@stigmer/server 3.40.1 → 3.41.0

package/dist/domain/iampolicy/membership.js

@@ -55,14 +55,22 @@ export function isPersonStamp(stamp) {
  * it exactly its client's auto-grant role on the owning organization and
  * never runs these rules, and the reconciliation must not either, or every
  * product user would become a member of every organization (and the
- * operator-email arm would read an email the platform asserted).
+ * operator-email arm would read an email the platform asserted). Nor does a
+ * federated account, for the same reason at every arm: its subject and its
+ * email are the ones an organization's identity provider asserted, so the
+ * alias rule would read a subject the provider chose as a founder's stamp
+ * (`owner`), the operator-email arm an email it chose (`admin`), and arm 5
+ * would make it a member of every organization. A federated person's roles
+ * come from their provider's configuration and the organization's
+ * administrators, never from these rules.
  */
 export function isPersonAccount(account) {
     const spec = account.spec;
     return (spec !== undefined &&
         !spec.isMachineAccount &&
         spec.provisioningMode !== IdentityAccountProvisioningMode.machine &&
-        spec.provisioningMode !== IdentityAccountProvisioningMode.platform_client);
+        spec.provisioningMode !== IdentityAccountProvisioningMode.platform_client &&
+        spec.provisioningMode !== IdentityAccountProvisioningMode.federated);
 }
 /**
  * The five arms in their ruled order, as one pure function over what they
@@ -141,11 +149,11 @@ export function newMembershipRules(deps) {
     }
     /**
      * The arms for ONE account over a scanned world: a row on every
-     * organization the account holds none on, granted as `caller`. Shared
-     * by the hook (one account, the world scanned for it) and the
-     * reconciliation (the world scanned once for every account).
+     * organization the account holds none on, granted as `caller` through
+     * `cause`'s door. Shared by the hook (one account, the world scanned for
+     * it) and the reconciliation (the world scanned once for every account).
      */
-    async function applyRulesTo(account, caller, world) {
+    async function applyRulesTo(account, caller, world, cause) {
         const accountId = account.metadata?.id ?? "";
         if (accountId === "") {
             throw new Error("membership rules: the account carries no id");
@@ -168,7 +176,7 @@ export function newMembershipRules(deps) {
                 organizationHasRows: (await policies.findByResource(ORGANIZATION, organization.id))
                     .length > 0,
             });
-            await grantPath.grant(organizationRole(accountId, role, organization.id), caller);
+            await grantPath.grant(organizationRole(accountId, role, organization.id), caller, cause);
         }
     }
     /** Every person account the store holds, oldest first (creation stamp, then id) — the order their sign-ins ran in. */
@@ -197,10 +205,7 @@ export function newMembershipRules(deps) {
             if (organizations.length === 0) {
                 return;
             }
-            await applyRulesTo(account, caller, {
-                organizations,
-                blueprints: await scanBlueprints(),
-            });
+            await applyRulesTo(account, caller, { organizations, blueprints: await scanBlueprints() }, "first_sign_in");
         },
         async ensureRolesForExistingAccounts() {
             if ((await store.bootstrapState.get(ROLES_RECONCILED_KEY)) !== "") {
@@ -213,7 +218,7 @@ export function newMembershipRules(deps) {
                     // As the account itself (actor.ts, the one construction), so the
                     // row's audit actor reads exactly as the person's own first
                     // sign-in would have stamped it.
-                    await applyRulesTo(account, accountAsCaller(account), world);
+                    await applyRulesTo(account, accountAsCaller(account), world, "role_reconciliation");
                 }
             }
             // After the last account, never before: a fault above leaves the
@@ -235,7 +240,7 @@ export function newMembershipRules(deps) {
                 if (owners.length > 0) {
                     continue;
                 }
-                await grantPath.grant(organizationRole(accountId, IamRole.owner, organization.id), actor);
+                await grantPath.grant(organizationRole(accountId, IamRole.owner, organization.id), actor, "operator_ownership");
             }
         },
     };

package/dist/domain/iampolicy/membership.js.map

@@ -1 +1 @@
-{"version":3,"file":"membership.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/membership.ts"],"names":[],"mappings":"AA6GA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AACjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAC5G,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAG/F,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAmB1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAC/B,IAAI,GAAG,CAA+B;IACpC,CAAC,eAAe,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAClD,CAAC,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC;IACpC,CAAC,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC;IAC1C,CAAC,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC;IACpC,CAAC,eAAe,CAAC,UAAU,EAAE,eAAe,CAAC;IAC7C,CAAC,eAAe,CAAC,WAAW,EAAE,iBAAiB,CAAC;IAChD,CAAC,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC;CAC3C,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;AAChE,MAAM,gBAAgB,GAAG,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;AASxE;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,2BAA2B,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,OAAwB;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,OAAO,CACL,IAAI,KAAK,SAAS;QAClB,CAAC,IAAI,CAAC,gBAAgB;QACtB,IAAI,CAAC,gBAAgB,KAAK,+BAA+B,CAAC,OAAO;QACjE,IAAI,CAAC,gBAAgB,KAAK,+BAA+B,CAAC,eAAe,CAC1E,CAAC;AACJ,CAAC;AAgBD;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,QAAsB;IAC5C,MAAM,EACJ,SAAS,EACT,OAAO,EACP,KAAK,EACL,aAAa,EACb,YAAY,EACZ,wBAAwB,EACxB,mBAAmB,GACpB,GAAG,QAAQ,CAAC;IACb,MAAM,MAAM,GAAG,CAAC,KAAa,EAAW,EAAE,CACxC,KAAK,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,IAAI,aAAa,KAAK,EAAE,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QACpD,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,MAAM,oBAAoB,GAAG;QAC3B,YAAY,CAAC,SAAS;QACtB,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;KACpD,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,oBAAoB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClD,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC;AAQD,qIAAqI;AACrI,SAAS,iBAAiB,CAAC,OAAwB;IACjD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;IAC1D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,iBAAiB,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAyB;IAC1D,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAE3D,KAAK,UAAU,IAAI,CAAC,IAAqB;QACvC,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,uBAAuB,YAAY,CAAC,IAAI,CAAC,4BAA4B,CACtE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACxB,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO;gBACL,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE;gBACtB,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE;gBACxB,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE;aACrE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,cAAc;QAC3B,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,oFAAoF;IACpF,KAAK,UAAU,mBAAmB,CAChC,SAAiB;QAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QACzE,OAAO,IAAI,GAAG,CACZ,IAAI;aACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,YAAY,CAAC;aAC1D,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAC9C,CAAC;IACJ,CAAC;IAED,4FAA4F;IAC5F,KAAK,UAAU,SAAS;QACtB,OAAO;YACL,aAAa,EAAE,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC;YACvD,UAAU,EAAE,MAAM,cAAc,EAAE;SACnC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,YAAY,CACzB,OAAwB,EACxB,MAAsB,EACtB,KAAmB;QAEnB,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAElD,KAAK,MAAM,YAAY,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC9B,SAAS;YACX,CAAC;YACD,MAAM,wBAAwB,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CACtD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,YAAY,CAAC,EAAE,CACjD,CAAC;YACF,MAAM,IAAI,GAAG,OAAO,CAAC;gBACnB,SAAS;gBACT,OAAO;gBACP,KAAK;gBACL,aAAa;gBACb,YAAY;gBACZ,wBAAwB;gBACxB,mBAAmB,EACjB,CAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;qBAC3D,MAAM,GAAG,CAAC;aAChB,CAAC,CAAC;YACH,MAAM,SAAS,CAAC,KAAK,CACnB,gBAAgB,CAAC,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC,EAClD,MAAM,CACP,CAAC;QACJ,CAAC;IACH,CAAC;IAED,sHAAsH;IACtH,KAAK,UAAU,kBAAkB;QAC/B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;QACzE,OAAO,IAAI;aACR,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;aACxD,MAAM,CAAC,eAAe,CAAC;aACvB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACb,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC/D,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;gBACrB,OAAO,UAAU,CAAC;YACpB,CAAC;YACD,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACP,CAAC;IAED,OAAO;QACL,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM;YACpC,IAAI,MAAM,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;gBAClC,OAAO;YACT,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;YAC/D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,OAAO;YACT,CAAC;YACD,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE;gBAClC,aAAa;gBACb,UAAU,EAAE,MAAM,cAAc,EAAE;aACnC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,8BAA8B;YAClC,IAAI,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBAClE,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC5C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;gBAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC/B,iEAAiE;oBACjE,4DAA4D;oBAC5D,iCAAiC;oBACjC,MAAM,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;YACD,iEAAiE;YACjE,8DAA8D;YAC9D,wDAAwD;YACxD,MAAM,KAAK,CAAC,cAAc,CAAC,GAAG,CAC5B,oBAAoB,EACpB,cAAc,CAAC,IAAI,IAAI,EAAE,CAAC,CAC3B,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,uBAAuB,CAAC,QAAQ;YACpC,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC1E,CAAC;YACD,uEAAuE;YACvE,+DAA+D;YAC/D,0DAA0D;YAC1D,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YACxC,KAAK,MAAM,YAAY,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;gBACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,2BAA2B,CACvD,YAAY,EACZ,YAAY,CAAC,EAAE,EACf,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAC5B,CAAC;gBACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtB,SAAS;gBACX,CAAC;gBACD,MAAM,SAAS,CAAC,KAAK,CACnB,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC,EAC3D,KAAK,CACN,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"membership.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/membership.ts"],"names":[],"mappings":"AA8GA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AACjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAC5G,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAG/F,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAG9D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAmB1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAC/B,IAAI,GAAG,CAA+B;IACpC,CAAC,eAAe,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAClD,CAAC,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC;IACpC,CAAC,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC;IAC1C,CAAC,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC;IACpC,CAAC,eAAe,CAAC,UAAU,EAAE,eAAe,CAAC;IAC7C,CAAC,eAAe,CAAC,WAAW,EAAE,iBAAiB,CAAC;IAChD,CAAC,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC;CAC3C,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;AAChE,MAAM,gBAAgB,GAAG,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;AASxE;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,2BAA2B,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,eAAe,CAAC,OAAwB;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,OAAO,CACL,IAAI,KAAK,SAAS;QAClB,CAAC,IAAI,CAAC,gBAAgB;QACtB,IAAI,CAAC,gBAAgB,KAAK,+BAA+B,CAAC,OAAO;QACjE,IAAI,CAAC,gBAAgB,KAAK,+BAA+B,CAAC,eAAe;QACzE,IAAI,CAAC,gBAAgB,KAAK,+BAA+B,CAAC,SAAS,CACpE,CAAC;AACJ,CAAC;AAgBD;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,QAAsB;IAC5C,MAAM,EACJ,SAAS,EACT,OAAO,EACP,KAAK,EACL,aAAa,EACb,YAAY,EACZ,wBAAwB,EACxB,mBAAmB,GACpB,GAAG,QAAQ,CAAC;IACb,MAAM,MAAM,GAAG,CAAC,KAAa,EAAW,EAAE,CACxC,KAAK,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,IAAI,aAAa,KAAK,EAAE,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QACpD,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,MAAM,oBAAoB,GAAG;QAC3B,YAAY,CAAC,SAAS;QACtB,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;KACpD,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,oBAAoB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClD,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC;AAQD,qIAAqI;AACrI,SAAS,iBAAiB,CAAC,OAAwB;IACjD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;IAC1D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,iBAAiB,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAyB;IAC1D,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAE3D,KAAK,UAAU,IAAI,CAAC,IAAqB;QACvC,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,uBAAuB,YAAY,CAAC,IAAI,CAAC,4BAA4B,CACtE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACxB,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO;gBACL,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE;gBACtB,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE;gBACxB,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE;aACrE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,cAAc;QAC3B,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,oFAAoF;IACpF,KAAK,UAAU,mBAAmB,CAChC,SAAiB;QAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QACzE,OAAO,IAAI,GAAG,CACZ,IAAI;aACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,YAAY,CAAC;aAC1D,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAC9C,CAAC;IACJ,CAAC;IAED,4FAA4F;IAC5F,KAAK,UAAU,SAAS;QACtB,OAAO;YACL,aAAa,EAAE,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC;YACvD,UAAU,EAAE,MAAM,cAAc,EAAE;SACnC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,YAAY,CACzB,OAAwB,EACxB,MAAsB,EACtB,KAAmB,EACnB,KAAwB;QAExB,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAElD,KAAK,MAAM,YAAY,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC9B,SAAS;YACX,CAAC;YACD,MAAM,wBAAwB,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CACtD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,YAAY,CAAC,EAAE,CACjD,CAAC;YACF,MAAM,IAAI,GAAG,OAAO,CAAC;gBACnB,SAAS;gBACT,OAAO;gBACP,KAAK;gBACL,aAAa;gBACb,YAAY;gBACZ,wBAAwB;gBACxB,mBAAmB,EACjB,CAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;qBAC3D,MAAM,GAAG,CAAC;aAChB,CAAC,CAAC;YACH,MAAM,SAAS,CAAC,KAAK,CACnB,gBAAgB,CAAC,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC,EAClD,MAAM,EACN,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IAED,sHAAsH;IACtH,KAAK,UAAU,kBAAkB;QAC/B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;QACzE,OAAO,IAAI;aACR,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;aACxD,MAAM,CAAC,eAAe,CAAC;aACvB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACb,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC/D,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;gBACrB,OAAO,UAAU,CAAC;YACpB,CAAC;YACD,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACP,CAAC;IAED,OAAO;QACL,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM;YACpC,IAAI,MAAM,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;gBAClC,OAAO;YACT,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;YAC/D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,OAAO;YACT,CAAC;YACD,MAAM,YAAY,CAChB,OAAO,EACP,MAAM,EACN,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,EAAE,EAAE,EACrD,eAAe,CAChB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,8BAA8B;YAClC,IAAI,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBAClE,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC5C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;gBAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC/B,iEAAiE;oBACjE,4DAA4D;oBAC5D,iCAAiC;oBACjC,MAAM,YAAY,CAChB,OAAO,EACP,eAAe,CAAC,OAAO,CAAC,EACxB,KAAK,EACL,qBAAqB,CACtB,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,iEAAiE;YACjE,8DAA8D;YAC9D,wDAAwD;YACxD,MAAM,KAAK,CAAC,cAAc,CAAC,GAAG,CAC5B,oBAAoB,EACpB,cAAc,CAAC,IAAI,IAAI,EAAE,CAAC,CAC3B,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,uBAAuB,CAAC,QAAQ;YACpC,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC1E,CAAC;YACD,uEAAuE;YACvE,+DAA+D;YAC/D,0DAA0D;YAC1D,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YACxC,KAAK,MAAM,YAAY,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;gBACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,2BAA2B,CACvD,YAAY,EACZ,YAAY,CAAC,EAAE,EACf,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAC5B,CAAC;gBACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtB,SAAS;gBACX,CAAC;gBACD,MAAM,SAAS,CAAC,KAAK,CACnB,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC,EAC3D,KAAK,EACL,oBAAoB,CACrB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/iampolicy/resource-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-store.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/resource-store.ts"],"names":[],"mappings":"AAkDA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAItD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAgBjD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,KAAK,GAAG,cAAc,CA6GtE"}
+{"version":3,"file":"resource-store.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/resource-store.ts"],"names":[],"mappings":"AAsDA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAItD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAgBjD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,KAAK,GAAG,cAAc,CA6GtE"}

package/dist/domain/iampolicy/resource-store.js

@@ -32,6 +32,10 @@
  * way). Conditional store writes are a platform-wide follow-up, not this
  * adapter's to invent.
  *
+ * History. Open source keeps no permission history: the change record the
+ * grant path hands `save` and `deleteById` (store.ts) is not read here, and
+ * the same facts ride the grant path's log lines.
+ *
  * Store faults follow the ratified mapping (domain/apikey/lookup.ts): a
  * typed ResourceNotFoundError reads as `undefined`; anything else
  * propagates — an outage must never read as "no grant".

package/dist/domain/iampolicy/resource-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-store.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/resource-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAErF,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAGlD,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,8BAA8B,GAClC,0BAA0B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,MAAM,wBAAwB,GAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAE7E,MAAM,UAAU,yBAAyB,CAAC,KAAY;IACpD,KAAK,UAAU,QAAQ,CAAC,EAAU;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,8FAA8F;IAC9F,KAAK,UAAU,GAAG;QAChB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,UAAU,KAAK,CAClB,SAAyC;QAEzC,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YACrC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,KAAK,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,oBAAoB,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE;YACjB,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC;QAED,QAAQ,EAAE,QAAQ;QAElB,KAAK,CAAC,eAAe,CAAC,aAAa,EAAE,WAAW;YAC9C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,kBAAkB,EAAE;gBAC1D,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;aACpD,CAAC,CAAC;YACH,OAAO,IAAI;iBACR,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;iBACnD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;QACzE,CAAC;QAED,cAAc,CAAC,YAAY,EAAE,UAAU;YACrC,OAAO,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;QACzE,CAAC;QAED,0BAA0B,CACxB,aAAa,EACb,WAAW,EACX,YAAY,EACZ,UAAU;YAEV,OAAO,KAAK,CACV,CAAC,MAAM,EAAE,EAAE,CACT,WAAW,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC;gBAC/C,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAC/C,CAAC;QACJ,CAAC;QAED,2BAA2B,CAAC,YAAY,EAAE,UAAU,EAAE,SAAS;YAC7D,OAAO,KAAK,CACV,CAAC,MAAM,EAAE,EAAE,CACT,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC;gBAC5C,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CACzC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,iCAAiC,CACrC,YAAY,EACZ,UAAU,EACV,aAAa,EACb,SAAS;YAET,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;YACrC,KAAK,MAAM,MAAM,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;gBACjC,IACE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC;oBAC5C,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;oBACtC,CAAC,aAAa,KAAK,SAAS;wBAC1B,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,aAAa,CAAC,EACjD,CAAC;oBACD,UAAU,CAAC,GAAG,CACZ,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,CAC5E,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,UAAU,CAAC,IAAI,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,YAAY,EAAE,UAAU;YAC3C,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,IAAI,CACvB,CAAC,MAAM,EAAE,EAAE,CACT,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC;gBAC5C,CAAC,8BAA8B,CAAC,QAAQ,CACtC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CACnC;gBACD,CAAC,wBAAwB,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CACzD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAiB,EAAE,IAAY,EAAE,EAAU;IAC9D,OAAO,CACL,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAiB,EAAE,IAAY,EAAE,EAAU;IAC7D,OAAO,CACL,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,CACzE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAiB;IACnC,OAAO,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACrC,CAAC"}
+{"version":3,"file":"resource-store.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/resource-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAErF,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAGlD,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,8BAA8B,GAClC,0BAA0B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,MAAM,wBAAwB,GAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAE7E,MAAM,UAAU,yBAAyB,CAAC,KAAY;IACpD,KAAK,UAAU,QAAQ,CAAC,EAAU;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,8FAA8F;IAC9F,KAAK,UAAU,GAAG;QAChB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,UAAU,KAAK,CAClB,SAAyC;QAEzC,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YACrC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,KAAK,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,oBAAoB,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE;YACjB,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC;QAED,QAAQ,EAAE,QAAQ;QAElB,KAAK,CAAC,eAAe,CAAC,aAAa,EAAE,WAAW;YAC9C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,kBAAkB,EAAE;gBAC1D,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;aACpD,CAAC,CAAC;YACH,OAAO,IAAI;iBACR,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;iBACnD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;QACzE,CAAC;QAED,cAAc,CAAC,YAAY,EAAE,UAAU;YACrC,OAAO,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;QACzE,CAAC;QAED,0BAA0B,CACxB,aAAa,EACb,WAAW,EACX,YAAY,EACZ,UAAU;YAEV,OAAO,KAAK,CACV,CAAC,MAAM,EAAE,EAAE,CACT,WAAW,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC;gBAC/C,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAC/C,CAAC;QACJ,CAAC;QAED,2BAA2B,CAAC,YAAY,EAAE,UAAU,EAAE,SAAS;YAC7D,OAAO,KAAK,CACV,CAAC,MAAM,EAAE,EAAE,CACT,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC;gBAC5C,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CACzC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,iCAAiC,CACrC,YAAY,EACZ,UAAU,EACV,aAAa,EACb,SAAS;YAET,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;YACrC,KAAK,MAAM,MAAM,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;gBACjC,IACE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC;oBAC5C,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;oBACtC,CAAC,aAAa,KAAK,SAAS;wBAC1B,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,aAAa,CAAC,EACjD,CAAC;oBACD,UAAU,CAAC,GAAG,CACZ,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,CAC5E,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,UAAU,CAAC,IAAI,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,YAAY,EAAE,UAAU;YAC3C,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,IAAI,CACvB,CAAC,MAAM,EAAE,EAAE,CACT,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC;gBAC5C,CAAC,8BAA8B,CAAC,QAAQ,CACtC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CACnC;gBACD,CAAC,wBAAwB,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CACzD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAiB,EAAE,IAAY,EAAE,EAAU;IAC9D,OAAO,CACL,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAiB,EAAE,IAAY,EAAE,EAAU;IAC7D,OAAO,CACL,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,CACzE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAiB;IACnC,OAAO,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACrC,CAAC"}

package/dist/domain/iampolicy/role-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-lifecycle.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/role-lifecycle.ts"],"names":[],"mappings":"AAoEA,OAAO,KAAK,EACV,8BAA8B,EAG/B,MAAM,4CAA4C,CAAC;AAGpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAG1D,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;CACrC;AAQD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,wBAAwB,GAC7B,8BAA8B,CAuChC"}
+{"version":3,"file":"role-lifecycle.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/role-lifecycle.ts"],"names":[],"mappings":"AAoEA,OAAO,KAAK,EACV,8BAA8B,EAG/B,MAAM,4CAA4C,CAAC;AAGpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAG1D,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;CACrC;AAQD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,wBAAwB,GAC7B,8BAA8B,CAyChC"}

package/dist/domain/iampolicy/role-lifecycle.js

@@ -86,7 +86,7 @@ export function newBuiltInRoleLifecycle(deps) {
             if (accountId === "") {
                 return;
             }
-            await grantPath.grant(organizationRole(accountId, IamRole.owner, event.resourceId), { ...event.caller, identityId: accountId });
+            await grantPath.grant(organizationRole(accountId, IamRole.owner, event.resourceId), { ...event.caller, identityId: accountId }, "organization_created");
         },
         async onResourceDeleted(event) {
             if (!CLEANUP_KINDS.has(event.kind)) {
@@ -95,7 +95,7 @@ export function newBuiltInRoleLifecycle(deps) {
             await grantPath.cleanupResource(create(ApiResourceRefSchema, {
                 kind: kindEnumName(event.kind),
                 id: event.resourceId,
-            }));
+            }), event.caller);
         },
         async onVisibilityChanged() {
             // Visibility is a tuple concern (org-viewer, public-viewer shapes);

package/dist/domain/iampolicy/role-lifecycle.js.map

@@ -1 +1 @@
-{"version":3,"file":"role-lifecycle.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/role-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,oBAAoB,EAAE,MAAM,wFAAwF,CAAC;AAC9H,OAAO,EAAE,oBAAoB,EAAE,MAAM,qDAAqD,CAAC;AAC3F,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAOpE,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAGjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAO9C,6FAA6F;AAC7F,MAAM,aAAa,GAAiC,IAAI,GAAG,CAAC;IAC1D,eAAe,CAAC,YAAY;IAC5B,eAAe,CAAC,gBAAgB;CACjC,CAAC,CAAC;AAEH,MAAM,UAAU,uBAAuB,CACrC,IAA8B;IAE9B,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACrC,OAAO;QACL,KAAK,CAAC,iBAAiB,CAAC,KAA2B;YACjD,IACE,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC,YAAY;gBAC3C,KAAK,CAAC,gBAAgB,KAAK,oBAAoB,CAAC,MAAM;gBACtD,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,MAAM,EACnC,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/D,MAAM,SAAS,GAAG,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,SAAS,CAAC,KAAK,CACnB,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,EAC5D,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAC3C,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,KAA2B;YACjD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,OAAO;YACT,CAAC;YACD,MAAM,SAAS,CAAC,eAAe,CAC7B,MAAM,CAAC,oBAAoB,EAAE;gBAC3B,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC9B,EAAE,EAAE,KAAK,CAAC,UAAU;aACrB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,mBAAmB;YACvB,oEAAoE;YACpE,mDAAmD;QACrD,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"role-lifecycle.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/role-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,oBAAoB,EAAE,MAAM,wFAAwF,CAAC;AAC9H,OAAO,EAAE,oBAAoB,EAAE,MAAM,qDAAqD,CAAC;AAC3F,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAOpE,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAGjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAO9C,6FAA6F;AAC7F,MAAM,aAAa,GAAiC,IAAI,GAAG,CAAC;IAC1D,eAAe,CAAC,YAAY;IAC5B,eAAe,CAAC,gBAAgB;CACjC,CAAC,CAAC;AAEH,MAAM,UAAU,uBAAuB,CACrC,IAA8B;IAE9B,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACrC,OAAO;QACL,KAAK,CAAC,iBAAiB,CAAC,KAA2B;YACjD,IACE,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC,YAAY;gBAC3C,KAAK,CAAC,gBAAgB,KAAK,oBAAoB,CAAC,MAAM;gBACtD,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,MAAM,EACnC,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/D,MAAM,SAAS,GAAG,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,SAAS,CAAC,KAAK,CACnB,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,EAC5D,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAC1C,sBAAsB,CACvB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,KAA2B;YACjD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,OAAO;YACT,CAAC;YACD,MAAM,SAAS,CAAC,eAAe,CAC7B,MAAM,CAAC,oBAAoB,EAAE;gBAC3B,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC9B,EAAE,EAAE,KAAK,CAAC,UAAU;aACrB,CAAC,EACF,KAAK,CAAC,MAAM,CACb,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,mBAAmB;YACvB,oEAAoE;YACpE,mDAAmD;QACrD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/iampolicy/roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/roles.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mDAAmD,CAAC;AAgDlF,2EAA2E;AAC3E,wBAAgB,mBAAmB,IAAI,aAAa,CAAC,MAAM,CAAC,CAE3D;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAY/D"}
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/roles.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mDAAmD,CAAC;AAwDlF,2EAA2E;AAC3E,wBAAgB,mBAAmB,IAAI,aAAa,CAAC,MAAM,CAAC,CAE3D;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAY/D"}

package/dist/domain/iampolicy/roles.js

@@ -48,6 +48,13 @@ const ROLE_DISPLAY = [
         name: "Participant",
         description: "Reply to customers and manage conversation takeover on a channel",
     },
+    // Grantable per resource on agent, workflow and mcp_server; omitting it
+    // would hide every editor from the resource's access listing.
+    {
+        role: IamRole.editor,
+        name: "Editor",
+        description: "Edit and run the resource; cannot delete it or change who has access",
+    },
 ];
 const RELATION_TO_DISPLAY = new Map(ROLE_DISPLAY.map((entry) => [IamRole[entry.role], entry]));
 /** The allowlist for access-listing queries (Java assignableRelations). */

package/dist/domain/iampolicy/roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG5C,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AASpE,MAAM,YAAY,GAA+B;IAC/C;QACE,IAAI,EAAE,OAAO,CAAC,KAAK;QACnB,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,2DAA2D;KACzE;IACD;QACE,IAAI,EAAE,OAAO,CAAC,KAAK;QACnB,IAAI,EAAE,eAAe;QACrB,WAAW,EACT,uEAAuE;KAC1E;IACD;QACE,IAAI,EAAE,OAAO,CAAC,MAAM;QACpB,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,IAAI,EAAE,OAAO,CAAC,MAAM;QACpB,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,kCAAkC;KAChD;IACD,kEAAkE;IAClE,uEAAuE;IACvE,mEAAmE;IACnE;QACE,IAAI,EAAE,OAAO,CAAC,WAAW;QACzB,IAAI,EAAE,aAAa;QACnB,WAAW,EACT,kEAAkE;KACrE;CACF,CAAC;AAEF,MAAM,mBAAmB,GAAqC,IAAI,GAAG,CACnE,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAC1D,CAAC;AAEF,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB;IACjC,OAAO,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,cAAc,EAAE;QAC5B,EAAE,EAAE,IAAI;QACR,IAAI;QACJ,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG5C,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AASpE,MAAM,YAAY,GAA+B;IAC/C;QACE,IAAI,EAAE,OAAO,CAAC,KAAK;QACnB,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,2DAA2D;KACzE;IACD;QACE,IAAI,EAAE,OAAO,CAAC,KAAK;QACnB,IAAI,EAAE,eAAe;QACrB,WAAW,EACT,uEAAuE;KAC1E;IACD;QACE,IAAI,EAAE,OAAO,CAAC,MAAM;QACpB,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,IAAI,EAAE,OAAO,CAAC,MAAM;QACpB,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,kCAAkC;KAChD;IACD,kEAAkE;IAClE,uEAAuE;IACvE,mEAAmE;IACnE;QACE,IAAI,EAAE,OAAO,CAAC,WAAW;QACzB,IAAI,EAAE,aAAa;QACnB,WAAW,EACT,kEAAkE;KACrE;IACD,wEAAwE;IACxE,8DAA8D;IAC9D;QACE,IAAI,EAAE,OAAO,CAAC,MAAM;QACpB,IAAI,EAAE,QAAQ;QACd,WAAW,EACT,sEAAsE;KACzE;CACF,CAAC;AAEF,MAAM,mBAAmB,GAAqC,IAAI,GAAG,CACnE,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAC1D,CAAC;AAEF,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB;IACjC,OAAO,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,cAAc,EAAE;QAC5B,EAAE,EAAE,IAAI;QACR,IAAI;QACJ,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;AACL,CAAC"}

package/dist/domain/iampolicy/steps.d.ts

@@ -86,15 +86,16 @@ import type { Authorizer } from "../../extensions/authorizer.js";
 import type { PolicyGrantScope } from "../../extensions/policy-grant-scope.js";
 import type { PipelineStep } from "../../pipeline/pipeline.js";
 import type { RequestContext } from "../../pipeline/request-context.js";
+import type { PolicyChangeCause } from "./change.js";
 import type { IamPolicyGrantPath } from "./grant-path.js";
 import type { IamPolicyStore } from "./store.js";
 /** The row a write chain answers — the granted row, or the revoked row (the default instance when there was none). */
 export declare const POLICY_RESULT_KEY = "policyResult";
 /** The `create` chain's role check; see the module header for the four arms. */
 export declare function newValidateGrantableRoleStep(scope: PolicyGrantScope): PipelineStep<typeof IamPolicySpecSchema>;
-/** Grant the spec as the chain's caller; the row (fresh or held) is the result. */
-export declare function newGrantStep(grantPath: IamPolicyGrantPath): PipelineStep<typeof IamPolicySpecSchema>;
-/** Revoke the spec's row; absent, the default instance is the result (Java's idempotent delete). */
+/** Grant the spec as the chain's caller, through the chain's door; the row (fresh or held) is the result. */
+export declare function newGrantStep(grantPath: IamPolicyGrantPath, cause: PolicyChangeCause): PipelineStep<typeof IamPolicySpecSchema>;
+/** Revoke the spec's row as the chain's caller; absent, the default instance is the result (Java's idempotent delete). */
 export declare function newRevokeStep(grantPath: IamPolicyGrantPath): PipelineStep<typeof IamPolicySpecSchema>;
 /** Revoke every relation the account holds directly on the organization. */
 export declare function newRevokeOrgAccessStep(grantPath: IamPolicyGrantPath): PipelineStep<typeof RevokeOrgAccessInputSchema>;

package/dist/domain/iampolicy/steps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AACH,OAAO,EAAU,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAK9D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AACpG,OAAO,KAAK,EAEV,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,qDAAqD,CAAC;AAG7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAM/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAexE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAMjD,sHAAsH;AACtH,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,gFAAgF;AAChF,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,gBAAgB,GACtB,YAAY,CAAC,OAAO,mBAAmB,CAAC,CA4D1C;AA2CD,mFAAmF;AACnF,wBAAgB,YAAY,CAC1B,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAU1C;AAED,oGAAoG;AACpG,wBAAgB,aAAa,CAC3B,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAU1C;AAED,4EAA4E;AAC5E,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,0BAA0B,CAAC,CAYjD;AAED,iGAAiG;AACjG,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,oBAAoB,CAAC,CAQ3C;AAcD,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AA+BD,yEAAyE;AACzE,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,cAAc,CAAC,OAAO,mBAAmB,CAAC,GAC9C,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAStC;AAED,sFAAsF;AACtF,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,cAAc,GACvB,CACD,GAAG,EAAE,cAAc,CAAC,OAAO,0BAA0B,CAAC,KACnD,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAQxC;AAED,4GAA4G;AAC5G,wBAAgB,+BAA+B,CAAC,IAAI,SAAS,WAAW,EACtE,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,GACnF,YAAY,CAAC,IAAI,CAAC,CAuBpB;AAED,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,IAAI,SAAS,WAAW,EAC1D,QAAQ,EAAE,cAAc,EACxB,eAAe,EAAE,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,GACnF,YAAY,CAAC,IAAI,CAAC,CAiBpB"}
+{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AACH,OAAO,EAAU,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAK9D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AACpG,OAAO,KAAK,EAEV,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,qDAAqD,CAAC;AAG7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAM/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAexE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAMjD,sHAAsH;AACtH,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,gFAAgF;AAChF,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,gBAAgB,GACtB,YAAY,CAAC,OAAO,mBAAmB,CAAC,CA4D1C;AA2CD,6GAA6G;AAC7G,wBAAgB,YAAY,CAC1B,SAAS,EAAE,kBAAkB,EAC7B,KAAK,EAAE,iBAAiB,GACvB,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAc1C;AAED,0HAA0H;AAC1H,wBAAgB,aAAa,CAC3B,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAa1C;AAED,4EAA4E;AAC5E,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,0BAA0B,CAAC,CAajD;AAED,iGAAiG;AACjG,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,oBAAoB,CAAC,CAQ3C;AAcD,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AA+BD,yEAAyE;AACzE,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,cAAc,CAAC,OAAO,mBAAmB,CAAC,GAC9C,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAStC;AAED,sFAAsF;AACtF,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,cAAc,GACvB,CACD,GAAG,EAAE,cAAc,CAAC,OAAO,0BAA0B,CAAC,KACnD,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAQxC;AAED,4GAA4G;AAC5G,wBAAgB,+BAA+B,CAAC,IAAI,SAAS,WAAW,EACtE,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,GACnF,YAAY,CAAC,IAAI,CAAC,CAuBpB;AAED,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,IAAI,SAAS,WAAW,EAC1D,QAAQ,EAAE,cAAc,EACxB,eAAe,EAAE,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,GACnF,YAAY,CAAC,IAAI,CAAC,CAiBpB"}

package/dist/domain/iampolicy/steps.js

@@ -145,22 +145,22 @@ function requireTeamGrant(role, qualifier, kind, kindName, scoped) {
         throw new ConnectError(teamQualifierMessage(qualifier), Code.InvalidArgument);
     }
 }
-/** Grant the spec as the chain's caller; the row (fresh or held) is the result. */
-export function newGrantStep(grantPath) {
+/** Grant the spec as the chain's caller, through the chain's door; the row (fresh or held) is the result. */
+export function newGrantStep(grantPath, cause) {
     return {
         name: "Grant",
         async execute(ctx) {
-            const { policy } = await grantPath.grant(ctx.input, ctx.callerIdentity);
+            const { policy } = await grantPath.grant(ctx.input, ctx.callerIdentity, cause);
             ctx.set(POLICY_RESULT_KEY, policy);
         },
     };
 }
-/** Revoke the spec's row; absent, the default instance is the result (Java's idempotent delete). */
+/** Revoke the spec's row as the chain's caller; absent, the default instance is the result (Java's idempotent delete). */
 export function newRevokeStep(grantPath) {
     return {
         name: "Revoke",
         async execute(ctx) {
-            const revoked = await grantPath.revokeBySpec(ctx.input);
+            const revoked = await grantPath.revokeBySpec(ctx.input, ctx.callerIdentity);
             ctx.set(POLICY_RESULT_KEY, revoked ?? create(IamPolicySchema));
         },
     };
@@ -170,7 +170,7 @@ export function newRevokeOrgAccessStep(grantPath) {
     return {
         name: "RevokeOrgAccess",
         execute(ctx) {
-            return grantPath.revokeOrgAccess(ctx.input.identityAccountId, ctx.input.organizationId);
+            return grantPath.revokeOrgAccess(ctx.input.identityAccountId, ctx.input.organizationId, ctx.callerIdentity);
         },
     };
 }
@@ -180,7 +180,7 @@ export function newCleanupResourceStep(grantPath) {
         name: "CleanupResource",
         execute(ctx) {
             const ref = ctx.input;
-            return grantPath.cleanupResource(ref);
+            return grantPath.cleanupResource(ref, ctx.callerIdentity);
         },
     };
 }

package/dist/domain/iampolicy/steps.js.map

@@ -1 +1 @@
-{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AACH,OAAO,EAAE,MAAM,EAAoB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAOrF,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAInF,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,GACtB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EACL,kBAAkB,EAClB,+BAA+B,EAC/B,yCAAyC,EACzC,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAE5B,sHAAsH;AACtH,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEhD,gFAAgF;AAChF,MAAM,UAAU,4BAA4B,CAC1C,KAAuB;IAEvB,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,OAAO,CAAC,GAA+C;YACrD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,YAAY,CACpB,uBAAuB,CAAC,QAAQ,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CACpB,yCAAyC,EACzC,IAAI,CAAC,aAAa,CACnB,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,IAAI,SAAS,EAAE,IAAI,KAAK,cAAc,EAAE,CAAC;gBACvC,gBAAgB,CACd,IAAI,CAAC,QAAQ,EACb,SAAS,CAAC,QAAQ,EAClB,IAAI,EACJ,QAAQ,EACR,MAAM,CACP,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,YAAY,CACpB,uBAAuB,CACrB,IAAI,CAAC,QAAQ,EACb,QAAQ,EACR,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CACvC,EACD,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,iBAAiB,GAAG,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;YAChD,MAAM,aAAa,GAAG,yBAAyB,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,aAAa,KAAK,eAAe,CAAC,gBAAgB,EAAE,CAAC;gBACvD,MAAM,IAAI,YAAY,CACpB,4BAA4B,CAAC,iBAAiB,CAAC,EAC/C,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;YAC5C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,YAAY,CACpB,sBAAsB,CAAC,SAAS,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,cAAc,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;AAE1D;;;GAGG;AACH,SAAS,gBAAgB,CACvB,IAAY,EACZ,SAAiB,EACjB,IAAqB,EACrB,QAAgB,EAChB,MAA4B;IAE5B,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CACd,CAAC;IACF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CACpB,uBAAuB,CAAC,QAAQ,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,YAAY,CACpB,2BAA2B,CACzB,IAAI,EACJ,QAAQ,EACR,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CACrC,EACD,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,qBAAqB,EAAE,CAAC;QACxC,MAAM,IAAI,YAAY,CACpB,oBAAoB,CAAC,SAAS,CAAC,EAC/B,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAC1B,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,OAAO,CACX,GAA+C;YAE/C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YACxE,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,aAAa,CAC3B,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CACX,GAA+C;YAE/C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACxD,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sBAAsB,CACpC,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,CACL,GAAsD;YAEtD,OAAO,SAAS,CAAC,eAAe,CAC9B,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAC3B,GAAG,CAAC,KAAK,CAAC,cAAc,CACzB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,sBAAsB,CACpC,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,CAAC,GAAgD;YACtD,MAAM,GAAG,GAAmB,GAAG,CAAC,KAAK,CAAC;YACtC,OAAO,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,0DAA0D;AAC1D,MAAM,sBAAsB,GAAG,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;AAC1E,MAAM,0BAA0B,GAAG,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;AAClF,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAE9C,gGAAgG;AAChG,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAQrD;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAC/B,GAAyB,EACzB,QAAwB,EACxB,cAAsB;IAEtB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC9C,IAAI,IAAI,YAAY,GAAG,EAAE,CAAC;QACxB,OAAO,IAA2B,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,2BAA2B,CACrD,sBAAsB,EACtB,cAAc,EACd,CAAC,cAAc,CAAC,CACjB,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,IAAI;SACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;SACjC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,IAAI,KAAK,0BAA0B,CAAC;SACrE,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAC3C,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CACjC,GAA+C;IAE/C,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;IACpD,IAAI,QAAQ,EAAE,IAAI,KAAK,sBAAsB,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QAC7E,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC;QACrB,cAAc,EAAE,QAAQ,CAAC,EAAE;QAC3B,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,wBAAwB,CACtC,QAAwB;IAIxB,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;QACvE,OAAO,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAClC,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,iBAAiB,EAAE;YAClD,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,+BAA+B,CAC7C,UAAsB,EACtB,eAAoF;IAEpF,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,GAAG,CAAC,cAAc,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,MAAM,yBAAyB,CAC7B,UAAU,EACV,GAAG,CAAC,cAAc,EAClB;gBACE,UAAU,EAAE,aAAa,CAAC,gBAAgB;gBAC1C,YAAY,EAAE,eAAe,CAAC,YAAY;gBAC1C,UAAU,EAAE,MAAM,CAAC,cAAc;aAClC,EACD,+BAA+B,CAChC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,mBAAmB,CACjC,QAAwB,EACxB,eAAoF;IAEpF,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,GAAG,CAAC,cAAc,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YAC9E,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AACH,OAAO,EAAE,MAAM,EAAoB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAOrF,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAInF,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,GACtB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EACL,kBAAkB,EAClB,+BAA+B,EAC/B,yCAAyC,EACzC,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAE5B,sHAAsH;AACtH,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEhD,gFAAgF;AAChF,MAAM,UAAU,4BAA4B,CAC1C,KAAuB;IAEvB,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,OAAO,CAAC,GAA+C;YACrD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,YAAY,CACpB,uBAAuB,CAAC,QAAQ,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CACpB,yCAAyC,EACzC,IAAI,CAAC,aAAa,CACnB,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,IAAI,SAAS,EAAE,IAAI,KAAK,cAAc,EAAE,CAAC;gBACvC,gBAAgB,CACd,IAAI,CAAC,QAAQ,EACb,SAAS,CAAC,QAAQ,EAClB,IAAI,EACJ,QAAQ,EACR,MAAM,CACP,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,YAAY,CACpB,uBAAuB,CACrB,IAAI,CAAC,QAAQ,EACb,QAAQ,EACR,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CACvC,EACD,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,iBAAiB,GAAG,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;YAChD,MAAM,aAAa,GAAG,yBAAyB,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,aAAa,KAAK,eAAe,CAAC,gBAAgB,EAAE,CAAC;gBACvD,MAAM,IAAI,YAAY,CACpB,4BAA4B,CAAC,iBAAiB,CAAC,EAC/C,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;YAC5C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,YAAY,CACpB,sBAAsB,CAAC,SAAS,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,cAAc,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;AAE1D;;;GAGG;AACH,SAAS,gBAAgB,CACvB,IAAY,EACZ,SAAiB,EACjB,IAAqB,EACrB,QAAgB,EAChB,MAA4B;IAE5B,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CACd,CAAC;IACF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CACpB,uBAAuB,CAAC,QAAQ,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,YAAY,CACpB,2BAA2B,CACzB,IAAI,EACJ,QAAQ,EACR,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CACrC,EACD,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,qBAAqB,EAAE,CAAC;QACxC,MAAM,IAAI,YAAY,CACpB,oBAAoB,CAAC,SAAS,CAAC,EAC/B,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,YAAY,CAC1B,SAA6B,EAC7B,KAAwB;IAExB,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,OAAO,CACX,GAA+C;YAE/C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CACtC,GAAG,CAAC,KAAK,EACT,GAAG,CAAC,cAAc,EAClB,KAAK,CACN,CAAC;YACF,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,aAAa,CAC3B,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CACX,GAA+C;YAE/C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,YAAY,CAC1C,GAAG,CAAC,KAAK,EACT,GAAG,CAAC,cAAc,CACnB,CAAC;YACF,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sBAAsB,CACpC,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,CACL,GAAsD;YAEtD,OAAO,SAAS,CAAC,eAAe,CAC9B,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAC3B,GAAG,CAAC,KAAK,CAAC,cAAc,EACxB,GAAG,CAAC,cAAc,CACnB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,sBAAsB,CACpC,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,CAAC,GAAgD;YACtD,MAAM,GAAG,GAAmB,GAAG,CAAC,KAAK,CAAC;YACtC,OAAO,SAAS,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5D,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,0DAA0D;AAC1D,MAAM,sBAAsB,GAAG,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;AAC1E,MAAM,0BAA0B,GAAG,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;AAClF,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAE9C,gGAAgG;AAChG,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAQrD;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAC/B,GAAyB,EACzB,QAAwB,EACxB,cAAsB;IAEtB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC9C,IAAI,IAAI,YAAY,GAAG,EAAE,CAAC;QACxB,OAAO,IAA2B,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,2BAA2B,CACrD,sBAAsB,EACtB,cAAc,EACd,CAAC,cAAc,CAAC,CACjB,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,IAAI;SACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;SACjC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,IAAI,KAAK,0BAA0B,CAAC;SACrE,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAC3C,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CACjC,GAA+C;IAE/C,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;IACpD,IAAI,QAAQ,EAAE,IAAI,KAAK,sBAAsB,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QAC7E,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC;QACrB,cAAc,EAAE,QAAQ,CAAC,EAAE;QAC3B,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,wBAAwB,CACtC,QAAwB;IAIxB,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;QACvE,OAAO,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAClC,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,iBAAiB,EAAE;YAClD,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,+BAA+B,CAC7C,UAAsB,EACtB,eAAoF;IAEpF,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,GAAG,CAAC,cAAc,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,MAAM,yBAAyB,CAC7B,UAAU,EACV,GAAG,CAAC,cAAc,EAClB;gBACE,UAAU,EAAE,aAAa,CAAC,gBAAgB;gBAC1C,YAAY,EAAE,eAAe,CAAC,YAAY;gBAC1C,UAAU,EAAE,MAAM,CAAC,cAAc;aAClC,EACD,+BAA+B,CAChC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,mBAAmB,CACjC,QAAwB,EACxB,eAAoF;IAEpF,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,GAAG,CAAC,cAAc,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YAC9E,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/iampolicy/store-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store-contract.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/store-contract.ts"],"names":[],"mappings":"AAgDA,OAAO,KAAK,EACV,gBAAgB,EAEhB,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AAOtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,gGAAgG;AAChG,MAAM,MAAM,6BAA6B,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;AAEhF,MAAM,MAAM,0BAA0B,GAAG,gBAAgB,CAAC;AA4X1D,uEAAuE;AACvE,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,OAAO,CAAC,6BAA6B,CAAC,GACxD,aAAa,CAAC,0BAA0B,CAAC,CAE3C"}
+{"version":3,"file":"store-contract.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/store-contract.ts"],"names":[],"mappings":"AAmDA,OAAO,KAAK,EACV,gBAAgB,EAEhB,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AAQtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,gGAAgG;AAChG,MAAM,MAAM,6BAA6B,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;AAEhF,MAAM,MAAM,0BAA0B,GAAG,gBAAgB,CAAC;AA4Z1D,uEAAuE;AACvE,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,OAAO,CAAC,6BAA6B,CAAC,GACxD,aAAa,CAAC,0BAA0B,CAAC,CAE3C"}

package/dist/domain/iampolicy/store-contract.js

@@ -18,7 +18,10 @@
  *
  * The corners A12 taught are cases from the start, not later additions:
  * every relation on a pair; distinct principals, not rows; the scope-tuple
- * exclusions verbatim; unknown-id delete a no-op; a held id refused.
+ * exclusions verbatim; unknown-id delete a no-op; a held id refused. A
+ * change record changes nothing about the row; what a store that keeps a
+ * history writes with it is that store's own test, since the port lets an
+ * implementation keep none.
  *
  * What the kit deliberately does not carry: open source's derived-id
  * refusal and its primary-key read, the cloud's column layout and SQLSTATE
@@ -217,6 +220,24 @@ const CASES = [
             await assert.doesNotReject(store.save(policy), "the triple of a deleted policy must be savable again");
         },
     ],
+    [
+        "a change record changes nothing about the row: save and deleteById behave as without one",
+        async ({ store }) => {
+            const record = {
+                actor: { id: BOB, callerClass: "user" },
+                cause: "grant",
+                organizationId: "acme",
+            };
+            const policy = policyRow(orgRole(ALICE, "admin", "acme"));
+            await store.save(policy, record);
+            const found = await store.findById(idOf(policy));
+            assert.ok(found !== undefined && equals(IamPolicySchema, found, policy), "a policy saved with a record must read back exactly as saved");
+            await assert.rejects(store.save(policyRow(orgRole(ALICE, "admin", "acme"), BOB), record), DuplicatePolicyError, "a held id with a record must still raise DuplicatePolicyError");
+            await store.deleteById(idOf(policy), { ...record, cause: "revoke" });
+            assert.equal(await store.findById(idOf(policy)), undefined, "a policy deleted with a record must be gone");
+            await assert.doesNotReject(store.deleteById(idOf(policy), { ...record, cause: "revoke" }), "deleting an id that is not held, with a record, must resolve");
+        },
+    ],
     [
         "deleteById of an unknown id resolves",
         async ({ store }) => {

package/dist/domain/iampolicy/store-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"store-contract.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/store-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4DAA4D,CAAC;AAEvG,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAErF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAE1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAMjE,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAQlD,MAAM,KAAK,GAAG,gCAAgC,CAAC;AAC/C,MAAM,GAAG,GAAG,gCAAgC,CAAC;AAC7C,MAAM,KAAK,GAAG,gCAAgC,CAAC;AAE/C,SAAS,IAAI,CACX,SAA0D,EAC1D,QAAgB,EAChB,QAAsC;IAEtC,OAAO,MAAM,CAAC,mBAAmB,EAAE;QACjC,SAAS,EAAE;YACT,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,EAAE;SACnC;QACD,QAAQ;QACR,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE;KACnD,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,SAAS,OAAO,CACd,SAAiB,EACjB,QAAgB,EAChB,KAAa;IAEb,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE;QACjE,IAAI,EAAE,cAAc;QACpB,EAAE,EAAE,KAAK;KACV,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,UAAyB,EAAE,SAAS,GAAG,KAAK;IAC7D,OAAO,MAAM,CAAC,eAAe,EAAE;QAC7B,UAAU,EAAE,sBAAsB;QAClC,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,MAAM,CAAC,yBAAyB,EAAE;YAC1C,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC;SAC5B,CAAC;QACF,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE;KACnE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,IAAI,CAAC,MAAiB;IAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACrC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,mCAAmC,CAAC,CAAC;IAC7D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,QAAkC;IACrD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,KAAqB,EACrB,QAAkC;IAElC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,MAAM,KAAK,GAA2D;IACpE;QACE,2CAA2C;QAC3C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1D,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YACjD,MAAM,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,EAAE,uCAAuC,CAAC,CAAC;YACxE,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,CAAC,EACtC,yDAAyD,CAC1D,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,iCAAiC,CAAC,EACvD,SAAS,EACT,uDAAuD,CACxD,CAAC;QACJ,CAAC;KACF;IACD;QACE,qFAAqF;QACrF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YAC3C,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAClC,oBAAoB,EACpB,oFAAoF,CACrF,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CACV,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EACjD,KAAK,EACL,6DAA6D,CAC9D,CAAC;QACJ,CAAC;KACF;IACD;QACE,sFAAsF;QACtF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,CAAC,KAAK,EAAE;gBACnB,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC1C,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC3C,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAC7C,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;aAC1C,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CACd,WAAW,CACT,MAAM,KAAK,CAAC,0BAA0B,CACpC,kBAAkB,EAClB,KAAK,EACL,cAAc,EACd,MAAM,CACP,CACF,EACD,CAAC,OAAO,EAAE,QAAQ,CAAC,EACnB,wEAAwE,CACzE,CAAC;YACF,MAAM,CAAC,SAAS,CACd,MAAM,KAAK,CAAC,0BAA0B,CACpC,kBAAkB,EAClB,GAAG,EACH,cAAc,EACd,QAAQ,CACT,EACD,EAAE,EACF,+CAA+C,CAChD,CAAC;QACJ,CAAC;KACF;IACD;QACE,8DAA8D;QAC9D,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,UAAU,GAAG,IAAI,CACrB,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,EACpC,cAAc,EACd,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAC7B,CAAC;YACF,MAAM,OAAO,CAAC,KAAK,EAAE;gBACnB,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC1C,SAAS,CAAC,UAAU,CAAC;gBACrB,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;aAC5C,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CACd,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAC/D,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,EACzB,iEAAiE,CAClE,CAAC;YACF,MAAM,CAAC,SAAS,CACd,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAC9D,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAC9C,+DAA+D,CAChE,CAAC;YACF,MAAM,CAAC,SAAS,CACd,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,SAAS,CAAC,EACrD,EAAE,EACF,mDAAmD,CACpD,CAAC;QACJ,CAAC;KACF;IACD;QACE,0FAA0F;QAC1F,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,CAAC,KAAK,EAAE;gBACnB,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC1C,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACzC,SAAS,CACP,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE;oBACzD,IAAI,EAAE,cAAc;oBACpB,EAAE,EAAE,MAAM;iBACX,CAAC,CACH;aACF,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CACd,WAAW,CACT,MAAM,KAAK,CAAC,2BAA2B,CAAC,cAAc,EAAE,MAAM,EAAE;gBAC9D,OAAO;gBACP,QAAQ;gBACR,QAAQ;aACT,CAAC,CACH,EACD,CAAC,OAAO,EAAE,QAAQ,CAAC,EACnB,2DAA2D,CAC5D,CAAC;YACF,MAAM,CAAC,SAAS,CACd,MAAM,KAAK,CAAC,2BAA2B,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,CAAC,EACnE,EAAE,EACF,wDAAwD,CACzD,CAAC;QACJ,CAAC;KACF;IACD;QACE,mGAAmG;QACnG,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACrD,MAAM,OAAO,CAAC,KAAK,EAAE;gBACnB,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC1C,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC3C,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACzC,SAAS,CACP,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE;oBACrD,IAAI,EAAE,cAAc;oBACpB,EAAE,EAAE,MAAM;iBACX,CAAC,CACH;gBACD,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;aAC5C,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iCAAiC,CAC3C,cAAc,EACd,MAAM,EACN,SAAS,EACT,KAAK,CACN,EACD,CAAC,EACD,0FAA0F,CAC3F,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iCAAiC,CAC3C,cAAc,EACd,MAAM,EACN,kBAAkB,EAClB,KAAK,CACN,EACD,CAAC,EACD,wDAAwD,CACzD,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iCAAiC,CAC3C,cAAc,EACd,MAAM,EACN,SAAS,EACT,CAAC,OAAO,CAAC,CACV,EACD,CAAC,EACD,4CAA4C,CAC7C,CAAC;QACJ,CAAC;KACF;IACD;QACE,2FAA2F;QAC3F,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE;gBACvE,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,KAAK;aACV,CAAC,CAAC;YACH,MAAM,OAAO,CAAC,KAAK,EAAE;gBACnB,SAAS,CACP,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE;oBACrD,IAAI,EAAE,OAAO;oBACb,EAAE,EAAE,KAAK;iBACV,CAAC,CACH;gBACD,SAAS,CACP,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE;oBAC/D,IAAI,EAAE,OAAO;oBACb,EAAE,EAAE,KAAK;iBACV,CAAC,CACH;gBACD,SAAS,CACP,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE;oBACpD,IAAI,EAAE,OAAO;oBACb,EAAE,EAAE,KAAK;iBACV,CAAC,CACH;gBACD,SAAS,CAAC,KAAK,CAAC;aACjB,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAC1D,WAAW,CAAC,KAAK,CAAC,EAClB,qFAAqF,CACtF,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,EAClD,SAAS,EACT,2DAA2D,CAC5D,CAAC;QACJ,CAAC;KACF;IACD;QACE,oEAAoE;QACpE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1D,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAClC,SAAS,EACT,6CAA6C,CAC9C,CAAC;YACF,MAAM,CAAC,SAAS,CACd,MAAM,KAAK,CAAC,0BAA0B,CACpC,kBAAkB,EAClB,KAAK,EACL,cAAc,EACd,MAAM,CACP,EACD,EAAE,EACF,mDAAmD,CACpD,CAAC;YACF,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAClB,sDAAsD,CACvD,CAAC;QACJ,CAAC;KACF;IACD;QACE,sCAAsC;QACtC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,UAAU,CAAC,iCAAiC,CAAC,EACnD,0DAA0D,CAC3D,CAAC;QACJ,CAAC;KACF;IACD;QACE,oEAAoE;QACpE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EACpE,yEAAyE,CAC1E,CAAC;YACF,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,0BAA0B,CACtC,kBAAkB,EAClB,KAAK,EACL,cAAc,EACd,MAAM,CACP,EACD,8EAA8E,CAC/E,CAAC;QACJ,CAAC;KACF;IACD;QACE,kFAAkF;QAClF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;gBACvC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBACpC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;aACnC,CAAC,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBACjC,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,MAAM,YAAY,oBAAoB,EAC7C,mEAAmE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAC3F,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,CAAC,EAAE,CACP,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,EACvD,+CAA+C,CAChD,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,0BAA0B,CACjD,kBAAkB,EAClB,KAAK,EACL,cAAc,EACd,MAAM,CACP,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,wCAAwC,CAAC,CAAC;YACvE,MAAM,CAAC,KAAK,CACV,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EACrB,WAAW,CAAC,MAAM,CAAC,EACnB,mDAAmD,CACpD,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAEF,uEAAuE;AACvE,MAAM,UAAU,sBAAsB,CACpC,WAAyD;IAEzD,OAAO,iBAAiB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"store-contract.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/store-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4DAA4D,CAAC;AAEvG,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAErF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAE1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAOjE,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAQlD,MAAM,KAAK,GAAG,gCAAgC,CAAC;AAC/C,MAAM,GAAG,GAAG,gCAAgC,CAAC;AAC7C,MAAM,KAAK,GAAG,gCAAgC,CAAC;AAE/C,SAAS,IAAI,CACX,SAA0D,EAC1D,QAAgB,EAChB,QAAsC;IAEtC,OAAO,MAAM,CAAC,mBAAmB,EAAE;QACjC,SAAS,EAAE;YACT,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,EAAE;SACnC;QACD,QAAQ;QACR,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE;KACnD,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,SAAS,OAAO,CACd,SAAiB,EACjB,QAAgB,EAChB,KAAa;IAEb,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE;QACjE,IAAI,EAAE,cAAc;QACpB,EAAE,EAAE,KAAK;KACV,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,UAAyB,EAAE,SAAS,GAAG,KAAK;IAC7D,OAAO,MAAM,CAAC,eAAe,EAAE;QAC7B,UAAU,EAAE,sBAAsB;QAClC,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,MAAM,CAAC,yBAAyB,EAAE;YAC1C,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC;SAC5B,CAAC;QACF,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE;KACnE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,IAAI,CAAC,MAAiB;IAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACrC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,mCAAmC,CAAC,CAAC;IAC7D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,QAAkC;IACrD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,KAAqB,EACrB,QAAkC;IAElC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,MAAM,KAAK,GAA2D;IACpE;QACE,2CAA2C;QAC3C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1D,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YACjD,MAAM,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,EAAE,uCAAuC,CAAC,CAAC;YACxE,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,CAAC,EACtC,yDAAyD,CAC1D,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,iCAAiC,CAAC,EACvD,SAAS,EACT,uDAAuD,CACxD,CAAC;QACJ,CAAC;KACF;IACD;QACE,qFAAqF;QACrF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YAC3C,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAClC,oBAAoB,EACpB,oFAAoF,CACrF,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CACV,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EACjD,KAAK,EACL,6DAA6D,CAC9D,CAAC;QACJ,CAAC;KACF;IACD;QACE,sFAAsF;QACtF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,CAAC,KAAK,EAAE;gBACnB,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC1C,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC3C,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAC7C,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;aAC1C,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CACd,WAAW,CACT,MAAM,KAAK,CAAC,0BAA0B,CACpC,kBAAkB,EAClB,KAAK,EACL,cAAc,EACd,MAAM,CACP,CACF,EACD,CAAC,OAAO,EAAE,QAAQ,CAAC,EACnB,wEAAwE,CACzE,CAAC;YACF,MAAM,CAAC,SAAS,CACd,MAAM,KAAK,CAAC,0BAA0B,CACpC,kBAAkB,EAClB,GAAG,EACH,cAAc,EACd,QAAQ,CACT,EACD,EAAE,EACF,+CAA+C,CAChD,CAAC;QACJ,CAAC;KACF;IACD;QACE,8DAA8D;QAC9D,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,UAAU,GAAG,IAAI,CACrB,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,EACpC,cAAc,EACd,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAC7B,CAAC;YACF,MAAM,OAAO,CAAC,KAAK,EAAE;gBACnB,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC1C,SAAS,CAAC,UAAU,CAAC;gBACrB,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;aAC5C,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CACd,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAC/D,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,EACzB,iEAAiE,CAClE,CAAC;YACF,MAAM,CAAC,SAAS,CACd,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAC9D,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAC9C,+DAA+D,CAChE,CAAC;YACF,MAAM,CAAC,SAAS,CACd,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,SAAS,CAAC,EACrD,EAAE,EACF,mDAAmD,CACpD,CAAC;QACJ,CAAC;KACF;IACD;QACE,0FAA0F;QAC1F,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,OAAO,CAAC,KAAK,EAAE;gBACnB,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC1C,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACzC,SAAS,CACP,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE;oBACzD,IAAI,EAAE,cAAc;oBACpB,EAAE,EAAE,MAAM;iBACX,CAAC,CACH;aACF,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CACd,WAAW,CACT,MAAM,KAAK,CAAC,2BAA2B,CAAC,cAAc,EAAE,MAAM,EAAE;gBAC9D,OAAO;gBACP,QAAQ;gBACR,QAAQ;aACT,CAAC,CACH,EACD,CAAC,OAAO,EAAE,QAAQ,CAAC,EACnB,2DAA2D,CAC5D,CAAC;YACF,MAAM,CAAC,SAAS,CACd,MAAM,KAAK,CAAC,2BAA2B,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,CAAC,EACnE,EAAE,EACF,wDAAwD,CACzD,CAAC;QACJ,CAAC;KACF;IACD;QACE,mGAAmG;QACnG,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACrD,MAAM,OAAO,CAAC,KAAK,EAAE;gBACnB,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC1C,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC3C,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACzC,SAAS,CACP,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE;oBACrD,IAAI,EAAE,cAAc;oBACpB,EAAE,EAAE,MAAM;iBACX,CAAC,CACH;gBACD,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;aAC5C,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iCAAiC,CAC3C,cAAc,EACd,MAAM,EACN,SAAS,EACT,KAAK,CACN,EACD,CAAC,EACD,0FAA0F,CAC3F,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iCAAiC,CAC3C,cAAc,EACd,MAAM,EACN,kBAAkB,EAClB,KAAK,CACN,EACD,CAAC,EACD,wDAAwD,CACzD,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,iCAAiC,CAC3C,cAAc,EACd,MAAM,EACN,SAAS,EACT,CAAC,OAAO,CAAC,CACV,EACD,CAAC,EACD,4CAA4C,CAC7C,CAAC;QACJ,CAAC;KACF;IACD;QACE,2FAA2F;QAC3F,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE;gBACvE,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,KAAK;aACV,CAAC,CAAC;YACH,MAAM,OAAO,CAAC,KAAK,EAAE;gBACnB,SAAS,CACP,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE;oBACrD,IAAI,EAAE,OAAO;oBACb,EAAE,EAAE,KAAK;iBACV,CAAC,CACH;gBACD,SAAS,CACP,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE;oBAC/D,IAAI,EAAE,OAAO;oBACb,EAAE,EAAE,KAAK;iBACV,CAAC,CACH;gBACD,SAAS,CACP,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE;oBACpD,IAAI,EAAE,OAAO;oBACb,EAAE,EAAE,KAAK;iBACV,CAAC,CACH;gBACD,SAAS,CAAC,KAAK,CAAC;aACjB,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAC1D,WAAW,CAAC,KAAK,CAAC,EAClB,qFAAqF,CACtF,CAAC;YACF,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,EAClD,SAAS,EACT,2DAA2D,CAC5D,CAAC;QACJ,CAAC;KACF;IACD;QACE,oEAAoE;QACpE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1D,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAClC,SAAS,EACT,6CAA6C,CAC9C,CAAC;YACF,MAAM,CAAC,SAAS,CACd,MAAM,KAAK,CAAC,0BAA0B,CACpC,kBAAkB,EAClB,KAAK,EACL,cAAc,EACd,MAAM,CACP,EACD,EAAE,EACF,mDAAmD,CACpD,CAAC;YACF,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAClB,sDAAsD,CACvD,CAAC;QACJ,CAAC;KACF;IACD;QACE,0FAA0F;QAC1F,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,GAAuB;gBACjC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,OAAO;gBACd,cAAc,EAAE,MAAM;aACvB,CAAC;YACF,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1D,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YACjD,MAAM,CAAC,EAAE,CACP,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,CAAC,EAC7D,8DAA8D,CAC/D,CAAC;YACF,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,EACnE,oBAAoB,EACpB,+DAA+D,CAChE,CAAC;YACF,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrE,MAAM,CAAC,KAAK,CACV,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAClC,SAAS,EACT,6CAA6C,CAC9C,CAAC;YACF,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAC9D,8DAA8D,CAC/D,CAAC;QACJ,CAAC;KACF;IACD;QACE,sCAAsC;QACtC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,UAAU,CAAC,iCAAiC,CAAC,EACnD,0DAA0D,CAC3D,CAAC;QACJ,CAAC;KACF;IACD;QACE,oEAAoE;QACpE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EACpE,yEAAyE,CAC1E,CAAC;YACF,MAAM,MAAM,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,0BAA0B,CACtC,kBAAkB,EAClB,KAAK,EACL,cAAc,EACd,MAAM,CACP,EACD,8EAA8E,CAC/E,CAAC;QACJ,CAAC;KACF;IACD;QACE,kFAAkF;QAClF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;gBACvC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBACpC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;aACnC,CAAC,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBACjC,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,MAAM,YAAY,oBAAoB,EAC7C,mEAAmE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAC3F,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,CAAC,EAAE,CACP,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,EACvD,+CAA+C,CAChD,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,0BAA0B,CACjD,kBAAkB,EAClB,KAAK,EACL,cAAc,EACd,MAAM,CACP,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,wCAAwC,CAAC,CAAC;YACvE,MAAM,CAAC,KAAK,CACV,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EACrB,WAAW,CAAC,MAAM,CAAC,EACnB,mDAAmD,CACpD,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAEF,uEAAuE;AACvE,MAAM,UAAU,sBAAsB,CACpC,WAAyD;IAEzD,OAAO,iBAAiB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC"}

package/dist/domain/iampolicy/store.d.ts

@@ -38,9 +38,22 @@
  *     editions' filters read alike);
  *   - a typed not-found reads as `undefined`; any other storage failure
  *     propagates as the infrastructure fault it is (the ratified
- *     store-fault mapping — an outage must never read as "no grant").
+ *     store-fault mapping — an outage must never read as "no grant");
+ *   - a change record (change.ts) never changes what happens to the row:
+ *     `save` and `deleteById` behave identically with and without one.
+ *
+ * The change record. The grant path hands one to `save` and `deleteById`
+ * for every access row it writes or deletes. An implementation that keeps
+ * a permission history writes exactly one entry for it in the SAME atomic
+ * unit as the row change, and none when the row did not change: a held id
+ * raises DuplicatePolicyError before anything is written, and deleting an
+ * id that is not held records nothing. History equals the row changes
+ * exactly, with nothing to filter or heal. An implementation may keep no
+ * history and ignore the record; open source's adapter does. A driver
+ * written against the one-argument methods still satisfies this interface.
  */
 import type { IamPolicy } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
+import type { PolicyChangeRecord } from "./change.js";
 /**
  * Raised by `save` when the id is already held, so the grant path runs its
  * race arm (re-read the winner by triple; answer it as the duplicate).
@@ -53,10 +66,10 @@ export declare class DuplicatePolicyError extends Error {
     });
 }
 export interface IamPolicyStore {
-    /** Insert; a held id raises DuplicatePolicyError. */
-    save(policy: IamPolicy): Promise<void>;
-    /** Removes the row; no error when it does not exist. */
-    deleteById(id: string): Promise<void>;
+    /** Insert; a held id raises DuplicatePolicyError. `record`: the change to keep, when the row grants access. */
+    save(policy: IamPolicy, record?: PolicyChangeRecord): Promise<void>;
+    /** Removes the row; no error when it does not exist. `record`: as for `save`, kept only when a row was removed. */
+    deleteById(id: string, record?: PolicyChangeRecord): Promise<void>;
     findById(id: string): Promise<IamPolicy | undefined>;
     /** Every row naming the principal — the cleanup's principal-side arm. */
     findByPrincipal(principalKind: string, principalId: string): Promise<ReadonlyArray<IamPolicy>>;

package/dist/domain/iampolicy/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oDAAoD,CAAC;AAEpF;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAED,MAAM,WAAW,cAAc;IAC7B,qDAAqD;IACrD,IAAI,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,wDAAwD;IACxD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IACrD,yEAAyE;IACzE,eAAe,CACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACrC,mEAAmE;IACnE,cAAc,CACZ,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACrC,4FAA4F;IAC5F,0BAA0B,CACxB,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACrC,0HAA0H;IAC1H,2BAA2B,CACzB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,GAC/B,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACrC,8GAA8G;IAC9G,iCAAiC,CAC/B,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,GAC/B,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB;;;;OAIG;IACH,cAAc,CACZ,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;CACnC"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oDAAoD,CAAC;AAEpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAED,MAAM,WAAW,cAAc;IAC7B,+GAA+G;IAC/G,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,mHAAmH;IACnH,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IACrD,yEAAyE;IACzE,eAAe,CACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACrC,mEAAmE;IACnE,cAAc,CACZ,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACrC,4FAA4F;IAC5F,0BAA0B,CACxB,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACrC,0HAA0H;IAC1H,2BAA2B,CACzB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,GAC/B,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACrC,8GAA8G;IAC9G,iCAAiC,CAC/B,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,GAC/B,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB;;;;OAIG;IACH,cAAc,CACZ,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;CACnC"}

package/dist/domain/iampolicy/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/store.ts"],"names":[],"mappings":"AA4CA;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/store.ts"],"names":[],"mappings":"AA0DA;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF"}

package/dist/domain/identityaccount/constants.d.ts

@@ -40,6 +40,13 @@ export declare const ACCOUNT_ID_PREFIX = "ida";
  * no address — refused, never hashed.
  */
 export declare function accountIdFor(idpId: string): string;
+/**
+ * Whether `id` has an account id's shape, `ida_<...>`: a derived id and a
+ * minted one share it (see the header). A shape test, not an existence
+ * check. Its one use is to skip a read that could only miss, since no
+ * account carries an account id as its subject (resolve.ts).
+ */
+export declare function isAccountIdShaped(id: string): boolean;
 /**
  * The subject namespace of the trusted-local posture. An OIDC subject is
  * `<connection>|<id>` by Auth0 convention; `local|` claims the same shape
@@ -84,6 +91,14 @@ export declare function reservedSubjectMessage(idpId: string): string;
 export declare const ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE = "Identity account not found for the authenticated user";
 /** provisionMyAccount for a caller whose credential names no subject (UNAUTHENTICATED). */
 export declare const NO_IDP_ID_MESSAGE = "Cannot provision account: no IDP ID in authentication context";
+/**
+ * provisionMyAccount for a caller the platform's own sign-in did not vouch
+ * for (PERMISSION_DENIED): a person of an organization's identity provider,
+ * a platform client's user, a system lane's token, or any caller that is
+ * not a person. Names no account: the refusal answers before the store is
+ * asked about the credential's subject.
+ */
+export declare const NOT_A_DIRECT_SIGN_IN_MESSAGE = "Cannot provision account: this RPC provisions a person signing in through this platform's own sign-in, and another lane vouched for this credential";
 /** provisionMyAccount when the issuer's userinfo cannot be read (UNAVAILABLE); the cause follows. */
 export declare const USERINFO_UNAVAILABLE_PREFIX = "Failed to fetch user profile from identity provider: ";
 /** get / getByEmail / getByIdpId / getActorInfo / update / delete on a missing account (NOT_FOUND). */

package/dist/domain/identityaccount/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKlD;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;;;;GASG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAKtD;AAsBD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,aAAa,CAAC;AAEjD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,aAAa,CAAC;AAEzD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5D;AAMD,uDAAuD;AACvD,eAAO,MAAM,oCAAoC,0DACQ,CAAC;AAE1D,2FAA2F;AAC3F,eAAO,MAAM,iBAAiB,kEACmC,CAAC;AAElE,qGAAqG;AACrG,eAAO,MAAM,2BAA2B,0DACiB,CAAC;AAE1D,uGAAuG;AACvG,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,yCACC,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,gFACmC,CAAC;AAEhF,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAEnE"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKlD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;;;;GASG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAKtD;AAsBD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,aAAa,CAAC;AAEjD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,aAAa,CAAC;AAEzD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5D;AAMD,uDAAuD;AACvD,eAAO,MAAM,oCAAoC,0DACQ,CAAC;AAE1D,2FAA2F;AAC3F,eAAO,MAAM,iBAAiB,kEACmC,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,wJAC8G,CAAC;AAExJ,qGAAqG;AACrG,eAAO,MAAM,2BAA2B,0DACiB,CAAC;AAE1D,uGAAuG;AACvG,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,yCACC,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,gFACmC,CAAC;AAEhF,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAEnE"}

package/dist/domain/identityaccount/constants.js

@@ -12,6 +12,15 @@ export function accountIdFor(idpId) {
     }
     return derivedId(ACCOUNT_ID_PREFIX, idpId);
 }
+/**
+ * Whether `id` has an account id's shape, `ida_<...>`: a derived id and a
+ * minted one share it (see the header). A shape test, not an existence
+ * check. Its one use is to skip a read that could only miss, since no
+ * account carries an account id as its subject (resolve.ts).
+ */
+export function isAccountIdShaped(id) {
+    return id.startsWith(`${ACCOUNT_ID_PREFIX}_`);
+}
 /**
  * The subject namespace of the trusted-local posture. An OIDC subject is
  * `<connection>|<id>` by Auth0 convention; `local|` claims the same shape
@@ -90,6 +99,14 @@ export function reservedSubjectMessage(idpId) {
 export const ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE = "Identity account not found for the authenticated user";
 /** provisionMyAccount for a caller whose credential names no subject (UNAUTHENTICATED). */
 export const NO_IDP_ID_MESSAGE = "Cannot provision account: no IDP ID in authentication context";
+/**
+ * provisionMyAccount for a caller the platform's own sign-in did not vouch
+ * for (PERMISSION_DENIED): a person of an organization's identity provider,
+ * a platform client's user, a system lane's token, or any caller that is
+ * not a person. Names no account: the refusal answers before the store is
+ * asked about the credential's subject.
+ */
+export const NOT_A_DIRECT_SIGN_IN_MESSAGE = "Cannot provision account: this RPC provisions a person signing in through this platform's own sign-in, and another lane vouched for this credential";
 /** provisionMyAccount when the issuer's userinfo cannot be read (UNAVAILABLE); the cause follows. */
 export const USERINFO_UNAVAILABLE_PREFIX = "Failed to fetch user profile from identity provider: ";
 /** get / getByEmail / getByIdpId / getActorInfo / update / delete on a missing account (NOT_FOUND). */

package/dist/domain/identityaccount/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/constants.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAE7D,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEvC;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAE5C,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,OAAO,GAAG,mBAAmB,GAAG,UAAU,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,OAAO,CAAC,MAAsB;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACnD,OAAO,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACxC,CAAC;QACvB,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAEjD,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,UAAU,CAAC;AAEzD,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,OAAO,KAAK,CAAC,UAAU,CAAC,8BAA8B,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,YAAY,KAAK,eAAe,8BAA8B,6DAA6D,CAAC;AACrI,CAAC;AAED,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,uDAAuD;AACvD,MAAM,CAAC,MAAM,oCAAoC,GAC/C,uDAAuD,CAAC;AAE1D,2FAA2F;AAC3F,MAAM,CAAC,MAAM,iBAAiB,GAC5B,+DAA+D,CAAC;AAElE,qGAAqG;AACrG,MAAM,CAAC,MAAM,2BAA2B,GACtC,uDAAuD,CAAC;AAE1D,uGAAuG;AACvG,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,OAAO,+BAA+B,MAAM,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,sCAAsC,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAC1C,6EAA6E,CAAC;AAEhF,MAAM,UAAU,8BAA8B,CAAC,MAAc;IAC3D,OAAO,GAAG,MAAM,wBAAwB,+BAA+B,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,aAAqB;IACzD,OAAO,iDAAiD,aAAa,mDAAmD,CAAC;AAC3H,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/identityaccount/constants.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAE7D,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEvC;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAU;IAC1C,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,iBAAiB,GAAG,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAE5C,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,OAAO,GAAG,mBAAmB,GAAG,UAAU,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,OAAO,CAAC,MAAsB;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACnD,OAAO,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACxC,CAAC;QACvB,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAEjD,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,UAAU,CAAC;AAEzD,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,OAAO,KAAK,CAAC,UAAU,CAAC,8BAA8B,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,YAAY,KAAK,eAAe,8BAA8B,6DAA6D,CAAC;AACrI,CAAC;AAED,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,uDAAuD;AACvD,MAAM,CAAC,MAAM,oCAAoC,GAC/C,uDAAuD,CAAC;AAE1D,2FAA2F;AAC3F,MAAM,CAAC,MAAM,iBAAiB,GAC5B,+DAA+D,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,qJAAqJ,CAAC;AAExJ,qGAAqG;AACrG,MAAM,CAAC,MAAM,2BAA2B,GACtC,uDAAuD,CAAC;AAE1D,uGAAuG;AACvG,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,OAAO,+BAA+B,MAAM,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,sCAAsC,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAC1C,6EAA6E,CAAC;AAEhF,MAAM,UAAU,8BAA8B,CAAC,MAAc;IAC3D,OAAO,GAAG,MAAM,wBAAwB,+BAA+B,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,aAAqB;IACzD,OAAO,iDAAiD,aAAa,mDAAmD,CAAC;AAC3H,CAAC"}

package/dist/domain/identityaccount/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/controller.ts"],"names":[],"mappings":"AAmDA,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAKzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAc3H,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAGxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AA8BjG,OAAO,KAAK,EACV,kBAAkB,EAClB,aAAa,EAGb,wBAAwB,EACzB,MAAM,mBAAmB,CAAC;AAkB3B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8GAA8G;IAC9G,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,gFAAgF;IAChF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;CAC7E;AAED,MAAM,WAAW,6BAA8B,SAAQ,qBAAqB;IAC1E,QAAQ,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAC/C,2FAA2F;IAC3F,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACpD,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,SAAS,CAAC;CACrD;AAED,4EAA4E;AAC5E,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,6BAA6B,GAClC,IAAI,CAkDN;AA2DD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,qBAAqB,EAC3B,IAAI,EAAE,eAAe,GACpB,aAAa,CAmBf"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/identityaccount/controller.ts"],"names":[],"mappings":"AAqDA,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAKzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAc3H,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAGxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AA+BjG,OAAO,KAAK,EACV,kBAAkB,EAClB,aAAa,EAGb,wBAAwB,EACzB,MAAM,mBAAmB,CAAC;AAkB3B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8GAA8G;IAC9G,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,gFAAgF;IAChF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;CAC7E;AAED,MAAM,WAAW,6BAA8B,SAAQ,qBAAqB;IAC1E,QAAQ,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAC/C,2FAA2F;IAC3F,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACpD,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,SAAS,CAAC;CACrD;AAED,4EAA4E;AAC5E,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,6BAA6B,GAClC,IAAI,CAkDN;AA2DD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,qBAAqB,EAC3B,IAAI,EAAE,eAAe,GACpB,aAAa,CAmBf"}