@stigmer/server 3.31.0 → 3.33.0

package/dist/domain/apikey/controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/apikey/controller.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGxD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,YAAY,EAAE,MAAM,iDAAiD,CAAC;AAE/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAC9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAU/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE9E,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,+BAA+B,GAChC,MAAM,YAAY,CAAC;AAapB,mEAAmE;AACnE,MAAM,UAAU,sBAAsB,CACpC,MAAqB,EACrB,IAA0B;IAE1B,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE;QACtC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC;QACxD,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC;QAClD,MAAM,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC;KAC7D,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE;QACpC,GAAG,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC;QAChD,YAAY,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC;QACtE,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACnD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,IAA0B,EAC1B,MAAc,EACd,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,YAAY,EACZ,MAAM,EACN,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAsB,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC;SACjE,OAAO,CACN,gBAAgB,CAAC,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CACzE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,qBAAqB,EAAE,CAAC;SAChC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,OAAO,CAAC,+BAA+B,EAAE,CAAC;SAC1C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,MAAM,CACnB,IAA0B,EAC1B,MAAc,EACd,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,YAAY,EACZ,MAAM,EACN,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAsB,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC;SACjE,OAAO,CACN,gBAAgB,CAAC,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CACzE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,0BAA0B,EAAE,CAAC;SACrC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,YAAY,CACzB,IAA0B,EAC1B,QAAkB,EAClB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAC3C,QAAQ,EACR,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,eAAe,EACf,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CACzE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,EAAE,CAAC;SACnC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;SAC/D,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,qDAAqD,CAAC,EAChE,sCAAsC,CACvC,CAAC;IACJ,CAAC;IACD,OAAO,OAAiB,CAAC;AAC3B,CAAC;AAED,oDAAoD;AACpD,KAAK,UAAU,GAAG,CAChB,IAA0B,EAC1B,QAAkB,EAClB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EACtC,QAAQ,EACR,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,YAAY,EACZ,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,qBAAqB,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CACpE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;SACpD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAW,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,IAA0B,EAC1B,UAAsB,EACtB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAC/C,UAAU,EACV,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,wBAAwB,EACxB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,qBAAqB,CAAC,MAAM,CAAC,YAAY,EACzC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACzC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAW,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,OAAO,CACpB,IAA0B,EAC1B,KAAY,EACZ,GAAmB;IAEnB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAC1C,KAAK,EACL,QAAQ,EACR,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,iBAAiB,EACjB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CACxE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,IAAI,IAAkB,CAAC;IACvB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAC3C,IAAI,CAAC,aAAa,EAClB,QAAQ,EACR,eAAe,CAAC,OAAO,EACvB,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,EAChD,EAAE,CACH,CAAC;IACF,OAAO,MAAM,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/apikey/controller.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGxD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,YAAY,EAAE,MAAM,iDAAiD,CAAC;AAE/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAC9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAU/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE9E,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,+BAA+B,GAChC,MAAM,YAAY,CAAC;AAapB,mEAAmE;AACnE,MAAM,UAAU,sBAAsB,CACpC,MAAqB,EACrB,IAA0B;IAE1B,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE;QACtC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC;QACxD,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC;QAClD,MAAM,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC;KAC7D,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE;QACpC,GAAG,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC;QAChD,YAAY,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC;QACtE,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACnD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,IAA0B,EAC1B,MAAc,EACd,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,YAAY,EACZ,MAAM,EACN,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAsB,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC;SACjE,OAAO,CACN,gBAAgB,CAAC,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CACzE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,qBAAqB,EAAE,CAAC;SAChC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,OAAO,CAAC,+BAA+B,EAAE,CAAC;SAC1C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,MAAM,CACnB,IAA0B,EAC1B,MAAc,EACd,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,YAAY,EACZ,MAAM,EACN,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAsB,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC;SACjE,OAAO,CACN,gBAAgB,CAAC,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CACzE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,0BAA0B,EAAE,CAAC;SACrC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,YAAY,CACzB,IAA0B,EAC1B,QAAkB,EAClB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAC3C,QAAQ,EACR,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,eAAe,EACf,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CACzE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,EAAE,CAAC;SACnC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;SAC/D,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,qDAAqD,CAAC,EAChE,sCAAsC,CACvC,CAAC;IACJ,CAAC;IACD,OAAO,OAAiB,CAAC;AAC3B,CAAC;AAED,oDAAoD;AACpD,KAAK,UAAU,GAAG,CAChB,IAA0B,EAC1B,QAAkB,EAClB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EACtC,QAAQ,EACR,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,YAAY,EACZ,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,qBAAqB,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CACpE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;SACpD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAW,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,IAA0B,EAC1B,UAAsB,EACtB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAC/C,UAAU,EACV,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,wBAAwB,EACxB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,qBAAqB,CAAC,MAAM,CAAC,YAAY,EACzC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACzC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAW,CAAC;AACnD,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,OAAO,CACpB,IAA0B,EAC1B,KAAY,EACZ,GAAmB;IAEnB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAC1C,KAAK,EACL,QAAQ,EACR,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,iBAAiB,EACjB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CACxE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,IAAI,IAAkB,CAAC;IACvB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAC3C,IAAI,CAAC,aAAa,EAClB,QAAQ,EACR,eAAe,CAAC,OAAO,EACvB,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,EAChD,EAAE,CACH,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACzC,oBAAoB,CAClB,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EACrC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CACtC,CACF,CAAC;IACF,OAAO,MAAM,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5C,CAAC"}

package/dist/domain/apikey/verifier.d.ts

@@ -1,3 +1,4 @@
+import type { Logger } from "../../boot/logger.js";
 import type { IdentityVerifier } from "../../extensions/identity.js";
 import type { Store } from "../../store/interface.js";
 import type { AccountsBySubject } from "../identityaccount/resolve.js";
@@ -10,6 +11,10 @@ export interface ApiKeyVerifierDeps {
     readonly store: Store;
     /** The identity-account domain's subject lookup the creator stamp resolves through (A6). */
     readonly accounts: AccountsBySubject;
+    /** Where a failed last-use stamp is reported. */
+    readonly logger: Logger;
+    /** The clock both the expiry check and the last-use stamp read. */
+    readonly now: () => Date;
 }
 export declare function newApiKeyIdentityVerifier(deps: ApiKeyVerifierDeps): IdentityVerifier;
 //# sourceMappingURL=verifier.d.ts.map

package/dist/domain/apikey/verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../src/domain/apikey/verifier.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAIvE,4EAA4E;AAC5E,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAErD,8CAA8C;AAC9C,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,4FAA4F;IAC5F,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;CACtC;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,kBAAkB,GACvB,gBAAgB,CAiClB"}
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../src/domain/apikey/verifier.ts"],"names":[],"mappings":"AAmDA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAIvE,4EAA4E;AAC5E,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAErD,8CAA8C;AAC9C,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,4FAA4F;IAC5F,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC;CAC1B;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,kBAAkB,GACvB,gBAAgB,CAoClB"}

package/dist/domain/apikey/verifier.js

@@ -33,9 +33,20 @@
  * identityId changes on a hit: email/displayName stay the stamp's, the
  * actor the key recorded at minting. The credential checks run first, so
  * a revoked or expired key never reaches the account store.
+ *
+ * An accepted key's use is then recorded on its status.last_used_at
+ * (identity/credential-use.ts): at most once a resolution, judged from the
+ * row this read already holds, written atomically through
+ * Store.updateResource so it can never undo a concurrent update of the
+ * key, and best-effort — a failed stamp is logged and the request
+ * proceeds. A refused key records nothing (stigmer/stigmer#1255).
  */
 import { Code, ConnectError } from "@connectrpc/connect";
+import { create } from "@bufbuild/protobuf";
 import { timestampDate } from "@bufbuild/protobuf/wkt";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiKeySchema, ApiKeyStatusSchema } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/api_pb";
+import { recordCredentialUse } from "../../identity/credential-use.js";
 import { identityIdForSubject } from "../identityaccount/resolve.js";
 import { hashApiKey, isApiKeyToken } from "./keymaterial.js";
 import { findApiKeyByHash } from "./lookup.js";
@@ -44,7 +55,7 @@ export const INVALID_TOKEN_MESSAGE = "invalid token";
 /** Java classifyAuthError's "expired" arm. */
 export const TOKEN_EXPIRED_MESSAGE = "token has expired";
 export function newApiKeyIdentityVerifier(deps) {
-    const { store, accounts } = deps;
+    const { store, accounts, logger } = deps;
     return {
         name: "apikey",
         async verify(token) {
@@ -55,8 +66,9 @@ export function newApiKeyIdentityVerifier(deps) {
             if (key === undefined) {
                 throw new ConnectError(INVALID_TOKEN_MESSAGE, Code.Unauthenticated);
             }
+            const now = deps.now();
             const expiresAt = key.spec?.expiresAt;
-            if (expiresAt !== undefined && timestampDate(expiresAt) <= new Date()) {
+            if (expiresAt !== undefined && timestampDate(expiresAt) <= now) {
                 throw new ConnectError(TOKEN_EXPIRED_MESSAGE, Code.Unauthenticated);
             }
             const owner = key.status?.audit?.specAudit?.createdBy;
@@ -66,8 +78,10 @@ export function newApiKeyIdentityVerifier(deps) {
                 // through the pipeline; guards hand-seeded or corrupted rows).
                 throw new ConnectError(INVALID_TOKEN_MESSAGE, Code.Unauthenticated);
             }
+            const identityId = await identityIdForSubject(accounts, owner.id);
+            await recordKeyUse(store, logger, key, now);
             return {
-                identityId: await identityIdForSubject(accounts, owner.id),
+                identityId,
                 callerClass: "user",
                 issuer: "",
                 rawToken: token,
@@ -77,4 +91,19 @@ export function newApiKeyIdentityVerifier(deps) {
         },
     };
 }
+/** Stamps the accepted key's last use on its own row, atomically. */
+function recordKeyUse(store, logger, key, now) {
+    const id = key.metadata?.id ?? "";
+    return recordCredentialUse({
+        credential: "api key",
+        id,
+        lastUsedAt: key.status?.lastUsedAt,
+        now,
+        logger,
+        write: (stamp) => store.updateResource(ApiResourceKind.api_key, id, ApiKeySchema, (live) => {
+            live.status ??= create(ApiKeyStatusSchema);
+            stamp(live.status);
+        }),
+    });
+}
 //# sourceMappingURL=verifier.js.map

package/dist/domain/apikey/verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../src/domain/apikey/verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAOvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAErD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AASzD,MAAM,UAAU,yBAAyB,CACvC,IAAwB;IAExB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACjC,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;YACtC,IAAI,SAAS,KAAK,SAAS,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;gBACtE,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;YACtD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC3C,oEAAoE;gBACpE,mEAAmE;gBACnE,+DAA+D;gBAC/D,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,MAAM,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC1D,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,KAAK;gBACf,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../src/domain/apikey/verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AAQnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAEvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAErD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAazD,MAAM,UAAU,yBAAyB,CACvC,IAAwB;IAExB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzC,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;YACtC,IAAI,SAAS,KAAK,SAAS,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC;gBAC/D,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;YACtD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC3C,oEAAoE;gBACpE,mEAAmE;gBACnE,+DAA+D;gBAC/D,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YAClE,MAAM,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5C,OAAO;gBACL,UAAU;gBACV,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,KAAK;gBACf,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,SAAS,YAAY,CACnB,KAAY,EACZ,MAAc,EACd,GAAW,EACX,GAAS;IAET,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IAClC,OAAO,mBAAmB,CAAC;QACzB,UAAU,EAAE,SAAS;QACrB,EAAE;QACF,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU;QAClC,GAAG;QACH,MAAM;QACN,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE;YACvE,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC,CAAC;KACL,CAAC,CAAC;AACL,CAAC"}

package/dist/domain/iampolicy/constants.d.ts

@@ -38,7 +38,8 @@
  * unknown permission, the unknown principal kind (the resource sentence's
  * shape), the malformed triple, and the four principal refusals a team
  * grantee brought (a person's qualifier, a team's qualifier, a kind no
- * team may be granted, a role a team may not hold).
+ * team may be granted, a role a team may not hold), and the two owner
+ * refusals (a non-owner touching the owner role, the last owner's removal).
  */
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { IamPolicySpec } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
@@ -169,4 +170,13 @@ export declare function teamNotGrantableMessage(kind: string): string;
 export declare function teamRoleNotGrantableMessage(role: string, kind: string, grantable: ReadonlyArray<string>): string;
 /** A triple field holding a canonical-text delimiter (INVALID_ARGUMENT; Q-S2-1). */
 export declare function malformedTripleMessage(field: string): string;
+/**
+ * Granting, revoking or removing the owner role on an organization without
+ * `can_assign_roles` there (PERMISSION_DENIED). An admin grants every role
+ * up to admin; only an owner makes, or unmakes, an owner. An edition that
+ * serves invitations answers the same sentence for an owner invitation.
+ */
+export declare const OWNER_ASSIGNMENT_DENIED_MESSAGE = "only an owner of the organization can grant, revoke or remove the owner role";
+/** Revoking or removing the last owner of an organization (FAILED_PRECONDITION). */
+export declare const LAST_OWNER_MESSAGE = "an organization must keep at least one owner; make another member an owner first";
 //# sourceMappingURL=constants.d.ts.map

package/dist/domain/iampolicy/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,KAAK,EAEV,aAAa,EACd,MAAM,qDAAqD,CAAC;AAK7D,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAC1D,eAAO,MAAM,eAAe,cAAc,CAAC;AAE3C,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAAmB,CAAC;AAoBxE;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAG/D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,CAe5E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAOvD;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,eAAe,CAO1D,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,0BAA0B,EAAE,aAAa,CAAC,eAAe,CAGrE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAM9C,2CAA2C;AAC3C,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,oGAAoG;AACpG,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,+FAA+F;AAC/F,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,GAC/B,MAAM,CAER;AAED,yEAAyE;AACzE,eAAO,MAAM,+BAA+B,iDACI,CAAC;AAEjD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/D;AAMD;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,+EACwB,CAAC;AAE/E,mGAAmG;AACnG,eAAO,MAAM,2CAA2C,0EACiB,CAAC;AAE1E,0FAA0F;AAC1F,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,4FAA4F;AAC5F,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGjE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,yEAAyE;AACzE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,gHAAgH;AAChH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,GAC/B,MAAM,CAER;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5D"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,KAAK,EAEV,aAAa,EACd,MAAM,qDAAqD,CAAC;AAK7D,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAC1D,eAAO,MAAM,eAAe,cAAc,CAAC;AAE3C,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAAmB,CAAC;AAoBxE;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAG/D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,CAe5E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAOvD;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,eAAe,CAO1D,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,0BAA0B,EAAE,aAAa,CAAC,eAAe,CAGrE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAM9C,2CAA2C;AAC3C,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,oGAAoG;AACpG,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,+FAA+F;AAC/F,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,GAC/B,MAAM,CAER;AAED,yEAAyE;AACzE,eAAO,MAAM,+BAA+B,iDACI,CAAC;AAEjD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/D;AAMD;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,+EACwB,CAAC;AAE/E,mGAAmG;AACnG,eAAO,MAAM,2CAA2C,0EACiB,CAAC;AAE1E,0FAA0F;AAC1F,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,4FAA4F;AAC5F,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGjE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,yEAAyE;AACzE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,gHAAgH;AAChH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,GAC/B,MAAM,CAER;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,iFACoC,CAAC;AAEjF,oFAAoF;AACpF,eAAO,MAAM,kBAAkB,qFACqD,CAAC"}

package/dist/domain/iampolicy/constants.js

@@ -38,7 +38,8 @@
  * unknown permission, the unknown principal kind (the resource sentence's
  * shape), the malformed triple, and the four principal refusals a team
  * grantee brought (a person's qualifier, a team's qualifier, a kind no
- * team may be granted, a role a team may not hold).
+ * team may be granted, a role a team may not hold), and the two owner
+ * refusals (a non-owner touching the owner role, the last owner's removal).
  */
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { kindEnumName } from "../../pipeline/apiresource-meta.js";
@@ -246,4 +247,13 @@ export function teamRoleNotGrantableMessage(role, kind, grantable) {
 export function malformedTripleMessage(field) {
     return `policy ${field} must not contain ':', '#' or '@'`;
 }
+/**
+ * Granting, revoking or removing the owner role on an organization without
+ * `can_assign_roles` there (PERMISSION_DENIED). An admin grants every role
+ * up to admin; only an owner makes, or unmakes, an owner. An edition that
+ * serves invitations answers the same sentence for an owner invitation.
+ */
+export const OWNER_ASSIGNMENT_DENIED_MESSAGE = "only an owner of the organization can grant, revoke or remove the owner role";
+/** Revoking or removing the last owner of an organization (FAILED_PRECONDITION). */
+export const LAST_OWNER_MESSAGE = "an organization must keep at least one owner; make another member an owner first";
 //# sourceMappingURL=constants.js.map

package/dist/domain/iampolicy/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAMtH,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAE7D,+DAA+D;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAC1D,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAE3C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,iBAAiB,GAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AASxE,SAAS,cAAc,CAAC,IAAmB;IACzC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAmB;IACrD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;AAC/G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAmB;IACtD,MAAM,MAAM,GAA0D;QACpE,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;QAC9C,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;QACtD,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;QAC5C,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QACxC,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;KAC5B,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAmB;IAC7C,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAmC;IAC7D,eAAe,CAAC,KAAK;IACrB,eAAe,CAAC,QAAQ;IACxB,eAAe,CAAC,KAAK;IACrB,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,WAAW;IAC3B,eAAe,CAAC,QAAQ;CACzB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAmC;IACxE,eAAe,CAAC,gBAAgB;IAChC,eAAe,CAAC,IAAI;CACrB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC;AAE9C,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,2CAA2C;AAC3C,MAAM,UAAU,qBAAqB,CAAC,EAAU;IAC9C,OAAO,yBAAyB,EAAE,EAAE,CAAC;AACvC,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,6CAA6C,IAAI,gEAAgE,CAAC;AAC3H,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,uBAAuB,CACrC,IAAY,EACZ,IAAY,EACZ,SAAgC;IAEhC,OAAO,SAAS,IAAI,yCAAyC,IAAI,wBAAwB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACnH,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,+BAA+B,GAC1C,8CAA8C,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACrD,OAAO,2BAA2B,IAAI,GAAG,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,yCAAyC,GACpD,4EAA4E,CAAC;AAE/E,mGAAmG;AACnG,MAAM,CAAC,MAAM,2CAA2C,GACtD,uEAAuE,CAAC;AAE1E,0FAA0F;AAC1F,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,OAAO,uBAAuB,QAAQ,GAAG,CAAC;AAC5C,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,OAAO,4BAA4B,IAAI,GAAG,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,MAAM,SAAS,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,mBAAmB,IAAI,2DAA2D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACnH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,OAAO,6DAA6D,QAAQ,GAAG,CAAC;AAClF,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO,4CAA4C,qBAAqB,gCAAgC,QAAQ,GAAG,CAAC;AACtH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,qDAAqD,IAAI,IAAI,CAAC;AACvE,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,2BAA2B,CACzC,IAAY,EACZ,IAAY,EACZ,SAAgC;IAEhC,OAAO,SAAS,IAAI,mDAAmD,IAAI,8BAA8B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACnI,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,UAAU,KAAK,mCAAmC,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAMtH,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAE7D,+DAA+D;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAC1D,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAE3C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,iBAAiB,GAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AASxE,SAAS,cAAc,CAAC,IAAmB;IACzC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAmB;IACrD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;AAC/G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAmB;IACtD,MAAM,MAAM,GAA0D;QACpE,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;QAC9C,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;QACtD,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;QAC5C,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QACxC,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;KAC5B,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAmB;IAC7C,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAmC;IAC7D,eAAe,CAAC,KAAK;IACrB,eAAe,CAAC,QAAQ;IACxB,eAAe,CAAC,KAAK;IACrB,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,WAAW;IAC3B,eAAe,CAAC,QAAQ;CACzB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAmC;IACxE,eAAe,CAAC,gBAAgB;IAChC,eAAe,CAAC,IAAI;CACrB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC;AAE9C,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,2CAA2C;AAC3C,MAAM,UAAU,qBAAqB,CAAC,EAAU;IAC9C,OAAO,yBAAyB,EAAE,EAAE,CAAC;AACvC,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,6CAA6C,IAAI,gEAAgE,CAAC;AAC3H,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,uBAAuB,CACrC,IAAY,EACZ,IAAY,EACZ,SAAgC;IAEhC,OAAO,SAAS,IAAI,yCAAyC,IAAI,wBAAwB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACnH,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,+BAA+B,GAC1C,8CAA8C,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACrD,OAAO,2BAA2B,IAAI,GAAG,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,yCAAyC,GACpD,4EAA4E,CAAC;AAE/E,mGAAmG;AACnG,MAAM,CAAC,MAAM,2CAA2C,GACtD,uEAAuE,CAAC;AAE1E,0FAA0F;AAC1F,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,OAAO,uBAAuB,QAAQ,GAAG,CAAC;AAC5C,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,OAAO,4BAA4B,IAAI,GAAG,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,MAAM,SAAS,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,mBAAmB,IAAI,2DAA2D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACnH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,OAAO,6DAA6D,QAAQ,GAAG,CAAC;AAClF,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO,4CAA4C,qBAAqB,gCAAgC,QAAQ,GAAG,CAAC;AACtH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,qDAAqD,IAAI,IAAI,CAAC;AACvE,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,2BAA2B,CACzC,IAAY,EACZ,IAAY,EACZ,SAAgC;IAEhC,OAAO,SAAS,IAAI,mDAAmD,IAAI,8BAA8B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACnI,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,UAAU,KAAK,mCAAmC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAC1C,8EAA8E,CAAC;AAEjF,oFAAoF;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAC7B,kFAAkF,CAAC"}

package/dist/domain/iampolicy/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/controller.ts"],"names":[],"mappings":"AAkGA,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAqCzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAE3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAGxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAmB9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAStE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAe1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAcjD,iHAAiH;AACjH,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,GAAG,aAAa,CAAC;AAEjE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,4GAA4G;IAC5G,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,sHAAsH;IACtH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACvD,0GAA0G;IAC1G,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACxD,wFAAwF;IACxF,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,sEAAsE;AACtE,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,uBAAuB,GAC5B,IAAI,CA0CN"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/controller.ts"],"names":[],"mappings":"AAoGA,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAqCzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAE3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAGxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAmB9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAStE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAmB1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAcjD,iHAAiH;AACjH,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,GAAG,aAAa,CAAC;AAEjE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,4GAA4G;IAC5G,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,sHAAsH;IACtH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACvD,0GAA0G;IAC1G,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACxD,wFAAwF;IACxF,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,sEAAsE;AACtE,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,uBAAuB,GAC5B,IAAI,CA2CN"}

package/dist/domain/iampolicy/controller.js

@@ -13,7 +13,9 @@
  * in-process RPCs (Q-OR-1), never through an exported constructor.
  *
  * Shape (Q-S5-1). The six command RPCs are pipeline chains, each
- * `Authorize → ValidateProto → <one domain step>` (steps.ts): the write is
+ * `Authorize → ValidateProto → <one domain step>` (steps.ts), with the two
+ * owner steps before the write on `create`, `delete` and `revokeOrgAccess`
+ * (owner is assigned by owners, steps.ts's last section): the write is
  * the grant path's, the annotation drives position 1, and the executor's
  * fault mapping covers a store fault from inside the path. The eight
  * query RPCs are direct handlers over `authorizeDirect` (the cloud's
@@ -117,7 +119,7 @@ import { AUTHENTICATION_REQUIRED_MESSAGE, AUTHORIZATION_QUERIES_UNIMPLEMENTED_ME
 import { newAccountDisplayResolver } from "./display-resolver.js";
 import { permissionByEnumName } from "./permissions.js";
 import { assignableRelations, isAssignableRole, roleInfoFromRelation, } from "./roles.js";
-import { POLICY_RESULT_KEY, newCleanupResourceStep, newGrantStep, newRevokeOrgAccessStep, newRevokeStep, newValidateGrantableRoleStep, } from "./steps.js";
+import { POLICY_RESULT_KEY, newAuthorizeOwnerAssignmentStep, newCleanupResourceStep, newGrantStep, newKeepOneOwnerStep, newRevokeOrgAccessStep, newRevokeStep, newValidateGrantableRoleStep, orgAccessOwnerRoleChange, specOwnerRoleChange, } from "./steps.js";
 import { refsOf, requireKnownPrincipalKind, requireKnownResourceKind, requireWellFormedTriple, } from "./wire-refusals.js";
 /**
  * The Java pre-migration `_self` principal alias — rejected with a
@@ -139,10 +141,10 @@ export function registerIamPolicyServices(router, deps) {
             guardSystemRpc(command.cleanupResourcePolicies, callerIdentityOf(ctx));
             return cleanupResourcePolicies(deps, ref, ctx);
         },
-        revokeOrgAccess: (input, ctx) => revokeOrgAccess(deps, command.revokeOrgAccess, input, ctx),
+        revokeOrgAccess: (input, ctx) => revokeOrgAccess(deps, command.revokeOrgAccess, input, ctx, true),
         bootstrapRevokeOrgAccess: (input, ctx) => {
             guardSystemRpc(command.bootstrapRevokeOrgAccess, callerIdentityOf(ctx));
-            return revokeOrgAccess(deps, command.bootstrapRevokeOrgAccess, input, ctx);
+            return revokeOrgAccess(deps, command.bootstrapRevokeOrgAccess, input, ctx, false);
         },
     });
     router.service(IamPolicyQueryController, {
@@ -175,7 +177,8 @@ function guardSystemRpc(method, caller) {
 // ---------------------------------------------------------------------------
 /**
  * `create`: the wire refusal, then Authorize → ValidateProto →
- * ValidateGrantableRole → [iam-policy-create:pre-side-effect-gate] → Grant.
+ * ValidateGrantableRole → AuthorizeOwnerAssignment →
+ * [iam-policy-create:pre-side-effect-gate] → Grant.
  */
 function createPolicy(deps, spec, ctx) {
     requireWellFormedTriple(spec);
@@ -183,8 +186,9 @@ function createPolicy(deps, spec, ctx) {
 }
 /**
  * The grant chain both `create` and `bootstrapPolicy` run; only the user
- * lane validates the role and runs the create gate slot — bootstrap writes
- * structural relations no scope would admit and no edition gates.
+ * lane validates the role, asks for an owner's authority when it grants
+ * owner, and runs the create gate slot — bootstrap writes structural
+ * relations no scope would admit and no edition gates.
  */
 async function grantThroughChain(deps, method, spec, ctx, validateRole) {
     const reqCtx = new RequestContext(IamPolicySpecSchema, spec, callerIdentityOf(ctx), kindOf(ctx));
@@ -193,6 +197,7 @@ async function grantThroughChain(deps, method, spec, ctx, validateRole) {
         .addStep(newValidateProtoStep());
     if (validateRole) {
         pipeline.addStep(newValidateGrantableRoleStep(deps.grantScope));
+        pipeline.addStep(newAuthorizeOwnerAssignmentStep(deps.authorizer, specOwnerRoleChange));
         for (const step of stepsForSlot(deps.gateSteps, "iam-policy-create:pre-side-effect-gate")) {
             pipeline.addStep(step);
         }
@@ -200,7 +205,11 @@ async function grantThroughChain(deps, method, spec, ctx, validateRole) {
     await pipeline.addStep(newGrantStep(deps.grantPath)).build().execute(reqCtx);
     return policyResultOf(reqCtx, method);
 }
-/** `delete`: the wire refusal, then Authorize → ValidateProto → Revoke; the revoked row, or the default instance. */
+/**
+ * `delete`: the wire refusal, then Authorize → ValidateProto →
+ * AuthorizeOwnerAssignment → KeepOneOwner → Revoke; the revoked row, or the
+ * default instance.
+ */
 async function deletePolicy(deps, spec, ctx) {
     requireWellFormedTriple(spec);
     const method = IamPolicyCommandController.method.delete;
@@ -208,17 +217,32 @@ async function deletePolicy(deps, spec, ctx) {
     await newPipeline("iampolicy-delete", deps.logger)
         .addStep(newAuthorizeStep(method, deps.authorizer))
         .addStep(newValidateProtoStep())
+        .addStep(newAuthorizeOwnerAssignmentStep(deps.authorizer, specOwnerRoleChange))
+        .addStep(newKeepOneOwnerStep(deps.policies, specOwnerRoleChange))
         .addStep(newRevokeStep(deps.grantPath))
         .build()
         .execute(reqCtx);
     return policyResultOf(reqCtx, method);
 }
-/** `revokeOrgAccess` and its system twin share one chain; only the annotation differs. */
-async function revokeOrgAccess(deps, method, input, ctx) {
+/**
+ * `revokeOrgAccess` and its system twin share one chain: Authorize →
+ * ValidateProto → RevokeOrgAccess, and on the caller lane
+ * AuthorizeOwnerAssignment → KeepOneOwner before the revoke. The twin's
+ * platform-pipeline callers hold no organization role, and removing an
+ * account is theirs to decide.
+ */
+async function revokeOrgAccess(deps, method, input, ctx, guardOwners) {
     const reqCtx = new RequestContext(RevokeOrgAccessInputSchema, input, callerIdentityOf(ctx), kindOf(ctx));
-    await newPipeline(`iampolicy-${method.localName}`, deps.logger)
+    const pipeline = newPipeline(`iampolicy-${method.localName}`, deps.logger)
         .addStep(newAuthorizeStep(method, deps.authorizer))
-        .addStep(newValidateProtoStep())
+        .addStep(newValidateProtoStep());
+    if (guardOwners) {
+        const ownerRoleChange = orgAccessOwnerRoleChange(deps.policies);
+        pipeline
+            .addStep(newAuthorizeOwnerAssignmentStep(deps.authorizer, ownerRoleChange))
+            .addStep(newKeepOneOwnerStep(deps.policies, ownerRoleChange));
+    }
+    await pipeline
         .addStep(newRevokeOrgAccessStep(deps.grantPath))
         .build()
         .execute(reqCtx);

package/dist/domain/iampolicy/controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2FG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,MAAM,IAAI,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAE5G,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AAapG,OAAO,EACL,gCAAgC,EAChC,+BAA+B,EAC/B,8BAA8B,EAC9B,4BAA4B,EAC5B,qBAAqB,EACrB,mCAAmC,EACnC,0BAA0B,GAC3B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sDAAsD,CAAC;AAKhG,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAM1E,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAIxE,OAAO,EACL,cAAc,EACd,YAAY,EACZ,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EACL,iCAAiC,EACjC,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EACL,+BAA+B,EAC/B,2CAA2C,EAC3C,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAGlE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,4BAA4B,GAC7B,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,MAAM,EACN,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAwBlC,sEAAsE;AACtE,MAAM,UAAU,yBAAyB,CACvC,MAAqB,EACrB,IAA6B;IAE7B,MAAM,eAAe,GAAG,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC;IAElD,MAAM,CAAC,OAAO,CAAC,0BAA0B,EAAE;QACzC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACpD,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACpD,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC7B,cAAc,CAAC,OAAO,CAAC,eAAe,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC;QACD,uBAAuB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpC,cAAc,CAAC,OAAO,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YACvE,OAAO,uBAAuB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,eAAe,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC9B,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,CAAC;QAC5D,wBAAwB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACvC,cAAc,CAAC,OAAO,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YACxE,OAAO,eAAe,CACpB,IAAI,EACJ,OAAO,CAAC,wBAAwB,EAChC,KAAK,EACL,GAAG,CACJ,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE;QACvC,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,iBAAiB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACtE,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACxE,yBAAyB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxC,yBAAyB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC7C,0BAA0B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACzC,0BAA0B,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC9C,6BAA6B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC5C,6BAA6B,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,CAAC;QAClE,yBAAyB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxC,yBAAyB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC7C,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAkB,EAAE,MAAsB;IAChE,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO;IACT,CAAC;IACD,MAAM,IAAI,YAAY,CACpB,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,QAAQ,EAClD,IAAI,CAAC,gBAAgB,CACtB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,YAAY,CACnB,IAA6B,EAC7B,IAAmB,EACnB,GAAmB;IAEnB,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,iBAAiB,CACtB,IAAI,EACJ,0BAA0B,CAAC,MAAM,CAAC,MAAM,EACxC,IAAI,EACJ,GAAG,EACH,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,MAAkB,EAClB,IAAmB,EACnB,GAAmB,EACnB,YAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,mBAAmB,EACnB,IAAI,EACJ,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,CAC1B,aAAa,MAAM,CAAC,SAAS,EAAE,EAC/B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnC,IAAI,YAAY,EAAE,CAAC;QACjB,QAAQ,CAAC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAChE,KAAK,MAAM,IAAI,IAAI,YAAY,CAC7B,IAAI,CAAC,SAAS,EACd,wCAAwC,CACzC,EAAE,CAAC;YACF,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7E,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,qHAAqH;AACrH,KAAK,UAAU,YAAY,CACzB,IAA6B,EAC7B,IAAmB,EACnB,GAAmB;IAEnB,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,mBAAmB,EACnB,IAAI,EACJ,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAA6B,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC;SAC3E,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SACtC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,eAAe,CAC5B,IAA6B,EAC7B,MAAkB,EAClB,KAA2B,EAC3B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,0BAA0B,EAC1B,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,aAAa,MAAM,CAAC,SAAS,EAAE,EAC/B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SAC/C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,IAA6B,EAC7B,GAAmB,EACnB,GAAmB;IAEnB,MAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,uBAAuB,CAAC;IACzE,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,oBAAoB,EACpB,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,mCAAmC,EACnC,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SAC/C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,cAAc,CACrB,MAA4B,EAC5B,MAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,SAAS,sCAAsC,CAAC,EACpE,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,MAAmB,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,qEAAqE;AACrE,KAAK,UAAU,GAAG,CAChB,IAA6B,EAC7B,EAAe,EACf,GAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,EACtC,2BAA2B,CAC5B,CAAC;IACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,qBAAqB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;IACD,sEAAsE;IACtE,qEAAqE;IACrE,wDAAwD;IACxD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,GAAG,EACnC,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,EAAE,EACF,EAAE,YAAY,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CACzE,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,EACxC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE7D,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,CAAC,oBAAoB,EAAE;YAC7C,IAAI,EAAE,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC;YACpD,EAAE,EAAE,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,EAAE;YACzC,SAAS;YACT,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,0EAA0E;IAC1E,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,yEAAyE;IACzE,IACE,UAAU,KAAK,aAAa,CAAC,gBAAgB;QAC7C,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EACzD,CAAC;QACD,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,qEAAqE;IACrE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE;QACjE,UAAU;QACV,YAAY;QACZ,UAAU,EAAE,QAAQ,CAAC,EAAE;KACxB,CAAC,CAAC;IACH,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,KAAK,aAAa;YAChB,MAAM,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAC3D,iCAAiC,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAA6B,EAC7B,KAA8B,EAC9B,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,yBAAyB,CACtC,IAA6B,EAC7B,KAAqC,EACrC,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACrD,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,eAAe,CAC9C,SAAS,EACT,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,OAAO,MAAM,CAAC,+BAA+B,EAAE;QAC7C,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,IAA6B,EAC7B,KAAsC,EACtC,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,yBAAyB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,0BAA0B,EAC1D,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAChD,QAAQ,EACR,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,OAAO,MAAM,CAAC,gCAAgC,EAAE;QAC9C,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,IAA6B,EAC7B,eAA6D,EAC7D,KAA8B,EAC9B,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,6BAA6B,EAC7D,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,IAAI,EAAE;QACpC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CACtC,IAAI,CAAC,QAAQ,EACb,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,EACX,KAAK,CAAC,gBAAgB,CACvB,CAAC;QACF,OAAO,wBAAwB,CAC7B,IAAI,CAAC,QAAQ,EACb,eAAe,EACf,IAAI,CAAC,gBAAgB,EACrB,SAAS,CACV,CAAC;IACJ,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,mCAAmC,EAAE;QACjD,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;KACtB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,IAA6B,EAC7B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,yBAAyB,EACzD,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,IAAI,CACrB,GAAG,EAAE,CACH,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CACtC,SAAS,CAAC,IAAI,EACd,SAAS,CAAC,EAAE,EACZ,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,CACZ,EACH,gCAAgC,CACjC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI;SACf,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;SAC5C,MAAM,CAAC,gBAAgB,CAAC;SACxB,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAA6B,EAC7B,KAA8B,EAC9B,GAAmB;IAEnB,mEAAmE;IACnE,MAAM,aAAa,GACjB,KAAK,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAC/D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,yBAAyB,CAAC,aAAa,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,kBAAkB,EAClD,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,GAAG,EAAE,CACH,IAAI,CAAC,QAAQ,CAAC,iCAAiC,CAC7C,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,EAC1C,KAAK,CAAC,KAAK,EACX,aAAa,EACb,mBAAmB,EAAE,CACtB,EACH,4BAA4B,CAC7B,CAAC;IACF,OAAO,MAAM,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,sEAAsE;AACtE,SAAS,oBAAoB,CAAC,MAAsB;IAClD,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,+BAA+B,EAC/B,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,MAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,IAAI,CACxB,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAC7C,wCAAwC,CACzC,CAAC;IACF,OAAO,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAClC,IAA6B,EAC7B,MAAsB,EACtB,SAAqC;IAErC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC1E,OAAO;IACT,CAAC;IACD,IAAI,SAAS,EAAE,IAAI,KAAK,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,YAAY,CACpB,4DAA4D,EAC5D,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,SAAS,CAAC,EAAE,CAAC;IACjC,IAAI,WAAW,KAAK,EAAE,IAAI,WAAW,KAAK,iBAAiB,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CACpB,QAAQ,iBAAiB,uCAAuC;YAC9D,kDAAkD,EACpD,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,KAAK,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CACpB,4CAA4C,EAC5C,IAAI,CAAC,gBAAgB,CACtB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,kBAAkB,CACzB,IAA6B;IAE7B,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CACpB,2CAA2C,EAC3C,IAAI,CAAC,aAAa,CACnB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,GAA+B;IACjD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,sDAAsD,CAAC,EACjE,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,MAAiC;IAC3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,mDAAmD,CAAC,EAC9D,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2FAA2F;AAC3F,SAAS,SAAS,CAAC,MAAiB;IAClC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,UAAU,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,GAAG,4BAA4B,CACjE,EACD,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,mGAAmG;AACnG,KAAK,UAAU,IAAI,CACjB,SAA2B,EAC3B,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,MAAM,IAAI,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAE5G,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AAapG,OAAO,EACL,gCAAgC,EAChC,+BAA+B,EAC/B,8BAA8B,EAC9B,4BAA4B,EAC5B,qBAAqB,EACrB,mCAAmC,EACnC,0BAA0B,GAC3B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sDAAsD,CAAC;AAKhG,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAM1E,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAIxE,OAAO,EACL,cAAc,EACd,YAAY,EACZ,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EACL,iCAAiC,EACjC,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EACL,+BAA+B,EAC/B,2CAA2C,EAC3C,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAGlE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,+BAA+B,EAC/B,sBAAsB,EACtB,YAAY,EACZ,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,4BAA4B,EAC5B,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,MAAM,EACN,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAwBlC,sEAAsE;AACtE,MAAM,UAAU,yBAAyB,CACvC,MAAqB,EACrB,IAA6B;IAE7B,MAAM,eAAe,GAAG,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC;IAElD,MAAM,CAAC,OAAO,CAAC,0BAA0B,EAAE;QACzC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACpD,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACpD,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC7B,cAAc,CAAC,OAAO,CAAC,eAAe,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC;QACD,uBAAuB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpC,cAAc,CAAC,OAAO,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YACvE,OAAO,uBAAuB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,eAAe,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC9B,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;QAClE,wBAAwB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACvC,cAAc,CAAC,OAAO,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YACxE,OAAO,eAAe,CACpB,IAAI,EACJ,OAAO,CAAC,wBAAwB,EAChC,KAAK,EACL,GAAG,EACH,KAAK,CACN,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE;QACvC,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,iBAAiB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACtE,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACxE,yBAAyB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxC,yBAAyB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC7C,0BAA0B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACzC,0BAA0B,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC9C,6BAA6B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC5C,6BAA6B,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,CAAC;QAClE,yBAAyB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxC,yBAAyB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC7C,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAkB,EAAE,MAAsB;IAChE,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO;IACT,CAAC;IACD,MAAM,IAAI,YAAY,CACpB,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,QAAQ,EAClD,IAAI,CAAC,gBAAgB,CACtB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,YAAY,CACnB,IAA6B,EAC7B,IAAmB,EACnB,GAAmB;IAEnB,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,iBAAiB,CACtB,IAAI,EACJ,0BAA0B,CAAC,MAAM,CAAC,MAAM,EACxC,IAAI,EACJ,GAAG,EACH,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,MAAkB,EAClB,IAAmB,EACnB,GAAmB,EACnB,YAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,mBAAmB,EACnB,IAAI,EACJ,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,CAC1B,aAAa,MAAM,CAAC,SAAS,EAAE,EAC/B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnC,IAAI,YAAY,EAAE,CAAC;QACjB,QAAQ,CAAC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAChE,QAAQ,CAAC,OAAO,CACd,+BAA+B,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CACtE,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,YAAY,CAC7B,IAAI,CAAC,SAAS,EACd,wCAAwC,CACzC,EAAE,CAAC;YACF,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7E,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,IAA6B,EAC7B,IAAmB,EACnB,GAAmB;IAEnB,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,mBAAmB,EACnB,IAAI,EACJ,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAA6B,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC;SAC3E,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CACN,+BAA+B,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CACtE;SACA,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;SAChE,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SACtC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAC5B,IAA6B,EAC7B,MAAkB,EAClB,KAA2B,EAC3B,GAAmB,EACnB,WAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,0BAA0B,EAC1B,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,CAC1B,aAAa,MAAM,CAAC,SAAS,EAAE,EAC/B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnC,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,eAAe,GAAG,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChE,QAAQ;aACL,OAAO,CAAC,+BAA+B,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;aAC1E,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,QAAQ;SACX,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SAC/C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,IAA6B,EAC7B,GAAmB,EACnB,GAAmB;IAEnB,MAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,uBAAuB,CAAC;IACzE,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,oBAAoB,EACpB,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,mCAAmC,EACnC,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SAC/C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,cAAc,CACrB,MAA4B,EAC5B,MAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,SAAS,sCAAsC,CAAC,EACpE,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,MAAmB,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,qEAAqE;AACrE,KAAK,UAAU,GAAG,CAChB,IAA6B,EAC7B,EAAe,EACf,GAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,EACtC,2BAA2B,CAC5B,CAAC;IACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,qBAAqB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;IACD,sEAAsE;IACtE,qEAAqE;IACrE,wDAAwD;IACxD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,GAAG,EACnC,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,EAAE,EACF,EAAE,YAAY,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CACzE,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,EACxC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE7D,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,CAAC,oBAAoB,EAAE;YAC7C,IAAI,EAAE,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC;YACpD,EAAE,EAAE,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,EAAE;YACzC,SAAS;YACT,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,0EAA0E;IAC1E,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,yEAAyE;IACzE,IACE,UAAU,KAAK,aAAa,CAAC,gBAAgB;QAC7C,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EACzD,CAAC;QACD,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,qEAAqE;IACrE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE;QACjE,UAAU;QACV,YAAY;QACZ,UAAU,EAAE,QAAQ,CAAC,EAAE;KACxB,CAAC,CAAC;IACH,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,KAAK,aAAa;YAChB,MAAM,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAC3D,iCAAiC,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAA6B,EAC7B,KAA8B,EAC9B,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,yBAAyB,CACtC,IAA6B,EAC7B,KAAqC,EACrC,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACrD,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,eAAe,CAC9C,SAAS,EACT,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,OAAO,MAAM,CAAC,+BAA+B,EAAE;QAC7C,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,IAA6B,EAC7B,KAAsC,EACtC,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,yBAAyB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,0BAA0B,EAC1D,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAChD,QAAQ,EACR,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,OAAO,MAAM,CAAC,gCAAgC,EAAE;QAC9C,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,IAA6B,EAC7B,eAA6D,EAC7D,KAA8B,EAC9B,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,6BAA6B,EAC7D,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,IAAI,EAAE;QACpC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CACtC,IAAI,CAAC,QAAQ,EACb,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,EACX,KAAK,CAAC,gBAAgB,CACvB,CAAC;QACF,OAAO,wBAAwB,CAC7B,IAAI,CAAC,QAAQ,EACb,eAAe,EACf,IAAI,CAAC,gBAAgB,EACrB,SAAS,CACV,CAAC;IACJ,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,mCAAmC,EAAE;QACjD,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;KACtB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,IAA6B,EAC7B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,yBAAyB,EACzD,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,IAAI,CACrB,GAAG,EAAE,CACH,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CACtC,SAAS,CAAC,IAAI,EACd,SAAS,CAAC,EAAE,EACZ,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,CACZ,EACH,gCAAgC,CACjC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI;SACf,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;SAC5C,MAAM,CAAC,gBAAgB,CAAC;SACxB,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAA6B,EAC7B,KAA8B,EAC9B,GAAmB;IAEnB,mEAAmE;IACnE,MAAM,aAAa,GACjB,KAAK,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAC/D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,yBAAyB,CAAC,aAAa,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,kBAAkB,EAClD,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,GAAG,EAAE,CACH,IAAI,CAAC,QAAQ,CAAC,iCAAiC,CAC7C,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,EAC1C,KAAK,CAAC,KAAK,EACX,aAAa,EACb,mBAAmB,EAAE,CACtB,EACH,4BAA4B,CAC7B,CAAC;IACF,OAAO,MAAM,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,sEAAsE;AACtE,SAAS,oBAAoB,CAAC,MAAsB;IAClD,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,+BAA+B,EAC/B,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,MAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,IAAI,CACxB,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAC7C,wCAAwC,CACzC,CAAC;IACF,OAAO,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAClC,IAA6B,EAC7B,MAAsB,EACtB,SAAqC;IAErC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC1E,OAAO;IACT,CAAC;IACD,IAAI,SAAS,EAAE,IAAI,KAAK,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,YAAY,CACpB,4DAA4D,EAC5D,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,SAAS,CAAC,EAAE,CAAC;IACjC,IAAI,WAAW,KAAK,EAAE,IAAI,WAAW,KAAK,iBAAiB,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CACpB,QAAQ,iBAAiB,uCAAuC;YAC9D,kDAAkD,EACpD,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,KAAK,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CACpB,4CAA4C,EAC5C,IAAI,CAAC,gBAAgB,CACtB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,kBAAkB,CACzB,IAA6B;IAE7B,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CACpB,2CAA2C,EAC3C,IAAI,CAAC,aAAa,CACnB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,GAA+B;IACjD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,sDAAsD,CAAC,EACjE,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,MAAiC;IAC3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,mDAAmD,CAAC,EAC9D,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2FAA2F;AAC3F,SAAS,SAAS,CAAC,MAAiB;IAClC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,UAAU,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,GAAG,4BAA4B,CACjE,EACD,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,mGAAmG;AACnG,KAAK,UAAU,IAAI,CACjB,SAA2B,EAC3B,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}

package/dist/domain/iampolicy/steps.d.ts

@@ -1,8 +1,93 @@
+/**
+ * IamPolicy pipeline steps (20260913.01 slice 5; Q-S5-1): the domain-local
+ * steps the six command chains splice after the shared `Authorize` and
+ * `ValidateProto`. The write itself is never here — every step that writes
+ * calls the ONE grant and revoke path (grant-path.ts, which owns the
+ * cloud#425 orderings, the by-triple read and the wire refusals) and leaves
+ * its answer under POLICY_RESULT_KEY for the handler. The chains are
+ * deliberately short: `Authorize → ValidateProto → <one of these>`, with
+ * only the owner steps (the last section) before the write on the three
+ * caller lanes, so the pipeline executor's fault mapping (a step's ConnectError keeps its code;
+ * a raw store fault becomes the sanitized INTERNAL) covers the path's two
+ * error shapes with no second idiom in the handlers.
+ *
+ * ValidateGrantableRole (the `create` chain only; `bootstrapPolicy` is the
+ * structural lane and skips it) is the one step with branching logic. It
+ * runs BEFORE Grant — the cloud's validate-before-write order, so a held
+ * legacy row under a role the kind does not grant is refused rather than
+ * answered as a duplicate — and reads, in this order (Q-OR-3 as refined;
+ * Q-S3-3):
+ *   1. the wire refusals: an unknown resource kind is `Unknown resource
+ *      kind`, never a role sentence — the second line behind the
+ *      controller's pre-position-1 refusal (Q-S6-1), kept so the step's
+ *      own contract holds for whoever splices it;
+ *   2. the PROTO (`grantableRolesFor`): a kind that lists no role is
+ *      system-managed in every edition — the cloud's byte-pinned copy,
+ *      whatever the composed scope claims;
+ *   3. the composed SCOPE: a kind it lists nothing for is a per-resource
+ *      grant this edition does not serve — UNIMPLEMENTED naming the
+ *      editions that do;
+ *   4. proto ∩ scope, in proto order: the role must be in the
+ *      intersection — the cloud's second copy listing it. Intersecting is
+ *      what keeps a scope from WIDENING the contract by accident;
+ *   5. the PRINCIPAL (Q-S9-2, 2026-09-14; constants.ts
+ *      USER_GRANT_PRINCIPAL_KINDS): a person grants roles to people and to
+ *      teams of people, and to nothing else. A row whose principal is a
+ *      resource is a structural link (the hierarchy walk's parent edge),
+ *      which is `bootstrapPolicy`'s to write; through this lane it would
+ *      let a right on one organization read another's members. Last, so
+ *      every answer the cloud's create gives today is unchanged and only
+ *      the row it should never have written is refused. A person names no
+ *      relation qualifier: `identity_account:<id>#<anything>` names
+ *      nobody, and OpenFGA would refuse the tuple after the row was
+ *      written, a grant on paper that is denied in practice.
+ *
+ * A TEAM principal takes its own list in place of arm 4: the kind's
+ * `team_grantable_roles` ∩ scope, never the person list, because a team
+ * is granted only what its members could each be granted and never
+ * ownership. It must name the team's members (`TEAM_MEMBERS_RELATION`).
+ * A kind that lists no team role refuses a team whatever the role, so
+ * open source (organization-only scope, and `organization` lists none)
+ * grants a team nothing without a branch of its own. Whether the team
+ * exists and belongs to the resource's organization needs a read, which
+ * this synchronous step does not make: that is the
+ * `iam-policy-create:pre-side-effect-gate` slot's, spliced after it.
+ *
+ * Owner is assigned by owners. Every caller of the member lanes holds
+ * `can_grant_access` (admin) already, so an admin grants every role up to
+ * admin; a change that touches an organization's `owner` role also needs
+ * `can_assign_roles` there, which only its owners hold. Two steps carry it,
+ * on the caller lanes only (`create`, `delete`, `revokeOrgAccess`; never
+ * the bootstrap twins, whose platform-pipeline callers hold no
+ * organization role):
+ *   - AuthorizeOwnerAssignment asks `can_assign_roles` when the spec grants
+ *     or revokes `owner` on an organization, or when the account
+ *     `revokeOrgAccess` removes holds it. It is Authorize's own evaluation
+ *     (`authorizeResolvedResource`), so the `internal` caller skips it as it
+ *     skips position 1;
+ *   - KeepOneOwner refuses a revoke or a removal that would leave the
+ *     organization with no owner. It is a product rule rather than
+ *     authorization, so it is its own step. It skips `internal` too. The
+ *     port has no transaction, so two owners removing each other at the
+ *     same instant can both pass; each still needed `can_assign_roles`.
+ * Both read the organization's owner rows once per request
+ * (`organizationOwners`). They do not govern the grants that follow
+ * configuration rather than a caller (the organization creator's row, the
+ * membership rules, the trusted-local operator), which call the grant path
+ * directly, nor an edition's in-process doors that grant a role on a
+ * person's behalf (an invitation's redemption, an identity provider's
+ * auto-grant), which run as `internal` and hold the same rule at their own
+ * sites.
+ */
+import { type DescMessage } from "@bufbuild/protobuf";
 import type { RevokeOrgAccessInputSchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/io_pb";
 import type { ApiResourceRefSchema, IamPolicySpecSchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
+import type { Authorizer } from "../../extensions/authorizer.js";
 import type { PolicyGrantScope } from "../../extensions/policy-grant-scope.js";
 import type { PipelineStep } from "../../pipeline/pipeline.js";
+import type { RequestContext } from "../../pipeline/request-context.js";
 import type { IamPolicyGrantPath } from "./grant-path.js";
+import type { IamPolicyStore } from "./store.js";
 /** The row a write chain answers — the granted row, or the revoked row (the default instance when there was none). */
 export declare const POLICY_RESULT_KEY = "policyResult";
 /** The `create` chain's role check; see the module header for the four arms. */
@@ -15,4 +100,17 @@ export declare function newRevokeStep(grantPath: IamPolicyGrantPath): PipelineSt
 export declare function newRevokeOrgAccessStep(grantPath: IamPolicyGrantPath): PipelineStep<typeof RevokeOrgAccessInputSchema>;
 /** Revoke every row naming the ref as resource or principal — the deleted resource's cleanup. */
 export declare function newCleanupResourceStep(grantPath: IamPolicyGrantPath): PipelineStep<typeof ApiResourceRefSchema>;
+/** An organization owner role a request would grant or remove, and whose it is. */
+export interface OwnerRoleChange {
+    readonly organizationId: string;
+    readonly accountId: string;
+}
+/** `create` and `delete`: the spec names the change; nothing is read. */
+export declare function specOwnerRoleChange(ctx: RequestContext<typeof IamPolicySpecSchema>): Promise<OwnerRoleChange | undefined>;
+/** `revokeOrgAccess`: the removal touches owner exactly when the account holds it. */
+export declare function orgAccessOwnerRoleChange(policies: IamPolicyStore): (ctx: RequestContext<typeof RevokeOrgAccessInputSchema>) => Promise<OwnerRoleChange | undefined>;
+/** A change touching an organization's owner role needs `can_assign_roles` there; see the module header. */
+export declare function newAuthorizeOwnerAssignmentStep<Desc extends DescMessage>(authorizer: Authorizer, ownerRoleChange: (ctx: RequestContext<Desc>) => Promise<OwnerRoleChange | undefined>): PipelineStep<Desc>;
+/** A revoke or removal may not leave the organization with no owner; see the module header. */
+export declare function newKeepOneOwnerStep<Desc extends DescMessage>(policies: IamPolicyStore, ownerRoleChange: (ctx: RequestContext<Desc>) => Promise<OwnerRoleChange | undefined>): PipelineStep<Desc>;
 //# sourceMappingURL=steps.d.ts.map

package/dist/domain/iampolicy/steps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/steps.ts"],"names":[],"mappings":"AA2DA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AACpG,OAAO,KAAK,EAEV,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,qDAAqD,CAAC;AAG7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAM/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAa/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAM1D,sHAAsH;AACtH,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,gFAAgF;AAChF,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,gBAAgB,GACtB,YAAY,CAAC,OAAO,mBAAmB,CAAC,CA4D1C;AA2CD,mFAAmF;AACnF,wBAAgB,YAAY,CAC1B,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAU1C;AAED,oGAAoG;AACpG,wBAAgB,aAAa,CAC3B,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAU1C;AAED,4EAA4E;AAC5E,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,0BAA0B,CAAC,CAYjD;AAED,iGAAiG;AACjG,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,oBAAoB,CAAC,CAQ3C"}
+{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AACH,OAAO,EAAU,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAK9D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AACpG,OAAO,KAAK,EAEV,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,qDAAqD,CAAC;AAG7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAM/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAexE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAMjD,sHAAsH;AACtH,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,gFAAgF;AAChF,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,gBAAgB,GACtB,YAAY,CAAC,OAAO,mBAAmB,CAAC,CA4D1C;AA2CD,mFAAmF;AACnF,wBAAgB,YAAY,CAC1B,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAU1C;AAED,oGAAoG;AACpG,wBAAgB,aAAa,CAC3B,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAU1C;AAED,4EAA4E;AAC5E,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,0BAA0B,CAAC,CAYjD;AAED,iGAAiG;AACjG,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,oBAAoB,CAAC,CAQ3C;AAcD,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AA+BD,yEAAyE;AACzE,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,cAAc,CAAC,OAAO,mBAAmB,CAAC,GAC9C,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAStC;AAED,sFAAsF;AACtF,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,cAAc,GACvB,CACD,GAAG,EAAE,cAAc,CAAC,OAAO,0BAA0B,CAAC,KACnD,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAQxC;AAED,4GAA4G;AAC5G,wBAAgB,+BAA+B,CAAC,IAAI,SAAS,WAAW,EACtE,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,GACnF,YAAY,CAAC,IAAI,CAAC,CAuBpB;AAED,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,IAAI,SAAS,WAAW,EAC1D,QAAQ,EAAE,cAAc,EACxB,eAAe,EAAE,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,GACnF,YAAY,CAAC,IAAI,CAAC,CAiBpB"}