED_MESSAGE, Code.Unimplemented);
             }
+            const principal = spec.principal;
+            if (principal?.kind === TEAM_KIND_NAME) {
+                requireTeamGrant(spec.relation, principal.relation, kind, kindName, scoped);
+                return;
+            }
             const grantable = contract.filter((role) => scoped.has(role));
             if (!grantable.some((role) => IamRole[role] === spec.relation)) {
                 throw new ConnectError(roleNotGrantableMessage(spec.relation, kindName, grantable.map((role) => IamRole[role])), Code.InvalidArgument);
             }
-            const principalKindName = spec.principal?.kind ?? "";
+            const principalKindName = principal?.kind ?? "";
             const principalKind = requireKnownPrincipalKind(principalKindName);
-            if (!USER_GRANT_PRINCIPAL_KINDS.includes(principalKind)) {
+            if (principalKind !== ApiResourceKind.identity_account) {
                 throw new ConnectError(principalNotGrantableMessage(principalKindName), Code.InvalidArgument);
             }
+            const qualifier = principal?.relation ?? "";
+            if (qualifier !== "") {
+                throw new ConnectError(personQualifierMessage(qualifier), Code.InvalidArgument);
+            }
         },
     };
 }
+/** The wire name of the team kind, as an `ApiResourceRef.kind` carries it. */
+const TEAM_KIND_NAME = kindEnumName(ApiResourceKind.team);
+/**
+ * The team arm of ValidateGrantableRole (the module header): the role
+ * against the kind's team list narrowed by the scope, then the qualifier.
+ */
+function requireTeamGrant(role, qualifier, kind, kindName, scoped) {
+    const teamGrantable = teamGrantableRolesFor(kind).filter((r) => scoped.has(r));
+    if (teamGrantable.length === 0) {
+        throw new ConnectError(teamNotGrantableMessage(kindName), Code.InvalidArgument);
+    }
+    if (!teamGrantable.some((r) => IamRole[r] === role)) {
+        throw new ConnectError(teamRoleNotGrantableMessage(role, kindName, teamGrantable.map((r) => IamRole[r])), Code.InvalidArgument);
+    }
+    if (qualifier !== TEAM_MEMBERS_RELATION) {
+        throw new ConnectError(teamQualifierMessage(qualifier), Code.InvalidArgument);
+    }
+}
 /** Grant the spec as the chain's caller; the row (fresh or held) is the result. */
 export function newGrantStep(grantPath) {
     return {

package/dist/domain/iampolicy/steps.js.map

@@ -1 +1 @@
-{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAOrF,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAGpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAGvE,OAAO,EACL,yCAAyC,EACzC,0BAA0B,EAC1B,uBAAuB,EACvB,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAE5B,sHAAsH;AACtH,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEhD,gFAAgF;AAChF,MAAM,UAAU,4BAA4B,CAC1C,KAAuB;IAEvB,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,OAAO,CAAC,GAA+C;YACrD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,YAAY,CACpB,uBAAuB,CAAC,QAAQ,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CACpB,yCAAyC,EACzC,IAAI,CAAC,aAAa,CACnB,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,YAAY,CACpB,uBAAuB,CACrB,IAAI,CAAC,QAAQ,EACb,QAAQ,EACR,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CACvC,EACD,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;YACrD,MAAM,aAAa,GAAG,yBAAyB,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,YAAY,CACpB,4BAA4B,CAAC,iBAAiB,CAAC,EAC/C,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAC1B,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,OAAO,CACX,GAA+C;YAE/C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YACxE,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,aAAa,CAC3B,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CACX,GAA+C;YAE/C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACxD,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sBAAsB,CACpC,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,CACL,GAAsD;YAEtD,OAAO,SAAS,CAAC,eAAe,CAC9B,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAC3B,GAAG,CAAC,KAAK,CAAC,cAAc,CACzB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,sBAAsB,CACpC,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,CAAC,GAAgD;YACtD,MAAM,GAAG,GAAmB,GAAG,CAAC,KAAK,CAAC;YACtC,OAAO,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAOrF,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAGpE,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,GACtB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EACL,yCAAyC,EACzC,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAE5B,sHAAsH;AACtH,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEhD,gFAAgF;AAChF,MAAM,UAAU,4BAA4B,CAC1C,KAAuB;IAEvB,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,OAAO,CAAC,GAA+C;YACrD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,YAAY,CACpB,uBAAuB,CAAC,QAAQ,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CACpB,yCAAyC,EACzC,IAAI,CAAC,aAAa,CACnB,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,IAAI,SAAS,EAAE,IAAI,KAAK,cAAc,EAAE,CAAC;gBACvC,gBAAgB,CACd,IAAI,CAAC,QAAQ,EACb,SAAS,CAAC,QAAQ,EAClB,IAAI,EACJ,QAAQ,EACR,MAAM,CACP,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,YAAY,CACpB,uBAAuB,CACrB,IAAI,CAAC,QAAQ,EACb,QAAQ,EACR,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CACvC,EACD,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,iBAAiB,GAAG,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;YAChD,MAAM,aAAa,GAAG,yBAAyB,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,aAAa,KAAK,eAAe,CAAC,gBAAgB,EAAE,CAAC;gBACvD,MAAM,IAAI,YAAY,CACpB,4BAA4B,CAAC,iBAAiB,CAAC,EAC/C,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;YAC5C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,YAAY,CACpB,sBAAsB,CAAC,SAAS,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,cAAc,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;AAE1D;;;GAGG;AACH,SAAS,gBAAgB,CACvB,IAAY,EACZ,SAAiB,EACjB,IAAqB,EACrB,QAAgB,EAChB,MAA4B;IAE5B,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CACd,CAAC;IACF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CACpB,uBAAuB,CAAC,QAAQ,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,YAAY,CACpB,2BAA2B,CACzB,IAAI,EACJ,QAAQ,EACR,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CACrC,EACD,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,qBAAqB,EAAE,CAAC;QACxC,MAAM,IAAI,YAAY,CACpB,oBAAoB,CAAC,SAAS,CAAC,EAC/B,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAC1B,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,OAAO,CACX,GAA+C;YAE/C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YACxE,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,aAAa,CAC3B,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CACX,GAA+C;YAE/C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACxD,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sBAAsB,CACpC,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,CACL,GAAsD;YAEtD,OAAO,SAAS,CAAC,eAAe,CAC9B,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAC3B,GAAG,CAAC,KAAK,CAAC,cAAc,CACzB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,sBAAsB,CACpC,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,CAAC,GAAgD;YACtD,MAAM,GAAG,GAAmB,GAAG,CAAC,KAAK,CAAC;YACtC,OAAO,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/workflow/registry/data/task-kind-registry.json

@@ -1498,6 +1498,7 @@
                                         "identity_provider",
                                         "oauth_app",
                                         "platform_client",
+                                        "team",
                                         "organization",
                                         "platform",
                                         "agent",

package/dist/extensions/drivers.d.ts

@@ -31,6 +31,9 @@
  *     port, which kinds an edition grants on, and the tuple-half query
  *     engine only an authorization backend can answer) — landed with
  *     20260913.01, gate ruling Q-OR-10
+ *   - principal display (how an access list names a grantee that is not
+ *     a person: a team, in the editions that serve teams) — landed with
+ *     the Team kind
  *   - outbound egress (which addresses the control plane may dial when
  *     it reaches a URL a user supplied: the MCP endpoint it probes at save
  *     time and the login server it reaches on Sign in) — landed with the
@@ -70,6 +73,7 @@ import type { OutboundEgressPolicy } from "./outbound-egress.js";
 import type { ListReadScope } from "./list-read-scope.js";
 import type { OrganizationDirectory } from "./organization-directory.js";
 import type { PolicyGrantScope } from "./policy-grant-scope.js";
+import type { PrincipalDisplay } from "./principal-display.js";
 import type { ResourceAuthorizationLifecycle } from "./resource-authorization.js";
 import type { ScheduleFireCallerMint } from "./schedule-fire-caller.js";
 /** The driver contributions of one extension unit. */
@@ -226,6 +230,14 @@ export interface ExtensionDrivers {
      * with the edition reason — the identityFederation absent shape.
      */
     readonly authorizationQueries?: AuthorizationQueryEngine;
+    /**
+     * The principal display (single-instance point): how an access list
+     * names a grantee that is not a person — a team, in the editions that
+     * serve teams (extensions/principal-display.ts carries the contract).
+     * When absent, such a grantee renders by its id, the fallback shape
+     * every access list has always had.
+     */
+    readonly principalDisplay?: PrincipalDisplay;
     /**
      * The license-status provider (single-instance point): what license
      * this server holds, answered by PlatformQueryController.getLicenseStatus

package/dist/extensions/drivers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"drivers.d.ts","sourceRoot":"","sources":["../../src/extensions/drivers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,WAAW,CAC3C,MAAM,EACN,4BAA4B,CAC7B,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,WAAW,CAC9C,MAAM,EACN,yBAAyB,CAC1B,CAAC;IACF;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC;IACzE;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IACrD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,wBAAwB,CAAC;IACzD;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAC/C;;;;;;;;OAQG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IACnD;;;;;;;;;OASG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,oBAAoB,CAAC;IAClD;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CAChD"}
+{"version":3,"file":"drivers.d.ts","sourceRoot":"","sources":["../../src/extensions/drivers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,WAAW,CAC3C,MAAM,EACN,4BAA4B,CAC7B,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,WAAW,CAC9C,MAAM,EACN,yBAAyB,CAC1B,CAAC;IACF;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC;IACzE;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IACrD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,wBAAwB,CAAC;IACzD;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAC/C;;;;;;;;OAQG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IACnD;;;;;;;;;OASG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,oBAAoB,CAAC;IAClD;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CAChD"}

package/dist/extensions/gate-slots.d.ts

@@ -34,6 +34,15 @@
  * Non-transactional in the `org-create:post-persist` sense: a gate
  * failure fails the request, the row survives, the next call heals.
  *
+ * The eighth, `iam-policy-create:pre-side-effect-gate`: the IamPolicy
+ * `create` chain (the user grant lane), after ValidateGrantableRole and
+ * before Grant, so nothing is written when a gate refuses. It exists for
+ * the checks a grant needs that take a read, which the synchronous grant
+ * scope may not make: the Enterprise and Cloud editions refuse a team
+ * that does not exist, a team of another organization than the granted
+ * resource, and a team member who is not one of the organization's
+ * viewers. Never on `bootstrapPolicy`, the platform's structural lane.
+ *
  * Two enforcement layers, deliberately redundant, both derived from the
  * ONE literal tuple below (lockstep by construction):
  *   - GateSlotName (compile time): the union of declared slot literals.
@@ -61,7 +70,7 @@ import type { PipelineStep } from "../pipeline/pipeline.js";
  * owner-visible slot additions — each entry cites its chain position in
  * the guidelines' slot table, which must match the splice sites exactly.
  */
-export declare const GATE_SLOT_NAMES: readonly ["agent-execution-create:pre-side-effect-gate", "agent-execution-recover:pre-side-effect-gate", "agent-execution-submit-approval:gate", "session-create:pre-side-effect-gate", "org-create:post-persist", "sandbox-acquisition:gate", "identity-account-provision:post-persist"];
+export declare const GATE_SLOT_NAMES: readonly ["agent-execution-create:pre-side-effect-gate", "agent-execution-recover:pre-side-effect-gate", "agent-execution-submit-approval:gate", "session-create:pre-side-effect-gate", "org-create:post-persist", "sandbox-acquisition:gate", "identity-account-provision:post-persist", "iam-policy-create:pre-side-effect-gate"];
 /** The declared slot-name union — a registration outside it fails tsc. */
 export type GateSlotName = (typeof GATE_SLOT_NAMES)[number];
 /**

package/dist/extensions/gate-slots.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-slots.d.ts","sourceRoot":"","sources":["../../src/extensions/gate-slots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,eAAe,2RAQlB,CAAC;AAEX,0EAA0E;AAC1E,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAEnD,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,WAAW,CACzC,MAAM,EACN,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CACzC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAS,WAAW,EACnD,SAAS,EAAE,iBAAiB,EAC5B,IAAI,EAAE,YAAY,GACjB,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAOnC"}
+{"version":3,"file":"gate-slots.d.ts","sourceRoot":"","sources":["../../src/extensions/gate-slots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,eAAe,qUASlB,CAAC;AAEX,0EAA0E;AAC1E,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAEnD,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,WAAW,CACzC,MAAM,EACN,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CACzC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAS,WAAW,EACnD,SAAS,EAAE,iBAAiB,EAC5B,IAAI,EAAE,YAAY,GACjB,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAOnC"}

package/dist/extensions/gate-slots.js

@@ -11,6 +11,7 @@ export const GATE_SLOT_NAMES = [
     "org-create:post-persist",
     "sandbox-acquisition:gate",
     "identity-account-provision:post-persist",
+    "iam-policy-create:pre-side-effect-gate",
 ];
 /**
  * The boot-time declared-slot set — resolveExtensions validates every

package/dist/extensions/gate-slots.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate-slots.js","sourceRoot":"","sources":["../../src/extensions/gate-slots.ts"],"names":[],"mappings":"AA4DA;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,6CAA6C;IAC7C,8CAA8C;IAC9C,sCAAsC;IACtC,qCAAqC;IACrC,yBAAyB;IACzB,0BAA0B;IAC1B,yCAAyC;CACjC,CAAC;AAKX;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAC7D,eAAe,CAChB,CAAC;AAWF;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,SAA4B,EAC5B,IAAkB;IAElB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACxC,kDAAkD;IAClD,oEAAoE;IACpE,sEAAsE;IACtE,cAAc;IACd,OAAO,KAA0C,CAAC;AACpD,CAAC"}
+{"version":3,"file":"gate-slots.js","sourceRoot":"","sources":["../../src/extensions/gate-slots.ts"],"names":[],"mappings":"AAqEA;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,6CAA6C;IAC7C,8CAA8C;IAC9C,sCAAsC;IACtC,qCAAqC;IACrC,yBAAyB;IACzB,0BAA0B;IAC1B,yCAAyC;IACzC,wCAAwC;CAChC,CAAC;AAKX;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAC7D,eAAe,CAChB,CAAC;AAWF;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,SAA4B,EAC5B,IAAkB;IAElB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACxC,kDAAkD;IAClD,oEAAoE;IACpE,sEAAsE;IACtE,cAAc;IACd,OAAO,KAA0C,CAAC;AACpD,CAAC"}

package/dist/extensions/principal-display.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The principal-display driver point: how an access list names a grantee
+ * that is not a person. Single instance, registered as
+ * `drivers.principalDisplay`.
+ *
+ * An access list ("who has access to this agent, with which roles") names
+ * every grantee. People are resolved by the core from the identity-account
+ * port (domain/iampolicy/display-resolver.ts), the same in every edition.
+ * A grantee of another kind — a team, in the Enterprise and Cloud editions
+ * — lives in a store only that edition holds, so its name comes from this
+ * point. Absent (open source, which grants to no team), such a grantee
+ * renders in the fallback shape the access list has always used: its kind,
+ * with its id standing in as its name.
+ *
+ * The contract:
+ *   - It answers for the ids it knows and omits the rest; an omitted id
+ *     takes the fallback shape, never an error (a team deleted between
+ *     the grant read and this call is an omission, not a fault).
+ *   - It is never asked about the identity account; the core owns people.
+ *   - A fault it cannot answer through THROWS (the ListReadScope rule:
+ *     an empty answer is a real answer, never an outage in disguise), and
+ *     the list RPC fails with it.
+ */
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { ApiResourceRefView } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/io_pb";
+/** The principal-display contract (single-instance point, ExtensionDrivers.principalDisplay). */
+export interface PrincipalDisplay {
+    /**
+     * Display views for the principals of `kind` with these ids, keyed by
+     * id; ids it does not know are absent from the map.
+     */
+    resolve(kind: ApiResourceKind, ids: ReadonlyArray<string>): Promise<ReadonlyMap<string, ApiResourceRefView>>;
+}
+//# sourceMappingURL=principal-display.d.ts.map

package/dist/extensions/principal-display.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-display.d.ts","sourceRoot":"","sources":["../../src/extensions/principal-display.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAC3H,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AAE5F,iGAAiG;AACjG,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,OAAO,CACL,IAAI,EAAE,eAAe,EACrB,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,GACzB,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;CACrD"}

package/dist/extensions/principal-display.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=principal-display.js.map

package/dist/extensions/principal-display.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-display.js","sourceRoot":"","sources":["../../src/extensions/principal-display.ts"],"names":[],"mappings":""}