@stigmer/server 3.40.0 → 3.41.0

package/dist/domain/iampolicy/controller.js

@@ -135,7 +135,7 @@ export function registerIamPolicyServices(router, deps) {
         delete: (spec, ctx) => deletePolicy(deps, spec, ctx),
         bootstrapPolicy: (spec, ctx) => {
             guardSystemRpc(command.bootstrapPolicy, callerIdentityOf(ctx));
-            return grantThroughChain(deps, command.bootstrapPolicy, spec, ctx, false);
+            return grantThroughChain(deps, command.bootstrapPolicy, spec, ctx, false, "structural");
         },
         cleanupResourcePolicies: (ref, ctx) => {
             guardSystemRpc(command.cleanupResourcePolicies, callerIdentityOf(ctx));
@@ -182,15 +182,16 @@ function guardSystemRpc(method, caller) {
  */
 function createPolicy(deps, spec, ctx) {
     requireWellFormedTriple(spec);
-    return grantThroughChain(deps, IamPolicyCommandController.method.create, spec, ctx, true);
+    return grantThroughChain(deps, IamPolicyCommandController.method.create, spec, ctx, true, "grant");
 }
 /**
  * The grant chain both `create` and `bootstrapPolicy` run; only the user
  * lane validates the role, asks for an owner's authority when it grants
  * owner, and runs the create gate slot — bootstrap writes structural
- * relations no scope would admit and no edition gates.
+ * relations no scope would admit and no edition gates. `cause` is the
+ * lane's door, recorded with every access row it writes.
  */
-async function grantThroughChain(deps, method, spec, ctx, validateRole) {
+async function grantThroughChain(deps, method, spec, ctx, validateRole, cause) {
     const reqCtx = new RequestContext(IamPolicySpecSchema, spec, callerIdentityOf(ctx), kindOf(ctx));
     const pipeline = newPipeline(`iampolicy-${method.localName}`, deps.logger)
         .addStep(newAuthorizeStep(method, deps.authorizer))
@@ -202,7 +203,10 @@ async function grantThroughChain(deps, method, spec, ctx, validateRole) {
             pipeline.addStep(step);
         }
     }
-    await pipeline.addStep(newGrantStep(deps.grantPath)).build().execute(reqCtx);
+    await pipeline
+        .addStep(newGrantStep(deps.grantPath, cause))
+        .build()
+        .execute(reqCtx);
     return policyResultOf(reqCtx, method);
 }
 /**

package/dist/domain/iampolicy/controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,MAAM,IAAI,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAE5G,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AAapG,OAAO,EACL,gCAAgC,EAChC,+BAA+B,EAC/B,8BAA8B,EAC9B,4BAA4B,EAC5B,qBAAqB,EACrB,mCAAmC,EACnC,0BAA0B,GAC3B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sDAAsD,CAAC;AAKhG,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAM1E,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAIxE,OAAO,EACL,cAAc,EACd,YAAY,EACZ,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EACL,iCAAiC,EACjC,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EACL,+BAA+B,EAC/B,2CAA2C,EAC3C,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAGlE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,+BAA+B,EAC/B,sBAAsB,EACtB,YAAY,EACZ,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,4BAA4B,EAC5B,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,MAAM,EACN,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAwBlC,sEAAsE;AACtE,MAAM,UAAU,yBAAyB,CACvC,MAAqB,EACrB,IAA6B;IAE7B,MAAM,eAAe,GAAG,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC;IAElD,MAAM,CAAC,OAAO,CAAC,0BAA0B,EAAE;QACzC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACpD,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACpD,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC7B,cAAc,CAAC,OAAO,CAAC,eAAe,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC;QACD,uBAAuB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpC,cAAc,CAAC,OAAO,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YACvE,OAAO,uBAAuB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,eAAe,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC9B,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;QAClE,wBAAwB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACvC,cAAc,CAAC,OAAO,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YACxE,OAAO,eAAe,CACpB,IAAI,EACJ,OAAO,CAAC,wBAAwB,EAChC,KAAK,EACL,GAAG,EACH,KAAK,CACN,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE;QACvC,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,iBAAiB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACtE,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACxE,yBAAyB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxC,yBAAyB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC7C,0BAA0B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACzC,0BAA0B,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC9C,6BAA6B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC5C,6BAA6B,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,CAAC;QAClE,yBAAyB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxC,yBAAyB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC7C,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAkB,EAAE,MAAsB;IAChE,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO;IACT,CAAC;IACD,MAAM,IAAI,YAAY,CACpB,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,QAAQ,EAClD,IAAI,CAAC,gBAAgB,CACtB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,YAAY,CACnB,IAA6B,EAC7B,IAAmB,EACnB,GAAmB;IAEnB,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,iBAAiB,CACtB,IAAI,EACJ,0BAA0B,CAAC,MAAM,CAAC,MAAM,EACxC,IAAI,EACJ,GAAG,EACH,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,MAAkB,EAClB,IAAmB,EACnB,GAAmB,EACnB,YAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,mBAAmB,EACnB,IAAI,EACJ,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,CAC1B,aAAa,MAAM,CAAC,SAAS,EAAE,EAC/B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnC,IAAI,YAAY,EAAE,CAAC;QACjB,QAAQ,CAAC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAChE,QAAQ,CAAC,OAAO,CACd,+BAA+B,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CACtE,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,YAAY,CAC7B,IAAI,CAAC,SAAS,EACd,wCAAwC,CACzC,EAAE,CAAC;YACF,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7E,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,IAA6B,EAC7B,IAAmB,EACnB,GAAmB;IAEnB,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,mBAAmB,EACnB,IAAI,EACJ,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAA6B,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC;SAC3E,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CACN,+BAA+B,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CACtE;SACA,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;SAChE,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SACtC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAC5B,IAA6B,EAC7B,MAAkB,EAClB,KAA2B,EAC3B,GAAmB,EACnB,WAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,0BAA0B,EAC1B,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,CAC1B,aAAa,MAAM,CAAC,SAAS,EAAE,EAC/B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnC,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,eAAe,GAAG,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChE,QAAQ;aACL,OAAO,CAAC,+BAA+B,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;aAC1E,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,QAAQ;SACX,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SAC/C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,IAA6B,EAC7B,GAAmB,EACnB,GAAmB;IAEnB,MAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,uBAAuB,CAAC;IACzE,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,oBAAoB,EACpB,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,mCAAmC,EACnC,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SAC/C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,cAAc,CACrB,MAA4B,EAC5B,MAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,SAAS,sCAAsC,CAAC,EACpE,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,MAAmB,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,qEAAqE;AACrE,KAAK,UAAU,GAAG,CAChB,IAA6B,EAC7B,EAAe,EACf,GAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,EACtC,2BAA2B,CAC5B,CAAC;IACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,qBAAqB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;IACD,sEAAsE;IACtE,qEAAqE;IACrE,wDAAwD;IACxD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,GAAG,EACnC,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,EAAE,EACF,EAAE,YAAY,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CACzE,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,EACxC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE7D,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,CAAC,oBAAoB,EAAE;YAC7C,IAAI,EAAE,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC;YACpD,EAAE,EAAE,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,EAAE;YACzC,SAAS;YACT,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,0EAA0E;IAC1E,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,yEAAyE;IACzE,IACE,UAAU,KAAK,aAAa,CAAC,gBAAgB;QAC7C,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EACzD,CAAC;QACD,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,qEAAqE;IACrE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE;QACjE,UAAU;QACV,YAAY;QACZ,UAAU,EAAE,QAAQ,CAAC,EAAE;KACxB,CAAC,CAAC;IACH,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,KAAK,aAAa;YAChB,MAAM,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAC3D,iCAAiC,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAA6B,EAC7B,KAA8B,EAC9B,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,yBAAyB,CACtC,IAA6B,EAC7B,KAAqC,EACrC,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACrD,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,eAAe,CAC9C,SAAS,EACT,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,OAAO,MAAM,CAAC,+BAA+B,EAAE;QAC7C,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,IAA6B,EAC7B,KAAsC,EACtC,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,yBAAyB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,0BAA0B,EAC1D,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAChD,QAAQ,EACR,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,OAAO,MAAM,CAAC,gCAAgC,EAAE;QAC9C,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,IAA6B,EAC7B,eAA6D,EAC7D,KAA8B,EAC9B,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,6BAA6B,EAC7D,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,IAAI,EAAE;QACpC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CACtC,IAAI,CAAC,QAAQ,EACb,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,EACX,KAAK,CAAC,gBAAgB,CACvB,CAAC;QACF,OAAO,wBAAwB,CAC7B,IAAI,CAAC,QAAQ,EACb,eAAe,EACf,IAAI,CAAC,gBAAgB,EACrB,SAAS,CACV,CAAC;IACJ,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,mCAAmC,EAAE;QACjD,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;KACtB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,IAA6B,EAC7B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,yBAAyB,EACzD,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,IAAI,CACrB,GAAG,EAAE,CACH,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CACtC,SAAS,CAAC,IAAI,EACd,SAAS,CAAC,EAAE,EACZ,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,CACZ,EACH,gCAAgC,CACjC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI;SACf,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;SAC5C,MAAM,CAAC,gBAAgB,CAAC;SACxB,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAA6B,EAC7B,KAA8B,EAC9B,GAAmB;IAEnB,mEAAmE;IACnE,MAAM,aAAa,GACjB,KAAK,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAC/D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,yBAAyB,CAAC,aAAa,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,kBAAkB,EAClD,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,GAAG,EAAE,CACH,IAAI,CAAC,QAAQ,CAAC,iCAAiC,CAC7C,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,EAC1C,KAAK,CAAC,KAAK,EACX,aAAa,EACb,mBAAmB,EAAE,CACtB,EACH,4BAA4B,CAC7B,CAAC;IACF,OAAO,MAAM,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,sEAAsE;AACtE,SAAS,oBAAoB,CAAC,MAAsB;IAClD,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,+BAA+B,EAC/B,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,MAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,IAAI,CACxB,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAC7C,wCAAwC,CACzC,CAAC;IACF,OAAO,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAClC,IAA6B,EAC7B,MAAsB,EACtB,SAAqC;IAErC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC1E,OAAO;IACT,CAAC;IACD,IAAI,SAAS,EAAE,IAAI,KAAK,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,YAAY,CACpB,4DAA4D,EAC5D,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,SAAS,CAAC,EAAE,CAAC;IACjC,IAAI,WAAW,KAAK,EAAE,IAAI,WAAW,KAAK,iBAAiB,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CACpB,QAAQ,iBAAiB,uCAAuC;YAC9D,kDAAkD,EACpD,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,KAAK,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CACpB,4CAA4C,EAC5C,IAAI,CAAC,gBAAgB,CACtB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,kBAAkB,CACzB,IAA6B;IAE7B,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CACpB,2CAA2C,EAC3C,IAAI,CAAC,aAAa,CACnB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,GAA+B;IACjD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,sDAAsD,CAAC,EACjE,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,MAAiC;IAC3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,mDAAmD,CAAC,EAC9D,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2FAA2F;AAC3F,SAAS,SAAS,CAAC,MAAiB;IAClC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,UAAU,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,GAAG,4BAA4B,CACjE,EACD,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,mGAAmG;AACnG,KAAK,UAAU,IAAI,CACjB,SAA2B,EAC3B,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,MAAM,IAAI,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAE5G,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AAapG,OAAO,EACL,gCAAgC,EAChC,+BAA+B,EAC/B,8BAA8B,EAC9B,4BAA4B,EAC5B,qBAAqB,EACrB,mCAAmC,EACnC,0BAA0B,GAC3B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sDAAsD,CAAC;AAKhG,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAM1E,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAIxE,OAAO,EACL,cAAc,EACd,YAAY,EACZ,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EACL,iCAAiC,EACjC,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EACL,+BAA+B,EAC/B,2CAA2C,EAC3C,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAGlE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,+BAA+B,EAC/B,sBAAsB,EACtB,YAAY,EACZ,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,4BAA4B,EAC5B,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,MAAM,EACN,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAwBlC,sEAAsE;AACtE,MAAM,UAAU,yBAAyB,CACvC,MAAqB,EACrB,IAA6B;IAE7B,MAAM,eAAe,GAAG,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC;IAElD,MAAM,CAAC,OAAO,CAAC,0BAA0B,EAAE;QACzC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACpD,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACpD,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC7B,cAAc,CAAC,OAAO,CAAC,eAAe,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,iBAAiB,CACtB,IAAI,EACJ,OAAO,CAAC,eAAe,EACvB,IAAI,EACJ,GAAG,EACH,KAAK,EACL,YAAY,CACb,CAAC;QACJ,CAAC;QACD,uBAAuB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpC,cAAc,CAAC,OAAO,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YACvE,OAAO,uBAAuB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,eAAe,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC9B,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;QAClE,wBAAwB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACvC,cAAc,CAAC,OAAO,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YACxE,OAAO,eAAe,CACpB,IAAI,EACJ,OAAO,CAAC,wBAAwB,EAChC,KAAK,EACL,GAAG,EACH,KAAK,CACN,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE;QACvC,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,iBAAiB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACtE,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACxE,yBAAyB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxC,yBAAyB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC7C,0BAA0B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACzC,0BAA0B,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC9C,6BAA6B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC5C,6BAA6B,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,CAAC;QAClE,yBAAyB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxC,yBAAyB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC7C,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAkB,EAAE,MAAsB;IAChE,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO;IACT,CAAC;IACD,MAAM,IAAI,YAAY,CACpB,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,QAAQ,EAClD,IAAI,CAAC,gBAAgB,CACtB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,YAAY,CACnB,IAA6B,EAC7B,IAAmB,EACnB,GAAmB;IAEnB,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,iBAAiB,CACtB,IAAI,EACJ,0BAA0B,CAAC,MAAM,CAAC,MAAM,EACxC,IAAI,EACJ,GAAG,EACH,IAAI,EACJ,OAAO,CACR,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,MAAkB,EAClB,IAAmB,EACnB,GAAmB,EACnB,YAAqB,EACrB,KAAwB;IAExB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,mBAAmB,EACnB,IAAI,EACJ,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,CAC1B,aAAa,MAAM,CAAC,SAAS,EAAE,EAC/B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnC,IAAI,YAAY,EAAE,CAAC;QACjB,QAAQ,CAAC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAChE,QAAQ,CAAC,OAAO,CACd,+BAA+B,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CACtE,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,YAAY,CAC7B,IAAI,CAAC,SAAS,EACd,wCAAwC,CACzC,EAAE,CAAC;YACF,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ;SACX,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;SAC5C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,IAA6B,EAC7B,IAAmB,EACnB,GAAmB;IAEnB,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,mBAAmB,EACnB,IAAI,EACJ,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAA6B,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC;SAC3E,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CACN,+BAA+B,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CACtE;SACA,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;SAChE,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SACtC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAC5B,IAA6B,EAC7B,MAAkB,EAClB,KAA2B,EAC3B,GAAmB,EACnB,WAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,0BAA0B,EAC1B,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,CAC1B,aAAa,MAAM,CAAC,SAAS,EAAE,EAC/B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnC,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,eAAe,GAAG,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChE,QAAQ;aACL,OAAO,CAAC,+BAA+B,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;aAC1E,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,QAAQ;SACX,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SAC/C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,IAA6B,EAC7B,GAAmB,EACnB,GAAmB;IAEnB,MAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,uBAAuB,CAAC;IACzE,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,oBAAoB,EACpB,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,mCAAmC,EACnC,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SAC/C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,cAAc,CACrB,MAA4B,EAC5B,MAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,SAAS,sCAAsC,CAAC,EACpE,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,MAAmB,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,qEAAqE;AACrE,KAAK,UAAU,GAAG,CAChB,IAA6B,EAC7B,EAAe,EACf,GAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,EACtC,2BAA2B,CAC5B,CAAC;IACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,qBAAqB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;IACD,sEAAsE;IACtE,qEAAqE;IACrE,wDAAwD;IACxD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,GAAG,EACnC,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,EAAE,EACF,EAAE,YAAY,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CACzE,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,EACxC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE7D,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,CAAC,oBAAoB,EAAE;YAC7C,IAAI,EAAE,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC;YACpD,EAAE,EAAE,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,EAAE;YACzC,SAAS;YACT,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,0EAA0E;IAC1E,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,yEAAyE;IACzE,IACE,UAAU,KAAK,aAAa,CAAC,gBAAgB;QAC7C,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EACzD,CAAC;QACD,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,qEAAqE;IACrE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE;QACjE,UAAU;QACV,YAAY;QACZ,UAAU,EAAE,QAAQ,CAAC,EAAE;KACxB,CAAC,CAAC;IACH,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,KAAK,aAAa;YAChB,MAAM,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAC3D,iCAAiC,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAA6B,EAC7B,KAA8B,EAC9B,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,yBAAyB,CACtC,IAA6B,EAC7B,KAAqC,EACrC,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACrD,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,eAAe,CAC9C,SAAS,EACT,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,OAAO,MAAM,CAAC,+BAA+B,EAAE;QAC7C,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,IAA6B,EAC7B,KAAsC,EACtC,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,yBAAyB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,0BAA0B,EAC1D,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAChD,QAAQ,EACR,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,OAAO,MAAM,CAAC,gCAAgC,EAAE;QAC9C,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,IAA6B,EAC7B,eAA6D,EAC7D,KAA8B,EAC9B,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,6BAA6B,EAC7D,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,IAAI,EAAE;QACpC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CACtC,IAAI,CAAC,QAAQ,EACb,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,EACX,KAAK,CAAC,gBAAgB,CACvB,CAAC;QACF,OAAO,wBAAwB,CAC7B,IAAI,CAAC,QAAQ,EACb,eAAe,EACf,IAAI,CAAC,gBAAgB,EACrB,SAAS,CACV,CAAC;IACJ,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,mCAAmC,EAAE;QACjD,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;KACtB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,IAA6B,EAC7B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,yBAAyB,EACzD,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,IAAI,CACrB,GAAG,EAAE,CACH,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CACtC,SAAS,CAAC,IAAI,EACd,SAAS,CAAC,EAAE,EACZ,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,CACZ,EACH,gCAAgC,CACjC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI;SACf,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;SAC5C,MAAM,CAAC,gBAAgB,CAAC;SACxB,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAA6B,EAC7B,KAA8B,EAC9B,GAAmB;IAEnB,mEAAmE;IACnE,MAAM,aAAa,GACjB,KAAK,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAC/D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,yBAAyB,CAAC,aAAa,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,kBAAkB,EAClD,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,GAAG,EAAE,CACH,IAAI,CAAC,QAAQ,CAAC,iCAAiC,CAC7C,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,EAC1C,KAAK,CAAC,KAAK,EACX,aAAa,EACb,mBAAmB,EAAE,CACtB,EACH,4BAA4B,CAC7B,CAAC;IACF,OAAO,MAAM,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,sEAAsE;AACtE,SAAS,oBAAoB,CAAC,MAAsB;IAClD,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,+BAA+B,EAC/B,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,MAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,IAAI,CACxB,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAC7C,wCAAwC,CACzC,CAAC;IACF,OAAO,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAClC,IAA6B,EAC7B,MAAsB,EACtB,SAAqC;IAErC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC1E,OAAO;IACT,CAAC;IACD,IAAI,SAAS,EAAE,IAAI,KAAK,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,YAAY,CACpB,4DAA4D,EAC5D,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,SAAS,CAAC,EAAE,CAAC;IACjC,IAAI,WAAW,KAAK,EAAE,IAAI,WAAW,KAAK,iBAAiB,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CACpB,QAAQ,iBAAiB,uCAAuC;YAC9D,kDAAkD,EACpD,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,KAAK,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CACpB,4CAA4C,EAC5C,IAAI,CAAC,gBAAgB,CACtB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,kBAAkB,CACzB,IAA6B;IAE7B,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CACpB,2CAA2C,EAC3C,IAAI,CAAC,aAAa,CACnB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,GAA+B;IACjD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,sDAAsD,CAAC,EACjE,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,MAAiC;IAC3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,mDAAmD,CAAC,EAC9D,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2FAA2F;AAC3F,SAAS,SAAS,CAAC,MAAiB;IAClC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,UAAU,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,GAAG,4BAA4B,CACjE,EACD,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,mGAAmG;AACnG,KAAK,UAAU,IAAI,CACjB,SAA2B,EAC3B,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}

package/dist/domain/iampolicy/grant-path.d.ts

@@ -3,6 +3,7 @@ import type { ApiResourceRef, IamPolicySpec } from "@stigmer/protos/ai/stigmer/i
 import type { Logger } from "../../boot/logger.js";
 import type { CallerIdentity } from "../../extensions/identity.js";
 import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
+import type { PolicyChangeCause } from "./change.js";
 import type { IamPolicyStore } from "./store.js";
 export interface GrantResult {
     readonly policy: IamPolicy;
@@ -11,18 +12,19 @@ export interface GrantResult {
 }
 export interface IamPolicyGrantPath {
     /**
-     * Grant the triple as `caller`: gate, find by triple, write the row when
-     * absent (the caller's audit stamp), then `onPolicyGranted` — on the
-     * duplicate arm too. A hook throw fails the grant with the row in place.
+     * Grant the triple as `caller`, through the door `cause` names: gate,
+     * find by triple, write the row when absent (the caller's audit stamp),
+     * then `onPolicyGranted` — on the duplicate arm too. A hook throw fails
+     * the grant with the row in place.
      */
-    grant(spec: IamPolicySpec, caller: CallerIdentity): Promise<GrantResult>;
+    grant(spec: IamPolicySpec, caller: CallerIdentity, cause: PolicyChangeCause): Promise<GrantResult>;
     /**
-     * Revoke the triple: gate, find by triple, `onPolicyRevoked` (with the
-     * row, or with the spec alone on the absent arm), then delete the row.
-     * A hook throw leaves row and tuple. Answers the revoked row, or
-     * `undefined` when there was none.
+     * Revoke the triple as `caller` (IamPolicy.delete's door): gate, find by
+     * triple, `onPolicyRevoked` (with the row, or with the spec alone on the
+     * absent arm), then delete the row. A hook throw leaves row and tuple.
+     * Answers the revoked row, or `undefined` when there was none.
      */
-    revokeBySpec(spec: IamPolicySpec): Promise<IamPolicy | undefined>;
+    revokeBySpec(spec: IamPolicySpec, caller: CallerIdentity): Promise<IamPolicy | undefined>;
     /**
      * Revoke every row naming the ref as its principal, then every row naming
      * it as its resource with the `owner` rows last, each through the revoke
@@ -30,14 +32,30 @@ export interface IamPolicyGrantPath {
      * The order matters where the ref still exists: an organization's delete
      * runs this before its row goes and fails on the first fault, so a
      * cleanup that stops partway has not yet removed the owners who may
-     * retry it.
+     * retry it. `caller` is whoever deleted the resource.
      */
-    cleanupResource(ref: ApiResourceRef): Promise<void>;
-    /** Revoke every relation the account holds directly on the organization. */
-    revokeOrgAccess(identityAccountId: string, organizationId: string): Promise<void>;
+    cleanupResource(ref: ApiResourceRef, caller: CallerIdentity): Promise<void>;
+    /**
+     * Revoke every relation the account holds directly on the organization,
+     * then every row it holds on the organization's resources except its
+     * authorship (the module header's sweep), as `caller`.
+     */
+    revokeOrgAccess(identityAccountId: string, organizationId: string, caller: CallerIdentity): Promise<void>;
+}
+/**
+ * The recorded creator of a stored resource, the one fact the removal
+ * sweep needs from outside the policy rows.
+ */
+export interface ResourceCreators {
+    /**
+     * The row's `status.audit.spec_audit.created_by.id`, or undefined when
+     * this server stores no row of that kind and id.
+     */
+    creatorOf(kind: string, id: string): Promise<string | undefined>;
 }
 export interface IamPolicyGrantPathDeps {
     readonly policies: IamPolicyStore;
+    readonly creators: ResourceCreators;
     /** The composed driver, if any; a driver without the two policy hooks is the same as none. */
     readonly lifecycle: ResourceAuthorizationLifecycle | undefined;
     readonly logger: Logger;

package/dist/domain/iampolicy/grant-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-path.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/grant-path.ts"],"names":[],"mappings":"AA2DA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oDAAoD,CAAC;AAGpF,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACd,MAAM,qDAAqD,CAAC;AAE7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AASjG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAMjD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,uFAAuF;IACvF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACzE;;;;;OAKG;IACH,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IAClE;;;;;;;;OAQG;IACH,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,4EAA4E;IAC5E,eAAe,CACb,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,8FAA8F;IAC9F,QAAQ,CAAC,SAAS,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,sBAAsB,GAC3B,kBAAkB,CAkHpB"}
+{"version":3,"file":"grant-path.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/grant-path.ts"],"names":[],"mappings":"AA0GA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oDAAoD,CAAC;AAGpF,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACd,MAAM,qDAAqD,CAAC;AAE7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAEV,8BAA8B,EAC/B,MAAM,4CAA4C,CAAC;AAWpD,OAAO,KAAK,EAEV,iBAAiB,EAElB,MAAM,aAAa,CAAC;AAErB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA6CjD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,uFAAuF;IACvF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,KAAK,CACH,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,WAAW,CAAC,CAAC;IACxB;;;;;OAKG;IACH,YAAY,CACV,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IAClC;;;;;;;;OAQG;IACH,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E;;;;OAIG;IACH,eAAe,CACb,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,8FAA8F;IAC9F,QAAQ,CAAC,SAAS,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAWD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,sBAAsB,GAC3B,kBAAkB,CAgSpB"}

package/dist/domain/iampolicy/grant-path.js

@@ -46,6 +46,52 @@
  * `cleanupResource` and `revokeOrgAccess` take refs and ids their callers
  * read from rows, so they do not refuse.
  *
+ * Leaving an organization. The model bounds every direct grant on an
+ * organization-scoped object by the organization (`[identity_account]
+ * and affiliated from organization`, fga/model/tenancy/organization.fga),
+ * so a person with no role left in an organization reaches nothing in it
+ * on the next check. This path keeps the ROWS truthful to that: when a
+ * revoke leaves an account with no row on an organization, it revokes the
+ * rows the account holds on that organization's resources (a share, a
+ * team membership, an owner granted by someone else), each through the
+ * revoke order, so a departed person is listed nowhere and a return does
+ * not bring the shares back. It keeps AUTHORSHIP: an `owner` or `creator`
+ * row whose principal is the resource's recorded creator, exactly the
+ * tuple open source derives from the creator stamp instead of storing it
+ * (authorization/derived-tuples.ts), so both editions keep the same fact
+ * and the model's bound governs it in both. `revokeOrgAccess` always
+ * sweeps, so a retry after a crash mid-sweep converges; `revokeBySpec`
+ * sweeps when the row it revoked was the account's last on that
+ * organization; `cleanupResource` never sweeps (an organization's or an
+ * account's delete, where the bound already leaves every row inert and a
+ * sweep per member would add failure points to a delete that stops on
+ * the first fault). A resource's organization is read from the scope
+ * links the rows hold (`resolveHierarchy`); open source writes none and
+ * grants nothing below the organization (grant-scope.ts), so there the
+ * sweep finds nothing to do.
+ *
+ * Affiliation. The model's bound reads `organization#affiliated`, a stored
+ * relation that stands exactly while the person holds a row on the
+ * organization. This path is the one writer of those rows, so it announces
+ * every change of them through the lifecycle and never decides the answer
+ * itself: `onOrganizationAffiliationChanging` before a row naming an
+ * account on an organization is deleted (the driver removes the tuple
+ * first, fail-closed), `onOrganizationAffiliationChanged` after such a row
+ * is written or deleted (the driver re-derives the tuple from the committed
+ * rows). `affiliated` itself is refused as a grant on every lane; it is
+ * derived, never granted.
+ *
+ * Who and why. Every method takes the caller, and the grants take the door
+ * they came through (change.ts `PolicyChangeCause`); the revokes know
+ * theirs. For every access row it writes or deletes, the path hands the
+ * store a change record (the actor, the cause, the row's organization), so
+ * an edition that keeps a permission history writes it in the same atomic
+ * unit as the row (store.ts). The organization is resolved before any row
+ * of the operation is deleted: `cleanupResource` removes a resource's
+ * scope link before its owner rows, and the sweep already knows its
+ * organization. The grant and revoke log lines carry the same facts, open
+ * source's own trail.
+ *
  * The row this path builds: the proto's apiVersion const and kind, the
  * derived id, the spec as given, and the caller's audit stamp through the
  * platform's one stamper (setAuditFieldsForCreate) — the cloud's
@@ -54,19 +100,72 @@
  * span organizations and none owns it.
  */
 import { create } from "@bufbuild/protobuf";
+import { Code, ConnectError } from "@connectrpc/connect";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
 import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
 import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import { kindEnumName } from "../../pipeline/apiresource-meta.js";
 import { setAuditFieldsForCreate } from "../../pipeline/steps/defaults.js";
-import { IAM_POLICY_API_VERSION, IAM_POLICY_KIND, policyIdFor, } from "./constants.js";
+import { AFFILIATION_NOT_GRANTABLE_MESSAGE, IAM_POLICY_API_VERSION, IAM_POLICY_KIND, policyIdFor, } from "./constants.js";
+import { resolveHierarchy } from "./access-lists.js";
+import { grantsAccess, policyActorOf } from "./change.js";
 import { DuplicatePolicyError } from "./store.js";
 import { refsOf, requireWellFormedTriple } from "./wire-refusals.js";
 /** The relation `cleanupResource` revokes last on the ref's own rows. */
 const OWNER_RELATION = IamRole[IamRole.owner];
+const ACCOUNT_KIND = kindEnumName(ApiResourceKind.identity_account);
+const ORGANIZATION_KIND = kindEnumName(ApiResourceKind.organization);
+/** The organization relation derived from a person's roles (fga/model/tenancy/organization.fga). */
+const AFFILIATED_RELATION = "affiliated";
+/**
+ * The (account, organization) pair a row's affiliation hangs on, or
+ * undefined when the row is not a person's row on an organization (a
+ * structural link, a userset principal, a row on any other kind).
+ */
+function affiliationOf(spec) {
+    const principal = spec.principal;
+    const resource = spec.resource;
+    if (principal === undefined ||
+        resource === undefined ||
+        principal.kind !== ACCOUNT_KIND ||
+        principal.relation !== "" ||
+        resource.kind !== ORGANIZATION_KIND) {
+        return undefined;
+    }
+    return { identityAccountId: principal.id, organizationId: resource.id };
+}
+/**
+ * The relations a resource's creation records for its creator: `owner`
+ * on a kind whose owner is its creator, `creator` on a kind that also
+ * records one (the proto's `requires_creator_tuple`). The removal sweep
+ * keeps these when they name the resource's recorded creator.
+ */
+const AUTHORSHIP_RELATIONS = new Set([
+    OWNER_RELATION,
+    "creator",
+]);
 export function newIamPolicyGrantPath(deps) {
-    const { policies, lifecycle, logger } = deps;
+    const { policies, creators, lifecycle, logger } = deps;
+    /** The organization a resource belongs to, through its scope links; "" when it names none. */
+    async function organizationByScope(resource) {
+        if (resource.kind === ORGANIZATION_KIND) {
+            return resource.id;
+        }
+        const hierarchy = await resolveHierarchy(policies, resource.kind, resource.id, true);
+        return (hierarchy.find((level) => level.kind === ORGANIZATION_KIND)?.id ?? "");
+    }
+    /** The record the store keeps beside an access row; none for a structural link. */
+    async function recordFor(spec, change, organizationOf) {
+        if (spec.resource === undefined || !grantsAccess(spec)) {
+            return undefined;
+        }
+        return {
+            actor: change.actor,
+            cause: change.cause,
+            organizationId: await organizationOf(spec.resource),
+        };
+    }
     /** The row holding this exact triple — the pair's rows, filtered by relation. */
     async function findByTriple(spec) {
         const { principal, resource } = refsOf(spec);
@@ -75,28 +174,85 @@ export function newIamPolicyGrantPath(deps) {
             policy.spec.relation === spec.relation &&
             policy.spec.principal?.relation === principal.relation);
     }
-    /** The revoke order for one row: the hook, then the delete. */
-    async function revokeRow(policy) {
+    /** The revoke order for one row: its record resolved, the hook, then the delete. */
+    async function revokeRow(policy, change, organizationOf = organizationByScope) {
         const spec = policy.spec;
         if (spec === undefined) {
             throw new Error(`policy ${policy.metadata?.id ?? "?"} has no spec — corrupt row`);
         }
+        const record = await recordFor(spec, change, organizationOf);
+        const affiliation = affiliationOf(spec);
+        if (affiliation !== undefined) {
+            await lifecycle?.onOrganizationAffiliationChanging?.(affiliation);
+        }
         await lifecycle?.onPolicyRevoked?.({ spec, policy });
         const id = policy.metadata?.id ?? "";
-        await policies.deleteById(id);
-        logger.info("iam policy revoked", fieldsOf(id, spec));
+        await policies.deleteById(id, record);
+        logger.info("iam policy revoked", fieldsOf(id, spec, change, record));
+        if (affiliation !== undefined) {
+            await lifecycle?.onOrganizationAffiliationChanged?.(affiliation);
+        }
+    }
+    /** Whether the account still holds any row on the organization. */
+    async function holdsOrganizationRow(accountId, organizationId) {
+        const held = await policies.findByPrincipal(ACCOUNT_KIND, accountId);
+        return held.some((policy) => policy.spec?.resource?.kind === ORGANIZATION_KIND &&
+            policy.spec.resource.id === organizationId);
+    }
+    /** Whether the row records the resource's creator as its author. */
+    async function isAuthorship(policy, accountId) {
+        const spec = policy.spec;
+        if (spec?.resource === undefined ||
+            !AUTHORSHIP_RELATIONS.has(spec.relation)) {
+            return false;
+        }
+        const creator = await creators.creatorOf(spec.resource.kind, spec.resource.id);
+        return creator === accountId;
+    }
+    /** Revoke what the account holds on the organization's resources, authorship kept. */
+    async function sweepOrganization(accountId, organizationId, actor) {
+        const change = { actor, cause: "left_organization" };
+        const inThisOrganization = async () => organizationId;
+        const held = await policies.findByPrincipal(ACCOUNT_KIND, accountId);
+        let revoked = 0;
+        for (const policy of held) {
+            const resource = policy.spec?.resource;
+            if (resource === undefined || resource.kind === ORGANIZATION_KIND) {
+                continue;
+            }
+            const hierarchy = await resolveHierarchy(policies, resource.kind, resource.id, true);
+            const inOrganization = hierarchy.some((level) => level.kind === ORGANIZATION_KIND && level.id === organizationId);
+            if (!inOrganization || (await isAuthorship(policy, accountId))) {
+                continue;
+            }
+            await revokeRow(policy, change, inThisOrganization);
+            revoked++;
+        }
+        if (revoked > 0) {
+            logger.info("iam policy organization access swept", {
+                identityAccountId: accountId,
+                organizationId,
+                revoked: String(revoked),
+            });
+        }
     }
     return {
-        async grant(spec, caller) {
+        async grant(spec, caller, cause) {
             requireWellFormedTriple(spec);
+            const change = { actor: policyActorOf(caller), cause };
+            if (spec.relation === AFFILIATED_RELATION &&
+                spec.resource?.kind === ORGANIZATION_KIND) {
+                throw new ConnectError(AFFILIATION_NOT_GRANTABLE_MESSAGE, Code.InvalidArgument);
+            }
             let policy = await findByTriple(spec);
             let duplicate = policy !== undefined;
             if (policy === undefined) {
                 const fresh = buildRow(spec, caller);
+                const record = await recordFor(spec, change, organizationByScope);
                 try {
-                    await policies.save(fresh);
+                    await policies.save(fresh, record);
                     policy = fresh;
-                    logger.info("iam policy granted", fieldsOf(policyIdFor(spec), spec));
+                    logger.info("iam policy granted", fieldsOf(policyIdFor(spec), spec, change, record));
                 }
                 catch (error) {
                     if (!(error instanceof DuplicatePolicyError)) {
@@ -115,42 +271,76 @@ export function newIamPolicyGrantPath(deps) {
                 }
             }
             if (duplicate) {
-                logger.debug("iam policy already held", fieldsOf(policy.metadata?.id ?? "", spec));
+                logger.debug("iam policy already held", fieldsOf(policy.metadata?.id ?? "", spec, change, undefined));
             }
             // Deliberately unconditional (cloud#425): a duplicate re-grant is the
             // inline heal for a row whose tuple never landed.
             await lifecycle?.onPolicyGranted?.({ policy, duplicate });
+            // The same unconditional heal for the affiliation the row stands for.
+            const affiliation = affiliationOf(spec);
+            if (affiliation !== undefined) {
+                await lifecycle?.onOrganizationAffiliationChanged?.(affiliation);
+            }
             return { policy, duplicate };
         },
-        async revokeBySpec(spec) {
+        async revokeBySpec(spec, caller) {
             requireWellFormedTriple(spec);
+            const actor = policyActorOf(caller);
             const existing = await findByTriple(spec);
             if (existing === undefined) {
                 // No row: a composition still deletes the bare tuple (one written
                 // before the row mirror existed); converges the store either way.
                 await lifecycle?.onPolicyRevoked?.({ spec, policy: undefined });
-                return undefined;
+                const affiliation = affiliationOf(spec);
+                if (affiliation !== undefined) {
+                    // Nothing was deleted; re-deriving from the rows heals a tuple
+                    // that outlived them.
+                    await lifecycle?.onOrganizationAffiliationChanged?.(affiliation);
+                }
+            }
+            else {
+                await revokeRow(existing, { actor, cause: "revoke" });
+            }
+            const { principal, resource } = refsOf(spec);
+            if (principal.kind === ACCOUNT_KIND &&
+                resource.kind === ORGANIZATION_KIND &&
+                !(await holdsOrganizationRow(principal.id, resource.id))) {
+                await sweepOrganization(principal.id, resource.id, actor);
             }
-            await revokeRow(existing);
             return existing;
         },
-        async cleanupResource(ref) {
+        async cleanupResource(ref, caller) {
+            const change = {
+                actor: policyActorOf(caller),
+                cause: "resource_deleted",
+            };
             const asPrincipal = await policies.findByPrincipal(ref.kind, ref.id);
             const asResource = await policies.findByResource(ref.kind, ref.id);
+            // The ref's own scope link is one of its resource-side rows and goes
+            // before its owners, so its organization is read once, up front.
+            const refOrganization = asResource.some((policy) => policy.spec !== undefined && grantsAccess(policy.spec))
+                ? await organizationByScope(ref)
+                : "";
+            const organizationOf = async (resource) => resource.kind === ref.kind && resource.id === ref.id
+                ? refOrganization
+                : organizationByScope(resource);
             const isOwner = (policy) => policy.spec?.relation === OWNER_RELATION;
             for (const policy of distinctById([
                 ...asPrincipal,
                 ...asResource.filter((policy) => !isOwner(policy)),
                 ...asResource.filter(isOwner),
             ])) {
-                await revokeRow(policy);
+                await revokeRow(policy, change, organizationOf);
             }
         },
-        async revokeOrgAccess(identityAccountId, organizationId) {
+        async revokeOrgAccess(identityAccountId, organizationId, caller) {
+            const actor = policyActorOf(caller);
+            const change = { actor, cause: "organization_access_revoked" };
             const direct = await policies.findByPrincipalAndResource(kindEnumName(ApiResourceKind.identity_account), identityAccountId, kindEnumName(ApiResourceKind.organization), organizationId);
             for (const policy of direct) {
-                await revokeRow(policy);
+                await revokeRow(policy, change);
             }
+            await sweepOrganization(identityAccountId, organizationId, actor);
         },
     };
 }
@@ -177,8 +367,11 @@ function distinctById(policies) {
         return true;
     });
 }
-/** The structured fields every log line carries — ids and kinds, never a token. */
-function fieldsOf(id, spec) {
+/**
+ * The structured fields every log line carries — ids, kinds, who and why,
+ * never a token; the organization when the row is an access row.
+ */
+function fieldsOf(id, spec, change, record) {
     return {
         policyId: id,
         relation: spec.relation,
@@ -186,6 +379,10 @@ function fieldsOf(id, spec) {
         principalId: spec.principal?.id ?? "",
         resourceKind: spec.resource?.kind ?? "",
         resourceId: spec.resource?.id ?? "",
+        actorId: change.actor.id,
+        actorClass: change.actor.callerClass,
+        cause: change.cause,
+        ...(record === undefined ? {} : { organizationId: record.organizationId }),
     };
 }
 //# sourceMappingURL=grant-path.js.map

package/dist/domain/iampolicy/grant-path.js.map

@@ -1 +1 @@
-{"version":3,"file":"grant-path.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/grant-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,yBAAyB,EAAE,MAAM,4DAA4D,CAAC;AAEvG,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AASpE,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAErE,yEAAyE;AACzE,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AA8C9C,MAAM,UAAU,qBAAqB,CACnC,IAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAE7C,iFAAiF;IACjF,KAAK,UAAU,YAAY,CACzB,IAAmB;QAEnB,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,0BAA0B,CACtD,SAAS,CAAC,IAAI,EACd,SAAS,CAAC,EAAE,EACZ,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,CACZ,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,IAAI,KAAK,SAAS;YACzB,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YACtC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,KAAK,SAAS,CAAC,QAAQ,CACzD,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,KAAK,UAAU,SAAS,CAAC,MAAiB;QACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,UAAU,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,GAAG,4BAA4B,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,EAAE,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QACrC,MAAM,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM;YACtB,uBAAuB,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC;YACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAC3B,MAAM,GAAG,KAAK,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBACvE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,CAAC,KAAK,YAAY,oBAAoB,CAAC,EAAE,CAAC;wBAC7C,MAAM,KAAK,CAAC;oBACd,CAAC;oBACD,0DAA0D;oBAC1D,6DAA6D;oBAC7D,6DAA6D;oBAC7D,iCAAiC;oBACjC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;oBACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;wBACzB,MAAM,KAAK,CAAC;oBACd,CAAC;oBACD,MAAM,GAAG,MAAM,CAAC;oBAChB,SAAS,GAAG,IAAI,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,CAAC,KAAK,CACV,yBAAyB,EACzB,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAC1C,CAAC;YACJ,CAAC;YACD,sEAAsE;YACtE,kDAAkD;YAClD,MAAM,SAAS,EAAE,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,IAAI;YACrB,uBAAuB,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,kEAAkE;gBAClE,kEAAkE;gBAClE,MAAM,SAAS,EAAE,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAChE,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC1B,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,GAAG;YACvB,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACrE,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACnE,MAAM,OAAO,GAAG,CAAC,MAAiB,EAAW,EAAE,CAC7C,MAAM,CAAC,IAAI,EAAE,QAAQ,KAAK,cAAc,CAAC;YAC3C,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC;gBAChC,GAAG,WAAW;gBACd,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClD,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;aAC9B,CAAC,EAAE,CAAC;gBACH,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,iBAAiB,EAAE,cAAc;YACrD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,0BAA0B,CACtD,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAC9C,iBAAiB,EACjB,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,EAC1C,cAAc,CACf,CAAC;YACF,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;gBAC5B,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,SAAS,QAAQ,CAAC,IAAmB,EAAE,MAAsB;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,EAAE;QACrC,UAAU,EAAE,sBAAsB;QAClC,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,MAAM,CAAC,yBAAyB,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,IAAI;KACL,CAAC,CAAC;IACH,uBAAuB,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6CAA6C;AAC7C,SAAS,YAAY,CACnB,QAAkC;IAElC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;QAChC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mFAAmF;AACnF,SAAS,QAAQ,CAAC,EAAU,EAAE,IAAmB;IAC/C,OAAO;QACL,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE;QACzC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE;QACrC,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE;QACvC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;KACpC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"grant-path.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/grant-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoGG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,yBAAyB,EAAE,MAAM,4DAA4D,CAAC;AAEvG,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAYpE,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EACL,iCAAiC,EACjC,sBAAsB,EACtB,eAAe,EACf,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAM1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAErE,yEAAyE;AACzE,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAE9C,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;AACpE,MAAM,iBAAiB,GAAG,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;AAErE,oGAAoG;AACpG,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAEzC;;;;GAIG;AACH,SAAS,aAAa,CACpB,IAAmB;IAEnB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,IACE,SAAS,KAAK,SAAS;QACvB,QAAQ,KAAK,SAAS;QACtB,SAAS,CAAC,IAAI,KAAK,YAAY;QAC/B,SAAS,CAAC,QAAQ,KAAK,EAAE;QACzB,QAAQ,CAAC,IAAI,KAAK,iBAAiB,EACnC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,iBAAiB,EAAE,SAAS,CAAC,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IACxD,cAAc;IACd,SAAS;CACV,CAAC,CAAC;AAiFH,MAAM,UAAU,qBAAqB,CACnC,IAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEvD,8FAA8F;IAC9F,KAAK,UAAU,mBAAmB,CAChC,QAAwB;QAExB,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACxC,OAAO,QAAQ,CAAC,EAAE,CAAC;QACrB,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CACtC,QAAQ,EACR,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,EACX,IAAI,CACL,CAAC;QACF,OAAO,CACL,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB,CAAC,EAAE,EAAE,IAAI,EAAE,CACtE,CAAC;IACJ,CAAC;IAED,mFAAmF;IACnF,KAAK,UAAU,SAAS,CACtB,IAAmB,EACnB,MAAc,EACd,cAA8B;QAE9B,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,cAAc,EAAE,MAAM,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,KAAK,UAAU,YAAY,CACzB,IAAmB;QAEnB,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,0BAA0B,CACtD,SAAS,CAAC,IAAI,EACd,SAAS,CAAC,EAAE,EACZ,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,CACZ,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,IAAI,KAAK,SAAS;YACzB,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YACtC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,KAAK,SAAS,CAAC,QAAQ,CACzD,CAAC;IACJ,CAAC;IAED,oFAAoF;IACpF,KAAK,UAAU,SAAS,CACtB,MAAiB,EACjB,MAAc,EACd,iBAAiC,mBAAmB;QAEpD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,UAAU,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,GAAG,4BAA4B,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,SAAS,EAAE,iCAAiC,EAAE,CAAC,WAAW,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,SAAS,EAAE,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QACrC,MAAM,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACtE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,SAAS,EAAE,gCAAgC,EAAE,CAAC,WAAW,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,KAAK,UAAU,oBAAoB,CACjC,SAAiB,EACjB,cAAsB;QAEtB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,IAAI,CACd,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,iBAAiB;YACjD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,cAAc,CAC7C,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,KAAK,UAAU,YAAY,CACzB,MAAiB,EACjB,SAAiB;QAEjB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IACE,IAAI,EAAE,QAAQ,KAAK,SAAS;YAC5B,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EACxC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,CACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAClB,IAAI,CAAC,QAAQ,CAAC,EAAE,CACjB,CAAC;QACF,OAAO,OAAO,KAAK,SAAS,CAAC;IAC/B,CAAC;IAED,sFAAsF;IACtF,KAAK,UAAU,iBAAiB,CAC9B,SAAiB,EACjB,cAAsB,EACtB,KAAkB;QAElB,MAAM,MAAM,GAAW,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QAC7D,MAAM,kBAAkB,GAAmB,KAAK,IAAI,EAAE,CAAC,cAAc,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACrE,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC;YACvC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBAClE,SAAS;YACX,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CACtC,QAAQ,EACR,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,EACX,IAAI,CACL,CAAC;YACF,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CACnC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,IAAI,KAAK,iBAAiB,IAAI,KAAK,CAAC,EAAE,KAAK,cAAc,CAClE,CAAC;YACF,IAAI,CAAC,cAAc,IAAI,CAAC,MAAM,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;gBAC/D,SAAS;YACX,CAAC;YACD,MAAM,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;YACpD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE;gBAClD,iBAAiB,EAAE,SAAS;gBAC5B,cAAc;gBACd,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK;YAC7B,uBAAuB,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,MAAM,GAAW,EAAE,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;YAC/D,IACE,IAAI,CAAC,QAAQ,KAAK,mBAAmB;gBACrC,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,iBAAiB,EACzC,CAAC;gBACD,MAAM,IAAI,YAAY,CACpB,iCAAiC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC;YACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACrC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAC;gBAClE,IAAI,CAAC;oBACH,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;oBACnC,MAAM,GAAG,KAAK,CAAC;oBACf,MAAM,CAAC,IAAI,CACT,oBAAoB,EACpB,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAClD,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,CAAC,KAAK,YAAY,oBAAoB,CAAC,EAAE,CAAC;wBAC7C,MAAM,KAAK,CAAC;oBACd,CAAC;oBACD,0DAA0D;oBAC1D,6DAA6D;oBAC7D,6DAA6D;oBAC7D,iCAAiC;oBACjC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;oBACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;wBACzB,MAAM,KAAK,CAAC;oBACd,CAAC;oBACD,MAAM,GAAG,MAAM,CAAC;oBAChB,SAAS,GAAG,IAAI,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,CAAC,KAAK,CACV,yBAAyB,EACzB,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAC7D,CAAC;YACJ,CAAC;YACD,sEAAsE;YACtE,kDAAkD;YAClD,MAAM,SAAS,EAAE,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1D,sEAAsE;YACtE,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,SAAS,EAAE,gCAAgC,EAAE,CAAC,WAAW,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM;YAC7B,uBAAuB,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,kEAAkE;gBAClE,kEAAkE;gBAClE,MAAM,SAAS,EAAE,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAChE,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC9B,+DAA+D;oBAC/D,sBAAsB;oBACtB,MAAM,SAAS,EAAE,gCAAgC,EAAE,CAAC,WAAW,CAAC,CAAC;gBACnE,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7C,IACE,SAAS,CAAC,IAAI,KAAK,YAAY;gBAC/B,QAAQ,CAAC,IAAI,KAAK,iBAAiB;gBACnC,CAAC,CAAC,MAAM,oBAAoB,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,EACxD,CAAC;gBACD,MAAM,iBAAiB,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM;YAC/B,MAAM,MAAM,GAAW;gBACrB,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC;gBAC5B,KAAK,EAAE,kBAAkB;aAC1B,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACrE,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACnE,qEAAqE;YACrE,iEAAiE;YACjE,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CACrC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CACnE;gBACC,CAAC,CAAC,MAAM,mBAAmB,CAAC,GAAG,CAAC;gBAChC,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,cAAc,GAAmB,KAAK,EAAE,QAAQ,EAAE,EAAE,CACxD,QAAQ,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE;gBAClD,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,CAAC,MAAiB,EAAW,EAAE,CAC7C,MAAM,CAAC,IAAI,EAAE,QAAQ,KAAK,cAAc,CAAC;YAC3C,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC;gBAChC,GAAG,WAAW;gBACd,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClD,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;aAC9B,CAAC,EAAE,CAAC;gBACH,MAAM,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,KAAK,CAAC,eAAe,CACnB,iBAAiB,EACjB,cAAc,EACd,MAAM;YAEN,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,MAAM,GAAW,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,0BAA0B,CACtD,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAC9C,iBAAiB,EACjB,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,EAC1C,cAAc,CACf,CAAC;YACF,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;gBAC5B,MAAM,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAClC,CAAC;YACD,MAAM,iBAAiB,CAAC,iBAAiB,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,SAAS,QAAQ,CAAC,IAAmB,EAAE,MAAsB;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,EAAE;QACrC,UAAU,EAAE,sBAAsB;QAClC,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,MAAM,CAAC,yBAAyB,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,IAAI;KACL,CAAC,CAAC;IACH,uBAAuB,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6CAA6C;AAC7C,SAAS,YAAY,CACnB,QAAkC;IAElC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;QAChC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CACf,EAAU,EACV,IAAmB,EACnB,MAAc,EACd,MAAsC;IAEtC,OAAO;QACL,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE;QACzC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE;QACrC,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE;QACvC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;QACnC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;QACxB,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW;QACpC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;KAC3E,CAAC;AACJ,CAAC"}

package/dist/domain/iampolicy/membership.d.ts

@@ -59,8 +59,9 @@
  *   one of them would be an outsider on every organization with nobody
  *   able to grant a way back. At the first boot where the bootstrap-state
  *   marker (ROLES_RECONCILED_KEY) is absent, the arms above run for every
- *   PERSON account (`isPersonAccount`: not a machine account, the row-
- *   level twin of the `user`-class gate), acting as that account, in
+ *   PERSON account (`isPersonAccount`: not a machine, platform-client or
+ *   federated account, the row-level twin of the `user`-class gate),
+ *   acting as that account, in
  *   creation order — the order the sign-ins would have run the hook in,
  *   so arm 4 hands an unclaimed organization to its first sign-in and
  *   not to whoever sorts first by id — and the marker is written after
@@ -159,7 +160,14 @@ export declare function isPersonStamp(stamp: string): boolean;
  * it exactly its client's auto-grant role on the owning organization and
  * never runs these rules, and the reconciliation must not either, or every
  * product user would become a member of every organization (and the
- * operator-email arm would read an email the platform asserted).
+ * operator-email arm would read an email the platform asserted). Nor does a
+ * federated account, for the same reason at every arm: its subject and its
+ * email are the ones an organization's identity provider asserted, so the
+ * alias rule would read a subject the provider chose as a founder's stamp
+ * (`owner`), the operator-email arm an email it chose (`admin`), and arm 5
+ * would make it a member of every organization. A federated person's roles
+ * come from their provider's configuration and the organization's
+ * administrators, never from these rules.
  */
 export declare function isPersonAccount(account: IdentityAccount): boolean;
 /** One organization's question for one account: everything the five arms read, resolved by the caller. */

package/dist/domain/iampolicy/membership.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membership.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/membership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2GG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAStD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAGhG,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAQpE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAGtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAE7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,yGAAyG;IACzG,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,kFAAkF;IAClF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD,2EAA2E;IAC3E,uBAAuB,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,qIAAqI;IACrI,8BAA8B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,eAAe,EAAE,WAAW,CASvE,CAAC;AAKL,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAQjE;AAED,0GAA0G;AAC1G,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+GAA+G;IAC/G,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,wBAAwB,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAClE,kHAAkH;IAClH,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;CACvC;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CA6BvD;AAiBD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,GAAG,eAAe,CAiL7E"}
+{"version":3,"file":"membership.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/membership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4GG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAStD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAGhG,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAQpE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAGtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAG7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,yGAAyG;IACzG,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,kFAAkF;IAClF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD,2EAA2E;IAC3E,uBAAuB,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,qIAAqI;IACrI,8BAA8B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,eAAe,EAAE,WAAW,CASvE,CAAC;AAKL,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CASjE;AAED,0GAA0G;AAC1G,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+GAA+G;IAC/G,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,wBAAwB,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAClE,kHAAkH;IAClH,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;CACvC;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CA6BvD;AAiBD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,GAAG,eAAe,CA2L7E"}