@stigmer/server 3.40.1 → 3.41.0

package/dist/domain/apikey/verifier.js

@@ -34,6 +34,27 @@
  * actor the key recorded at minting. The credential checks run first, so
  * a revoked or expired key never reaches the account store.
  *
+ * One stamp names nobody by construction: the operator's from before
+ * sign-in was turned on (stigmer/stigmer#1169). A key created while the
+ * server trusted every caller carries the operator's email, or "system",
+ * and once sign-in is on the operator is a different account, derived
+ * from the issuer's subject. Carrying the key to either account was
+ * weighed and refused. Carried to the pre-sign-in account, it would be a
+ * live credential no signed-in person could see or revoke, since only a
+ * key's owner may. Carried to the signed-in account, a credential would
+ * change hands on an email match. So such a key is refused by name:
+ * UNAUTHENTICATED, API_KEY_CREATED_BEFORE_SIGN_IN_MESSAGE and the
+ * API_KEY_CREATED_BEFORE_SIGN_IN reason, which the CLI turns into the two
+ * commands that fix it. The alternative, admitting a bare email, made
+ * every later check fail as a misleading "Permission denied". The
+ * question is asked only of a stamp that resolved to nobody, through the
+ * identity-account domain's `isPreSignInOperatorStamp`, which makes no
+ * read for an account-id stamp. This verifier is composed only under an
+ * authentication posture (boot/compose.ts), so a server that trusts every
+ * caller never reaches the refusal. The reason is documented where a
+ * key's authentication is (apis/ai/stigmer/iam/apikey/v1/README.md): it
+ * can refuse any RPC, so no single RPC comment owns it.
+ *
  * An accepted key's use is then recorded on its status.last_used_at
  * (identity/credential-use.ts): at most once a resolution, judged from the
  * row this read already holds, written atomically through
@@ -47,13 +68,21 @@ import { timestampDate } from "@bufbuild/protobuf/wkt";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ApiKeySchema, ApiKeyStatusSchema } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/api_pb";
 import { recordCredentialUse } from "../../identity/credential-use.js";
-import { identityIdForSubject } from "../identityaccount/resolve.js";
+import { unauthenticatedWithReasonError } from "../../pipeline/errors.js";
+import { identityIdForSubject, isPreSignInOperatorStamp, } from "../identityaccount/resolve.js";
 import { hashApiKey, isApiKeyToken } from "./keymaterial.js";
 import { findApiKeyByHash } from "./lookup.js";
 /** Java classifyAuthError's fallback arm — the unknown/revoked-key copy. */
 export const INVALID_TOKEN_MESSAGE = "invalid token";
 /** Java classifyAuthError's "expired" arm. */
 export const TOKEN_EXPIRED_MESSAGE = "token has expired";
+/**
+ * The ErrorInfo reason a key created before sign-in was turned on is
+ * refused with (stigmer/stigmer#1169). Wire contract, no metadata.
+ */
+export const API_KEY_CREATED_BEFORE_SIGN_IN = "API_KEY_CREATED_BEFORE_SIGN_IN";
+/** The copy of that refusal: what happened and what to do. */
+export const API_KEY_CREATED_BEFORE_SIGN_IN_MESSAGE = "this API key was created before sign-in was turned on and no longer authenticates anyone; sign in and create a new key";
 export function newApiKeyIdentityVerifier(deps) {
     const { store, accounts, logger } = deps;
     return {
@@ -79,6 +108,10 @@ export function newApiKeyIdentityVerifier(deps) {
                 throw new ConnectError(INVALID_TOKEN_MESSAGE, Code.Unauthenticated);
             }
             const identityId = await identityIdForSubject(accounts, owner.id);
+            if (identityId === owner.id &&
+                (await isPreSignInOperatorStamp(accounts, owner.id))) {
+                throw unauthenticatedWithReasonError(API_KEY_CREATED_BEFORE_SIGN_IN_MESSAGE, { reason: API_KEY_CREATED_BEFORE_SIGN_IN });
+            }
             await recordKeyUse(store, logger, key, now);
             return {
                 identityId,

package/dist/domain/apikey/verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../src/domain/apikey/verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AAQnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAEvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAErD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAazD,MAAM,UAAU,yBAAyB,CACvC,IAAwB;IAExB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzC,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;YACtC,IAAI,SAAS,KAAK,SAAS,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC;gBAC/D,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;YACtD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC3C,oEAAoE;gBACpE,mEAAmE;gBACnE,+DAA+D;gBAC/D,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YAClE,MAAM,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5C,OAAO;gBACL,UAAU;gBACV,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,KAAK;gBACf,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,SAAS,YAAY,CACnB,KAAY,EACZ,MAAc,EACd,GAAW,EACX,GAAS;IAET,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IAClC,OAAO,mBAAmB,CAAC;QACzB,UAAU,EAAE,SAAS;QACrB,EAAE;QACF,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU;QAClC,GAAG;QACH,MAAM;QACN,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE;YACvE,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC,CAAC;KACL,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../src/domain/apikey/verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AAQnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAE1E,OAAO,EACL,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAErD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAEzD;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,gCAAgC,CAAC;AAE/E,8DAA8D;AAC9D,MAAM,CAAC,MAAM,sCAAsC,GACjD,wHAAwH,CAAC;AAa3H,MAAM,UAAU,yBAAyB,CACvC,IAAwB;IAExB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzC,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;YACtC,IAAI,SAAS,KAAK,SAAS,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC;gBAC/D,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;YACtD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC3C,oEAAoE;gBACpE,mEAAmE;gBACnE,+DAA+D;gBAC/D,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YAClE,IACE,UAAU,KAAK,KAAK,CAAC,EAAE;gBACvB,CAAC,MAAM,wBAAwB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,EACpD,CAAC;gBACD,MAAM,8BAA8B,CAClC,sCAAsC,EACtC,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAC3C,CAAC;YACJ,CAAC;YACD,MAAM,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5C,OAAO;gBACL,UAAU;gBACV,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,KAAK;gBACf,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,SAAS,YAAY,CACnB,KAAY,EACZ,MAAc,EACd,GAAW,EACX,GAAS;IAET,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IAClC,OAAO,mBAAmB,CAAC;QACzB,UAAU,EAAE,SAAS;QACrB,EAAE;QACF,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU;QAClC,GAAG;QACH,MAAM;QACN,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE;YACvE,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC,CAAC;KACL,CAAC,CAAC;AACL,CAAC"}

package/dist/domain/channelapp/controller.d.ts

@@ -19,9 +19,10 @@
  * loads, then authorizes the loaded app exactly as `get` would
  * (AuthorizeResolvedTarget). listByOrg narrows the organization's apps
  * through the composed list read scope to the ones a `get` would return:
- * the model shows a channel app to its owners, explicit grants and the
- * organization's admins, never to plain members or viewers
- * (fga/model/agentic/channel_app.fga, stigmer/stigmer#1384). Per-RPC
+ * the model shows a channel app to the organization's admins and explicit
+ * grants, never to plain members or viewers, and never to a creator who is
+ * no longer an admin (fga/model/agentic/channel_app.fga,
+ * stigmer/stigmer#1384, #1409). Per-RPC
  * posture: docs/authorization-coverage.md §13.
  *
  * Proven by channelapp.conformance.test.ts (CONFORMANCE_TARGET=local)

package/dist/domain/channelapp/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/channelapp/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAmBzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AACjG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AA6CpE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAUtD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kHAAkH;IAClH,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,qFAAqF;IACrF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC5E,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,yHAAyH;IACzH,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;CACnD;AAED,uEAAuE;AACvE,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,wBAAwB,GAC7B,IAAI,CAYN"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/channelapp/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAmBzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AACjG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AA6CpE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAUtD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kHAAkH;IAClH,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,qFAAqF;IACrF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC5E,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,yHAAyH;IACzH,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;CACnD;AAED,uEAAuE;AACvE,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,wBAAwB,GAC7B,IAAI,CAYN"}

package/dist/domain/channelapp/controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/channelapp/controller.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yDAAyD,CAAC;AAE3F,OAAO,EAAE,2BAA2B,EAAE,MAAM,6DAA6D,CAAC;AAC1G,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,EAAE,iBAAiB,EAAE,MAAM,wDAAwD,CAAC;AAU3F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAG9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,8BAA8B,GAC/B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AAExF,OAAO,EACL,iCAAiC,EACjC,wCAAwC,EACxC,wCAAwC,EACxC,gCAAgC,EAChC,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AAcpB,uEAAuE;AACvE,MAAM,UAAU,0BAA0B,CACxC,MAAqB,EACrB,IAA8B;IAE9B,MAAM,CAAC,OAAO,CAAC,2BAA2B,EAAE;QAC1C,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC1C,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QACtD,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC5C,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KAC3D,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE;QACxC,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC5D,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;KACnD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,IAA8B,EAC9B,GAAe,EACf,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,gBAAgB,EAChB,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAA0B,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC;SACzE,OAAO,CACN,gBAAgB,CACd,2BAA2B,CAAC,MAAM,CAAC,MAAM,EACzC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,wCAAwC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAC1E;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,MAAM,CACnB,IAA8B,EAC9B,GAAe,EACf,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,gBAAgB,EAChB,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAA0B,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC;SACzE,OAAO,CACN,gBAAgB,CACd,2BAA2B,CAAC,MAAM,CAAC,MAAM,EACzC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,OAAO,CAAC,gCAAgC,EAAE,CAAC;SAC3C,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CACN,wCAAwC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAC1E;SACA,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,KAAK,CAClB,IAA8B,EAC9B,GAAe,EACf,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,gBAAgB,EAChB,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAA0B,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC;SACxE,OAAO,CACN,gBAAgB,CACd,2BAA2B,CAAC,MAAM,CAAC,KAAK,EACxC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,OAAO,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,8CAA8C,CAAC,EACzD,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,YAAY;QACjB,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAClC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB,CAAC,gBAAgB,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,IAA8B,EAC9B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,2BAA2B,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAC/C,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,WAAW,CACf,mBAAmB,EACnB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,2BAA2B,CAAC,MAAM,CAAC,MAAM,EACzC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;SACnE,OAAO,CAAC,iCAAiC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SACnE,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,OAAO,CACN,gCAAgC,CAG9B,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAC7D;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,yCAAyC,CAAC,EACpD,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,OAAqB,CAAC;IAClC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wDAAwD;AACxD,KAAK,UAAU,GAAG,CAChB,IAA8B,EAC9B,EAAiB,EACjB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,yBAAyB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAC1C,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,gBAAgB,EAChB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,yBAAyB,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CACxE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;SACxD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAe,CAAC;IAC1D,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kEAAkE;AAClE,KAAK,UAAU,cAAc,CAC3B,IAA8B,EAC9B,GAAyB,EACzB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,yBAAyB,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EACrD,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,6BAA6B,EAAE,IAAI,CAAC,MAAM,CAAC;SAC1C,OAAO,CACN,gBAAgB,CACd,yBAAyB,CAAC,MAAM,CAAC,cAAc,EAC/C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;SAC7D,OAAO,CACN,8BAA8B,CAC5B,IAAI,CAAC,UAAU,EACf,oBAAoB,CAAC,yBAAyB,CAAC,MAAM,CAAC,GAAG,CAAC,CAC3D,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAe,CAAC;IAC1D,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC;;;;GAIG;AACH,KAAK,UAAU,SAAS,CACtB,IAA8B,EAC9B,GAA8B,EAC9B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAChD,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,wBAAwB,EACxB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,yBAAyB,CAAC,MAAM,CAAC,SAAS,EAC1C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SACtE,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,sCAAsC,CAAC,EACjD,sCAAsC,CACvC,CAAC;IACJ,CAAC;IACD,OAAO,MAAqB,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,gBAAgB,CACvB,KAAY,EACZ,aAAwC,EACxC,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,KAAK,CAAC,OAAO,CACX,GAEC;YAED,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YAE1B,IAAI,IAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;YAC3D,CAAC;YAED,MAAM,SAAS,GAAiB,EAAE,CAAC;YACnC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;gBACzB,IAAI,GAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,GAAG,GAAG,UAAU,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBAC5C,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;oBACxD,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;oBACtC,SAAS;gBACX,CAAC;gBACD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,uBAAuB,CACxC,aAAa,EACb,GAAG,CAAC,cAAc,EAClB,eAAe,CAAC,WAAW,EAC3B,SAAS,EACT,EAAE,CACH,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACjB,oBAAoB,CAClB,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EACrC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CACtC,CACF,CAAC;YAEF,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,iBAAiB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/channelapp/controller.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yDAAyD,CAAC;AAE3F,OAAO,EAAE,2BAA2B,EAAE,MAAM,6DAA6D,CAAC;AAC1G,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,EAAE,iBAAiB,EAAE,MAAM,wDAAwD,CAAC;AAU3F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAG9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,8BAA8B,GAC/B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AAExF,OAAO,EACL,iCAAiC,EACjC,wCAAwC,EACxC,wCAAwC,EACxC,gCAAgC,EAChC,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AAcpB,uEAAuE;AACvE,MAAM,UAAU,0BAA0B,CACxC,MAAqB,EACrB,IAA8B;IAE9B,MAAM,CAAC,OAAO,CAAC,2BAA2B,EAAE;QAC1C,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC1C,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QACtD,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC5C,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KAC3D,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE;QACxC,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC5D,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;KACnD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,IAA8B,EAC9B,GAAe,EACf,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,gBAAgB,EAChB,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAA0B,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC;SACzE,OAAO,CACN,gBAAgB,CACd,2BAA2B,CAAC,MAAM,CAAC,MAAM,EACzC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,wCAAwC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAC1E;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,MAAM,CACnB,IAA8B,EAC9B,GAAe,EACf,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,gBAAgB,EAChB,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAA0B,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC;SACzE,OAAO,CACN,gBAAgB,CACd,2BAA2B,CAAC,MAAM,CAAC,MAAM,EACzC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,OAAO,CAAC,gCAAgC,EAAE,CAAC;SAC3C,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CACN,wCAAwC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAC1E;SACA,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,KAAK,CAClB,IAA8B,EAC9B,GAAe,EACf,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,gBAAgB,EAChB,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAA0B,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC;SACxE,OAAO,CACN,gBAAgB,CACd,2BAA2B,CAAC,MAAM,CAAC,KAAK,EACxC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,OAAO,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,8CAA8C,CAAC,EACzD,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,YAAY;QACjB,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAClC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB,CAAC,gBAAgB,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,IAA8B,EAC9B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,2BAA2B,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAC/C,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,WAAW,CACf,mBAAmB,EACnB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,2BAA2B,CAAC,MAAM,CAAC,MAAM,EACzC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;SACnE,OAAO,CAAC,iCAAiC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SACnE,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,OAAO,CACN,gCAAgC,CAG9B,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAC7D;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,yCAAyC,CAAC,EACpD,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,OAAqB,CAAC;IAClC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wDAAwD;AACxD,KAAK,UAAU,GAAG,CAChB,IAA8B,EAC9B,EAAiB,EACjB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,yBAAyB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAC1C,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,gBAAgB,EAChB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,yBAAyB,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CACxE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;SACxD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAe,CAAC;IAC1D,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kEAAkE;AAClE,KAAK,UAAU,cAAc,CAC3B,IAA8B,EAC9B,GAAyB,EACzB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,yBAAyB,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EACrD,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,6BAA6B,EAAE,IAAI,CAAC,MAAM,CAAC;SAC1C,OAAO,CACN,gBAAgB,CACd,yBAAyB,CAAC,MAAM,CAAC,cAAc,EAC/C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;SAC7D,OAAO,CACN,8BAA8B,CAC5B,IAAI,CAAC,UAAU,EACf,oBAAoB,CAAC,yBAAyB,CAAC,MAAM,CAAC,GAAG,CAAC,CAC3D,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAe,CAAC;IAC1D,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC;;;;GAIG;AACH,KAAK,UAAU,SAAS,CACtB,IAA8B,EAC9B,GAA8B,EAC9B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAChD,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,wBAAwB,EACxB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,yBAAyB,CAAC,MAAM,CAAC,SAAS,EAC1C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SACtE,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,sCAAsC,CAAC,EACjD,sCAAsC,CACvC,CAAC;IACJ,CAAC;IACD,OAAO,MAAqB,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,gBAAgB,CACvB,KAAY,EACZ,aAAwC,EACxC,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,KAAK,CAAC,OAAO,CACX,GAEC;YAED,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YAE1B,IAAI,IAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;YAC3D,CAAC;YAED,MAAM,SAAS,GAAiB,EAAE,CAAC;YACnC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;gBACzB,IAAI,GAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,GAAG,GAAG,UAAU,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBAC5C,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;oBACxD,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;oBACtC,SAAS;gBACX,CAAC;gBACD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,uBAAuB,CACxC,aAAa,EACb,GAAG,CAAC,cAAc,EAClB,eAAe,CAAC,WAAW,EAC3B,SAAS,EACT,EAAE,CACH,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACjB,oBAAoB,CAClB,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EACrC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CACtC,CACF,CAAC;YAEF,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,iBAAiB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/executioncontext/steps.d.ts

@@ -96,7 +96,8 @@ export declare function newLoadByExecutionIdStep(store: Store): PipelineStep<Get
  * Ordered before the duplicate check so an unauthorized caller learns
  * nothing about which execution ids exist.
  *
- * OSS byte-identity: the permissive authorizer allows every check, so the
+ * OSS byte-identity: the trusted-local authorizer allows every check on
+ * an Organization that exists (trusted-local-authorizer.ts), so the
  * single-user posture is unchanged (the rosters prove it).
  */
 export declare function newAuthorizeExecutionContextCreateStep(authorizer: Authorizer): PipelineStep<typeof ExecutionContextSchema>;

package/dist/domain/executioncontext/steps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/executioncontext/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AAIvG,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,iEAAiE,CAAC;AAMvH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAEpE,OAAO,KAAK,EAAE,UAAU,EAAiB,MAAM,gCAAgC,CAAC;AAOhF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAI/D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAMtD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,IAAI,YAAY,CAC3D,OAAO,sBAAsB,CAC9B,CAYA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,0BAA0B,CACxC,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAkD7C;AAOD,KAAK,oBAAoB,GACvB,OAAO,+BAA+B,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC;AAEvE;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,KAAK,GACX,YAAY,CAAC,oBAAoB,CAAC,CA8BpC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sCAAsC,CACpD,UAAU,EAAE,UAAU,GACrB,YAAY,CAAC,OAAO,sBAAsB,CAAC,CA+C7C"}
+{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/executioncontext/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AAIvG,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,iEAAiE,CAAC;AAMvH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAEpE,OAAO,KAAK,EAAE,UAAU,EAAiB,MAAM,gCAAgC,CAAC;AAOhF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAI/D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAMtD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,IAAI,YAAY,CAC3D,OAAO,sBAAsB,CAC9B,CAYA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,0BAA0B,CACxC,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAkD7C;AAOD,KAAK,oBAAoB,GACvB,OAAO,+BAA+B,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC;AAEvE;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,KAAK,GACX,YAAY,CAAC,oBAAoB,CAAC,CA8BpC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sCAAsC,CACpD,UAAU,EAAE,UAAU,GACrB,YAAY,CAAC,OAAO,sBAAsB,CAAC,CA+C7C"}

package/dist/domain/executioncontext/steps.js

@@ -176,7 +176,8 @@ export function newLoadByExecutionIdStep(store) {
  * Ordered before the duplicate check so an unauthorized caller learns
  * nothing about which execution ids exist.
  *
- * OSS byte-identity: the permissive authorizer allows every check, so the
+ * OSS byte-identity: the trusted-local authorizer allows every check on
+ * an Organization that exists (trusted-local-authorizer.ts), so the
  * single-user posture is unchanged (the rosters prove it).
  */
 export function newAuthorizeExecutionContextCreateStep(authorizer) {

package/dist/domain/executioncontext/steps.js.map

@@ -1 +1 @@
-{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/executioncontext/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AAMvG,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAG1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEpE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAExB;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,6BAA6B;IAG3C,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,OAAO,CAAC,GAAkD;YACxD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;YACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBACpC,MAAM,oBAAoB,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,0BAA0B,CACxC,aAA4B,EAC5B,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,KAAK,CAAC,OAAO,CACX,GAAkD;YAElD,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC;YACxB,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;YAC3B,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzD,OAAO;YACT,CAAC;YAED,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC/B,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5B,MAAM,CAAC,IAAI,CACT,kFAAkF,EAClF,EAAE,WAAW,EAAE,EAAE,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,EAAE,CAC5C,CAAC;gBACJ,CAAC;gBACD,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;YACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;oBAC1C,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO;YACT,CAAC;YAED,IAAI,MAA2B,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,aAAa,CAAC,kBAAkB,CAC7C,MAAM,EACN,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,CACxD,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;YAC5D,CAAC;YACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC9B,KAAK,CAAC,KAAK,GAAG,WAAW,CAAC;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,iBAAiB,CAAC,IAAoC;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;AACvE,CAAC;AAKD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAY;IAEZ,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,KAAK,CAAC,OAAO,CAAC,GAAyC;YACrD,MAAM,KAAK,GAAqC,GAAG,CAAC,KAAK,CAAC;YAC1D,IAAI,KAAK,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;gBAC7B,MAAM,oBAAoB,CAAC,0BAA0B,CAAC,CAAC;YACzD,CAAC;YAED,IAAI,gBAAkC,CAAC;YACvC,IAAI,CAAC;gBACH,gBAAgB,GAAG,MAAM,KAAK,CAAC,WAAW,CACxC,GAAG,CAAC,eAAe,EACnB,kBAAkB,EAClB,KAAK,CAAC,WAAW,EACjB,sBAAsB,CACvB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,MAAM,aAAa,CACjB,mBAAmB,EACnB,gBAAgB,KAAK,CAAC,WAAW,EAAE,CACpC,CAAC;gBACJ,CAAC;gBACD,MAAM,aAAa,CAAC,KAAK,EAAE,mCAAmC,CAAC,CAAC;YAClE,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sCAAsC,CACpD,UAAsB;IAEtB,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,KAAK,CAAC,OAAO,CACX,GAAkD;YAElD,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC;YAClC,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,sDAAsD;YAChE,CAAC;YACD,IAAI,QAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE;oBAC5C,UAAU,EAAE,aAAa,CAAC,uBAAuB;oBACjD,YAAY,EAAE,eAAe,CAAC,YAAY;oBAC1C,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;iBAC7C,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CACjB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACzD,+DAA+D,CAChE,CAAC;YACJ,CAAC;YACD,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACtB,KAAK,OAAO;oBACV,OAAO;gBACT,KAAK,MAAM,CAAC;gBACZ,KAAK,WAAW;oBACd,MAAM,IAAI,YAAY,CACpB,+DAA+D,EAC/D,IAAI,CAAC,gBAAgB,CACtB,CAAC;gBACJ,KAAK,aAAa;oBAChB,MAAM,aAAa,CACjB,QAAQ,CAAC,KAAK,EACd,+DAA+D,CAChE,CAAC;gBACJ,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,UAAU,GAAU,QAAQ,CAAC;oBACnC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAC3D,+DAA+D,CAChE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/executioncontext/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AAMvG,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAG1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEpE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAExB;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,6BAA6B;IAG3C,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,OAAO,CAAC,GAAkD;YACxD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;YACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBACpC,MAAM,oBAAoB,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,0BAA0B,CACxC,aAA4B,EAC5B,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,KAAK,CAAC,OAAO,CACX,GAAkD;YAElD,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC;YACxB,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;YAC3B,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzD,OAAO;YACT,CAAC;YAED,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC/B,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5B,MAAM,CAAC,IAAI,CACT,kFAAkF,EAClF,EAAE,WAAW,EAAE,EAAE,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,EAAE,CAC5C,CAAC;gBACJ,CAAC;gBACD,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;YACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;oBAC1C,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO;YACT,CAAC;YAED,IAAI,MAA2B,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,aAAa,CAAC,kBAAkB,CAC7C,MAAM,EACN,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,CACxD,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;YAC5D,CAAC;YACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC9B,KAAK,CAAC,KAAK,GAAG,WAAW,CAAC;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,iBAAiB,CAAC,IAAoC;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;AACvE,CAAC;AAKD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAY;IAEZ,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,KAAK,CAAC,OAAO,CAAC,GAAyC;YACrD,MAAM,KAAK,GAAqC,GAAG,CAAC,KAAK,CAAC;YAC1D,IAAI,KAAK,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;gBAC7B,MAAM,oBAAoB,CAAC,0BAA0B,CAAC,CAAC;YACzD,CAAC;YAED,IAAI,gBAAkC,CAAC;YACvC,IAAI,CAAC;gBACH,gBAAgB,GAAG,MAAM,KAAK,CAAC,WAAW,CACxC,GAAG,CAAC,eAAe,EACnB,kBAAkB,EAClB,KAAK,CAAC,WAAW,EACjB,sBAAsB,CACvB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,MAAM,aAAa,CACjB,mBAAmB,EACnB,gBAAgB,KAAK,CAAC,WAAW,EAAE,CACpC,CAAC;gBACJ,CAAC;gBACD,MAAM,aAAa,CAAC,KAAK,EAAE,mCAAmC,CAAC,CAAC;YAClE,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sCAAsC,CACpD,UAAsB;IAEtB,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,KAAK,CAAC,OAAO,CACX,GAAkD;YAElD,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC;YAClC,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,sDAAsD;YAChE,CAAC;YACD,IAAI,QAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE;oBAC5C,UAAU,EAAE,aAAa,CAAC,uBAAuB;oBACjD,YAAY,EAAE,eAAe,CAAC,YAAY;oBAC1C,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;iBAC7C,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CACjB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACzD,+DAA+D,CAChE,CAAC;YACJ,CAAC;YACD,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACtB,KAAK,OAAO;oBACV,OAAO;gBACT,KAAK,MAAM,CAAC;gBACZ,KAAK,WAAW;oBACd,MAAM,IAAI,YAAY,CACpB,+DAA+D,EAC/D,IAAI,CAAC,gBAAgB,CACtB,CAAC;gBACJ,KAAK,aAAa;oBAChB,MAAM,aAAa,CACjB,QAAQ,CAAC,KAAK,EACd,+DAA+D,CAChE,CAAC;gBACJ,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,UAAU,GAAU,QAAQ,CAAC;oBACnC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAC3D,+DAA+D,CAChE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/iampolicy/access-lists.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-lists.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/access-lists.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EACV,kBAAkB,EAClB,eAAe,EAEhB,MAAM,mDAAmD,CAAC;AAQ3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAM9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAQjD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,cAAc,EACxB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,OAAO,GACxB,OAAO,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,CAsBxC;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,uBAAuB,CACrB,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,GACzB,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;CACrD;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,cAAc,EACxB,eAAe,EAAE,wBAAwB,EACzC,gBAAgB,EAAE,gBAAgB,GAAG,SAAS,EAC9C,SAAS,EAAE,aAAa,CAAC,cAAc,CAAC,GACvC,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAmEzC"}
+{"version":3,"file":"access-lists.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/access-lists.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EACV,kBAAkB,EAClB,eAAe,EAEhB,MAAM,mDAAmD,CAAC;AAQ3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAM9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAWjD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,cAAc,EACxB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,OAAO,GACxB,OAAO,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,CAsBxC;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,uBAAuB,CACrB,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,GACzB,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;CACrD;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,cAAc,EACxB,eAAe,EAAE,wBAAwB,EACzC,gBAAgB,EAAE,gBAAgB,GAAG,SAAS,EAC9C,SAAS,EAAE,aAAa,CAAC,cAAc,CAAC,GACvC,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CA+EzC"}

package/dist/domain/iampolicy/access-lists.js

@@ -24,6 +24,17 @@
  * with the id standing in as the display name, the Java `enrich()`
  * fallback shape.
  *
+ * A resource's list names only people who belong to its organization.
+ * The model bounds every direct grant on an organization-scoped object by
+ * the organization (fga/model/tenancy/organization.fga `affiliated`), and
+ * the grant path revokes a departed person's shares, but it keeps their
+ * authorship row (grant-path.ts), which reaches nothing while they are
+ * away. A row that grants nothing is not access, so an account that holds
+ * no row on the resource's organization is left out of that resource's
+ * list, read from the same rows (one indexed `findByPrincipal` per listed
+ * account). An organization's own list is its roles and is never
+ * filtered.
+ *
  * Every entry names its grantee exactly as the rows hold it: kind, id AND
  * the relation qualifier (`team:<id>#member`), and entries group by all
  * three. A revoke matches the qualifier exactly (grant-path.ts
@@ -36,6 +47,8 @@ import { ApiResourceRefViewSchema, PrincipalAccessSchema, RoleGrantSchema, } fro
 import { ApiResourceRefSchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
 import { kindByEnumName, kindEnumName, } from "../../pipeline/apiresource-meta.js";
 import { assignableRelations, roleInfoFromRelation } from "./roles.js";
+const ACCOUNT_KIND = kindEnumName(ApiResourceKind.identity_account);
+const ORGANIZATION_KIND = kindEnumName(ApiResourceKind.organization);
 /** The Java resolver's bounds: ≤5 steps, platform terminates the walk. */
 const MAX_HIERARCHY_DEPTH = 5;
 const TERMINAL_KINDS = new Set([
@@ -82,9 +95,17 @@ export async function buildPrincipalAccessList(policies, displayResolver, princi
     if (grants.length === 0) {
         return [];
     }
-    const enriched = await resolvePrincipalViews(grants.map((g) => g.policy), displayResolver, principalDisplay);
+    const departed = await accountsOutsideOrganization(policies, hierarchy, grants.map((grant) => grant.policy));
+    const current = grants.filter((grant) => {
+        const principal = grant.policy.spec?.principal;
+        return !(principal?.kind === ACCOUNT_KIND && departed.has(principal.id));
+    });
+    if (current.length === 0) {
+        return [];
+    }
+    const enriched = await resolvePrincipalViews(current.map((g) => g.policy), displayResolver, principalDisplay);
     const grouped = new Map();
-    for (const grant of grants) {
+    for (const grant of current) {
         const principal = grant.policy.spec?.principal;
         if (principal === undefined) {
             continue;
@@ -115,6 +136,40 @@ export async function buildPrincipalAccessList(policies, displayResolver, princi
         roles: entry.roles,
     }));
 }
+/**
+ * The accounts among the rows that hold no row on the resource's
+ * organization (the module header's rule). Empty for an organization's own
+ * list and for a resource no organization holds.
+ */
+async function accountsOutsideOrganization(policies, hierarchy, rows) {
+    const resource = hierarchy[0];
+    if (resource === undefined || resource.kind === ORGANIZATION_KIND) {
+        return new Set();
+    }
+    const levels = hierarchy.some((level) => level.kind === ORGANIZATION_KIND)
+        ? hierarchy
+        : await resolveHierarchy(policies, resource.kind, resource.id, true);
+    const organization = levels.find((level) => level.kind === ORGANIZATION_KIND);
+    if (organization === undefined) {
+        return new Set();
+    }
+    const accounts = new Set();
+    for (const row of rows) {
+        if (row.spec?.principal?.kind === ACCOUNT_KIND) {
+            accounts.add(row.spec.principal.id);
+        }
+    }
+    const outside = new Set();
+    for (const account of accounts) {
+        const held = await policies.findByPrincipal(ACCOUNT_KIND, account);
+        const inOrganization = held.some((policy) => policy.spec?.resource?.kind === ORGANIZATION_KIND &&
+            policy.spec.resource.id === organization.id);
+        if (!inOrganization) {
+            outside.add(account);
+        }
+    }
+    return outside;
+}
 /**
  * The display views of every distinct principal the rows name, keyed
  * `kind:id` (the grouping key, so two kinds can never share an id's view):

package/dist/domain/iampolicy/access-lists.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-lists.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/access-lists.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAOtH,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,eAAe,GAChB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qDAAqD,CAAC;AAG3F,OAAO,EACL,cAAc,EACd,YAAY,GACb,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAGvE,0EAA0E;AAC1E,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,YAAY,CAAC,eAAe,CAAC,QAAQ,CAAC;CACvC,CAAC,CAAC;AAOH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAwB,EACxB,YAAoB,EACpB,UAAkB,EAClB,gBAAyB;IAEzB,MAAM,SAAS,GAAqB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,WAAW,GAAG,YAAY,CAAC;IAC/B,IAAI,SAAS,GAAG,UAAU,CAAC;IAC3B,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,mBAAmB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,EAC/D,KAAK,EAAE,EACP,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC;QAC3C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM;QACR,CAAC;QACD,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC;QAC1B,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC;QACtB,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAaD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAwB,EACxB,eAAyC,EACzC,gBAA8C,EAC9C,SAAwC;IAOxC,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,2BAA2B,CACrD,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,EAAE,EACR,mBAAmB,EAAE,CACtB,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAC3B,eAAe,EACf,gBAAgB,CACjB,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,GAAG,EAGpB,CAAC;IACJ,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC;QAC/C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QACtE,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/D,KAAK,GAAG;gBACN,kEAAkE;gBAClE,mEAAmE;gBACnE,6DAA6D;gBAC7D,mCAAmC;gBACnC,SAAS,EAAE,YAAY,CACrB,IAAI;oBACF,MAAM,CAAC,wBAAwB,EAAE;wBAC/B,IAAI,EAAE,SAAS,CAAC,IAAI;wBACpB,EAAE,EAAE,SAAS,CAAC,EAAE;wBAChB,IAAI,EAAE,SAAS,CAAC,EAAE;qBACnB,CAAC,EACJ,SAAS,CAAC,QAAQ,CACnB;gBACD,KAAK,EAAE,EAAE;aACV,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,MAAM,CAAC,qBAAqB,EAAE;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,qBAAqB,CAClC,IAA8B,EAC9B,eAAyC,EACzC,gBAA8C;IAE9C,MAAM,WAAW,GAAG,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;QACtC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QAC/D,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACtB,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IACpD,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;QACxC,IAAI,QAAiD,CAAC;QACtD,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,QAAQ,GAAG,MAAM,eAAe,CAAC,uBAAuB,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;YACtC,IACE,gBAAgB,KAAK,SAAS;gBAC9B,IAAI,KAAK,eAAe,CAAC,yBAAyB,EAClD,CAAC;gBACD,SAAS;YACX,CAAC;YACD,QAAQ,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;YAClC,KAAK,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CACnB,IAAwB,EACxB,QAAgB;IAEhB,MAAM,OAAO,GAAG,KAAK,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;IACtD,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC5B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CACjB,MAAiB,EACjB,WAAoB,EACpB,KAAqB;IAErB,OAAO,MAAM,CAAC,eAAe,EAAE;QAC7B,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;QACvD,WAAW;QACX,GAAG,CAAC,WAAW;YACb,CAAC,CAAC;gBACE,aAAa,EAAE,MAAM,CAAC,oBAAoB,EAAE;oBAC1C,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,EAAE,EAAE,KAAK,CAAC,EAAE;iBACb,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"access-lists.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/access-lists.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAOtH,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,eAAe,GAChB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qDAAqD,CAAC;AAG3F,OAAO,EACL,cAAc,EACd,YAAY,GACb,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAGvE,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;AACpE,MAAM,iBAAiB,GAAG,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;AAErE,0EAA0E;AAC1E,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,YAAY,CAAC,eAAe,CAAC,QAAQ,CAAC;CACvC,CAAC,CAAC;AAOH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAwB,EACxB,YAAoB,EACpB,UAAkB,EAClB,gBAAyB;IAEzB,MAAM,SAAS,GAAqB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,WAAW,GAAG,YAAY,CAAC;IAC/B,IAAI,SAAS,GAAG,UAAU,CAAC;IAC3B,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,mBAAmB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,EAC/D,KAAK,EAAE,EACP,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC;QAC3C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM;QACR,CAAC;QACD,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC;QAC1B,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC;QACtB,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAaD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAwB,EACxB,eAAyC,EACzC,gBAA8C,EAC9C,SAAwC;IAOxC,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,2BAA2B,CACrD,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,EAAE,EACR,mBAAmB,EAAE,CACtB,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,QAAQ,EACR,SAAS,EACT,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CACpC,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACtC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC;QAC/C,OAAO,CAAC,CAAC,SAAS,EAAE,IAAI,KAAK,YAAY,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAC1C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAC5B,eAAe,EACf,gBAAgB,CACjB,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,GAAG,EAGpB,CAAC;IACJ,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC;QAC/C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QACtE,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/D,KAAK,GAAG;gBACN,kEAAkE;gBAClE,mEAAmE;gBACnE,6DAA6D;gBAC7D,mCAAmC;gBACnC,SAAS,EAAE,YAAY,CACrB,IAAI;oBACF,MAAM,CAAC,wBAAwB,EAAE;wBAC/B,IAAI,EAAE,SAAS,CAAC,IAAI;wBACpB,EAAE,EAAE,SAAS,CAAC,EAAE;wBAChB,IAAI,EAAE,SAAS,CAAC,EAAE;qBACnB,CAAC,EACJ,SAAS,CAAC,QAAQ,CACnB;gBACD,KAAK,EAAE,EAAE;aACV,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,MAAM,CAAC,qBAAqB,EAAE;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,2BAA2B,CACxC,QAAwB,EACxB,SAAwC,EACxC,IAA8B;IAE9B,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAClE,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB,CAAC;QACxE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACvE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC;IAC9E,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;YAC/C,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAC9B,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,iBAAiB;YACjD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,YAAY,CAAC,EAAE,CAC9C,CAAC;QACF,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,qBAAqB,CAClC,IAA8B,EAC9B,eAAyC,EACzC,gBAA8C;IAE9C,MAAM,WAAW,GAAG,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;QACtC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QAC/D,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACtB,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IACpD,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;QACxC,IAAI,QAAiD,CAAC;QACtD,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,QAAQ,GAAG,MAAM,eAAe,CAAC,uBAAuB,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;YACtC,IACE,gBAAgB,KAAK,SAAS;gBAC9B,IAAI,KAAK,eAAe,CAAC,yBAAyB,EAClD,CAAC;gBACD,SAAS;YACX,CAAC;YACD,QAAQ,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;YAClC,KAAK,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CACnB,IAAwB,EACxB,QAAgB;IAEhB,MAAM,OAAO,GAAG,KAAK,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;IACtD,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC5B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CACjB,MAAiB,EACjB,WAAoB,EACpB,KAAqB;IAErB,OAAO,MAAM,CAAC,eAAe,EAAE;QAC7B,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;QACvD,WAAW;QACX,GAAG,CAAC,WAAW;YACb,CAAC,CAAC;gBACE,aAAa,EAAE,MAAM,CAAC,oBAAoB,EAAE;oBAC1C,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,EAAE,EAAE,KAAK,CAAC,EAAE;iBACb,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;AACL,CAAC"}

package/dist/domain/iampolicy/change.d.ts

@@ -0,0 +1,53 @@
+import type { IamPolicySpec } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
+import type { CallerClass, CallerIdentity } from "../../extensions/identity.js";
+/**
+ * The door a change came through. Stored bytes in an edition's history.
+ *
+ *   - `grant`: IamPolicy.create, a grant on the user lane.
+ *   - `revoke`: IamPolicy.delete.
+ *   - `structural`: IamPolicy.bootstrapPolicy, the server recording what a
+ *     resource's creation or visibility implies (its creator's authorship,
+ *     its audience).
+ *   - `organization_access_revoked`: revokeOrgAccess and its system twin,
+ *     a person removed from an organization.
+ *   - `left_organization`: the sweep that follows a person's last role on
+ *     an organization, revoking what they held on its resources.
+ *   - `resource_deleted`: the rows that die with a deleted resource
+ *     (cleanupResourcePolicies, the built-in lifecycle's delete cleanup,
+ *     an organization's revoke before its row goes).
+ *   - `organization_created`: open source's creator `owner` row.
+ *   - `first_sign_in`: open source's membership rules for a new account.
+ *   - `role_reconciliation`: the one-shot pass that gives existing
+ *     accounts the roles the membership rules would have.
+ *   - `operator_ownership`: the trusted-local operator made owner of an
+ *     organization nobody owns.
+ *   - `platform_client_grant`: a PlatformClient's auto-granted role on the
+ *     account it mints.
+ */
+export type PolicyChangeCause = "grant" | "revoke" | "structural" | "organization_access_revoked" | "left_organization" | "resource_deleted" | "organization_created" | "first_sign_in" | "role_reconciliation" | "operator_ownership" | "platform_client_grant";
+/** Who made a change: the caller's id and class, nothing that identifies a person beyond the id. */
+export interface PolicyActor {
+    readonly id: string;
+    readonly callerClass: CallerClass;
+}
+/**
+ * What the store is handed beside an access row it writes or deletes. An
+ * implementation that keeps a history records exactly one entry for it, in
+ * the same atomic unit as the row change, and none when the row did not
+ * change (IamPolicyStore, store.ts).
+ */
+export interface PolicyChangeRecord {
+    readonly actor: PolicyActor;
+    readonly cause: PolicyChangeCause;
+    /**
+     * The organization the row's resource belongs to, resolved before any
+     * row of the operation is deleted; "" when none can be found (a kind
+     * outside organization scope, a legacy row with no scope link).
+     */
+    readonly organizationId: string;
+}
+/** The actor a caller is recorded as. */
+export declare function policyActorOf(caller: CallerIdentity): PolicyActor;
+/** Whether a row lets someone reach something (a person or an audience), as opposed to a structural link. */
+export declare function grantsAccess(spec: IamPolicySpec): boolean;
+//# sourceMappingURL=change.d.ts.map

package/dist/domain/iampolicy/change.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"change.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/change.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qDAAqD,CAAC;AAEzF,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGhF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,iBAAiB,GACzB,OAAO,GACP,QAAQ,GACR,YAAY,GACZ,6BAA6B,GAC7B,mBAAmB,GACnB,kBAAkB,GAClB,sBAAsB,GACtB,eAAe,GACf,qBAAqB,GACrB,oBAAoB,GACpB,uBAAuB,CAAC;AAE5B,oGAAoG;AACpG,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAID,yCAAyC;AACzC,wBAAgB,aAAa,CAAC,MAAM,EAAE,cAAc,GAAG,WAAW,CAEjE;AAED,6GAA6G;AAC7G,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAMzD"}

package/dist/domain/iampolicy/change.js

@@ -0,0 +1,44 @@
+/**
+ * What the grant path says about a change to a policy row: who made it,
+ * through which door, and in which organization. The grant path
+ * (grant-path.ts) builds one for every row it writes or deletes that
+ * grants access, and hands it to the store beside the row
+ * (`IamPolicyStore.save` and `deleteById`), so an edition that keeps a
+ * permission history writes it in the same atomic unit as the row. Open
+ * source keeps no history table; the same facts ride the path's grant and
+ * revoke log lines.
+ *
+ * The cause names a door the grant path already has, never an edition's
+ * business reason: an edition that grants on a person's behalf (an
+ * invitation, a federated sign-in) says whom it acted for through the
+ * actor (`serverActingFor`, pipeline/interceptors/auth.ts), not through a
+ * cause of its own. The strings are stored bytes in an edition's history:
+ * a cause is added, never renamed or reused.
+ *
+ * An access row is a row that lets someone reach something: it names a
+ * person, or an audience written as a userset (`team:T#member`,
+ * `organization:O#viewer`, `identity_provider:I#platform_user`). A row
+ * naming a resource as its principal with no relation is a structural link
+ * (a parent, a default instance, a managed organization), the bookkeeping
+ * a resource's own creation implies; it carries no change record.
+ *
+ * The actor is the caller's id and class and nothing else: never the email,
+ * the display name or the token, so a history holds no more of a person
+ * than the rows it describes already do.
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { kindEnumName } from "../../pipeline/apiresource-meta.js";
+const ACCOUNT_KIND = kindEnumName(ApiResourceKind.identity_account);
+/** The actor a caller is recorded as. */
+export function policyActorOf(caller) {
+    return { id: caller.identityId, callerClass: caller.callerClass };
+}
+/** Whether a row lets someone reach something (a person or an audience), as opposed to a structural link. */
+export function grantsAccess(spec) {
+    const principal = spec.principal;
+    if (principal === undefined) {
+        return false;
+    }
+    return principal.kind === ACCOUNT_KIND || principal.relation !== "";
+}
+//# sourceMappingURL=change.js.map

package/dist/domain/iampolicy/change.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"change.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/change.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAItH,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AA8DlE,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;AAEpE,yCAAyC;AACzC,MAAM,UAAU,aAAa,CAAC,MAAsB;IAClD,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;AACpE,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,KAAK,YAAY,IAAI,SAAS,CAAC,QAAQ,KAAK,EAAE,CAAC;AACtE,CAAC"}

package/dist/domain/iampolicy/constants.d.ts

@@ -177,6 +177,12 @@ export declare function malformedTripleMessage(field: string): string;
  * serves invitations answers the same sentence for an owner invitation.
  */
 export declare const OWNER_ASSIGNMENT_DENIED_MESSAGE = "only an owner of the organization can grant, revoke or remove the owner role";
+/**
+ * A grant of the organization's `affiliated` relation (INVALID_ARGUMENT, on
+ * every lane): it is derived from a person's organization roles, never
+ * granted (fga/model/tenancy/organization.fga).
+ */
+export declare const AFFILIATION_NOT_GRANTABLE_MESSAGE = "affiliated is derived from a person's organization roles and is never granted";
 /** Revoking or removing the last owner of an organization (FAILED_PRECONDITION). */
 export declare const LAST_OWNER_MESSAGE = "an organization must keep at least one owner; make another member an owner first";
 //# sourceMappingURL=constants.d.ts.map

package/dist/domain/iampolicy/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,KAAK,EAEV,aAAa,EACd,MAAM,qDAAqD,CAAC;AAK7D,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAC1D,eAAO,MAAM,eAAe,cAAc,CAAC;AAE3C,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAAmB,CAAC;AAoBxE;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAG/D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,CAe5E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAOvD;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,eAAe,CAO1D,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,0BAA0B,EAAE,aAAa,CAAC,eAAe,CAGrE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAM9C,2CAA2C;AAC3C,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,oGAAoG;AACpG,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,+FAA+F;AAC/F,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,GAC/B,MAAM,CAER;AAED,yEAAyE;AACzE,eAAO,MAAM,+BAA+B,iDACI,CAAC;AAEjD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/D;AAMD;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,+EACwB,CAAC;AAE/E,mGAAmG;AACnG,eAAO,MAAM,2CAA2C,0EACiB,CAAC;AAE1E,0FAA0F;AAC1F,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,4FAA4F;AAC5F,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGjE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,yEAAyE;AACzE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,gHAAgH;AAChH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,GAC/B,MAAM,CAER;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,iFACoC,CAAC;AAEjF,oFAAoF;AACpF,eAAO,MAAM,kBAAkB,qFACqD,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,KAAK,EAEV,aAAa,EACd,MAAM,qDAAqD,CAAC;AAK7D,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAC1D,eAAO,MAAM,eAAe,cAAc,CAAC;AAE3C,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAAmB,CAAC;AAoBxE;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAG/D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,CAe5E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAOvD;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,eAAe,CAO1D,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,0BAA0B,EAAE,aAAa,CAAC,eAAe,CAGrE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAM9C,2CAA2C;AAC3C,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,oGAAoG;AACpG,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,+FAA+F;AAC/F,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,GAC/B,MAAM,CAER;AAED,yEAAyE;AACzE,eAAO,MAAM,+BAA+B,iDACI,CAAC;AAEjD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/D;AAMD;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,+EACwB,CAAC;AAE/E,mGAAmG;AACnG,eAAO,MAAM,2CAA2C,0EACiB,CAAC;AAE1E,0FAA0F;AAC1F,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,4FAA4F;AAC5F,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGjE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,yEAAyE;AACzE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,gHAAgH;AAChH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,GAC/B,MAAM,CAER;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,iFACoC,CAAC;AAEjF;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,kFACmC,CAAC;AAElF,oFAAoF;AACpF,eAAO,MAAM,kBAAkB,qFACqD,CAAC"}

package/dist/domain/iampolicy/constants.js

@@ -254,6 +254,12 @@ export function malformedTripleMessage(field) {
  * serves invitations answers the same sentence for an owner invitation.
  */
 export const OWNER_ASSIGNMENT_DENIED_MESSAGE = "only an owner of the organization can grant, revoke or remove the owner role";
+/**
+ * A grant of the organization's `affiliated` relation (INVALID_ARGUMENT, on
+ * every lane): it is derived from a person's organization roles, never
+ * granted (fga/model/tenancy/organization.fga).
+ */
+export const AFFILIATION_NOT_GRANTABLE_MESSAGE = "affiliated is derived from a person's organization roles and is never granted";
 /** Revoking or removing the last owner of an organization (FAILED_PRECONDITION). */
 export const LAST_OWNER_MESSAGE = "an organization must keep at least one owner; make another member an owner first";
 //# sourceMappingURL=constants.js.map

package/dist/domain/iampolicy/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAMtH,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAE7D,+DAA+D;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAC1D,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAE3C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,iBAAiB,GAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AASxE,SAAS,cAAc,CAAC,IAAmB;IACzC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAmB;IACrD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;AAC/G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAmB;IACtD,MAAM,MAAM,GAA0D;QACpE,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;QAC9C,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;QACtD,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;QAC5C,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QACxC,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;KAC5B,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAmB;IAC7C,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAmC;IAC7D,eAAe,CAAC,KAAK;IACrB,eAAe,CAAC,QAAQ;IACxB,eAAe,CAAC,KAAK;IACrB,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,WAAW;IAC3B,eAAe,CAAC,QAAQ;CACzB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAmC;IACxE,eAAe,CAAC,gBAAgB;IAChC,eAAe,CAAC,IAAI;CACrB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC;AAE9C,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,2CAA2C;AAC3C,MAAM,UAAU,qBAAqB,CAAC,EAAU;IAC9C,OAAO,yBAAyB,EAAE,EAAE,CAAC;AACvC,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,6CAA6C,IAAI,gEAAgE,CAAC;AAC3H,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,uBAAuB,CACrC,IAAY,EACZ,IAAY,EACZ,SAAgC;IAEhC,OAAO,SAAS,IAAI,yCAAyC,IAAI,wBAAwB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACnH,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,+BAA+B,GAC1C,8CAA8C,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACrD,OAAO,2BAA2B,IAAI,GAAG,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,yCAAyC,GACpD,4EAA4E,CAAC;AAE/E,mGAAmG;AACnG,MAAM,CAAC,MAAM,2CAA2C,GACtD,uEAAuE,CAAC;AAE1E,0FAA0F;AAC1F,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,OAAO,uBAAuB,QAAQ,GAAG,CAAC;AAC5C,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,OAAO,4BAA4B,IAAI,GAAG,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,MAAM,SAAS,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,mBAAmB,IAAI,2DAA2D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACnH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,OAAO,6DAA6D,QAAQ,GAAG,CAAC;AAClF,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO,4CAA4C,qBAAqB,gCAAgC,QAAQ,GAAG,CAAC;AACtH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,qDAAqD,IAAI,IAAI,CAAC;AACvE,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,2BAA2B,CACzC,IAAY,EACZ,IAAY,EACZ,SAAgC;IAEhC,OAAO,SAAS,IAAI,mDAAmD,IAAI,8BAA8B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACnI,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,UAAU,KAAK,mCAAmC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAC1C,8EAA8E,CAAC;AAEjF,oFAAoF;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAC7B,kFAAkF,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAMtH,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAE7D,+DAA+D;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAC1D,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAE3C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,iBAAiB,GAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AASxE,SAAS,cAAc,CAAC,IAAmB;IACzC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAmB;IACrD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;AAC/G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAmB;IACtD,MAAM,MAAM,GAA0D;QACpE,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;QAC9C,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;QACtD,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;QAC5C,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QACxC,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;KAC5B,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAmB;IAC7C,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAmC;IAC7D,eAAe,CAAC,KAAK;IACrB,eAAe,CAAC,QAAQ;IACxB,eAAe,CAAC,KAAK;IACrB,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,WAAW;IAC3B,eAAe,CAAC,QAAQ;CACzB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAmC;IACxE,eAAe,CAAC,gBAAgB;IAChC,eAAe,CAAC,IAAI;CACrB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC;AAE9C,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,2CAA2C;AAC3C,MAAM,UAAU,qBAAqB,CAAC,EAAU;IAC9C,OAAO,yBAAyB,EAAE,EAAE,CAAC;AACvC,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,6CAA6C,IAAI,gEAAgE,CAAC;AAC3H,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,uBAAuB,CACrC,IAAY,EACZ,IAAY,EACZ,SAAgC;IAEhC,OAAO,SAAS,IAAI,yCAAyC,IAAI,wBAAwB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACnH,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,+BAA+B,GAC1C,8CAA8C,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACrD,OAAO,2BAA2B,IAAI,GAAG,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,yCAAyC,GACpD,4EAA4E,CAAC;AAE/E,mGAAmG;AACnG,MAAM,CAAC,MAAM,2CAA2C,GACtD,uEAAuE,CAAC;AAE1E,0FAA0F;AAC1F,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,OAAO,uBAAuB,QAAQ,GAAG,CAAC;AAC5C,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,OAAO,4BAA4B,IAAI,GAAG,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,MAAM,SAAS,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,mBAAmB,IAAI,2DAA2D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACnH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,OAAO,6DAA6D,QAAQ,GAAG,CAAC;AAClF,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO,4CAA4C,qBAAqB,gCAAgC,QAAQ,GAAG,CAAC;AACtH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,qDAAqD,IAAI,IAAI,CAAC;AACvE,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,2BAA2B,CACzC,IAAY,EACZ,IAAY,EACZ,SAAgC;IAEhC,OAAO,SAAS,IAAI,mDAAmD,IAAI,8BAA8B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACnI,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,UAAU,KAAK,mCAAmC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAC1C,8EAA8E,CAAC;AAEjF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAC5C,+EAA+E,CAAC;AAElF,oFAAoF;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAC7B,kFAAkF,CAAC"}

package/dist/domain/iampolicy/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/controller.ts"],"names":[],"mappings":"AAoGA,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAqCzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAE3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAGxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAmB9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAStE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAmB1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAcjD,iHAAiH;AACjH,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,GAAG,aAAa,CAAC;AAEjE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,4GAA4G;IAC5G,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,sHAAsH;IACtH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACvD,0GAA0G;IAC1G,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACxD,wFAAwF;IACxF,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,sEAAsE;AACtE,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,uBAAuB,GAC5B,IAAI,CA2CN"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/controller.ts"],"names":[],"mappings":"AAoGA,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAqCzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAE3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAGxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAmB9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAUtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAmB1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAcjD,iHAAiH;AACjH,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,GAAG,aAAa,CAAC;AAEjE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,4GAA4G;IAC5G,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,sHAAsH;IACtH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACvD,0GAA0G;IAC1G,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACxD,wFAAwF;IACxF,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,sEAAsE;AACtE,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,uBAAuB,GAC5B,IAAI,CAkDN"}

package/dist/domain/iampolicy/controller.js

@@ -135,7 +135,7 @@ export function registerIamPolicyServices(router, deps) {
         delete: (spec, ctx) => deletePolicy(deps, spec, ctx),
         bootstrapPolicy: (spec, ctx) => {
             guardSystemRpc(command.bootstrapPolicy, callerIdentityOf(ctx));
-            return grantThroughChain(deps, command.bootstrapPolicy, spec, ctx, false);
+            return grantThroughChain(deps, command.bootstrapPolicy, spec, ctx, false, "structural");
         },
         cleanupResourcePolicies: (ref, ctx) => {
             guardSystemRpc(command.cleanupResourcePolicies, callerIdentityOf(ctx));
@@ -182,15 +182,16 @@ function guardSystemRpc(method, caller) {
  */
 function createPolicy(deps, spec, ctx) {
     requireWellFormedTriple(spec);
-    return grantThroughChain(deps, IamPolicyCommandController.method.create, spec, ctx, true);
+    return grantThroughChain(deps, IamPolicyCommandController.method.create, spec, ctx, true, "grant");
 }
 /**
  * The grant chain both `create` and `bootstrapPolicy` run; only the user
  * lane validates the role, asks for an owner's authority when it grants
  * owner, and runs the create gate slot — bootstrap writes structural
- * relations no scope would admit and no edition gates.
+ * relations no scope would admit and no edition gates. `cause` is the
+ * lane's door, recorded with every access row it writes.
  */
-async function grantThroughChain(deps, method, spec, ctx, validateRole) {
+async function grantThroughChain(deps, method, spec, ctx, validateRole, cause) {
     const reqCtx = new RequestContext(IamPolicySpecSchema, spec, callerIdentityOf(ctx), kindOf(ctx));
     const pipeline = newPipeline(`iampolicy-${method.localName}`, deps.logger)
         .addStep(newAuthorizeStep(method, deps.authorizer))
@@ -202,7 +203,10 @@ async function grantThroughChain(deps, method, spec, ctx, validateRole) {
             pipeline.addStep(step);
         }
     }
-    await pipeline.addStep(newGrantStep(deps.grantPath)).build().execute(reqCtx);
+    await pipeline
+        .addStep(newGrantStep(deps.grantPath, cause))
+        .build()
+        .execute(reqCtx);
     return policyResultOf(reqCtx, method);
 }
 /**