@stigmer/server 3.37.1 → 3.38.1

package/dist/domain/organization/steps.js

@@ -10,12 +10,20 @@
  * uniqueness guarantee, mirroring cloud's OrganizationCreateHandler
  * (CheckDuplicate + CopySlugToId) step-for-step.
  *
- * Proven by organization.conformance.test.ts (CONFORMANCE_TARGET=local)
- * and __tests__/organization.test.ts.
+ * The same deviation shapes the delete: a freed slug is anyone's to take,
+ * so newRevokeOrganizationPoliciesStep revokes the organization's policy
+ * rows BEFORE its row is deleted, and fails the delete when it cannot.
+ *
+ * Proven by organization.conformance.test.ts (CONFORMANCE_TARGET=local),
+ * __tests__/organization.test.ts and __tests__/organization-delete.test.ts.
  */
+import { create } from "@bufbuild/protobuf";
 import { ResourceNotFoundError } from "../../store/interface.js";
 import { alreadyExistsError, internalError } from "../../pipeline/errors.js";
+import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
 import { metadataOf } from "../../pipeline/steps/shapes.js";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceRefSchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
 import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
 /**
  * Rejects a create when an organization already exists with the same slug,
@@ -86,4 +94,44 @@ export function newCopySlugToIdStep() {
         },
     };
 }
+/**
+ * Revokes every policy row that names the organization, as principal or as
+ * resource, before the delete removes its row: the rows its members hold
+ * on it, and the scope link every organization-scoped resource holds to
+ * it. Runs after the `org-delete:pre-delete` slot and before
+ * DeleteResource.
+ *
+ * The generic delete chains clean up after the row and log a fault,
+ * because a deleted resource's rows grant nothing once it is gone. An
+ * organization is the exception: its id is its slug, the delete frees the
+ * slug, and a row left behind would grant whoever creates the slug next.
+ * So this step does not catch. A fault fails the delete with the
+ * organization in place, and a retry resumes where the revocation stopped
+ * (the grant path revokes the organization's owners last, so the owner
+ * who retries still can). The grant path fires the composed driver's
+ * `onPolicyRevoked` before each row, so a composition's tuples go with
+ * their rows. The post-delete CleanupIamPolicies still runs: it catches
+ * whatever a concurrent write named the organization with in between.
+ */
+export function newRevokeOrganizationPoliciesStep(grantPath) {
+    return {
+        name: "RevokeOrganizationPolicies",
+        async execute(ctx) {
+            const organization = ctx.get(EXISTING_RESOURCE_KEY);
+            const id = organization?.metadata?.id ?? "";
+            if (id === "") {
+                throw internalError(new Error("organization delete reached RevokeOrganizationPolicies without its loaded row"), "failed to remove the organization's access policies");
+            }
+            try {
+                await grantPath.cleanupResource(create(ApiResourceRefSchema, {
+                    kind: ApiResourceKind[ApiResourceKind.organization],
+                    id,
+                }));
+            }
+            catch (error) {
+                throw internalError(error, "failed to remove the organization's access policies");
+            }
+        },
+    };
+}
 //# sourceMappingURL=steps.js.map

package/dist/domain/organization/steps.js.map

@@ -1 +1 @@
-{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/organization/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAG7E,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAE5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAE/F;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAY;IAEZ,OAAO;QACL,qEAAqE;QACrE,iEAAiE;QACjE,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,OAAO,CAAC,GAA8C;YAC1D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,EAAE,iBAAiB,CAAC,CAAC;YACpF,CAAC;YACD,gEAAgE;YAChE,2DAA2D;YAC3D,IAAI,QAAQ,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACzB,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAClF,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,WAAW,CACrB,GAAG,CAAC,eAAe,EACnB,QAAQ,CAAC,IAAI,EACb,kBAAkB,CACnB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,OAAO,CAAC,qCAAqC;gBAC/C,CAAC;gBACD,MAAM,aAAa,CAAC,KAAK,EAAE,4CAA4C,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,kBAAkB,CAAC,cAAc,EAAE,SAAS,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,OAAO,CAAC,GAA8C;YACpD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,EAAE,iBAAiB,CAAC,CAAC;YACpF,CAAC;YACD,kEAAkE;YAClE,yDAAyD;YACzD,IAAI,QAAQ,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACzB,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAClF,CAAC;YACD,QAAQ,CAAC,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/organization/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAG7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAG5D,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qDAAqD,CAAC;AAE3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAE/F;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAY;IAEZ,OAAO;QACL,qEAAqE;QACrE,iEAAiE;QACjE,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,OAAO,CAAC,GAA8C;YAC1D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,EAAE,iBAAiB,CAAC,CAAC;YACpF,CAAC;YACD,gEAAgE;YAChE,2DAA2D;YAC3D,IAAI,QAAQ,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACzB,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAClF,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,WAAW,CACrB,GAAG,CAAC,eAAe,EACnB,QAAQ,CAAC,IAAI,EACb,kBAAkB,CACnB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,OAAO,CAAC,qCAAqC;gBAC/C,CAAC;gBACD,MAAM,aAAa,CAAC,KAAK,EAAE,4CAA4C,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,kBAAkB,CAAC,cAAc,EAAE,SAAS,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,OAAO,CAAC,GAA8C;YACpD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,EAAE,iBAAiB,CAAC,CAAC;YACpF,CAAC;YACD,kEAAkE;YAClE,yDAAyD;YACzD,IAAI,QAAQ,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACzB,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAClF,CAAC;YACD,QAAQ,CAAC,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iCAAiC,CAC/C,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,4BAA4B;QAClC,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAErC,CAAC;YACd,MAAM,EAAE,GAAG,YAAY,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YAC5C,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACd,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,+EAA+E,CAAC,EAC1F,qDAAqD,CACtD,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,eAAe,CAC7B,MAAM,CAAC,oBAAoB,EAAE;oBAC3B,IAAI,EAAE,eAAe,CAAC,eAAe,CAAC,YAAY,CAAC;oBACnD,EAAE;iBACH,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CACjB,KAAK,EACL,qDAAqD,CACtD,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/platform/controller.d.ts

@@ -53,12 +53,14 @@ import type { LicenseStatusProvider } from "../../extensions/license-status.js";
 import type { RunnerCredentialProvider } from "../../runnerauth/runner-credential-provider.js";
 export interface PlatformControllerDeps {
     /**
-     * Temporal coordinates this server runs against, published to embedded
-     * runners. In OSS the server and its runners are co-located, so the
-     * address the server itself dials is the one runners should dial too —
-     * no internal/external split (unlike Stigmer Cloud).
+     * The Temporal coordinates published to embedded runners. The address
+     * is the one a runner should dial, which is not always the one this
+     * server dials: a clustered server reaches Temporal by an internal name
+     * its desktop runners cannot resolve (stigmer#1357). The composition
+     * root passes config.runnerBootstrapTemporalAddress, which defaults to
+     * the server's own address; the namespace is the server's.
      */
-    readonly temporalHostPort: string;
+    readonly runnerBootstrapTemporalAddress: string;
     readonly temporalNamespace: string;
     /**
      * Mints the execution-scoped tokens getRunnerScopedToken hands to

package/dist/domain/platform/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/platform/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAKzE,OAAO,EAML,aAAa,EACd,MAAM,uDAAuD,CAAC;AAS/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAEhF,OAAO,KAAK,EACV,wBAAwB,EAEzB,MAAM,gDAAgD,CAAC;AAGxD,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;IACrD;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,yEAAyE;AACzE,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,sBAAsB,GAC3B,IAAI,CASN"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/platform/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAKzE,OAAO,EAML,aAAa,EACd,MAAM,uDAAuD,CAAC;AAS/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAEhF,OAAO,KAAK,EACV,wBAAwB,EAEzB,MAAM,gDAAgD,CAAC;AAGxD,MAAM,WAAW,sBAAsB;IACrC;;;;;;;OAOG;IACH,QAAQ,CAAC,8BAA8B,EAAE,MAAM,CAAC;IAChD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;IACrD;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,yEAAyE;AACzE,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,sBAAsB,GAC3B,IAAI,CASN"}

package/dist/domain/platform/controller.js

@@ -63,7 +63,9 @@ async function getLicenseStatus(deps) {
 }
 /**
  * Go GetRunnerBootstrapConfig: the Temporal coordinates an embedded runner
- * should connect to so it can self-bootstrap from a token alone. The
+ * should connect to so it can self-bootstrap from a token alone: the
+ * address deps name for runners, never assumed to be the server's own
+ * (the proto's "the one reachable by the caller"). The
  * RunnerAccessToken / TokenType / RunnerAccessTokenExpiresInSeconds fields
  * are intentionally left empty in OSS: minting an iss=stigmer proxy token
  * is a cloud-only capability (OSS has no Cursor BiDi proxy to authenticate
@@ -79,7 +81,7 @@ async function getLicenseStatus(deps) {
  */
 async function getRunnerBootstrapConfig(deps, ctx) {
     const output = create(GetRunnerBootstrapConfigOutputSchema, {
-        temporalAddress: deps.temporalHostPort,
+        temporalAddress: deps.runnerBootstrapTemporalAddress,
         temporalNamespace: deps.temporalNamespace,
     });
     const bootstrapCredentials = deps.runnerAuthService.bootstrapCredentials?.bind(deps.runnerAuthService);

package/dist/domain/platform/controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/platform/controller.ts"],"names":[],"mappings":"AAiDA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AACjF,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,EACpC,gCAAgC,EAChC,yBAAyB,EACzB,uBAAuB,GAExB,MAAM,uDAAuD,CAAC;AAW/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAKvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAyD7E,yEAAyE;AACzE,MAAM,UAAU,wBAAwB,CACtC,MAAqB,EACrB,IAA4B;IAE5B,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE;QACtC,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC;QACxC,gBAAgB,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;QAC9C,wBAAwB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CACxC,wBAAwB,CAAC,IAAI,EAAE,GAAG,CAAC;QACrC,oBAAoB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACnC,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED,wFAAwF;AACxF,SAAS,aAAa,CAAC,IAA4B;IACjD,OAAO,MAAM,CAAC,yBAAyB,EAAE;QACvC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,gBAAgB,CAC7B,IAA4B;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,4BAA4B,EAAE;QAClD,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,iBAAiB,CAAC,GAAG,CAAC;KAClC,CAAC,CAAC;IACH,QAAQ,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,YAAY,CAAC,MAAM;YACtB,OAAO,MAAM,CAAC;QAChB,KAAK,YAAY,CAAC,OAAO;YACvB,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC5B,OAAO,MAAM,CAAC;QAChB,KAAK,YAAY,CAAC,KAAK,CAAC;QACxB,KAAK,YAAY,CAAC,QAAQ,CAAC;QAC3B,KAAK,YAAY,CAAC,KAAK,CAAC;QACxB,KAAK,YAAY,CAAC,OAAO;YACvB,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC5B,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,OAAO,MAAM,CAAC;QAChB,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,MAAM,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,wBAAwB,CACrC,IAA4B,EAC5B,GAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,CAAC,oCAAoC,EAAE;QAC1D,eAAe,EAAE,IAAI,CAAC,gBAAgB;QACtC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IACH,MAAM,oBAAoB,GACxB,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC5E,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,iBAAiB,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC;YACzD,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;YAC5B,MAAM,CAAC,iCAAiC;gBACtC,WAAW,CAAC,WAAW,CAAC,gBAAgB,CAAC;QAC7C,CAAC;QACD,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,oBAAoB,GAAG,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC;YAChE,MAAM,CAAC,sBAAsB,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC;YAC9D,MAAM,CAAC,6BAA6B;gBAClC,WAAW,CAAC,WAAW,CAAC,kBAAkB,IAAI,EAAE,CAAC;YACnD,MAAM,CAAC,+BAA+B;gBACpC,WAAW,CAAC,WAAW,CAAC,cAAc,IAAI,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wEAAwE,EACxE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAA4B,EAC5B,KAAgC,EAChC,GAAmB;IAEnB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,IAAI,CAC/D,IAAI,CAAC,iBAAiB,CACvB,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAC3B,iBAAiB,CAAC,KAAK,CAAC,EACxB,gBAAgB,CAAC,GAAG,CAAC,CACtB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC,gCAAgC,EAAE;YAC9C,iBAAiB,EAAE,MAAM,CAAC,KAAK;YAC/B,SAAS,EAAE,QAAQ;YACnB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAmB,CAAC;IACxB,QAAQ,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,kBAAkB;YACrB,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;YAChC,MAAM;QACR,KAAK,qBAAqB;YACxB,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;YAChC,MAAM;QACR,KAAK,WAAW,CAAC;QACjB,KAAK,SAAS,CAAC;QACf,KAAK,SAAS;YACZ,iEAAiE;YACjE,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC,KAAK,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,IACE,WAAW,KAAK,EAAE;QAClB,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,2BAA2B,CAAC,EAC9D,CAAC;QACD,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CACxC,2BAA2B,EAC3B,WAAW,EACX,CAAC,CACF,CAAC;QACF,OAAO,MAAM,CAAC,gCAAgC,EAAE;YAC9C,iBAAiB,EAAE,MAAM,CAAC,KAAK;YAC/B,SAAS,EAAE,QAAQ;YACnB,gBAAgB,EAAE,MAAM,CAAC,UAAU;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2DAA2D,EAC3D;YACE,WAAW;YACX,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;QACF,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,KAAgC;IAEhC,QAAQ,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,kBAAkB;YACrB,OAAO,EAAE,GAAG,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACpE,KAAK,qBAAqB;YACxB,OAAO,EAAE,GAAG,EAAE,oBAAoB,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACvE,KAAK,WAAW;YACd,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACvE,KAAK,SAAS;YACZ,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QAC5B,KAAK,SAAS;YACZ,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC,KAAK,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/platform/controller.ts"],"names":[],"mappings":"AAiDA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AACjF,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,EACpC,gCAAgC,EAChC,yBAAyB,EACzB,uBAAuB,GAExB,MAAM,uDAAuD,CAAC;AAW/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAKvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AA2D7E,yEAAyE;AACzE,MAAM,UAAU,wBAAwB,CACtC,MAAqB,EACrB,IAA4B;IAE5B,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE;QACtC,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC;QACxC,gBAAgB,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;QAC9C,wBAAwB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CACxC,wBAAwB,CAAC,IAAI,EAAE,GAAG,CAAC;QACrC,oBAAoB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACnC,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED,wFAAwF;AACxF,SAAS,aAAa,CAAC,IAA4B;IACjD,OAAO,MAAM,CAAC,yBAAyB,EAAE;QACvC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,gBAAgB,CAC7B,IAA4B;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,4BAA4B,EAAE;QAClD,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,iBAAiB,CAAC,GAAG,CAAC;KAClC,CAAC,CAAC;IACH,QAAQ,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,YAAY,CAAC,MAAM;YACtB,OAAO,MAAM,CAAC;QAChB,KAAK,YAAY,CAAC,OAAO;YACvB,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC5B,OAAO,MAAM,CAAC;QAChB,KAAK,YAAY,CAAC,KAAK,CAAC;QACxB,KAAK,YAAY,CAAC,QAAQ,CAAC;QAC3B,KAAK,YAAY,CAAC,KAAK,CAAC;QACxB,KAAK,YAAY,CAAC,OAAO;YACvB,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC5B,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,OAAO,MAAM,CAAC;QAChB,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,MAAM,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,wBAAwB,CACrC,IAA4B,EAC5B,GAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,CAAC,oCAAoC,EAAE;QAC1D,eAAe,EAAE,IAAI,CAAC,8BAA8B;QACpD,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IACH,MAAM,oBAAoB,GACxB,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC5E,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,iBAAiB,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC;YACzD,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;YAC5B,MAAM,CAAC,iCAAiC;gBACtC,WAAW,CAAC,WAAW,CAAC,gBAAgB,CAAC;QAC7C,CAAC;QACD,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,oBAAoB,GAAG,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC;YAChE,MAAM,CAAC,sBAAsB,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC;YAC9D,MAAM,CAAC,6BAA6B;gBAClC,WAAW,CAAC,WAAW,CAAC,kBAAkB,IAAI,EAAE,CAAC;YACnD,MAAM,CAAC,+BAA+B;gBACpC,WAAW,CAAC,WAAW,CAAC,cAAc,IAAI,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wEAAwE,EACxE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAA4B,EAC5B,KAAgC,EAChC,GAAmB;IAEnB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,IAAI,CAC/D,IAAI,CAAC,iBAAiB,CACvB,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAC3B,iBAAiB,CAAC,KAAK,CAAC,EACxB,gBAAgB,CAAC,GAAG,CAAC,CACtB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC,gCAAgC,EAAE;YAC9C,iBAAiB,EAAE,MAAM,CAAC,KAAK;YAC/B,SAAS,EAAE,QAAQ;YACnB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAmB,CAAC;IACxB,QAAQ,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,kBAAkB;YACrB,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;YAChC,MAAM;QACR,KAAK,qBAAqB;YACxB,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;YAChC,MAAM;QACR,KAAK,WAAW,CAAC;QACjB,KAAK,SAAS,CAAC;QACf,KAAK,SAAS;YACZ,iEAAiE;YACjE,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC,KAAK,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,IACE,WAAW,KAAK,EAAE;QAClB,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,2BAA2B,CAAC,EAC9D,CAAC;QACD,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CACxC,2BAA2B,EAC3B,WAAW,EACX,CAAC,CACF,CAAC;QACF,OAAO,MAAM,CAAC,gCAAgC,EAAE;YAC9C,iBAAiB,EAAE,MAAM,CAAC,KAAK;YAC/B,SAAS,EAAE,QAAQ;YACnB,gBAAgB,EAAE,MAAM,CAAC,UAAU;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2DAA2D,EAC3D;YACE,WAAW;YACX,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;QACF,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,KAAgC;IAEhC,QAAQ,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,kBAAkB;YACrB,OAAO,EAAE,GAAG,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACpE,KAAK,qBAAqB;YACxB,OAAO,EAAE,GAAG,EAAE,oBAAoB,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACvE,KAAK,WAAW;YACd,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACvE,KAAK,SAAS;YACZ,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QAC5B,KAAK,SAAS;YACZ,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC,KAAK,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/extensions/gate-slots.d.ts

@@ -53,6 +53,19 @@
  * limit belongs here too. `apply` delegates to create on its create arm,
  * so the slot fires there as well.
  *
+ * The tenth, `org-delete:pre-delete`: the organization delete chain after
+ * LoadExistingForDelete and before any write, so the organization exists
+ * and is loaded (EXISTING_RESOURCE_KEY) while its steps run. An
+ * organization's id is its slug and its delete frees the slug for anyone,
+ * so whatever an edition keeps for the organization must go before the row
+ * does, or be refused: a row left behind would belong to whoever creates
+ * the slug next. Its steps may refuse (Enterprise refuses while an
+ * identity provider still signs in platform-managed organizations) or
+ * remove the edition's own rows; either way a throw fails the delete with
+ * the organization intact, and the retry re-runs every step, so each owns
+ * its idempotency. After the slot the chain revokes the organization's own
+ * policy rows, also before the row and also failing closed.
+ *
  * Two enforcement layers, deliberately redundant, both derived from the
  * ONE literal tuple below (lockstep by construction):
  *   - GateSlotName (compile time): the union of declared slot literals.
@@ -80,7 +93,7 @@ import type { PipelineStep } from "../pipeline/pipeline.js";
  * owner-visible slot additions — each entry cites its chain position in
  * the guidelines' slot table, which must match the splice sites exactly.
  */
-export declare const GATE_SLOT_NAMES: readonly ["agent-execution-create:pre-side-effect-gate", "agent-execution-recover:pre-side-effect-gate", "agent-execution-submit-approval:gate", "session-create:pre-side-effect-gate", "org-create:post-persist", "sandbox-acquisition:gate", "identity-account-provision:post-persist", "iam-policy-create:pre-side-effect-gate", "org-create:pre-side-effect-gate"];
+export declare const GATE_SLOT_NAMES: readonly ["agent-execution-create:pre-side-effect-gate", "agent-execution-recover:pre-side-effect-gate", "agent-execution-submit-approval:gate", "session-create:pre-side-effect-gate", "org-create:post-persist", "sandbox-acquisition:gate", "identity-account-provision:post-persist", "iam-policy-create:pre-side-effect-gate", "org-create:pre-side-effect-gate", "org-delete:pre-delete"];
 /** The declared slot-name union — a registration outside it fails tsc. */
 export type GateSlotName = (typeof GATE_SLOT_NAMES)[number];
 /**

package/dist/extensions/gate-slots.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-slots.d.ts","sourceRoot":"","sources":["../../src/extensions/gate-slots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,eAAe,wWAUlB,CAAC;AAEX,0EAA0E;AAC1E,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAEnD,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,WAAW,CACzC,MAAM,EACN,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CACzC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAS,WAAW,EACnD,SAAS,EAAE,iBAAiB,EAC5B,IAAI,EAAE,YAAY,GACjB,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAOnC"}
+{"version":3,"file":"gate-slots.d.ts","sourceRoot":"","sources":["../../src/extensions/gate-slots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,eAAe,iYAWlB,CAAC;AAEX,0EAA0E;AAC1E,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAEnD,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,WAAW,CACzC,MAAM,EACN,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CACzC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAS,WAAW,EACnD,SAAS,EAAE,iBAAiB,EAC5B,IAAI,EAAE,YAAY,GACjB,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAOnC"}

package/dist/extensions/gate-slots.js

@@ -13,6 +13,7 @@ export const GATE_SLOT_NAMES = [
     "identity-account-provision:post-persist",
     "iam-policy-create:pre-side-effect-gate",
     "org-create:pre-side-effect-gate",
+    "org-delete:pre-delete",
 ];
 /**
  * The boot-time declared-slot set — resolveExtensions validates every

package/dist/extensions/gate-slots.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate-slots.js","sourceRoot":"","sources":["../../src/extensions/gate-slots.ts"],"names":[],"mappings":"AA+EA;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,6CAA6C;IAC7C,8CAA8C;IAC9C,sCAAsC;IACtC,qCAAqC;IACrC,yBAAyB;IACzB,0BAA0B;IAC1B,yCAAyC;IACzC,wCAAwC;IACxC,iCAAiC;CACzB,CAAC;AAKX;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAC7D,eAAe,CAChB,CAAC;AAWF;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,SAA4B,EAC5B,IAAkB;IAElB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACxC,kDAAkD;IAClD,oEAAoE;IACpE,sEAAsE;IACtE,cAAc;IACd,OAAO,KAA0C,CAAC;AACpD,CAAC"}
+{"version":3,"file":"gate-slots.js","sourceRoot":"","sources":["../../src/extensions/gate-slots.ts"],"names":[],"mappings":"AA4FA;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,6CAA6C;IAC7C,8CAA8C;IAC9C,sCAAsC;IACtC,qCAAqC;IACrC,yBAAyB;IACzB,0BAA0B;IAC1B,yCAAyC;IACzC,wCAAwC;IACxC,iCAAiC;IACjC,uBAAuB;CACf,CAAC;AAKX;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAC7D,eAAe,CAChB,CAAC;AAWF;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,SAA4B,EAC5B,IAAkB;IAElB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACxC,kDAAkD;IAClD,oEAAoE;IACpE,sEAAsE;IACtE,cAAc;IACd,OAAO,KAA0C,CAAC;AACpD,CAAC"}

package/dist/pipeline/steps/authorization-tuples.d.ts

@@ -88,8 +88,12 @@ export declare function newCreateAuthorizationTuplesStep<Desc extends DescMessag
 /**
  * CleanupIamPolicies — after the store delete in every delete chain.
  * Best-effort by contract: a driver failure is logged and the delete
- * succeeds (Java's DeleteOperationCleanupIamPoliciesStep swallows all —
- * the cloud side owns convergence for orphaned grants).
+ * succeeds (Java's DeleteOperationCleanupIamPoliciesStep swallows all),
+ * because a deleted resource's rows grant nothing once it is gone. The
+ * organization is the one kind whose id another caller can take next, so
+ * its chain revokes the organization's rows before the row, failing
+ * closed (RevokeOrganizationPolicies, domain/organization/steps.ts), and
+ * this step is only its backstop there.
  */
 export declare function newCleanupIamPoliciesStep<Desc extends DescMessage>(lifecycle: ResourceAuthorizationLifecycle | undefined, logger: Logger): PipelineStep<Desc>;
 /** Context key for the pre-update visibility level. */

package/dist/pipeline/steps/authorization-tuples.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-tuples.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/authorization-tuples.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAU3H,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EACV,0BAA0B,EAE1B,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,4CAA4C,CAAC;AAEpD;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CAKf;AAGD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAYnD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,qBAAqB,GAC3B,WAAW,CAAC,oBAAoB,CAAC,CAwBnC;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,qBAAqB,EAC/B,QAAQ,EAAE,qBAAqB,GAC9B;IACD,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAC7D,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9D,CAUA;AAgGD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,MAAM,GACb,oBAAoB,GAAG,SAAS,CAkClC;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,SAAS,WAAW,EACvE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CAuBpB;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CAiCpB;AAED,uDAAuD;AACvD,eAAO,MAAM,kBAAkB,+BAA+B,CAAC;AAE/D;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,IAAI,SAAS,WAAW,EAC1E,WAAW,EAAE,MAAM,GAClB,YAAY,CAAC,IAAI,CAAC,CAYpB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,SAAS,WAAW,EACpE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,WAAW,EAAE,MAAM,GAClB,YAAY,CAAC,IAAI,CAAC,CAoCpB"}
+{"version":3,"file":"authorization-tuples.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/authorization-tuples.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAU3H,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EACV,0BAA0B,EAE1B,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,4CAA4C,CAAC;AAEpD;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CAKf;AAGD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAYnD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,qBAAqB,GAC3B,WAAW,CAAC,oBAAoB,CAAC,CAwBnC;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,qBAAqB,EAC/B,QAAQ,EAAE,qBAAqB,GAC9B;IACD,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAC7D,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9D,CAUA;AAgGD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,MAAM,GACb,oBAAoB,GAAG,SAAS,CAkClC;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,SAAS,WAAW,EACvE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CAuBpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CAiCpB;AAED,uDAAuD;AACvD,eAAO,MAAM,kBAAkB,+BAA+B,CAAC;AAE/D;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,IAAI,SAAS,WAAW,EAC1E,WAAW,EAAE,MAAM,GAClB,YAAY,CAAC,IAAI,CAAC,CAYpB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,SAAS,WAAW,EACpE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,WAAW,EAAE,MAAM,GAClB,YAAY,CAAC,IAAI,CAAC,CAoCpB"}

package/dist/pipeline/steps/authorization-tuples.js

@@ -201,8 +201,12 @@ export function newCreateAuthorizationTuplesStep(lifecycle, logger) {
 /**
  * CleanupIamPolicies — after the store delete in every delete chain.
  * Best-effort by contract: a driver failure is logged and the delete
- * succeeds (Java's DeleteOperationCleanupIamPoliciesStep swallows all —
- * the cloud side owns convergence for orphaned grants).
+ * succeeds (Java's DeleteOperationCleanupIamPoliciesStep swallows all),
+ * because a deleted resource's rows grant nothing once it is gone. The
+ * organization is the one kind whose id another caller can take next, so
+ * its chain revokes the organization's rows before the row, failing
+ * closed (RevokeOrganizationPolicies, domain/organization/steps.ts), and
+ * this step is only its backstop there.
  */
 export function newCleanupIamPoliciesStep(lifecycle, logger) {
     return {

package/dist/pipeline/steps/authorization-tuples.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-tuples.js","sourceRoot":"","sources":["../../../src/pipeline/steps/authorization-tuples.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAE/F,OAAO,EACL,sBAAsB,GAEvB,MAAM,wFAAwF,CAAC;AAgBhG;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,SAAqD,EACrD,KAAiC;IAEjC,IAAI,SAAS,EAAE,uBAAuB,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO;IACT,CAAC;IACD,MAAM,SAAS,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;AACjD,CAAC;AACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,8EAA8E;AAC9E,yEAAyE;AACzE,mEAAmE;AACnE,qCAAqC;AACrC,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAqB,EACrB,KAA4B;IAE5B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,MAAM,QAAQ,GACZ,MAAM,EAAE,uBAAuB,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC;IAC1E,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,qBAAqB,CAAC,cAAc;YACvC,IAAI,MAAM,EAAE,WAAW,KAAK,IAAI,EAAE,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC3B,CAAC;YACD,MAAM;QACR,KAAK,qBAAqB,CAAC,mBAAmB;YAC5C,IAAI,MAAM,EAAE,gBAAgB,KAAK,IAAI,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;gBAC9B,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,MAAM;QACR;YACE,0DAA0D;YAC1D,MAAM;IACV,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAClC,IAAqB,EACrB,QAA+B,EAC/B,QAA+B;IAK/B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtD,OAAO;QACL,cAAc,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvE,cAAc,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACxE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,oEAAoE;AACpE,oCAAoC;AACpC,8EAA8E;AAE9E,SAAS,iBAAiB,CACxB,IAAqB,EACrB,QAAiB,EACjB,YAAkC;IAElC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,sEAAsE;QACtE,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,2BAA2B,YAAY,CAAC,QAAQ,kBAAkB,YAAY,CAAC,SAAS,oBAAoB,WAAW,CAAC,IAAI,CAAC,EAAE,CAChI,EACD,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC;QAC1C,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,IAAqB,EACrB,MAA2B,EAC3B,QAAiB,EACjB,KAAa,EACb,MAAc;IAEd,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,QAAQ,MAAM,CAAC,SAAS,EAAE,CAAC;QACzB,KAAK,sBAAsB,CAAC,YAAY,CAAC,CAAC,CAAC;YACzC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACjB,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,kEAAkE,WAAW,CAAC,IAAI,CAAC,EAAE,CACtF,EACD,uCAAuC,CACxC,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,cAAc;gBACxB,UAAU,EAAE,WAAW,CAAC,cAAc,CAAC;gBACvC,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;YACH,MAAM;QACR,CAAC;QACD,KAAK,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,GAAG,WAAW,CAAC,IAAI,CAAC,gDAAgD,CACrE,EACD,uCAAuC,CACxC,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7D,MAAM;QACR,CAAC;QACD,KAAK,sBAAsB,CAAC,UAAU;YACpC,MAAM;QACR,KAAK,sBAAsB,CAAC,QAAQ;YAClC,mEAAmE;YACnE,kEAAkE;YAClE,sDAAsD;YACtD,MAAM,CAAC,IAAI,CAAC,wDAAwD,EAAE;gBACpE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC;aACxB,CAAC,CAAC;YACH,MAAM;QACR;YACE,MAAM;IACV,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAqB,EACrB,QAAiB,EACjB,MAAsB,EACtB,MAAc;IAEd,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IAC/C,IACE,MAAM,KAAK,SAAS;QACpB,MAAM,CAAC,SAAS,KAAK,sBAAsB,CAAC,IAAI;QAChD,MAAM,CAAC,SAAS,KAAK,sBAAsB,CAAC,WAAW,EACvD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,yCAAyC,CAAC,EACpD,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI;QACJ,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,KAAK,EAAE,QAAQ,CAAC,GAAG;QACnB,MAAM;QACN,gBAAgB,EAAE,MAAM,CAAC,SAAS;QAClC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,WAAW,EAAE,kBAAkB,CAC7B,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,QAAQ,CAAC,GAAG,EACZ,MAAM,CACP;QACD,mEAAmE;QACnE,oCAAoC;QACpC,gBAAgB,EAAE,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;KACtE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAC9C,SAAqD,EACrD,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,2BAA2B;QACjC,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,2BAA2B,CACvC,GAAG,CAAC,eAAe,EACnB,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,cAAc,EAClB,MAAM,CACP,CAAC;YACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,uCAAuC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAqD,EACrD,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAEhC,CAAC;YACd,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;YACnC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,iBAAiB,CAAC;oBAChC,IAAI,EAAE,GAAG,CAAC,eAAe;oBACzB,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,QAAQ,CAAC,GAAG;oBACnB,MAAM,EAAE,GAAG,CAAC,cAAc;iBAC3B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CACT,iEAAiE,EACjE;oBACE,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC;oBACtC,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CACF,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CACjD,WAAmB;IAEnB,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,OAAO,CAAC,GAAyB;YAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAiC,CAAC;YACtE,GAAG,CAAC,GAAG,CACL,kBAAkB,EAClB,QAAQ,EAAE,QAAQ,EAAE,UAAU;gBAC5B,qBAAqB,CAAC,mCAAmC,CAC5D,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,SAAqD,EACrD,WAAmB;IAEnB,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAiC,CAAC;YACtE,MAAM,QAAQ,GAAG,QAAQ,EAAE,QAAQ,CAAC;YACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GACX,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAuC;gBAClE,qBAAqB,CAAC,mCAAmC,CAAC;YAC5D,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,oBAAoB,CAC7D,GAAG,CAAC,eAAe,EACnB,QAAQ,EACR,QAAQ,CAAC,UAAU,CACpB,CAAC;YACF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/D,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,mBAAmB,CAAC;oBAClC,IAAI,EAAE,GAAG,CAAC,eAAe;oBACzB,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,QAAQ,CAAC,GAAG;oBACnB,cAAc;oBACd,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authorization-tuples.js","sourceRoot":"","sources":["../../../src/pipeline/steps/authorization-tuples.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAE/F,OAAO,EACL,sBAAsB,GAEvB,MAAM,wFAAwF,CAAC;AAgBhG;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,SAAqD,EACrD,KAAiC;IAEjC,IAAI,SAAS,EAAE,uBAAuB,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO;IACT,CAAC;IACD,MAAM,SAAS,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;AACjD,CAAC;AACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,8EAA8E;AAC9E,yEAAyE;AACzE,mEAAmE;AACnE,qCAAqC;AACrC,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAqB,EACrB,KAA4B;IAE5B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,MAAM,QAAQ,GACZ,MAAM,EAAE,uBAAuB,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC;IAC1E,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,qBAAqB,CAAC,cAAc;YACvC,IAAI,MAAM,EAAE,WAAW,KAAK,IAAI,EAAE,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC3B,CAAC;YACD,MAAM;QACR,KAAK,qBAAqB,CAAC,mBAAmB;YAC5C,IAAI,MAAM,EAAE,gBAAgB,KAAK,IAAI,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;gBAC9B,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,MAAM;QACR;YACE,0DAA0D;YAC1D,MAAM;IACV,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAClC,IAAqB,EACrB,QAA+B,EAC/B,QAA+B;IAK/B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtD,OAAO;QACL,cAAc,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvE,cAAc,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACxE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,oEAAoE;AACpE,oCAAoC;AACpC,8EAA8E;AAE9E,SAAS,iBAAiB,CACxB,IAAqB,EACrB,QAAiB,EACjB,YAAkC;IAElC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,sEAAsE;QACtE,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,2BAA2B,YAAY,CAAC,QAAQ,kBAAkB,YAAY,CAAC,SAAS,oBAAoB,WAAW,CAAC,IAAI,CAAC,EAAE,CAChI,EACD,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC;QAC1C,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,IAAqB,EACrB,MAA2B,EAC3B,QAAiB,EACjB,KAAa,EACb,MAAc;IAEd,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,QAAQ,MAAM,CAAC,SAAS,EAAE,CAAC;QACzB,KAAK,sBAAsB,CAAC,YAAY,CAAC,CAAC,CAAC;YACzC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACjB,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,kEAAkE,WAAW,CAAC,IAAI,CAAC,EAAE,CACtF,EACD,uCAAuC,CACxC,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,cAAc;gBACxB,UAAU,EAAE,WAAW,CAAC,cAAc,CAAC;gBACvC,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;YACH,MAAM;QACR,CAAC;QACD,KAAK,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,GAAG,WAAW,CAAC,IAAI,CAAC,gDAAgD,CACrE,EACD,uCAAuC,CACxC,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7D,MAAM;QACR,CAAC;QACD,KAAK,sBAAsB,CAAC,UAAU;YACpC,MAAM;QACR,KAAK,sBAAsB,CAAC,QAAQ;YAClC,mEAAmE;YACnE,kEAAkE;YAClE,sDAAsD;YACtD,MAAM,CAAC,IAAI,CAAC,wDAAwD,EAAE;gBACpE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC;aACxB,CAAC,CAAC;YACH,MAAM;QACR;YACE,MAAM;IACV,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAqB,EACrB,QAAiB,EACjB,MAAsB,EACtB,MAAc;IAEd,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IAC/C,IACE,MAAM,KAAK,SAAS;QACpB,MAAM,CAAC,SAAS,KAAK,sBAAsB,CAAC,IAAI;QAChD,MAAM,CAAC,SAAS,KAAK,sBAAsB,CAAC,WAAW,EACvD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,yCAAyC,CAAC,EACpD,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI;QACJ,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,KAAK,EAAE,QAAQ,CAAC,GAAG;QACnB,MAAM;QACN,gBAAgB,EAAE,MAAM,CAAC,SAAS;QAClC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,WAAW,EAAE,kBAAkB,CAC7B,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,QAAQ,CAAC,GAAG,EACZ,MAAM,CACP;QACD,mEAAmE;QACnE,oCAAoC;QACpC,gBAAgB,EAAE,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;KACtE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAC9C,SAAqD,EACrD,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,2BAA2B;QACjC,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,2BAA2B,CACvC,GAAG,CAAC,eAAe,EACnB,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,cAAc,EAClB,MAAM,CACP,CAAC;YACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,uCAAuC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAqD,EACrD,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAEhC,CAAC;YACd,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;YACnC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,iBAAiB,CAAC;oBAChC,IAAI,EAAE,GAAG,CAAC,eAAe;oBACzB,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,QAAQ,CAAC,GAAG;oBACnB,MAAM,EAAE,GAAG,CAAC,cAAc;iBAC3B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CACT,iEAAiE,EACjE;oBACE,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC;oBACtC,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CACF,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CACjD,WAAmB;IAEnB,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,OAAO,CAAC,GAAyB;YAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAiC,CAAC;YACtE,GAAG,CAAC,GAAG,CACL,kBAAkB,EAClB,QAAQ,EAAE,QAAQ,EAAE,UAAU;gBAC5B,qBAAqB,CAAC,mCAAmC,CAC5D,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,SAAqD,EACrD,WAAmB;IAEnB,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAiC,CAAC;YACtE,MAAM,QAAQ,GAAG,QAAQ,EAAE,QAAQ,CAAC;YACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GACX,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAuC;gBAClE,qBAAqB,CAAC,mCAAmC,CAAC;YAC5D,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,oBAAoB,CAC7D,GAAG,CAAC,eAAe,EACnB,QAAQ,EACR,QAAQ,CAAC,UAAU,CACpB,CAAC;YACF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/D,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,mBAAmB,CAAC;oBAClC,IAAI,EAAE,GAAG,CAAC,eAAe;oBACzB,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,QAAQ,CAAC,GAAG;oBACnB,cAAc;oBACd,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/server",
-  "version": "3.37.1",
+  "version": "3.38.1",
   "description": "The Stigmer OSS control plane as a composable library: composeServer, the extension registry and the driver seams a composition builds on. The self-contained deployable of the same server is @stigmer/server-slim.",
   "license": "Apache-2.0",
   "type": "module",
@@ -63,11 +63,11 @@
     "@connectrpc/connect-node": "^2.0.0",
     "@kubernetes/client-node": "2.0.0",
     "@opentelemetry/api": "^1.9.0",
-    "@stigmer/outbound": "3.37.1",
-    "@stigmer/plugin-package": "3.37.1",
-    "@stigmer/protos": "3.37.1",
-    "@stigmer/temporal-codecs": "3.37.1",
-    "@stigmer/zip-structure": "3.37.1",
+    "@stigmer/outbound": "3.38.1",
+    "@stigmer/plugin-package": "3.38.1",
+    "@stigmer/protos": "3.38.1",
+    "@stigmer/temporal-codecs": "3.38.1",
+    "@stigmer/zip-structure": "3.38.1",
     "@temporalio/activity": "1.16.2",
     "@temporalio/client": "1.16.2",
     "@temporalio/common": "1.16.2",

package/src/boot/__tests__/config.test.ts

@@ -94,6 +94,37 @@ describe("loadConfig", () => {
     });
   });
 
+  // stigmer#1357: the address runners are told to dial is its own fact.
+  // Defaulting it to the server's own address keeps every co-located
+  // install byte-identical; a clustered server overrides it for runners
+  // that cannot resolve the cluster-internal name it dials itself.
+  describe("runnerBootstrapTemporalAddress (STIGMER_RUNNER_BOOTSTRAP_TEMPORAL_ADDRESS)", () => {
+    it("defaults to the address the server dials", () => {
+      expect(loadConfig({}).runnerBootstrapTemporalAddress).toBe("localhost:7233");
+      expect(
+        loadConfig({ TEMPORAL_HOST_PORT: "temporal.internal:7233" }).runnerBootstrapTemporalAddress,
+      ).toBe("temporal.internal:7233");
+    });
+
+    it("reads an explicit value, leaving the server's own address alone", () => {
+      const config = loadConfig({
+        TEMPORAL_HOST_PORT: "temporal.internal:7233",
+        STIGMER_RUNNER_BOOTSTRAP_TEMPORAL_ADDRESS: "temporal.example.com:7233",
+      });
+      expect(config.runnerBootstrapTemporalAddress).toBe("temporal.example.com:7233");
+      expect(config.temporalHostPort).toBe("temporal.internal:7233");
+    });
+
+    it("treats an empty string as absent (Go's getEnvString)", () => {
+      expect(
+        loadConfig({
+          TEMPORAL_HOST_PORT: "temporal.internal:7233",
+          STIGMER_RUNNER_BOOTSTRAP_TEMPORAL_ADDRESS: "",
+        }).runnerBootstrapTemporalAddress,
+      ).toBe("temporal.internal:7233");
+    });
+  });
+
   describe("STIGMER_OIDC_CONSOLE_CLIENT_ID (the console's sign-in client)", () => {
     const OIDC = {
       STIGMER_OIDC_ISSUER: "https://auth.example.com/realms/main",

package/src/boot/compose.ts

@@ -1268,6 +1268,9 @@ export async function composeServer(
       logger,
       authorizer,
       gateSteps: extensions.gateSteps,
+      // The delete revokes the organization's rows through the one grant
+      // path, before its row goes (domain/organization/steps.ts).
+      grantPath: iamPolicyGrantPath,
       // The role lifecycle and the directory (the identity stage): the
       // composed drivers, or open source's under the built-in posture.
       authorizationLifecycle: roleLifecycle,
@@ -1629,7 +1632,7 @@ export async function composeServer(
     });
     // Platform registers LAST of all controllers (Go server.go 530–535).
     registerPlatformServices(router, {
-      temporalHostPort: config.temporalHostPort,
+      runnerBootstrapTemporalAddress: config.runnerBootstrapTemporalAddress,
       temporalNamespace: config.temporalNamespace,
       runnerAuthService: runnerCredentials,
       edition: extensions.edition,

package/src/boot/config.ts

@@ -56,13 +56,11 @@ export interface ServerConfig {
   readonly operatorName: string;
   /**
    * Temporal coordinates this server runs against (Go TemporalHostPort/
-   * TemporalNamespace). Published to embedded runners via the platform
-   * domain's getRunnerBootstrapConfig — in OSS the server and its runners
-   * are co-located, so the address the server dials is the one runners
-   * dial too. The Temporal workers (#18) read the same fields; connection
-   * failure is NON-fatal (the server serves with the engine unavailable
-   * and the TemporalManager's health monitor keeps retrying — Go
-   * server.go InitialConnect posture).
+   * TemporalNamespace). The Temporal workers (#18) read the same fields;
+   * connection failure is NON-fatal (the server serves with the engine
+   * unavailable and the TemporalManager's health monitor keeps retrying —
+   * Go server.go InitialConnect posture). The address runners are told to
+   * dial is a separate fact: runnerBootstrapTemporalAddress below.
    */
   readonly temporalHostPort: string;
   readonly temporalNamespace: string;
@@ -75,6 +73,19 @@ export interface ServerConfig {
    * setting fails the boot, like OIDC's half configuration.
    */
   readonly temporalConnection: TemporalConnectionConfig;
+  /**
+   * The Temporal address getRunnerBootstrapConfig publishes to runners
+   * that discover their coordinates from this server instead of being
+   * given them (STIGMER_RUNNER_BOOTSTRAP_TEMPORAL_ADDRESS; stigmer#1357).
+   * Defaults to TEMPORAL_HOST_PORT — right whenever those runners share
+   * this server's network (a laptop, the compose stack, the chart). Set
+   * it when they do not: a server in a cluster that dials Temporal by its
+   * internal service name, and a desktop runner that must dial the
+   * frontend's external ingress. The namespace is not split; one
+   * namespace is served on every ingress. Sandboxes are told their
+   * address by the provisioner (sandboxTemporalAddress), never by this.
+   */
+  readonly runnerBootstrapTemporalAddress: string;
   /**
    * Artifact blob storage (attachments + execution outputs; Go
    * config.ArtifactStorage). "local" is the OSS default; "r2" boot-fails
@@ -315,6 +326,11 @@ export function loadConfig(env: NodeJS.ProcessEnv = process.env): ServerConfig {
     temporalHostPort: envString(env, "TEMPORAL_HOST_PORT", "localhost:7233"),
     temporalNamespace: envString(env, "TEMPORAL_NAMESPACE", "default"),
     temporalConnection: loadTemporalConnectionConfig((name) => env[name]),
+    runnerBootstrapTemporalAddress: envString(
+      env,
+      "STIGMER_RUNNER_BOOTSTRAP_TEMPORAL_ADDRESS",
+      envString(env, "TEMPORAL_HOST_PORT", "localhost:7233"),
+    ),
     artifactStorageType,
     artifactLocalBasePath: envString(
       env,

package/src/domain/agentexecution/__tests__/store-faults.test.ts

@@ -36,7 +36,12 @@ import { AgentExecutionQueryController } from "@stigmer/protos/ai/stigmer/agenti
 import type { ArtifactStorage } from "../../../artifactstorage/artifact-storage.js";
 import { createLogger } from "../../../boot/logger.js";
 import { callerIdentityKey } from "../../../pipeline/interceptors/auth.js";
-import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
+import {
+  errorOf,
+  failingStore,
+  testCallerIdentity,
+  untouchable,
+} from "../../../pipeline/__tests__/support.js";
 import { newPermissiveSingleTeamAuthorizer } from "../../../pipeline/steps/authorize.js";
 import { ResourceNotFoundError } from "../../../store/interface.js";
 import type { Store } from "../../../store/interface.js";
@@ -64,35 +69,10 @@ const EXECUTION_ID = "aex_storefault";
 
 const LOAD_FAULT_COPY = "failed to load agent execution";
 
-/** A dependency the call must never reach once its load has failed. */
-function untouchable<T extends object>(name: string): T {
-  return new Proxy({} as T, {
-    get(_target, prop) {
-      throw new Error(`${name}.${String(prop)} reached after a failed load`);
-    },
-  });
-}
-
-/** A store whose every read fails with the given error. */
-function failingStore(error: Error): Store {
-  return {
-    getResource: () => Promise.reject(error),
-  } as unknown as Store;
-}
-
 const MISSING = (): Error =>
   new ResourceNotFoundError(`agent_execution/${EXECUTION_ID}`);
 const LOCKED = (): Error => new Error("SQLITE_BUSY: database is locked");
 
-async function errorOf(call: () => Promise<unknown>): Promise<ConnectError> {
-  const error = await call().then(
-    () => undefined,
-    (e: unknown) => e,
-  );
-  expect(error, "the call must fail").toBeInstanceOf(ConnectError);
-  return error as ConnectError;
-}
-
 function lifecycleDeps(store: Store): LifecycleDeps {
   return {
     store,

package/src/domain/iampolicy/__tests__/grant-path.test.ts

@@ -14,8 +14,11 @@
  *     fail-open incident class). The absent arm fires the hook with the
  *     spec and no policy, so a composition can still delete a bare tuple
  *     written before the row mirror existed.
- *   - cleanupResource is bidirectional (as target AND as principal),
- *     deduplicated, revoking each row through the same revoke order.
+ *   - cleanupResource is bidirectional (as principal first, then as
+ *     target with the owner rows last), deduplicated, revoking each row
+ *     through the same revoke order; a fault stops it with the owners
+ *     still holding, since an organization's delete runs it before the
+ *     organization's row goes and its owner is the one who retries.
  *   - revokeOrgAccess revokes the account's direct rows on the
  *     organization; the inert org-column arm the cloud carried is gone
  *     (Q-OR-9).
@@ -378,17 +381,19 @@ describe("revoke: onPolicyRevoked before the row delete", () => {
 });
 
 describe("cleanupResource: bidirectional, deduplicated, each row through the revoke order", () => {
-  it("revokes rows where the ref is the resource AND rows where it is the principal", async () => {
+  it("revokes rows where the ref is the principal, then where it is the resource, owners last", async () => {
     const recorded: RecordedEvent[] = [];
     const { policies, path } = pathOver(recorded, recordingLifecycle(recorded));
-    const asResource = orgRole(ALICE, "owner", "acme");
+    const owner = orgRole(ALICE, "owner", "acme");
+    const member = orgRole(BOB, "member", "acme");
     const asPrincipal = triple(
       { kind: "organization", id: "acme" },
       "organization",
       { kind: "agent", id: AGENT },
     );
     const unrelated = orgRole(ALICE, "member", "globex");
-    for (const spec of [asResource, asPrincipal, unrelated]) {
+    // Granted owner first, so the order below is the cleanup's, not the store's.
+    for (const spec of [owner, member, asPrincipal, unrelated]) {
       await path.grant(spec, alice);
     }
     recorded.length = 0;
@@ -399,17 +404,45 @@ describe("cleanupResource: bidirectional, deduplicated, each row through the rev
 
     expect([...policies.rows.keys()]).toEqual([policyIdFor(unrelated)]);
     expect(recorded).toEqual([
-      { kind: "revoked", id: policyIdFor(asResource), relation: "owner" },
-      { kind: "row-delete", id: policyIdFor(asResource) },
       {
         kind: "revoked",
         id: policyIdFor(asPrincipal),
         relation: "organization",
       },
       { kind: "row-delete", id: policyIdFor(asPrincipal) },
+      { kind: "revoked", id: policyIdFor(member), relation: "member" },
+      { kind: "row-delete", id: policyIdFor(member) },
+      { kind: "revoked", id: policyIdFor(owner), relation: "owner" },
+      { kind: "row-delete", id: policyIdFor(owner) },
     ]);
   });
 
+  it("stops at the first fault with the owner rows still in place", async () => {
+    const recorded: RecordedEvent[] = [];
+    const lifecycle = recordingLifecycle(recorded);
+    const { policies, path } = pathOver(recorded, {
+      ...lifecycle,
+      onPolicyRevoked: (event) =>
+        event.spec.relation === "member"
+          ? Promise.reject(new Error("tuple delete refused"))
+          : lifecycle.onPolicyRevoked!(event),
+    });
+    const owner = orgRole(ALICE, "owner", "acme");
+    const member = orgRole(BOB, "member", "acme");
+    for (const spec of [owner, member]) {
+      await path.grant(spec, alice);
+    }
+
+    await expect(
+      path.cleanupResource(
+        create(ApiResourceRefSchema, { kind: "organization", id: "acme" }),
+      ),
+    ).rejects.toThrow("tuple delete refused");
+
+    expect(policies.rows.has(policyIdFor(owner))).toBe(true);
+    expect(policies.rows.has(policyIdFor(member))).toBe(true);
+  });
+
   it("a ref that is both principal and resource of one row revokes it once", async () => {
     const recorded: RecordedEvent[] = [];
     const { path } = pathOver(recorded, recordingLifecycle(recorded));

package/src/domain/iampolicy/grant-path.ts

@@ -59,6 +59,7 @@ import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/
 import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
 import type { IamPolicy } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
 import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import type {
   ApiResourceRef,
   IamPolicySpec,
@@ -78,6 +79,9 @@ import { DuplicatePolicyError } from "./store.js";
 import type { IamPolicyStore } from "./store.js";
 import { refsOf, requireWellFormedTriple } from "./wire-refusals.js";
 
+/** The relation `cleanupResource` revokes last on the ref's own rows. */
+const OWNER_RELATION = IamRole[IamRole.owner];
+
 export interface GrantResult {
   readonly policy: IamPolicy;
   /** True when the triple was already held: no row was written, the hook still fired. */
@@ -99,9 +103,13 @@ export interface IamPolicyGrantPath {
    */
   revokeBySpec(spec: IamPolicySpec): Promise<IamPolicy | undefined>;
   /**
-   * Revoke every row naming the ref as its resource, then every row naming
-   * it as its principal, each through the revoke order; a row that is both
-   * is revoked once. Nothing to clean is a no-op.
+   * Revoke every row naming the ref as its principal, then every row naming
+   * it as its resource with the `owner` rows last, each through the revoke
+   * order; a row that is both is revoked once. Nothing to clean is a no-op.
+   * The order matters where the ref still exists: an organization's delete
+   * runs this before its row goes and fails on the first fault, so a
+   * cleanup that stops partway has not yet removed the owners who may
+   * retry it.
    */
   cleanupResource(ref: ApiResourceRef): Promise<void>;
   /** Revoke every relation the account holds directly on the organization. */
@@ -209,9 +217,15 @@ export function newIamPolicyGrantPath(
     },
 
     async cleanupResource(ref): Promise<void> {
-      const asResource = await policies.findByResource(ref.kind, ref.id);
       const asPrincipal = await policies.findByPrincipal(ref.kind, ref.id);
-      for (const policy of distinctById([...asResource, ...asPrincipal])) {
+      const asResource = await policies.findByResource(ref.kind, ref.id);
+      const isOwner = (policy: IamPolicy): boolean =>
+        policy.spec?.relation === OWNER_RELATION;
+      for (const policy of distinctById([
+        ...asPrincipal,
+        ...asResource.filter((policy) => !isOwner(policy)),
+        ...asResource.filter(isOwner),
+      ])) {
         await revokeRow(policy);
       }
     },