@astram/identity 0.1.1 → 0.2.0

package/migrations/1710000000099-SeedDevIdentity.cjs

@@ -0,0 +1,130 @@
+/**
+ * ⛔ DEV/TEST-ONLY coherent identity seed — a no-op in production.
+ *
+ * Creates ONE id-aligned chain so a fresh app has a real login that resolves end-to-end:
+ *   company  'Astram Dev Co'   (shield_app.companies)
+ *   user     'admin'           (shield_app.users)          → the principal
+ *   role     'Administrator'   (shield_app.roles)
+ *   membership (active) + posting (open window)            → links user→company→role
+ *   credential admin@astram.test / Astram@dev-123          (shield_identity.identity_credential)
+ *     ic_principal_id = users.u_uuid, ic_tenant_id = companies.c_uuid, ic_roles = [role uuid]
+ *   grant   role → 'identity:*'  (shield_authz.role_permission)  → lights the admin nav
+ *
+ * The bug this fixes: the old alice/bob/carol fixtures seeded CREDENTIALS with SYNTHETIC ids
+ * (principal-alice/tenant-a) and NO org rows, so /auth/me + auth-facts had nothing to resolve.
+ * Here every id is generated once and reused across shield_app + shield_identity + shield_authz.
+ *
+ * GATE: runs only when NODE_ENV=development OR ASTRAM_SEED_DEV=1. Otherwise a no-op.
+ * IDEMPOTENT: every insert is INSERT ... SELECT ... WHERE NOT EXISTS on the BUSINESS key; a
+ * second run inserts ZERO rows. No hard-coded UUIDs (UUID() for new PKs; dependents resolved
+ * by business key). down() removes the chain by business key.
+ */
+
+const APP = 'shield_app';
+const IDENT = 'shield_identity';
+const AUTHZ = 'shield_authz';
+
+const COMPANY = 'Astram Dev Co';
+const USERNAME = 'admin';
+const EMAIL = 'admin@astram.test';
+const ROLE = 'Administrator';
+const HINT = 'admin@astram.test';
+// Argon2id encoded hash of 'Astram@dev-123' (dev-only; generated via the framework hasher — Step 1;
+// params match Argon2idPasswordHasher's DEFAULT_PARAMS: memoryCost 19456, timeCost 2, parallelism 1).
+const PASSWORD_HASH = '$argon2id$v=19$m=19456,t=2,p=1$vwqMTNRLVkrwAp4vGlZrYA$U+/nIGzGy+w2KAlMG5epvHqIyjV2hxNaVYDxJcbO6uc';
+const GRANT_KEY = 'identity:*';
+
+function seedEnabled() {
+  return process.env.NODE_ENV === 'development' || process.env.ASTRAM_SEED_DEV === '1';
+}
+
+async function up({ query }) {
+  if (!seedEnabled()) return; // production / non-dev → no-op
+
+  // 1) company (tenant)
+  await query(
+    `INSERT INTO \`${APP}\`.\`companies\` (c_uuid, c_name, c_status)
+       SELECT UUID(), ?, 'active'
+        WHERE NOT EXISTS (SELECT 1 FROM \`${APP}\`.\`companies\` WHERE c_name = ?)`,
+    [COMPANY, COMPANY],
+  );
+  // 2) user (principal)
+  await query(
+    `INSERT INTO \`${APP}\`.\`users\` (u_uuid, u_username, u_email, u_status)
+       SELECT UUID(), ?, ?, 'active'
+        WHERE NOT EXISTS (SELECT 1 FROM \`${APP}\`.\`users\` WHERE u_username = ?)`,
+    [USERNAME, EMAIL, USERNAME],
+  );
+  // 3) role
+  await query(
+    `INSERT INTO \`${APP}\`.\`roles\` (r_uuid, r_name)
+       SELECT UUID(), ?
+        WHERE NOT EXISTS (SELECT 1 FROM \`${APP}\`.\`roles\` WHERE r_name = ?)`,
+    [ROLE, ROLE],
+  );
+
+  // Resolve the ids we just ensured (by business key — never hard-coded).
+  const [company] = await query(`SELECT c_uuid FROM \`${APP}\`.\`companies\` WHERE c_name = ? LIMIT 1`, [COMPANY]);
+  const [user] = await query(`SELECT u_uuid FROM \`${APP}\`.\`users\` WHERE u_username = ? LIMIT 1`, [USERNAME]);
+  const [role] = await query(`SELECT r_uuid FROM \`${APP}\`.\`roles\` WHERE r_name = ? LIMIT 1`, [ROLE]);
+  const companyId = company.c_uuid, userId = user.u_uuid, roleId = role.r_uuid;
+
+  // 4) membership (active tenant pointer)
+  await query(
+    `INSERT INTO \`${APP}\`.\`company_membership\` (cm_uuid, cm_user_uuid, cm_company_uuid, cm_is_active, cm_status)
+       SELECT UUID(), ?, ?, 1, 'active'
+        WHERE NOT EXISTS (SELECT 1 FROM \`${APP}\`.\`company_membership\` WHERE cm_user_uuid = ? AND cm_company_uuid = ?)`,
+    [userId, companyId, userId, companyId],
+  );
+  const [membership] = await query(
+    `SELECT cm_uuid FROM \`${APP}\`.\`company_membership\` WHERE cm_user_uuid = ? AND cm_company_uuid = ? LIMIT 1`,
+    [userId, companyId],
+  );
+  const membershipId = membership.cm_uuid;
+
+  // 5) posting (open window: from/until null → always in-effect)
+  await query(
+    `INSERT INTO \`${APP}\`.\`membership_posting\` (mp_uuid, mp_membership_uuid, mp_role_uuid, mp_effective_from_ms, mp_effective_until_ms)
+       SELECT UUID(), ?, ?, NULL, NULL
+        WHERE NOT EXISTS (SELECT 1 FROM \`${APP}\`.\`membership_posting\` WHERE mp_membership_uuid = ? AND mp_role_uuid = ?)`,
+    [membershipId, roleId, membershipId, roleId],
+  );
+
+  // 6) credential (shield_identity) — ids ALIGNED to the org rows above
+  const nowMs = 1_752_192_000_000; // fixed dev timestamp (no Date.now — keeps re-runs identical)
+  await query(
+    `INSERT INTO \`${IDENT}\`.\`identity_credential\`
+       (ic_identity_hint, ic_password_hash, ic_principal_id, ic_tenant_id, ic_roles, ic_created_at_ms, ic_updated_at_ms)
+       SELECT ?, ?, ?, ?, ?, ?, ?
+        WHERE NOT EXISTS (SELECT 1 FROM \`${IDENT}\`.\`identity_credential\` WHERE ic_identity_hint = ?)`,
+    [HINT, PASSWORD_HASH, userId, companyId, JSON.stringify([roleId]), nowMs, nowMs, HINT],
+  );
+
+  // 7) grant (shield_authz) — one wildcard row covers identity:company/user/role:read
+  await query(
+    `INSERT INTO \`${AUTHZ}\`.\`role_permission\` (rp_uuid, rp_role_uuid, rp_perm_key)
+       SELECT UUID(), ?, ?
+        WHERE NOT EXISTS (SELECT 1 FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid = ? AND rp_perm_key = ?)`,
+    [roleId, GRANT_KEY, roleId, GRANT_KEY],
+  );
+}
+
+async function down({ query }) {
+  // Remove by business key (safe whether or not seed ran). Order: dependents first.
+  const [role] = await query(`SELECT r_uuid FROM \`${APP}\`.\`roles\` WHERE r_name = ? LIMIT 1`, [ROLE]);
+  if (role) {
+    await query(`DELETE FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid = ? AND rp_perm_key = ?`, [role.r_uuid, GRANT_KEY]);
+  }
+  await query(`DELETE FROM \`${IDENT}\`.\`identity_credential\` WHERE ic_identity_hint = ?`, [HINT]);
+  // membership_posting + company_membership cascade on user/company delete; remove user/company/role.
+  await query(`DELETE mp FROM \`${APP}\`.\`membership_posting\` mp
+      JOIN \`${APP}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
+      JOIN \`${APP}\`.\`users\` u ON u.u_uuid = cm.cm_user_uuid WHERE u.u_username = ?`, [USERNAME]);
+  await query(`DELETE cm FROM \`${APP}\`.\`company_membership\` cm
+      JOIN \`${APP}\`.\`users\` u ON u.u_uuid = cm.cm_user_uuid WHERE u.u_username = ?`, [USERNAME]);
+  await query(`DELETE FROM \`${APP}\`.\`users\` WHERE u_username = ?`, [USERNAME]);
+  await query(`DELETE FROM \`${APP}\`.\`roles\` WHERE r_name = ?`, [ROLE]);
+  await query(`DELETE FROM \`${APP}\`.\`companies\` WHERE c_name = ?`, [COMPANY]);
+}
+
+module.exports = { up, down };

package/migrations/1710000000100-SeedDevTenantBAndRoot.cjs

@@ -0,0 +1,212 @@
+/**
+ * ⛔ DEV/TEST-ONLY seed — a no-op in production. Extends `...099-SeedDevIdentity.cjs` with a
+ * SECOND tenant + a platform root, so Phase 6's cross-tenant offer→accept→revoke flow can be
+ * exercised across two REAL tenants out of the box (tenant-a offers, tenant-b accepts).
+ *
+ * PART A — tenant-b (mirrors ALL 7 steps of `...099`, id-aligned to a second chain):
+ *   company  'Astram Tenant B'   (shield_app.companies)
+ *   user     'admin-b'           (shield_app.users)               → the principal
+ *   role     ITS OWN 'Administrator B' role (created by THIS migration — NOT the shared
+ *            'Administrator' role `...099` created for tenant-a). Removes the shared-role
+ *            fragility a Phase-6 review flagged: admin-b's tenant-b authority is now
+ *            self-evident from its OWN role + membership, not merely a membership join
+ *            reusing a global role. 'Administrator B' is granted `identity:*` directly
+ *            (mirrors tenant-a's 'Administrator' → `identity:*` pattern), which covers
+ *            `identity:cross_tenant_grant:accept` via the same wildcard expansion, so
+ *            admin-b can ACCEPT a cross-tenant grant in tenant-b out of the box.
+ *   membership (active) + posting (open window)                   → links admin-b→company-b→Administrator B
+ *   credential admin-b@astram.test / Astram@dev-123 (SAME dev hash as `...099`'s admin)
+ *     ic_principal_id = users.u_uuid, ic_tenant_id = companies.c_uuid, ic_roles = [Administrator B role uuid]
+ *
+ * PART B — root (mirrors astram3 `1720000000014-DesignateCappedRoot.js`):
+ *   user 'root', u_is_platform_superuser = 1 (idempotent: INSERT-if-absent, then UPDATE the flag
+ *   to 1 so re-runs always converge). Root gets NO data-plane wildcard grant — root's authority
+ *   for control-plane object types (like `cross_tenant_grant`) comes from `isRoot`, not a role
+ *   grant (mirrors astram3: root operates via the cap, not grants).
+ *   credential root@astram.test / Astram@dev-123 (SAME dev hash), ic_tenant_id = tenant-a's
+ *   company id (root still logs into a session scoped to SOME tenant), ic_roles = [] (root's
+ *   power is the su flag, not a role).
+ *
+ * ⚠️  RUNTIME NOTE — `rootIds` allowlist (Task 9 / consumer-wiring concern, NOT this migration):
+ *   The framework resolves `isRoot` at runtime from the `rootIds` list the CONSUMER app passes
+ *   to `ShieldModule.forRoot({ rootIds })` / `IdentityFeatureModule.forRoot({ rootIds })` — NOT
+ *   purely from `u_is_platform_superuser` in the DB. Seeding `u_is_platform_superuser = 1` here
+ *   makes root a superuser IN THE DATABASE, but the consuming app (e.g. astram4) MUST ALSO add
+ *   this root user's uuid to its `rootIds` config for `isRoot` to be true at request time. This
+ *   migration CANNOT know that uuid ahead of time (it's `UUID()`-generated) — resolve it via:
+ *     SELECT u_uuid FROM shield_app.users WHERE u_username = 'root';
+ *   and wire the result into the consumer's `rootIds` array.
+ *
+ * GATE: runs only when NODE_ENV=development OR ASTRAM_SEED_DEV=1. Otherwise a no-op.
+ * IDEMPOTENT: every insert is INSERT ... SELECT ... WHERE NOT EXISTS on the BUSINESS key; the
+ * root flag UPDATE is naturally idempotent (converges to 1 every run). A second run inserts
+ * ZERO new rows. No hard-coded UUIDs (UUID() for new PKs; dependents resolved by business key).
+ * down() removes both chains by business key (including 'Administrator B' + its identity:*
+ * grant) — leaves the shared 'Administrator' role and tenant-a (from `...099`) untouched.
+ *
+ * Timestamp 1710000000100 sorts strictly after the existing dev seed (...099) and the ctg perm
+ * seed (...012) — runs LAST. It creates its own 'Administrator B' role (independent of the
+ * shared 'Administrator' role's grants), so it no longer depends on `...012`'s coarse-key
+ * expansion for admin-b's accept authority.
+ */
+
+const APP = 'shield_app';
+const IDENT = 'shield_identity';
+const AUTHZ = 'shield_authz';
+
+// --- Part A: tenant-b ---
+const COMPANY_B = 'Astram Tenant B';
+const USERNAME_B = 'admin-b';
+const EMAIL_B = 'admin-b@astram.test';
+const ROLE_B = 'Administrator B'; // tenant-b's OWN role (not the shared 'Administrator')
+const HINT_B = 'admin-b@astram.test';
+const IDENTITY_WILDCARD_KEY = 'identity:*';
+
+// --- Part B: root ---
+const ROOT_USERNAME = 'root';
+const ROOT_EMAIL = 'root@astram.test';
+const ROOT_HINT = 'root@astram.test';
+
+// Argon2id encoded hash of 'Astram@dev-123' (dev-only; SAME hash as ...099's admin — reused
+// verbatim so all dev credentials share one known password; params match
+// Argon2idPasswordHasher's DEFAULT_PARAMS: memoryCost 19456, timeCost 2, parallelism 1).
+const PASSWORD_HASH = '$argon2id$v=19$m=19456,t=2,p=1$vwqMTNRLVkrwAp4vGlZrYA$U+/nIGzGy+w2KAlMG5epvHqIyjV2hxNaVYDxJcbO6uc';
+
+function seedEnabled() {
+  return process.env.NODE_ENV === 'development' || process.env.ASTRAM_SEED_DEV === '1';
+}
+
+async function up({ query }) {
+  if (!seedEnabled()) return; // production / non-dev → no-op
+
+  // ── PART A: tenant-b ────────────────────────────────────────────────────────────────────
+
+  // A1) company-b (tenant)
+  await query(
+    `INSERT INTO \`${APP}\`.\`companies\` (c_uuid, c_name, c_status)
+       SELECT UUID(), ?, 'active'
+        WHERE NOT EXISTS (SELECT 1 FROM \`${APP}\`.\`companies\` WHERE c_name = ?)`,
+    [COMPANY_B, COMPANY_B],
+  );
+  // A2) user admin-b (principal)
+  await query(
+    `INSERT INTO \`${APP}\`.\`users\` (u_uuid, u_username, u_email, u_status)
+       SELECT UUID(), ?, ?, 'active'
+        WHERE NOT EXISTS (SELECT 1 FROM \`${APP}\`.\`users\` WHERE u_username = ?)`,
+    [USERNAME_B, EMAIL_B, USERNAME_B],
+  );
+
+  // Resolve ids by business key (never hard-coded). 'Administrator B' is tenant-b's OWN role
+  // (created here, NOT reusing `...099`'s shared 'Administrator') — makes admin-b's isolation
+  // self-evident from its own role, not merely from the membership join.
+  await query(
+    `INSERT INTO \`${APP}\`.\`roles\` (r_uuid, r_name)
+       SELECT UUID(), ?
+        WHERE NOT EXISTS (SELECT 1 FROM \`${APP}\`.\`roles\` WHERE r_name = ?)`,
+    [ROLE_B, ROLE_B],
+  );
+
+  const [companyB] = await query(`SELECT c_uuid FROM \`${APP}\`.\`companies\` WHERE c_name = ? LIMIT 1`, [COMPANY_B]);
+  const [userB] = await query(`SELECT u_uuid FROM \`${APP}\`.\`users\` WHERE u_username = ? LIMIT 1`, [USERNAME_B]);
+  const [roleB] = await query(`SELECT r_uuid FROM \`${APP}\`.\`roles\` WHERE r_name = ? LIMIT 1`, [ROLE_B]);
+  const companyBId = companyB.c_uuid, userBId = userB.u_uuid, roleId = roleB.r_uuid;
+
+  // A3) membership (active tenant pointer, admin-b → company-b)
+  await query(
+    `INSERT INTO \`${APP}\`.\`company_membership\` (cm_uuid, cm_user_uuid, cm_company_uuid, cm_is_active, cm_status)
+       SELECT UUID(), ?, ?, 1, 'active'
+        WHERE NOT EXISTS (SELECT 1 FROM \`${APP}\`.\`company_membership\` WHERE cm_user_uuid = ? AND cm_company_uuid = ?)`,
+    [userBId, companyBId, userBId, companyBId],
+  );
+  const [membershipB] = await query(
+    `SELECT cm_uuid FROM \`${APP}\`.\`company_membership\` WHERE cm_user_uuid = ? AND cm_company_uuid = ? LIMIT 1`,
+    [userBId, companyBId],
+  );
+  const membershipBId = membershipB.cm_uuid;
+
+  // A4) posting (open window: from/until null → always in-effect) — admin-b holds Administrator B IN company-b
+  await query(
+    `INSERT INTO \`${APP}\`.\`membership_posting\` (mp_uuid, mp_membership_uuid, mp_role_uuid, mp_effective_from_ms, mp_effective_until_ms)
+       SELECT UUID(), ?, ?, NULL, NULL
+        WHERE NOT EXISTS (SELECT 1 FROM \`${APP}\`.\`membership_posting\` WHERE mp_membership_uuid = ? AND mp_role_uuid = ?)`,
+    [membershipBId, roleId, membershipBId, roleId],
+  );
+
+  // A5) credential (shield_identity) — ids ALIGNED to company-b/admin-b above
+  const nowMs = 1_752_192_000_000; // fixed dev timestamp (no Date.now — keeps re-runs identical)
+  await query(
+    `INSERT INTO \`${IDENT}\`.\`identity_credential\`
+       (ic_identity_hint, ic_password_hash, ic_principal_id, ic_tenant_id, ic_roles, ic_created_at_ms, ic_updated_at_ms)
+       SELECT ?, ?, ?, ?, ?, ?, ?
+        WHERE NOT EXISTS (SELECT 1 FROM \`${IDENT}\`.\`identity_credential\` WHERE ic_identity_hint = ?)`,
+    [HINT_B, PASSWORD_HASH, userBId, companyBId, JSON.stringify([roleId]), nowMs, nowMs, HINT_B],
+  );
+
+  // A6) grant 'Administrator B' the identity:* wildcard — mirrors tenant-a's 'Administrator'
+  // → identity:* pattern (`...099`), so admin-b is a full admin in tenant-b via its OWN role.
+  // This wildcard also covers `identity:cross_tenant_grant:accept` (same coarse-key expansion
+  // the shared 'Administrator' relied on), so admin-b can accept a cross-tenant grant.
+  await query(
+    `INSERT INTO \`${AUTHZ}\`.\`role_permission\` (rp_uuid, rp_role_uuid, rp_perm_key)
+       SELECT UUID(), ?, ?
+        WHERE NOT EXISTS (SELECT 1 FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid = ? AND rp_perm_key = ?)`,
+    [roleId, IDENTITY_WILDCARD_KEY, roleId, IDENTITY_WILDCARD_KEY],
+  );
+
+  // ── PART B: root ────────────────────────────────────────────────────────────────────────
+
+  // B1) ensure a dedicated 'root' user exists (su=1). INSERT-if-absent, then UPDATE the flag to
+  // 1 so a pre-existing 'root' row (e.g. su=0) always converges on re-run.
+  await query(
+    `INSERT INTO \`${APP}\`.\`users\` (u_uuid, u_username, u_email, u_status, u_is_platform_superuser)
+       SELECT UUID(), ?, ?, 'active', 1
+        WHERE NOT EXISTS (SELECT 1 FROM \`${APP}\`.\`users\` WHERE u_username = ?)`,
+    [ROOT_USERNAME, ROOT_EMAIL, ROOT_USERNAME],
+  );
+  await query(`UPDATE \`${APP}\`.\`users\` SET u_is_platform_superuser = 1 WHERE u_username = ?`, [ROOT_USERNAME]);
+
+  const [rootUser] = await query(`SELECT u_uuid FROM \`${APP}\`.\`users\` WHERE u_username = ? LIMIT 1`, [ROOT_USERNAME]);
+  const rootUserId = rootUser.u_uuid;
+
+  // Root still logs into a session scoped to a tenant — anchor it to tenant-a (the original
+  // dev company from ...099), resolved by business key (never hard-coded).
+  const [companyA] = await query(`SELECT c_uuid FROM \`${APP}\`.\`companies\` WHERE c_name = ? LIMIT 1`, ['Astram Dev Co']);
+  const rootTenantId = companyA ? companyA.c_uuid : companyBId; // fall back to tenant-b if ...099 was skipped
+
+  // B2) credential (shield_identity) — ic_roles = [] (root's power is the su flag, not a role)
+  await query(
+    `INSERT INTO \`${IDENT}\`.\`identity_credential\`
+       (ic_identity_hint, ic_password_hash, ic_principal_id, ic_tenant_id, ic_roles, ic_created_at_ms, ic_updated_at_ms)
+       SELECT ?, ?, ?, ?, ?, ?, ?
+        WHERE NOT EXISTS (SELECT 1 FROM \`${IDENT}\`.\`identity_credential\` WHERE ic_identity_hint = ?)`,
+    [ROOT_HINT, PASSWORD_HASH, rootUserId, rootTenantId, JSON.stringify([]), nowMs, nowMs, ROOT_HINT],
+  );
+}
+
+async function down({ query }) {
+  // Reverse PART A (dependents first) — this migration's OWN 'Administrator B' role (+ its
+  // identity:* grant) is reversed too; the shared 'Administrator' role + tenant-a (from `...099`)
+  // are left untouched.
+  const [roleB] = await query(`SELECT r_uuid FROM \`${APP}\`.\`roles\` WHERE r_name = ? LIMIT 1`, [ROLE_B]);
+  if (roleB) {
+    await query(`DELETE FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid = ? AND rp_perm_key = ?`, [roleB.r_uuid, IDENTITY_WILDCARD_KEY]);
+  }
+  await query(`DELETE FROM \`${IDENT}\`.\`identity_credential\` WHERE ic_identity_hint = ?`, [HINT_B]);
+  await query(`DELETE mp FROM \`${APP}\`.\`membership_posting\` mp
+      JOIN \`${APP}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
+      JOIN \`${APP}\`.\`users\` u ON u.u_uuid = cm.cm_user_uuid WHERE u.u_username = ?`, [USERNAME_B]);
+  await query(`DELETE cm FROM \`${APP}\`.\`company_membership\` cm
+      JOIN \`${APP}\`.\`users\` u ON u.u_uuid = cm.cm_user_uuid WHERE u.u_username = ?`, [USERNAME_B]);
+  await query(`DELETE FROM \`${APP}\`.\`users\` WHERE u_username = ?`, [USERNAME_B]);
+  await query(`DELETE FROM \`${APP}\`.\`companies\` WHERE c_name = ?`, [COMPANY_B]);
+  // Role deleted LAST (after the posting that references it, and after its own grant).
+  if (roleB) {
+    await query(`DELETE FROM \`${APP}\`.\`roles\` WHERE r_uuid = ?`, [roleB.r_uuid]);
+  }
+
+  // Reverse PART B — root's credential + the root user.
+  await query(`DELETE FROM \`${IDENT}\`.\`identity_credential\` WHERE ic_identity_hint = ?`, [ROOT_HINT]);
+  await query(`DELETE FROM \`${APP}\`.\`users\` WHERE u_username = ?`, [ROOT_USERNAME]);
+}
+
+module.exports = { up, down };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/identity",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "license": "MIT",
   "description": "Astram framework — the framework-owned identity + tenancy model. Hosts the identity @ObjectType classes (user, company, membership, posting), framework-authored identity migrations, and the identity resolver. Top of the dependency graph: depends on @astram/engine (for @ObjectType/@Field decorators) + @astram/guard / @astram/core (for the auth ports).",
   "type": "commonjs",
@@ -21,9 +21,10 @@
     "access": "public"
   },
   "dependencies": {
+    "mariadb": "^3.4.0",
     "@astram/core": "1.0.0",
-    "@astram/guard": "0.4.0",
-    "@astram/engine": "0.1.1"
+    "@astram/engine": "0.1.3",
+    "@astram/guard": "0.5.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",