@stigmer/server 3.37.1 → 3.38.0

package/dist/extensions/gate-slots.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate-slots.js","sourceRoot":"","sources":["../../src/extensions/gate-slots.ts"],"names":[],"mappings":"AA+EA;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,6CAA6C;IAC7C,8CAA8C;IAC9C,sCAAsC;IACtC,qCAAqC;IACrC,yBAAyB;IACzB,0BAA0B;IAC1B,yCAAyC;IACzC,wCAAwC;IACxC,iCAAiC;CACzB,CAAC;AAKX;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAC7D,eAAe,CAChB,CAAC;AAWF;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,SAA4B,EAC5B,IAAkB;IAElB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACxC,kDAAkD;IAClD,oEAAoE;IACpE,sEAAsE;IACtE,cAAc;IACd,OAAO,KAA0C,CAAC;AACpD,CAAC"}
+{"version":3,"file":"gate-slots.js","sourceRoot":"","sources":["../../src/extensions/gate-slots.ts"],"names":[],"mappings":"AA4FA;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,6CAA6C;IAC7C,8CAA8C;IAC9C,sCAAsC;IACtC,qCAAqC;IACrC,yBAAyB;IACzB,0BAA0B;IAC1B,yCAAyC;IACzC,wCAAwC;IACxC,iCAAiC;IACjC,uBAAuB;CACf,CAAC;AAKX;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAC7D,eAAe,CAChB,CAAC;AAWF;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,SAA4B,EAC5B,IAAkB;IAElB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACxC,kDAAkD;IAClD,oEAAoE;IACpE,sEAAsE;IACtE,cAAc;IACd,OAAO,KAA0C,CAAC;AACpD,CAAC"}

package/dist/pipeline/steps/authorization-tuples.d.ts

@@ -88,8 +88,12 @@ export declare function newCreateAuthorizationTuplesStep<Desc extends DescMessag
 /**
  * CleanupIamPolicies — after the store delete in every delete chain.
  * Best-effort by contract: a driver failure is logged and the delete
- * succeeds (Java's DeleteOperationCleanupIamPoliciesStep swallows all —
- * the cloud side owns convergence for orphaned grants).
+ * succeeds (Java's DeleteOperationCleanupIamPoliciesStep swallows all),
+ * because a deleted resource's rows grant nothing once it is gone. The
+ * organization is the one kind whose id another caller can take next, so
+ * its chain revokes the organization's rows before the row, failing
+ * closed (RevokeOrganizationPolicies, domain/organization/steps.ts), and
+ * this step is only its backstop there.
  */
 export declare function newCleanupIamPoliciesStep<Desc extends DescMessage>(lifecycle: ResourceAuthorizationLifecycle | undefined, logger: Logger): PipelineStep<Desc>;
 /** Context key for the pre-update visibility level. */

package/dist/pipeline/steps/authorization-tuples.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-tuples.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/authorization-tuples.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAU3H,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EACV,0BAA0B,EAE1B,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,4CAA4C,CAAC;AAEpD;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CAKf;AAGD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAYnD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,qBAAqB,GAC3B,WAAW,CAAC,oBAAoB,CAAC,CAwBnC;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,qBAAqB,EAC/B,QAAQ,EAAE,qBAAqB,GAC9B;IACD,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAC7D,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9D,CAUA;AAgGD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,MAAM,GACb,oBAAoB,GAAG,SAAS,CAkClC;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,SAAS,WAAW,EACvE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CAuBpB;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CAiCpB;AAED,uDAAuD;AACvD,eAAO,MAAM,kBAAkB,+BAA+B,CAAC;AAE/D;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,IAAI,SAAS,WAAW,EAC1E,WAAW,EAAE,MAAM,GAClB,YAAY,CAAC,IAAI,CAAC,CAYpB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,SAAS,WAAW,EACpE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,WAAW,EAAE,MAAM,GAClB,YAAY,CAAC,IAAI,CAAC,CAoCpB"}
+{"version":3,"file":"authorization-tuples.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/authorization-tuples.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAU3H,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EACV,0BAA0B,EAE1B,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,4CAA4C,CAAC;AAEpD;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CAKf;AAGD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAYnD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,qBAAqB,GAC3B,WAAW,CAAC,oBAAoB,CAAC,CAwBnC;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,qBAAqB,EAC/B,QAAQ,EAAE,qBAAqB,GAC9B;IACD,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAC7D,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9D,CAUA;AAgGD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,MAAM,GACb,oBAAoB,GAAG,SAAS,CAkClC;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,SAAS,WAAW,EACvE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CAuBpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CAiCpB;AAED,uDAAuD;AACvD,eAAO,MAAM,kBAAkB,+BAA+B,CAAC;AAE/D;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,IAAI,SAAS,WAAW,EAC1E,WAAW,EAAE,MAAM,GAClB,YAAY,CAAC,IAAI,CAAC,CAYpB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,SAAS,WAAW,EACpE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,WAAW,EAAE,MAAM,GAClB,YAAY,CAAC,IAAI,CAAC,CAoCpB"}

package/dist/pipeline/steps/authorization-tuples.js

@@ -201,8 +201,12 @@ export function newCreateAuthorizationTuplesStep(lifecycle, logger) {
 /**
  * CleanupIamPolicies — after the store delete in every delete chain.
  * Best-effort by contract: a driver failure is logged and the delete
- * succeeds (Java's DeleteOperationCleanupIamPoliciesStep swallows all —
- * the cloud side owns convergence for orphaned grants).
+ * succeeds (Java's DeleteOperationCleanupIamPoliciesStep swallows all),
+ * because a deleted resource's rows grant nothing once it is gone. The
+ * organization is the one kind whose id another caller can take next, so
+ * its chain revokes the organization's rows before the row, failing
+ * closed (RevokeOrganizationPolicies, domain/organization/steps.ts), and
+ * this step is only its backstop there.
  */
 export function newCleanupIamPoliciesStep(lifecycle, logger) {
     return {

package/dist/pipeline/steps/authorization-tuples.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-tuples.js","sourceRoot":"","sources":["../../../src/pipeline/steps/authorization-tuples.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAE/F,OAAO,EACL,sBAAsB,GAEvB,MAAM,wFAAwF,CAAC;AAgBhG;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,SAAqD,EACrD,KAAiC;IAEjC,IAAI,SAAS,EAAE,uBAAuB,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO;IACT,CAAC;IACD,MAAM,SAAS,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;AACjD,CAAC;AACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,8EAA8E;AAC9E,yEAAyE;AACzE,mEAAmE;AACnE,qCAAqC;AACrC,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAqB,EACrB,KAA4B;IAE5B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,MAAM,QAAQ,GACZ,MAAM,EAAE,uBAAuB,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC;IAC1E,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,qBAAqB,CAAC,cAAc;YACvC,IAAI,MAAM,EAAE,WAAW,KAAK,IAAI,EAAE,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC3B,CAAC;YACD,MAAM;QACR,KAAK,qBAAqB,CAAC,mBAAmB;YAC5C,IAAI,MAAM,EAAE,gBAAgB,KAAK,IAAI,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;gBAC9B,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,MAAM;QACR;YACE,0DAA0D;YAC1D,MAAM;IACV,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAClC,IAAqB,EACrB,QAA+B,EAC/B,QAA+B;IAK/B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtD,OAAO;QACL,cAAc,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvE,cAAc,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACxE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,oEAAoE;AACpE,oCAAoC;AACpC,8EAA8E;AAE9E,SAAS,iBAAiB,CACxB,IAAqB,EACrB,QAAiB,EACjB,YAAkC;IAElC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,sEAAsE;QACtE,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,2BAA2B,YAAY,CAAC,QAAQ,kBAAkB,YAAY,CAAC,SAAS,oBAAoB,WAAW,CAAC,IAAI,CAAC,EAAE,CAChI,EACD,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC;QAC1C,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,IAAqB,EACrB,MAA2B,EAC3B,QAAiB,EACjB,KAAa,EACb,MAAc;IAEd,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,QAAQ,MAAM,CAAC,SAAS,EAAE,CAAC;QACzB,KAAK,sBAAsB,CAAC,YAAY,CAAC,CAAC,CAAC;YACzC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACjB,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,kEAAkE,WAAW,CAAC,IAAI,CAAC,EAAE,CACtF,EACD,uCAAuC,CACxC,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,cAAc;gBACxB,UAAU,EAAE,WAAW,CAAC,cAAc,CAAC;gBACvC,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;YACH,MAAM;QACR,CAAC;QACD,KAAK,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,GAAG,WAAW,CAAC,IAAI,CAAC,gDAAgD,CACrE,EACD,uCAAuC,CACxC,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7D,MAAM;QACR,CAAC;QACD,KAAK,sBAAsB,CAAC,UAAU;YACpC,MAAM;QACR,KAAK,sBAAsB,CAAC,QAAQ;YAClC,mEAAmE;YACnE,kEAAkE;YAClE,sDAAsD;YACtD,MAAM,CAAC,IAAI,CAAC,wDAAwD,EAAE;gBACpE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC;aACxB,CAAC,CAAC;YACH,MAAM;QACR;YACE,MAAM;IACV,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAqB,EACrB,QAAiB,EACjB,MAAsB,EACtB,MAAc;IAEd,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IAC/C,IACE,MAAM,KAAK,SAAS;QACpB,MAAM,CAAC,SAAS,KAAK,sBAAsB,CAAC,IAAI;QAChD,MAAM,CAAC,SAAS,KAAK,sBAAsB,CAAC,WAAW,EACvD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,yCAAyC,CAAC,EACpD,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI;QACJ,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,KAAK,EAAE,QAAQ,CAAC,GAAG;QACnB,MAAM;QACN,gBAAgB,EAAE,MAAM,CAAC,SAAS;QAClC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,WAAW,EAAE,kBAAkB,CAC7B,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,QAAQ,CAAC,GAAG,EACZ,MAAM,CACP;QACD,mEAAmE;QACnE,oCAAoC;QACpC,gBAAgB,EAAE,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;KACtE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAC9C,SAAqD,EACrD,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,2BAA2B;QACjC,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,2BAA2B,CACvC,GAAG,CAAC,eAAe,EACnB,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,cAAc,EAClB,MAAM,CACP,CAAC;YACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,uCAAuC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAqD,EACrD,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAEhC,CAAC;YACd,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;YACnC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,iBAAiB,CAAC;oBAChC,IAAI,EAAE,GAAG,CAAC,eAAe;oBACzB,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,QAAQ,CAAC,GAAG;oBACnB,MAAM,EAAE,GAAG,CAAC,cAAc;iBAC3B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CACT,iEAAiE,EACjE;oBACE,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC;oBACtC,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CACF,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CACjD,WAAmB;IAEnB,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,OAAO,CAAC,GAAyB;YAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAiC,CAAC;YACtE,GAAG,CAAC,GAAG,CACL,kBAAkB,EAClB,QAAQ,EAAE,QAAQ,EAAE,UAAU;gBAC5B,qBAAqB,CAAC,mCAAmC,CAC5D,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,SAAqD,EACrD,WAAmB;IAEnB,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAiC,CAAC;YACtE,MAAM,QAAQ,GAAG,QAAQ,EAAE,QAAQ,CAAC;YACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GACX,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAuC;gBAClE,qBAAqB,CAAC,mCAAmC,CAAC;YAC5D,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,oBAAoB,CAC7D,GAAG,CAAC,eAAe,EACnB,QAAQ,EACR,QAAQ,CAAC,UAAU,CACpB,CAAC;YACF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/D,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,mBAAmB,CAAC;oBAClC,IAAI,EAAE,GAAG,CAAC,eAAe;oBACzB,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,QAAQ,CAAC,GAAG;oBACnB,cAAc;oBACd,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authorization-tuples.js","sourceRoot":"","sources":["../../../src/pipeline/steps/authorization-tuples.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAE/F,OAAO,EACL,sBAAsB,GAEvB,MAAM,wFAAwF,CAAC;AAgBhG;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,SAAqD,EACrD,KAAiC;IAEjC,IAAI,SAAS,EAAE,uBAAuB,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO;IACT,CAAC;IACD,MAAM,SAAS,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;AACjD,CAAC;AACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,8EAA8E;AAC9E,yEAAyE;AACzE,mEAAmE;AACnE,qCAAqC;AACrC,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAqB,EACrB,KAA4B;IAE5B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,MAAM,QAAQ,GACZ,MAAM,EAAE,uBAAuB,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC;IAC1E,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,qBAAqB,CAAC,cAAc;YACvC,IAAI,MAAM,EAAE,WAAW,KAAK,IAAI,EAAE,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC3B,CAAC;YACD,MAAM;QACR,KAAK,qBAAqB,CAAC,mBAAmB;YAC5C,IAAI,MAAM,EAAE,gBAAgB,KAAK,IAAI,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;gBAC9B,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,MAAM;QACR;YACE,0DAA0D;YAC1D,MAAM;IACV,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAClC,IAAqB,EACrB,QAA+B,EAC/B,QAA+B;IAK/B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtD,OAAO;QACL,cAAc,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvE,cAAc,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACxE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,oEAAoE;AACpE,oCAAoC;AACpC,8EAA8E;AAE9E,SAAS,iBAAiB,CACxB,IAAqB,EACrB,QAAiB,EACjB,YAAkC;IAElC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,sEAAsE;QACtE,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,2BAA2B,YAAY,CAAC,QAAQ,kBAAkB,YAAY,CAAC,SAAS,oBAAoB,WAAW,CAAC,IAAI,CAAC,EAAE,CAChI,EACD,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC;QAC1C,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,IAAqB,EACrB,MAA2B,EAC3B,QAAiB,EACjB,KAAa,EACb,MAAc;IAEd,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,QAAQ,MAAM,CAAC,SAAS,EAAE,CAAC;QACzB,KAAK,sBAAsB,CAAC,YAAY,CAAC,CAAC,CAAC;YACzC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACjB,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,kEAAkE,WAAW,CAAC,IAAI,CAAC,EAAE,CACtF,EACD,uCAAuC,CACxC,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,cAAc;gBACxB,UAAU,EAAE,WAAW,CAAC,cAAc,CAAC;gBACvC,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;YACH,MAAM;QACR,CAAC;QACD,KAAK,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,GAAG,WAAW,CAAC,IAAI,CAAC,gDAAgD,CACrE,EACD,uCAAuC,CACxC,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7D,MAAM;QACR,CAAC;QACD,KAAK,sBAAsB,CAAC,UAAU;YACpC,MAAM;QACR,KAAK,sBAAsB,CAAC,QAAQ;YAClC,mEAAmE;YACnE,kEAAkE;YAClE,sDAAsD;YACtD,MAAM,CAAC,IAAI,CAAC,wDAAwD,EAAE;gBACpE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC;aACxB,CAAC,CAAC;YACH,MAAM;QACR;YACE,MAAM;IACV,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAqB,EACrB,QAAiB,EACjB,MAAsB,EACtB,MAAc;IAEd,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IAC/C,IACE,MAAM,KAAK,SAAS;QACpB,MAAM,CAAC,SAAS,KAAK,sBAAsB,CAAC,IAAI;QAChD,MAAM,CAAC,SAAS,KAAK,sBAAsB,CAAC,WAAW,EACvD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,yCAAyC,CAAC,EACpD,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI;QACJ,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,KAAK,EAAE,QAAQ,CAAC,GAAG;QACnB,MAAM;QACN,gBAAgB,EAAE,MAAM,CAAC,SAAS;QAClC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,WAAW,EAAE,kBAAkB,CAC7B,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,QAAQ,CAAC,GAAG,EACZ,MAAM,CACP;QACD,mEAAmE;QACnE,oCAAoC;QACpC,gBAAgB,EAAE,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;KACtE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAC9C,SAAqD,EACrD,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,2BAA2B;QACjC,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,2BAA2B,CACvC,GAAG,CAAC,eAAe,EACnB,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,cAAc,EAClB,MAAM,CACP,CAAC;YACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,uCAAuC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAqD,EACrD,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAEhC,CAAC;YACd,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;YACnC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,iBAAiB,CAAC;oBAChC,IAAI,EAAE,GAAG,CAAC,eAAe;oBACzB,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,QAAQ,CAAC,GAAG;oBACnB,MAAM,EAAE,GAAG,CAAC,cAAc;iBAC3B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CACT,iEAAiE,EACjE;oBACE,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC;oBACtC,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CACF,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CACjD,WAAmB;IAEnB,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,OAAO,CAAC,GAAyB;YAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAiC,CAAC;YACtE,GAAG,CAAC,GAAG,CACL,kBAAkB,EAClB,QAAQ,EAAE,QAAQ,EAAE,UAAU;gBAC5B,qBAAqB,CAAC,mCAAmC,CAC5D,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,SAAqD,EACrD,WAAmB;IAEnB,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAiC,CAAC;YACtE,MAAM,QAAQ,GAAG,QAAQ,EAAE,QAAQ,CAAC;YACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GACX,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAuC;gBAClE,qBAAqB,CAAC,mCAAmC,CAAC;YAC5D,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,oBAAoB,CAC7D,GAAG,CAAC,eAAe,EACnB,QAAQ,EACR,QAAQ,CAAC,UAAU,CACpB,CAAC;YACF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/D,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,mBAAmB,CAAC;oBAClC,IAAI,EAAE,GAAG,CAAC,eAAe;oBACzB,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,QAAQ,CAAC,GAAG;oBACnB,cAAc;oBACd,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/server",
-  "version": "3.37.1",
+  "version": "3.38.0",
   "description": "The Stigmer OSS control plane as a composable library: composeServer, the extension registry and the driver seams a composition builds on. The self-contained deployable of the same server is @stigmer/server-slim.",
   "license": "Apache-2.0",
   "type": "module",
@@ -63,11 +63,11 @@
     "@connectrpc/connect-node": "^2.0.0",
     "@kubernetes/client-node": "2.0.0",
     "@opentelemetry/api": "^1.9.0",
-    "@stigmer/outbound": "3.37.1",
-    "@stigmer/plugin-package": "3.37.1",
-    "@stigmer/protos": "3.37.1",
-    "@stigmer/temporal-codecs": "3.37.1",
-    "@stigmer/zip-structure": "3.37.1",
+    "@stigmer/outbound": "3.38.0",
+    "@stigmer/plugin-package": "3.38.0",
+    "@stigmer/protos": "3.38.0",
+    "@stigmer/temporal-codecs": "3.38.0",
+    "@stigmer/zip-structure": "3.38.0",
     "@temporalio/activity": "1.16.2",
     "@temporalio/client": "1.16.2",
     "@temporalio/common": "1.16.2",

package/src/boot/compose.ts

@@ -1268,6 +1268,9 @@ export async function composeServer(
       logger,
       authorizer,
       gateSteps: extensions.gateSteps,
+      // The delete revokes the organization's rows through the one grant
+      // path, before its row goes (domain/organization/steps.ts).
+      grantPath: iamPolicyGrantPath,
       // The role lifecycle and the directory (the identity stage): the
       // composed drivers, or open source's under the built-in posture.
       authorizationLifecycle: roleLifecycle,

package/src/domain/iampolicy/__tests__/grant-path.test.ts

@@ -14,8 +14,11 @@
  *     fail-open incident class). The absent arm fires the hook with the
  *     spec and no policy, so a composition can still delete a bare tuple
  *     written before the row mirror existed.
- *   - cleanupResource is bidirectional (as target AND as principal),
- *     deduplicated, revoking each row through the same revoke order.
+ *   - cleanupResource is bidirectional (as principal first, then as
+ *     target with the owner rows last), deduplicated, revoking each row
+ *     through the same revoke order; a fault stops it with the owners
+ *     still holding, since an organization's delete runs it before the
+ *     organization's row goes and its owner is the one who retries.
  *   - revokeOrgAccess revokes the account's direct rows on the
  *     organization; the inert org-column arm the cloud carried is gone
  *     (Q-OR-9).
@@ -378,17 +381,19 @@ describe("revoke: onPolicyRevoked before the row delete", () => {
 });
 
 describe("cleanupResource: bidirectional, deduplicated, each row through the revoke order", () => {
-  it("revokes rows where the ref is the resource AND rows where it is the principal", async () => {
+  it("revokes rows where the ref is the principal, then where it is the resource, owners last", async () => {
     const recorded: RecordedEvent[] = [];
     const { policies, path } = pathOver(recorded, recordingLifecycle(recorded));
-    const asResource = orgRole(ALICE, "owner", "acme");
+    const owner = orgRole(ALICE, "owner", "acme");
+    const member = orgRole(BOB, "member", "acme");
     const asPrincipal = triple(
       { kind: "organization", id: "acme" },
       "organization",
       { kind: "agent", id: AGENT },
     );
     const unrelated = orgRole(ALICE, "member", "globex");
-    for (const spec of [asResource, asPrincipal, unrelated]) {
+    // Granted owner first, so the order below is the cleanup's, not the store's.
+    for (const spec of [owner, member, asPrincipal, unrelated]) {
       await path.grant(spec, alice);
     }
     recorded.length = 0;
@@ -399,17 +404,45 @@ describe("cleanupResource: bidirectional, deduplicated, each row through the rev
 
     expect([...policies.rows.keys()]).toEqual([policyIdFor(unrelated)]);
     expect(recorded).toEqual([
-      { kind: "revoked", id: policyIdFor(asResource), relation: "owner" },
-      { kind: "row-delete", id: policyIdFor(asResource) },
       {
         kind: "revoked",
         id: policyIdFor(asPrincipal),
         relation: "organization",
       },
       { kind: "row-delete", id: policyIdFor(asPrincipal) },
+      { kind: "revoked", id: policyIdFor(member), relation: "member" },
+      { kind: "row-delete", id: policyIdFor(member) },
+      { kind: "revoked", id: policyIdFor(owner), relation: "owner" },
+      { kind: "row-delete", id: policyIdFor(owner) },
     ]);
   });
 
+  it("stops at the first fault with the owner rows still in place", async () => {
+    const recorded: RecordedEvent[] = [];
+    const lifecycle = recordingLifecycle(recorded);
+    const { policies, path } = pathOver(recorded, {
+      ...lifecycle,
+      onPolicyRevoked: (event) =>
+        event.spec.relation === "member"
+          ? Promise.reject(new Error("tuple delete refused"))
+          : lifecycle.onPolicyRevoked!(event),
+    });
+    const owner = orgRole(ALICE, "owner", "acme");
+    const member = orgRole(BOB, "member", "acme");
+    for (const spec of [owner, member]) {
+      await path.grant(spec, alice);
+    }
+
+    await expect(
+      path.cleanupResource(
+        create(ApiResourceRefSchema, { kind: "organization", id: "acme" }),
+      ),
+    ).rejects.toThrow("tuple delete refused");
+
+    expect(policies.rows.has(policyIdFor(owner))).toBe(true);
+    expect(policies.rows.has(policyIdFor(member))).toBe(true);
+  });
+
   it("a ref that is both principal and resource of one row revokes it once", async () => {
     const recorded: RecordedEvent[] = [];
     const { path } = pathOver(recorded, recordingLifecycle(recorded));

package/src/domain/iampolicy/grant-path.ts

@@ -59,6 +59,7 @@ import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/
 import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
 import type { IamPolicy } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
 import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import type {
   ApiResourceRef,
   IamPolicySpec,
@@ -78,6 +79,9 @@ import { DuplicatePolicyError } from "./store.js";
 import type { IamPolicyStore } from "./store.js";
 import { refsOf, requireWellFormedTriple } from "./wire-refusals.js";
 
+/** The relation `cleanupResource` revokes last on the ref's own rows. */
+const OWNER_RELATION = IamRole[IamRole.owner];
+
 export interface GrantResult {
   readonly policy: IamPolicy;
   /** True when the triple was already held: no row was written, the hook still fired. */
@@ -99,9 +103,13 @@ export interface IamPolicyGrantPath {
    */
   revokeBySpec(spec: IamPolicySpec): Promise<IamPolicy | undefined>;
   /**
-   * Revoke every row naming the ref as its resource, then every row naming
-   * it as its principal, each through the revoke order; a row that is both
-   * is revoked once. Nothing to clean is a no-op.
+   * Revoke every row naming the ref as its principal, then every row naming
+   * it as its resource with the `owner` rows last, each through the revoke
+   * order; a row that is both is revoked once. Nothing to clean is a no-op.
+   * The order matters where the ref still exists: an organization's delete
+   * runs this before its row goes and fails on the first fault, so a
+   * cleanup that stops partway has not yet removed the owners who may
+   * retry it.
    */
   cleanupResource(ref: ApiResourceRef): Promise<void>;
   /** Revoke every relation the account holds directly on the organization. */
@@ -209,9 +217,15 @@ export function newIamPolicyGrantPath(
     },
 
     async cleanupResource(ref): Promise<void> {
-      const asResource = await policies.findByResource(ref.kind, ref.id);
       const asPrincipal = await policies.findByPrincipal(ref.kind, ref.id);
-      for (const policy of distinctById([...asResource, ...asPrincipal])) {
+      const asResource = await policies.findByResource(ref.kind, ref.id);
+      const isOwner = (policy: IamPolicy): boolean =>
+        policy.spec?.relation === OWNER_RELATION;
+      for (const policy of distinctById([
+        ...asPrincipal,
+        ...asResource.filter((policy) => !isOwner(policy)),
+        ...asResource.filter(isOwner),
+      ])) {
         await revokeRow(policy);
       }
     },

package/src/domain/organization/__tests__/organization-delete.test.ts

@@ -0,0 +1,266 @@
+/**
+ * Pins the organization delete's order through a composed server in the
+ * trusted-local posture: everything that names the organization goes
+ * before its row, and a fault stops the delete with the organization in
+ * place. An organization's id is its slug and the delete frees the slug for
+ * anyone, so a row left behind would belong to the slug's next holder.
+ *
+ *   - the `org-delete:pre-delete` slot runs with the organization loaded
+ *     and still stored, and its rows still in place;
+ *   - a slot step's refusal answers its own code and copy, and leaves the
+ *     organization and its rows;
+ *   - the organization's policy rows are revoked before its row, as
+ *     principal and as resource: a revocation fault answers Internal with
+ *     fixed copy, leaves the organization and its owner row, and a retry
+ *     completes the delete;
+ *   - a slug freed by the delete and created again carries none of the old
+ *     organization's rows.
+ *
+ * The policy store is the library's in-memory double, composed as the
+ * IamPolicy store driver so a test can make one row's delete fault; the
+ * grant path, the role lifecycle and the chain are the library's own.
+ */
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import type { DescMessage } from "@bufbuild/protobuf";
+import { Code, ConnectError, createClient } from "@connectrpc/connect";
+import type { Client, Transport } from "@connectrpc/connect";
+import { createGrpcTransport } from "@connectrpc/connect-node";
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
+
+import { IamPolicyCommandController } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/command_pb";
+import type { IamPolicy } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
+import type { Organization } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
+import { OrganizationCommandController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/command_pb";
+import { OrganizationQueryController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/query_pb";
+
+import { loadConfig } from "../../../boot/config.js";
+import { composeServer } from "../../../boot/compose.js";
+import type { ComposedServer } from "../../../boot/compose.js";
+import { createLogger } from "../../../boot/logger.js";
+import type { GateSlotName } from "../../../extensions/gate-slots.js";
+import type { ServerExtension } from "../../../extensions/registry.js";
+import type { PipelineStep } from "../../../pipeline/pipeline.js";
+import { EXISTING_RESOURCE_KEY } from "../../../pipeline/steps/load-existing.js";
+import {
+  resetOperatorIdentityForTests,
+  setOperatorIdentity,
+} from "../../../pipeline/steps/defaults.js";
+import {
+  fakeIamPolicyStore,
+  orgRole,
+  triple,
+} from "../../iampolicy/__tests__/support.js";
+
+const OPERATOR_EMAIL = "operator@example.com";
+const REFUSED_SLUG = "delete-refused";
+const OUTSIDER = "ida_0byc5k14t1e7b7kdxft7hwz1f7";
+const AGENT = "agt_01hzzzzzzzzzzzzzzzzzzzzzzz";
+
+async function grpcError(run: () => Promise<unknown>): Promise<ConnectError> {
+  try {
+    await run();
+  } catch (error) {
+    if (error instanceof ConnectError) {
+      return error;
+    }
+    throw error;
+  }
+  throw new Error("expected the call to fail");
+}
+
+describe("organization delete (composed server, trusted-local posture)", () => {
+  const policies = fakeIamPolicyStore();
+  /** A policy id whose delete faults while set: the store answering an error mid-revocation. */
+  let faultingDelete: string | undefined;
+  const faultablePolicies = {
+    ...policies,
+    async deleteById(id: string): Promise<void> {
+      if (id === faultingDelete) {
+        throw new Error("policy store unavailable");
+      }
+      await policies.deleteById(id);
+    },
+  };
+
+  /** What the slot's step saw, per organization, while it ran. */
+  const seenBySlot = new Map<string, { loaded: string; rowsNaming: number }>();
+  const slotStep: PipelineStep<DescMessage> = {
+    name: "FakeOrgDeleteStep",
+    execute: (ctx) => {
+      const organization = ctx.get(EXISTING_RESOURCE_KEY) as
+        | Organization
+        | undefined;
+      const id = organization?.metadata?.id ?? "";
+      seenBySlot.set(id, { loaded: id, rowsNaming: rowsNaming(id).length });
+      if (id === REFUSED_SLUG) {
+        throw new ConnectError(
+          "fake edition keeps something for this organization",
+          Code.FailedPrecondition,
+        );
+      }
+    },
+  };
+  const unit: ServerExtension = {
+    name: "fake-org-delete",
+    gateSteps: new Map<GateSlotName, ReadonlyArray<PipelineStep<DescMessage>>>([
+      ["org-delete:pre-delete", [slotStep]],
+    ]),
+    drivers: { iamPolicyStore: faultablePolicies },
+  };
+
+  let dir: string;
+  let server: ComposedServer;
+  let transport: Transport;
+  let organizations: Client<typeof OrganizationCommandController>;
+  let organizationQuery: Client<typeof OrganizationQueryController>;
+  /** The platform's own pipeline: the in-process transport's `internal` caller. */
+  let platform: Client<typeof IamPolicyCommandController>;
+
+  function rowsNaming(org: string): IamPolicy[] {
+    return [...policies.rows.values()].filter(
+      (policy) =>
+        (policy.spec?.resource?.kind === "organization" &&
+          policy.spec.resource.id === org) ||
+        (policy.spec?.principal?.kind === "organization" &&
+          policy.spec.principal.id === org),
+    );
+  }
+
+  /** An organization with its creator's owner row, an outsider's member row, and an agent's scope link to it. */
+  async function organizationWithRows(slug: string): Promise<void> {
+    await organizations.create({
+      apiVersion: "tenancy.stigmer.ai/v1",
+      kind: "Organization",
+      metadata: { name: slug, slug, org: "" },
+      spec: { description: "created by the organization delete test" },
+    });
+    await platform.bootstrapPolicy(orgRole(OUTSIDER, "member", slug));
+    await platform.bootstrapPolicy(
+      triple({ kind: "organization", id: slug }, "organization", {
+        kind: "agent",
+        id: AGENT,
+      }),
+    );
+  }
+
+  beforeAll(async () => {
+    dir = mkdtempSync(path.join(tmpdir(), "organization-delete-test-"));
+    setOperatorIdentity(OPERATOR_EMAIL, "The Operator");
+    server = await composeServer({
+      config: loadConfig({
+        STIGMER_MODEL_REGISTRY_REFRESH: "off",
+        TEMPORAL_HOST_PORT: "127.0.0.1:1",
+        DB_PATH: path.join(dir, "stigmer.db"),
+        STORAGE_PATH: path.join(dir, "storage"),
+        ARTIFACT_LOCAL_BASE_PATH: path.join(dir, "artifacts"),
+        STIGMER_OPERATOR_EMAIL: OPERATOR_EMAIL,
+      }),
+      logger: createLogger({ level: "error", pretty: false, write: () => {} }),
+      extensions: [unit],
+      portOverride: 0,
+      host: "127.0.0.1",
+    });
+    const port = await server.start();
+    transport = createGrpcTransport({ baseUrl: `http://127.0.0.1:${port}` });
+    organizations = createClient(OrganizationCommandController, transport);
+    organizationQuery = createClient(OrganizationQueryController, transport);
+    platform = createClient(
+      IamPolicyCommandController,
+      server.inProcessTransport,
+    );
+  });
+
+  afterAll(async () => {
+    await server.shutdown();
+    resetOperatorIdentityForTests();
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  beforeEach(() => {
+    faultingDelete = undefined;
+  });
+
+  it("runs the slot with the organization and its rows in place, then removes every row naming it", async () => {
+    await organizationWithRows("delete-clean");
+    expect(rowsNaming("delete-clean")).toHaveLength(3);
+
+    await organizations.delete({ value: "delete-clean" });
+
+    expect(seenBySlot.get("delete-clean")).toEqual({
+      loaded: "delete-clean",
+      rowsNaming: 3,
+    });
+    expect(rowsNaming("delete-clean")).toEqual([]);
+    const gone = await grpcError(() =>
+      organizationQuery.get({ value: "delete-clean" }),
+    );
+    expect(gone.code).toBe(Code.NotFound);
+  });
+
+  it("a slot step's refusal answers its own copy and leaves the organization and its rows", async () => {
+    await organizationWithRows(REFUSED_SLUG);
+
+    const refused = await grpcError(() =>
+      organizations.delete({ value: REFUSED_SLUG }),
+    );
+
+    expect(refused.code).toBe(Code.FailedPrecondition);
+    expect(refused.rawMessage).toBe(
+      "fake edition keeps something for this organization",
+    );
+    expect(
+      (await organizationQuery.get({ value: REFUSED_SLUG })).metadata?.id,
+    ).toBe(REFUSED_SLUG);
+    expect(rowsNaming(REFUSED_SLUG)).toHaveLength(3);
+  });
+
+  it("a revocation fault fails the delete with the organization and its owner in place, and the retry completes it", async () => {
+    await organizationWithRows("delete-faults");
+    const member = rowsNaming("delete-faults").find(
+      (row) => row.spec?.relation === "member",
+    );
+    faultingDelete = member?.metadata?.id;
+
+    const failed = await grpcError(() =>
+      organizations.delete({ value: "delete-faults" }),
+    );
+
+    expect(failed.code).toBe(Code.Internal);
+    expect(failed.rawMessage).toBe(
+      "failed to remove the organization's access policies",
+    );
+    expect(
+      (await organizationQuery.get({ value: "delete-faults" })).metadata?.id,
+    ).toBe("delete-faults");
+    // The agent's scope link went first; the revocation stopped at the
+    // member row, before the owner row the retry needs.
+    expect(
+      rowsNaming("delete-faults")
+        .map((row) => row.spec?.relation)
+        .sort(),
+    ).toEqual(["member", "owner"]);
+
+    faultingDelete = undefined;
+    await organizations.delete({ value: "delete-faults" });
+    expect(rowsNaming("delete-faults")).toEqual([]);
+  });
+
+  it("a slug freed by the delete and created again carries none of the old organization's rows", async () => {
+    await organizationWithRows("delete-reborn");
+    await organizations.delete({ value: "delete-reborn" });
+
+    await organizations.create({
+      apiVersion: "tenancy.stigmer.ai/v1",
+      kind: "Organization",
+      metadata: { name: "delete-reborn", slug: "delete-reborn", org: "" },
+      spec: { description: "the slug, taken again" },
+    });
+
+    expect(
+      rowsNaming("delete-reborn").map((row) => row.spec?.relation),
+    ).toEqual(["owner"]);
+  });
+});

package/src/domain/organization/controller.ts

@@ -54,6 +54,7 @@ import type { ResolvedGateSteps } from "../../extensions/gate-slots.js";
 import { stepsForSlot } from "../../extensions/gate-slots.js";
 import { ALL_ORGANIZATIONS } from "../../extensions/organization-directory.js";
 import type { OrganizationDirectory } from "../../extensions/organization-directory.js";
+import type { IamPolicyGrantPath } from "../iampolicy/grant-path.js";
 import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
 import { apiResourceKindKey } from "../../pipeline/interceptors/apiresource.js";
 import {
@@ -105,15 +106,21 @@ import { newValidateVisibilityStep } from "../../pipeline/steps/validate-visibil
 import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 import { organizationSearchExtractor } from "./search-extractor.js";
-import { newCheckOrgDuplicateStep, newCopySlugToIdStep } from "./steps.js";
+import {
+  newCheckOrgDuplicateStep,
+  newCopySlugToIdStep,
+  newRevokeOrganizationPoliciesStep,
+} from "./steps.js";
 
 export interface OrganizationControllerDeps {
   readonly store: Store;
   readonly logger: Logger;
   /** The composed authorization seam — the Authorize step at position 1 of every chain calls it (O2, DD-007 §3). */
   readonly authorizer: Authorizer;
-  /** The composed slot registrations — this domain's post-persist slot (O4). */
+  /** The composed slot registrations — this domain's create and delete slots (O4). */
   readonly gateSteps: ResolvedGateSteps;
+  /** The one grant path: the delete revokes the organization's rows through it before its row goes. */
+  readonly grantPath: IamPolicyGrantPath;
   /** The composed tuple-lifecycle driver — undefined = the shared steps no-op (C2). */
   readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
   /** The composed query directory — undefined = OSS single-tenant behavior (C2). */
@@ -319,22 +326,38 @@ async function apply(
     : update(deps, withResolvedApplyId(OrganizationSchema, org, reqCtx), ctx);
 }
 
-/** Delete — returns the deleted organization (gRPC audit-trail convention). */
+/**
+ * Delete — returns the deleted organization (gRPC audit-trail convention).
+ *
+ * Everything that names the organization goes before its row, and a fault
+ * stops the delete with the organization intact: an organization's id is
+ * its slug, the delete frees the slug for anyone, and whatever outlived
+ * the row would belong to the slug's next holder. So, after the load:
+ *
+ *   1. the `org-delete:pre-delete` slot, where an edition refuses or
+ *      removes the rows it keeps for the organization (empty in OSS);
+ *   2. RevokeOrganizationPolicies, every policy row naming the
+ *      organization, through the grant path, never caught;
+ *   3. the row;
+ *   4. CleanupIamPolicies, the lifecycle's post-delete event: best-effort
+ *      like every delete chain's, it revokes whatever a concurrent write
+ *      named the organization with after step 2, and runs a composed
+ *      driver's post-delete companions;
+ *   5. the search entry.
+ */
 async function deleteOrganization(
   deps: OrganizationControllerDeps,
   orgId: OrganizationId,
   ctx: HandlerContext,
 ): Promise<Organization> {
+  type DeleteInput = typeof OrganizationCommandController.method.delete.input;
   const reqCtx = new RequestContext(
     OrganizationCommandController.method.delete.input,
     orgId,
     callerIdentityOf(ctx),
     kindOf(ctx),
   );
-  await newPipeline<typeof OrganizationCommandController.method.delete.input>(
-    "organization-delete",
-    deps.logger,
-  )
+  const builder = newPipeline<DeleteInput>("organization-delete", deps.logger)
     .addStep(
       newAuthorizeStep(
         OrganizationCommandController.method.delete,
@@ -343,7 +366,16 @@ async function deleteOrganization(
     )
     .addStep(newValidateProtoStep())
     .addStep(newExtractResourceIdStep())
-    .addStep(newLoadExistingForDeleteStep(deps.store, OrganizationSchema))
+    .addStep(newLoadExistingForDeleteStep(deps.store, OrganizationSchema));
+  // The pre-delete gate slot (see the doc comment above). Empty in OSS.
+  for (const step of stepsForSlot<DeleteInput>(
+    deps.gateSteps,
+    "org-delete:pre-delete",
+  )) {
+    builder.addStep(step);
+  }
+  await builder
+    .addStep(newRevokeOrganizationPoliciesStep<DeleteInput>(deps.grantPath))
     .addStep(newDeleteResourceStep(deps.store))
     .addStep(
       newCleanupIamPoliciesStep(deps.authorizationLifecycle, deps.logger),