@stigmer/server 3.27.1 → 3.28.0

package/src/authorization/model/rewrite.ts

@@ -1,61 +1,52 @@
 /**
- * The relation-rewrite vocabulary the model declarations are written in —
- * the forms an OpenFGA `define` line takes in the cloud's `.fga` files,
- * and nothing more:
+ * The evaluator's vocabulary for the authorization model: the five
+ * relation-rewrite forms OpenFGA's JSON uses in the compiled model
+ * (data/authorization-model.json, read by openfga-json.ts), and a kind's
+ * declaration as the evaluator consumes it. The model itself is the
+ * `.fga` files under fga/model; this module only names its shapes.
  *
- *   define organization: [organization]                      → direct(objectOf("organization"))
+ *   define organization: [organization]        → this, subjects [organization]
  *   define owner: [identity_account] or admin from organization
- *                → union(direct(objectOf("identity_account")), from("admin", "organization"))
- *   define viewer: [identity_account, organization#member, organization#viewer]
- *                   or owner or platform_viewer
- *                → union(direct(objectOf(...), usersetOf(...), usersetOf(...)),
- *                        computed("owner"), computed("platform_viewer"))
+ *                → union(this, from("admin", "organization"))
+ *   define viewer: [identity_account, organization#viewer] or owner
+ *                → union(this, computed("owner"))
  *   define member: [identity_account] and viewer from organization
- *                → intersection(direct(objectOf("identity_account")), from("viewer", "organization"))
- *   define can_view: viewer                                   → computed("viewer")
+ *                → intersection(this, from("viewer", "organization"))
+ *   define can_view: viewer                    → computed("viewer")
  *
  * `and` exists for one shape: a relation that is true only while another
- * holds too — a team's member is a person granted the role AND still one
+ * holds too (a team's member is a person granted the role AND still one
  * of the organization's viewers, so leaving the organization ends every
- * team-derived grant with no cleanup. A line is either a union or an
- * intersection of leaves, never both: the DSL would need parentheses to
- * mix them, the cloud's reader refuses parentheses, and `declareKind`
- * refuses the nesting that would need them. `but not` has no node; the day
- * a line needs it, the transcript cannot be written and the gap is a
+ * team-derived grant with no cleanup). Operators nest to any depth, as
+ * the DSL's parentheses allow; the evaluator recurses through them.
+ * `but not`, wildcards (`type:*`) and conditions have no form here: the
+ * reader refuses them by name, and the day the model needs one is a
  * design act.
  *
- * A subject type is an object type or a userset; the model admits no
- * wildcard (`type:*`) and declares no condition, so neither has a form
- * here. The day a line needs one, the transcript cannot be written and
- * the gap is a design act.
- *
- * A declaration file (model/<kind>.ts) is a TRANSCRIPT of its `.fga`
- * file: the same relations, in the file's order, each line rewritten in
- * these builders so a reader with the model open sees the same text, and
- * so a structural compare against the file (the cloud's drift test at
- * the re-pin) needs no translation table.
- *
  * The direct form carries its type restrictions (`[identity_account,
  * organization#viewer]`) because the evaluator ENFORCES them: a tuple
  * whose subject the line does not list is ignored, which is what OpenFGA
- * does at write time. That is the fail-closed property of this design —
+ * does at write time. That is the fail-closed property of this design:
  * a derivation that drifts from the model (a userset the line dropped)
- * makes open source deny, never allow.
+ * makes the evaluator deny, never allow.
  *
  * `derived` names the relations `kind_meta.authorization` cannot derive
- * from the row alone: `default_of` on an instance (the
- * blueprint's `status.default_instance_id` must name this row — one
- * blueprint read through the loader; default-of.ts, shared by the two
- * instance kinds) and `execution_viewer` on a workflow instance
- * (`spec.execution_visibility`; workflow_instance.ts). A declaration that
- * has such a relation states the rule beside the transcript; the tuple
- * source dispatches to it by relation.
+ * from the row alone: `default_of` on an instance (the blueprint's
+ * `status.default_instance_id` must name this row; default-of.ts, shared
+ * by the two instance kinds) and `execution_viewer` on a workflow
+ * instance (`spec.execution_visibility`; execution-viewer.ts). The
+ * binding table (bindings.ts) attaches them; the tuple source dispatches
+ * to them by relation.
+ *
+ * Only types live here: the one producer of production declarations is
+ * the reader joined with the bindings (model/index.ts). Tests build
+ * throwaway models (a cycle, a chain past the depth bound) with the
+ * builders in __tests__/throwaway-model.ts.
  */
 import type { DescMessage, Message } from "@bufbuild/protobuf";
 
 import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 
-import { kindEnumName } from "../../pipeline/apiresource-meta.js";
 import type { ObjectRef, RowLoader, Tuple } from "../tuples.js";
 
 /** One entry of a direct line's type restriction list. */
@@ -88,38 +79,6 @@ export type Rewrite =
       readonly members: ReadonlyArray<Rewrite>;
     };
 
-// ---------------------------------------------------------------------------
-// Builders — named so a transcript reads like its `.fga` line.
-// ---------------------------------------------------------------------------
-
-export function objectOf(type: string): SubjectType {
-  return { form: "object", type };
-}
-
-export function usersetOf(type: string, relation: string): SubjectType {
-  return { form: "userset", type, relation };
-}
-
-export function direct(...subjects: ReadonlyArray<SubjectType>): Rewrite {
-  return { node: "this", subjects };
-}
-
-export function computed(relation: string): Rewrite {
-  return { node: "computed", relation };
-}
-
-export function from(relation: string, tupleset: string): Rewrite {
-  return { node: "from", relation, tupleset };
-}
-
-export function union(...members: ReadonlyArray<Rewrite>): Rewrite {
-  return { node: "union", members };
-}
-
-export function intersection(...members: ReadonlyArray<Rewrite>): Rewrite {
-  return { node: "intersection", members };
-}
-
 // ---------------------------------------------------------------------------
 // A kind's declaration.
 // ---------------------------------------------------------------------------
@@ -139,127 +98,19 @@ export type DerivedRelation = (
 
 export interface KindDeclaration {
   readonly kind: ApiResourceKind;
-  /** The FGA type name — the kind's enum member name, as the cloud renders objects. */
+  /** The FGA type name: the kind's enum member name, as every edition renders objects. */
   readonly type: string;
-  /** The kind's message schema: what a stored row decodes with, and where its audit lives. */
-  readonly schema: DescMessage;
-  /** The `.fga` file this transcribes, relative to the cloud's `fga/` folder. */
+  /**
+   * The kind's message schema: what a stored row decodes with, and where
+   * its audit lives. Undefined for a ROWLESS type (bindings.ts), one with
+   * no stored resource (`platform`): it resolves over tuples alone, and
+   * no row is ever loaded or listed for it.
+   */
+  readonly schema: DescMessage | undefined;
+  /** The `.fga` file the type is defined in, relative to the server package. */
   readonly source: string;
-  /** Every relation the file defines, in the file's order. */
+  /** Every relation the type defines, sorted by name. */
   readonly relations: ReadonlyMap<string, Rewrite>;
   /** The relations `kind_meta` cannot derive (the module header). */
   readonly derived: ReadonlyMap<string, DerivedRelation>;
 }
-
-export interface KindDeclarationInput {
-  readonly kind: ApiResourceKind;
-  readonly schema: DescMessage;
-  readonly source: string;
-  readonly relations: ReadonlyArray<readonly [name: string, rewrite: Rewrite]>;
-  readonly derived?: ReadonlyArray<
-    readonly [name: string, rule: DerivedRelation]
-  >;
-}
-
-/**
- * Builds a declaration and refuses a transcript that cannot be right at
- * module load: a relation declared twice, a `computed` naming a relation
- * the kind does not define, a `from` whose tupleset the kind does not
- * define (its `relation` is the PARENT's and is resolved at evaluation),
- * a derived rule for a relation the transcript does not declare, and a
- * line no `.fga` file could hold without parentheses (a union inside an
- * intersection or the reverse, an operator nested in itself, an operator
- * over fewer than two members).
- */
-export function declareKind(input: KindDeclarationInput): KindDeclaration {
-  const type = kindEnumName(input.kind);
-  const relations = new Map<string, Rewrite>();
-  for (const [name, rewrite] of input.relations) {
-    if (relations.has(name)) {
-      throw new Error(`${input.source}: relation '${name}' is declared twice`);
-    }
-    const shape = unwritableShape(rewrite);
-    if (shape !== undefined) {
-      throw new Error(`${input.source}: '${name}' ${shape}`);
-    }
-    relations.set(name, rewrite);
-  }
-  for (const [name, rewrite] of relations) {
-    for (const reference of localReferences(rewrite)) {
-      if (!relations.has(reference.relation)) {
-        throw new Error(
-          `${input.source}: '${name}' names ${reference.role} '${reference.relation}', which ${type} does not declare`,
-        );
-      }
-    }
-  }
-  const derived = new Map<string, DerivedRelation>();
-  for (const [name, rule] of input.derived ?? []) {
-    if (!relations.has(name)) {
-      throw new Error(
-        `${input.source}: a derived rule for '${name}', which ${type} does not declare`,
-      );
-    }
-    derived.set(name, rule);
-  }
-  return {
-    kind: input.kind,
-    type,
-    schema: input.schema,
-    source: input.source,
-    relations,
-    derived,
-  };
-}
-
-/** The relations of the SAME kind a rewrite names: computed targets and tuplesets. */
-function localReferences(
-  rewrite: Rewrite,
-): ReadonlyArray<{ readonly role: string; readonly relation: string }> {
-  switch (rewrite.node) {
-    case "this":
-      return [];
-    case "computed":
-      return [{ role: "relation", relation: rewrite.relation }];
-    case "from":
-      return [{ role: "tupleset", relation: rewrite.tupleset }];
-    case "union":
-    case "intersection":
-      return rewrite.members.flatMap(localReferences);
-    default: {
-      const exhaustive: never = rewrite;
-      throw new Error(`unknown rewrite node: ${JSON.stringify(exhaustive)}`);
-    }
-  }
-}
-
-/**
- * Why a line could not be written in a `.fga` file without parentheses,
- * or undefined when it can: an operator's members are leaves (a direct
- * list, a sibling relation, a tuple-to-userset), and there are at least
- * two of them.
- */
-function unwritableShape(rewrite: Rewrite): string | undefined {
-  switch (rewrite.node) {
-    case "this":
-    case "computed":
-    case "from":
-      return undefined;
-    case "union":
-    case "intersection": {
-      if (rewrite.members.length < 2) {
-        return `is ${rewrite.node === "union" ? "an or" : "an and"} over fewer than two members`;
-      }
-      const nested = rewrite.members.find(
-        (member) => member.node === "union" || member.node === "intersection",
-      );
-      return nested === undefined
-        ? undefined
-        : `nests ${nested.node === "union" ? "or" : "and"} inside ${rewrite.node === "union" ? "or" : "and"}, which a .fga line cannot say without parentheses`;
-    }
-    default: {
-      const exhaustive: never = rewrite;
-      throw new Error(`unknown rewrite node: ${JSON.stringify(exhaustive)}`);
-    }
-  }
-}

package/src/authorization/strict-json.ts

@@ -0,0 +1,52 @@
+/**
+ * Strict reads of a parsed JSON or YAML value, for the two inputs the
+ * authorization module takes as data: the compiled model
+ * (model/openfga-json.ts) and the `.fga.yaml` store tests the evaluator is
+ * proven against (__tests__/store-test-kit.ts). Both are written by a
+ * format this module does not own (OpenFGA's), so both are read as
+ * `unknown` and refused loudly on anything unexpected: a change upstream
+ * is a thrown fault naming where it failed, never a half-read input.
+ *
+ * Every function takes `where`, the path of the value in its document
+ * (`authorization-model.json: type_definitions[3].relations.viewer`), and
+ * puts it at the head of the message.
+ */
+
+/** A mapping, refusing any key outside `allowedKeys` when they are given. */
+export function record(
+  value: unknown,
+  where: string,
+  allowedKeys?: ReadonlyArray<string>,
+): Record<string, unknown> {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${where}: expected a mapping`);
+  }
+  const entry = value as Record<string, unknown>;
+  if (allowedKeys !== undefined) {
+    for (const key of Object.keys(entry)) {
+      if (!allowedKeys.includes(key)) {
+        throw new Error(`${where}: unknown key '${key}'`);
+      }
+    }
+  }
+  return entry;
+}
+
+export function list(value: unknown, where: string): ReadonlyArray<unknown> {
+  if (!Array.isArray(value)) {
+    throw new Error(`${where}: expected a list`);
+  }
+  return value as ReadonlyArray<unknown>;
+}
+
+/** A list, or the empty list when the key is absent. */
+export function optionalList(value: unknown, where: string): ReadonlyArray<unknown> {
+  return value === undefined ? [] : list(value, where);
+}
+
+export function text(value: unknown, where: string): string {
+  if (typeof value !== "string") {
+    throw new Error(`${where}: expected a string`);
+  }
+  return value;
+}

package/src/boot/__tests__/list-indexes.test.ts

@@ -27,6 +27,10 @@ const PINNED: Readonly<
     fingerprint:
       "artifact{agent_execution=field:spec.source.agent_execution_id,workflow_execution=field:spec.source.workflow_execution_id}",
   },
+  iam_policy: {
+    revision: 1,
+    fingerprint: "iam_policy{principal=field:spec.principal.id}",
+  },
   session: {
     revision: 1,
     fingerprint:

package/src/boot/compose.ts

@@ -385,13 +385,15 @@ export async function composeServer(
     requireAuthentication,
   });
   const builtInAuthorization = authorizationPosture !== "unit-authorizer";
-  // The built-in authorizer declares the open-source kinds and no other
-  // (its registry is pinned set-equal to that tier), so a composition
-  // that serves a wider edition must bring its own Authorizer: every
-  // check on a kind the model does not declare would otherwise fault
-  // INTERNAL per request. Refused at boot, the same class as a
-  // misconfigured registry (DD-006 §2b) and the verifierless posture
-  // below — caught before any side effect.
+  // The built-in authorizer evaluates the one model every edition reads,
+  // but it derives each resource's tuples from the rows in this server's
+  // store. A wider edition's kinds are served by extensions that keep
+  // their rows in stores of their own, which the built-in tuple source
+  // cannot read, so a composition that serves a wider edition must bring
+  // its own Authorizer rather than get answers derived from rows that are
+  // not there. Refused at boot, the same class as a misconfigured
+  // registry and the verifierless posture below: caught before any side
+  // effect.
   if (
     authorizationPosture === "built-in" &&
     extensions.edition !== ServerEdition.oss

package/src/boot/list-indexes.ts

@@ -10,9 +10,14 @@
  * parent's rows without decoding the whole kind; the kinds here were
  * chosen on the hosted edition's row counts and sizes (2026-09-23: every
  * other org-scoped kind held under a hundred rows and a hundred kilobytes).
+ * A kind also joins when a port read on every authorization check would
+ * otherwise decode the whole kind: `iam_policy`, whose adapter reads a
+ * person's rows by principal (measured 2026-09-24: about 4.6 microseconds
+ * per row per read, 47 ms a check at ten thousand rows on sqlite).
  */
 import { agentExecutionListIndex } from "../domain/agentexecution/list-index.js";
 import { artifactListIndex } from "../domain/artifact/list-index.js";
+import { iamPolicyListIndex } from "../domain/iampolicy/list-index.js";
 import { sessionListIndex } from "../domain/session/list-index.js";
 import { workflowExecutionListIndex } from "../domain/workflowexecution/list-index.js";
 import type { ListIndexDeclaration } from "../store/list-index.js";
@@ -20,6 +25,7 @@ import type { ListIndexDeclaration } from "../store/list-index.js";
 export const LIST_INDEXES: ReadonlyArray<ListIndexDeclaration> = [
   agentExecutionListIndex,
   artifactListIndex,
+  iamPolicyListIndex,
   sessionListIndex,
   workflowExecutionListIndex,
 ];

package/src/domain/iampolicy/__tests__/resource-store.test.ts

@@ -2,10 +2,12 @@
  * Runs the IamPolicyStore port-contract kit (../store-contract.ts) over the
  * OSS adapter (../resource-store.ts) on both drivers through the drivers'
  * own fixtures (sqlite always; Postgres under TEST_DATABASE_URL), and pins
- * the one behaviour that is the OSS adapter's rather than the port's
- * (T01_1_review.md Q-OR-9): save refuses a policy whose id is not the
- * triple's derived id, the invariant that makes "one row per triple" the
- * primary key's job in open source.
+ * the two behaviours that are the OSS adapter's rather than the port's:
+ * save refuses a policy whose id is not the triple's derived id, the
+ * invariant that makes "one row per triple" the primary key's job in open
+ * source; and a principal's rows are read through the kind's list index,
+ * never by decoding the whole kind, because the built-in authorizer reads
+ * them on every check.
  *
  * The kit's case list is pinned by name so a case cannot drop out unnoticed:
  * the cloud driver's test iterates the same export over `cloud.iam_policy`
@@ -21,6 +23,7 @@ import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/
 import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
 import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
 
+import { LIST_INDEXES } from "../../../boot/list-indexes.js";
 import type { Store } from "../../../store/interface.js";
 import { PostgresStore } from "../../../store/postgres/store.js";
 import {
@@ -82,7 +85,11 @@ const postgresFixture: DriverFixture = {
     if (postgresDatabase === undefined) {
       postgresDatabase = await createTestDatabase();
     }
-    const store = await PostgresStore.open(postgresDatabase.databaseUrl);
+    const store = await PostgresStore.open(
+      postgresDatabase.databaseUrl,
+      undefined,
+      { listIndexes: LIST_INDEXES },
+    );
     await store.deleteResourcesByKind(ApiResourceKind.iam_policy);
     return { store, close: () => store.close() };
   },
@@ -160,6 +167,59 @@ describe.each([sqliteFixture, postgresFixture])(
           spec,
         );
       });
+
+      it("reads a principal's rows through the list index, never by decoding the whole kind", async () => {
+        let scans = 0;
+        const target = opened.store;
+        // Every method runs on the real store; only the scan is counted.
+        const counted = new Proxy(target, {
+          get(store, property) {
+            if (property === "listResources") {
+              return (kind: ApiResourceKind) => {
+                if (kind === ApiResourceKind.iam_policy) {
+                  scans += 1;
+                }
+                return store.listResources(kind);
+              };
+            }
+            const value: unknown = Reflect.get(store, property, store);
+            return typeof value === "function" ? value.bind(store) : value;
+          },
+        });
+        const policies = newResourceIamPolicyStore(counted);
+        for (const [principal, relation] of [
+          ["ida_wtr3jcf281yfk9xx61kj59fsme", "admin"],
+          ["ida_wtr3jcf281yfk9xx61kj59fsme", "member"],
+          ["ida_0hlf2yb5mhkgb3bdzkkrptqf4d", "member"],
+        ] as const) {
+          const spec = orgRole(principal, relation, "acme");
+          await policies.save(
+            create(IamPolicySchema, {
+              apiVersion: IAM_POLICY_API_VERSION,
+              kind: IAM_POLICY_KIND,
+              metadata: create(ApiResourceMetadataSchema, {
+                id: policyIdFor(spec),
+              }),
+              spec,
+            }),
+          );
+        }
+        const found = await policies.findByPrincipal(
+          "identity_account",
+          "ida_wtr3jcf281yfk9xx61kj59fsme",
+        );
+        expect(found.map((policy) => policy.spec?.relation).sort()).toEqual([
+          "admin",
+          "member",
+        ]);
+        expect(
+          await policies.findByPrincipal(
+            "team",
+            "ida_wtr3jcf281yfk9xx61kj59fsme",
+          ),
+        ).toEqual([]);
+        expect(scans).toBe(0);
+      });
     });
   },
 );

package/src/domain/iampolicy/list-index.ts

@@ -0,0 +1,33 @@
+/**
+ * The IamPolicy list index (store/list-index.ts): `principal` is the key
+ * the open-source adapter's `findByPrincipal` reads (resource-store.ts).
+ * It is not a lane's index: the built-in authorizer reads a person's rows,
+ * and the rows granted to each team they belong to, on every check and
+ * every list batch (authorization/derived-tuples.ts), and without the key
+ * each of those reads decodes the whole kind — a table that grows with
+ * every member, organization and grant.
+ *
+ * The key is the principal's id alone: a key reads one string field, and
+ * an id carries its kind's prefix (`ida_` for an account, `tm_` for a
+ * team), so the index narrows to one principal and the adapter's
+ * predicate on (kind, id) keeps the answer exact whatever the index
+ * returns. A policy is not organization-scoped the way a lane's rows are,
+ * so the read names no organization; the key table's lookup index leads
+ * with the key, not the organization (the v6 migration of each driver).
+ *
+ * A change to `keys` bumps `revision` (boot/__tests__/list-indexes.test.ts
+ * pins the pair).
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
+
+import { declareListIndex, field } from "../../store/list-index.js";
+
+export const iamPolicyListIndex = declareListIndex({
+  kind: ApiResourceKind.iam_policy,
+  schema: IamPolicySchema,
+  revision: 1,
+  keys: {
+    principal: field("spec.principal.id"),
+  },
+});

package/src/domain/iampolicy/resource-store.ts

@@ -4,14 +4,21 @@
  * §3a, §4). The composition root installs it when no extension registers
  * `drivers.iamPolicyStore`.
  *
- * Reads. `findById` is a PRIMARY-KEY read. Every other find decodes
- * `listResources(iam_policy)` and filters in memory: the `resources` table
- * has no secondary index and `findByField` is single-hit, so a scan is the
- * honest shape, and the row count is members × organizations on a
- * self-host — measured in the entry's execution record (§4), not assumed.
- * The filters are the cloud store's WHERE clauses restated over the proto
- * (store.ts names each), so a driver's test over either edition reads the
- * same contract.
+ * Reads. `findById` is a PRIMARY-KEY read. `findByPrincipal` is an
+ * INDEXED read through the kind's list index (list-index.ts), because the
+ * built-in authorizer calls it on every check and every list batch — for
+ * the person, and once more per team they belong to — and a scan there
+ * costs a decode of every row the server holds, per call (measured
+ * 2026-09-24: about 4.6 microseconds per row, 47 ms a check at ten
+ * thousand rows on sqlite). The index narrows by the principal's id; the
+ * (kind, id) predicate decides, so the answer is exact whatever the index
+ * returns, and the store keeps it exact while an older binary still
+ * writes (store/interface.ts, `queryResources`). Every other find decodes
+ * `listResources(iam_policy)` and filters in memory: they serve the grant
+ * path and the access lists, not the check, and the row count behind them
+ * is members × organizations on a self-host. The filters are the cloud
+ * store's WHERE clauses restated over the proto (store.ts names each), so
+ * a driver's test over either edition reads the same contract.
  *
  * Writes. `save` refuses a policy whose id is not its triple's derived id
  * (constants.ts policyIdFor): open source has no legacy random ids, and a
@@ -43,6 +50,7 @@ import { kindEnumName } from "../../pipeline/apiresource-meta.js";
 import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 import { USER_GRANT_PRINCIPAL_KINDS, policyIdFor } from "./constants.js";
+import { iamPolicyListIndex } from "./list-index.js";
 import { DuplicatePolicyError } from "./store.js";
 import type { IamPolicyStore } from "./store.js";
 
@@ -72,7 +80,7 @@ export function newResourceIamPolicyStore(store: Store): IamPolicyStore {
     }
   }
 
-  /** Every row of the kind, decoded — the scan behind every non-id read. */
+  /** Every row of the kind, decoded — the scan behind every read but by id and by principal. */
   async function all(): Promise<ReadonlyArray<IamPolicy>> {
     const rows = await store.listResources(KIND);
     return rows.map((bytes) => fromBinary(IamPolicySchema, bytes));
@@ -102,8 +110,13 @@ export function newResourceIamPolicyStore(store: Store): IamPolicyStore {
 
     findById: readById,
 
-    findByPrincipal(principalKind, principalId) {
-      return where((policy) => onPrincipal(policy, principalKind, principalId));
+    async findByPrincipal(principalKind, principalId) {
+      const rows = await store.queryResources(iamPolicyListIndex, {
+        anyKey: [{ name: "principal", value: principalId }],
+      });
+      return rows
+        .map((row) => fromBinary(IamPolicySchema, row.data))
+        .filter((policy) => onPrincipal(policy, principalKind, principalId));
     },
 
     findByResource(resourceKind, resourceId) {

package/src/extensions/__tests__/built-in-authorization-composed.test.ts

@@ -764,16 +764,13 @@ describe("built-in list scope (C4: two boots, one seed — the scope is the only
     let unscopedStore: Store | undefined;
     const passThrough: ListReadScope = {
       async authorizedResourceIds(_caller, kind) {
-        const declaration = builtInModel.byKind(kind);
-        if (unscopedStore === undefined || declaration === undefined) {
+        const schema = builtInModel.byKind(kind)?.schema;
+        if (unscopedStore === undefined || schema === undefined) {
           throw new Error("the pass-through is bound to a booted server");
         }
         const rows = await unscopedStore.listResources(kind);
         return new Set(
-          rows.map(
-            (bytes) =>
-              metadataOf(fromBinary(declaration.schema, bytes))?.id ?? "",
-          ),
+          rows.map((bytes) => metadataOf(fromBinary(schema, bytes))?.id ?? ""),
         );
       },
       restrictListEntries: (_caller, _kind, entries) =>