Grants the tools require

Every tool declares in its manifest what the owner of its external system must grant the tool's connection identity:

• roles: the baseline roles, spelled as that system names them (Google IAM roles for the GCP tool), that every connection of the tool needs;
• rights: what one of the tool's capabilities needs on an object type there (MicroStrategy's executor needs Execute on cubes and reports, for instance).

nistor dist grants prints them for the tools a distribution lock installs, so you can send the list to the people who grant access before you install or upgrade:

nistor dist grants envs/prod/distribution.lock

The command is read-only: it reads the lock and the tool manifests installed in the environment it runs in, and it contacts no database, no API and no external system. Run it where the lock's packages are installed (the runtime image, or a virtual environment built from the lock): a locked tool installed at another version, or whose manifest does not load, is refused rather than guessed.

What it prints#

A header naming the lock's digest, then one block per tool, sorted by tool id. A tool that declares nothing says so, and packages that install no tool are left out:

[gcp] Google Cloud Platform (nistor-tool-gcp 0.4.0)
  role roles/artifactregistry.reader
  role roles/bigquery.metadataViewer
  ...

[microstrategy] MicroStrategy (nistor-tool-microstrategy 0.4.0)
  right executor: Execute on MicrostrategyCube
  ...

The same lock and the same installed tools always print the same text, so you can keep it beside the lock and review its diff when you upgrade.

The roles are a baseline. A right an action needs on its own target (a Dataform invocation, a BigQuery write) is the permission preflight's to check, per rule, and is not listed. Infrastructure a tool needs in your cloud (audit-log sinks, subscriptions) is not printed: it stays in the Terraform modules the tools ship.