@astram/identity 0.12.0 → 0.14.0

package/dist/features/org-bootstrap/set-password-links.d.ts

@@ -0,0 +1,30 @@
+import { type ResetTokenStore } from '@astram/guard';
+export declare const DEFAULT_LINK_TTL_HOURS = 72;
+/** Whole hours, 1 to 168. */
+export declare function validateLinkTtlHours(hours: number): number;
+/**
+ * The reset-page base, under forgot-password's rule: outside development/test it must be set, http(s)
+ * and not loopback. Guard's resolver also checks the email-change base, which this run never uses, so
+ * that one is given a placeholder that always passes. The configured value is never echoed.
+ */
+export declare function resolveSetPasswordBase(env: NodeJS.ProcessEnv): string;
+export interface LinkTarget {
+    username: string;
+    principalId: string;
+    /** The user's company (audit tenant). */
+    tenantId: string;
+    /** Existing user whose earlier unused tokens must die first. */
+    invalidateFirst: boolean;
+}
+export interface IssueLinksInput {
+    store: ResetTokenStore;
+    targets: readonly LinkTarget[];
+    base: string;
+    ttlHours: number;
+    out: (line: string) => void;
+    /** Writes the `credential.setup_link_issued` audit row (user and expiry only). */
+    audit: (target: LinkTarget, expiresAtMs: number) => Promise<void>;
+}
+/** Issue one token per target and print its link once. Returns how many were issued. */
+export declare function issueSetPasswordLinks(input: IssueLinksInput): Promise<number>;
+//# sourceMappingURL=set-password-links.d.ts.map

package/dist/features/org-bootstrap/set-password-links.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-password-links.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/set-password-links.ts"],"names":[],"mappings":"AAMA,OAAO,EAA2B,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAG9E,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAGzC,6BAA6B;AAC7B,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ1D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAarE;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,eAAe,CAAC;IACvB,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,kFAAkF;IAClF,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,wFAAwF;AACxF,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBnF"}

package/dist/features/org-bootstrap/set-password-links.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_LINK_TTL_HOURS = void 0;
+exports.validateLinkTtlHours = validateLinkTtlHours;
+exports.resolveSetPasswordBase = resolveSetPasswordBase;
+exports.issueSetPasswordLinks = issueSetPasswordLinks;
+/**
+ * One-time set-password links (G-009 R8): the same token mechanism as forgot-password (32 random bytes,
+ * stored only as sha256 in the reset token store, per-row expiry), printed once to the operator's
+ * terminal. A token or link never reaches the audit row, the report or an error.
+ */
+const node_crypto_1 = require("node:crypto");
+const guard_1 = require("@astram/guard");
+const org_bootstrap_error_js_1 = require("./org-bootstrap-error.js");
+exports.DEFAULT_LINK_TTL_HOURS = 72;
+const HOUR_MS = 3_600_000;
+/** Whole hours, 1 to 168. */
+function validateLinkTtlHours(hours) {
+    if (!Number.isInteger(hours) || hours < 1 || hours > 168) {
+        throw new org_bootstrap_error_js_1.OrgBootstrapError('invalid_link_ttl', 'The link lifetime must be 1 to 168 whole hours.');
+    }
+    return hours;
+}
+/**
+ * The reset-page base, under forgot-password's rule: outside development/test it must be set, http(s)
+ * and not loopback. Guard's resolver also checks the email-change base, which this run never uses, so
+ * that one is given a placeholder that always passes. The configured value is never echoed.
+ */
+function resolveSetPasswordBase(env) {
+    try {
+        return (0, guard_1.resolveAuthLinkBaseUrls)({
+            env,
+            emailChangeLinkBaseUrlOption: 'https://email-change.not-used.example/',
+            mailDisabled: false,
+        }).resetLinkBaseUrl;
+    }
+    catch {
+        throw new org_bootstrap_error_js_1.OrgBootstrapError('link_base_url', 'RESET_LINK_BASE_URL must be set to a public http(s) URL (not localhost) outside development/test.');
+    }
+}
+/** Issue one token per target and print its link once. Returns how many were issued. */
+async function issueSetPasswordLinks(input) {
+    let issued = 0;
+    for (const target of input.targets) {
+        if (target.invalidateFirst)
+            await input.store.invalidateAllForPrincipal(target.principalId);
+        const raw = (0, node_crypto_1.randomBytes)(32).toString('hex');
+        const expiresAtMs = Date.now() + input.ttlHours * HOUR_MS;
+        await input.store.issue(target.principalId, (0, node_crypto_1.createHash)('sha256').update(raw).digest('hex'), expiresAtMs);
+        await input.audit(target, expiresAtMs);
+        input.out(`${target.username}  ${input.base}?token=${raw}  (expires ${new Date(expiresAtMs).toISOString()})`);
+        issued += 1;
+    }
+    return issued;
+}

package/dist/features/org-structure/org-catalog.service.d.ts

@@ -13,6 +13,19 @@ export declare class OrgCatalogService {
     listCompanyDepartments(companyUuid: string): Promise<NamedOption[]>;
     /** A company's branches as `{ uuid, name }` options for the posting editor. */
     listCompanyBranches(companyUuid: string): Promise<NamedOption[]>;
+    /**
+     * The id of the catalog row named `name`, creating it when none exists (G-009 R5). The catalog
+     * is global, so the lookup is by name; the create runs through the engine pipe like any write.
+     */
+    ensureDepartment(name: string): Promise<string>;
+    /** The id of the branch named `name`, creating it when none exists. */
+    ensureBranch(name: string): Promise<string>;
+    /** Link a department to a company (the junction row); idempotent. */
+    attachDepartment(companyUuid: string, departmentUuid: string): Promise<void>;
+    /** Link a branch to a company (the junction row); idempotent. */
+    attachBranch(companyUuid: string, branchUuid: string): Promise<void>;
+    private ensureCatalogRow;
+    private attachJunction;
     /** Shared reader for a company-scoped catalog junction; lists then name-resolves. */
     private listCompanyCatalog;
 }

package/dist/features/org-structure/org-catalog.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"org-catalog.service.d.ts","sourceRoot":"","sources":["../../../src/features/org-structure/org-catalog.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE7D,qBACa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,cAAc;IAEpD,kFAAkF;IAClF,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IASnE,+EAA+E;IAC/E,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAIhE,qFAAqF;YACvE,kBAAkB;CAoBjC"}
+{"version":3,"file":"org-catalog.service.d.ts","sourceRoot":"","sources":["../../../src/features/org-structure/org-catalog.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,cAAc,EAAiB,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAQ7D,qBACa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,cAAc;IAEpD,kFAAkF;IAClF,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IASnE,+EAA+E;IAC/E,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAIhE;;;OAGG;IACH,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI/C,uEAAuE;IACvE,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI3C,qEAAqE;IACrE,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5E,iEAAiE;IACjE,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAItD,gBAAgB;YAOhB,cAAc;IAa5B,qFAAqF;YACvE,kBAAkB;CAoBjC"}

package/dist/features/org-structure/org-catalog.service.js

@@ -18,6 +18,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.OrgCatalogService = void 0;
 const common_1 = require("@nestjs/common");
 const engine_1 = require("@astram/engine");
+/** Department/branch rows have a single uuid key; a composite id here is a wiring defect. */
+function catalogId(id) {
+    if (typeof id !== 'string')
+        throw new TypeError('catalog row id is not a single uuid');
+    return id;
+}
 let OrgCatalogService = class OrgCatalogService {
     records;
     constructor(records) {
@@ -31,6 +37,40 @@ let OrgCatalogService = class OrgCatalogService {
     listCompanyBranches(companyUuid) {
         return this.listCompanyCatalog('company_branch', 'branchUuid', 'branch', companyUuid);
     }
+    /**
+     * The id of the catalog row named `name`, creating it when none exists (G-009 R5). The catalog
+     * is global, so the lookup is by name; the create runs through the engine pipe like any write.
+     */
+    ensureDepartment(name) {
+        return this.ensureCatalogRow('department', name);
+    }
+    /** The id of the branch named `name`, creating it when none exists. */
+    ensureBranch(name) {
+        return this.ensureCatalogRow('branch', name);
+    }
+    /** Link a department to a company (the junction row); idempotent. */
+    attachDepartment(companyUuid, departmentUuid) {
+        return this.attachJunction('company_department', 'departmentUuid', companyUuid, departmentUuid);
+    }
+    /** Link a branch to a company (the junction row); idempotent. */
+    attachBranch(companyUuid, branchUuid) {
+        return this.attachJunction('company_branch', 'branchUuid', companyUuid, branchUuid);
+    }
+    async ensureCatalogRow(typeKey, name) {
+        const page = await this.records.list(typeKey, { where: { name } });
+        const existing = page.rows[0];
+        if (existing !== undefined)
+            return catalogId(existing.id);
+        return catalogId(await this.records.create(typeKey, { fields: { name } }));
+    }
+    async attachJunction(junctionTypeKey, refFieldKey, companyUuid, refUuid) {
+        const page = await this.records.list(junctionTypeKey, { where: { companyUuid } });
+        if (page.rows.some((r) => r.fields[refFieldKey] === refUuid))
+            return;
+        await this.records.create(junctionTypeKey, {
+            fields: { companyUuid, [refFieldKey]: refUuid },
+        });
+    }
     /** Shared reader for a company-scoped catalog junction; lists then name-resolves. */
     async listCompanyCatalog(junctionTypeKey, refFieldKey, catalogTypeKey, companyUuid) {
         const page = await this.records.list(junctionTypeKey, { where: { companyUuid } });

package/dist/features/role/role-owner-transition.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The ONLY writer of `roles.r_owner_company_uuid` after create (G-009 T14, SPEC R13 v5). The column
+ * is immutable at the engine, so an owner change is this audited compare-and-set on the caller's
+ * connection (inside its transaction): company -> NULL (company delete) or NULL -> company (owner
+ * claim). Any other shape (company -> company, NULL -> NULL, same -> same) is refused with no write.
+ * Exactly one row must change; a stale `from` or a failing audit throws, rolling the caller back.
+ */
+import { type IdentitySchemaNames } from '../../schema.js';
+export type RoleOwnerQuery = (sql: string, params?: readonly unknown[]) => Promise<unknown>;
+/** Writes the audit row for the transition on the SAME query (connection) as the update. */
+export type RoleOwnerAudit = (action: 'role.owner_cleared' | 'role.owner_claimed', attributes: {
+    roleUuid: string;
+    from: string | null;
+    to: string | null;
+}, query: RoleOwnerQuery) => Promise<void>;
+export declare function transitionRoleOwner(query: RoleOwnerQuery, roleUuid: string, from: string | null, to: string | null, audit: RoleOwnerAudit, schemas?: IdentitySchemaNames): Promise<void>;
+//# sourceMappingURL=role-owner-transition.d.ts.map

package/dist/features/role/role-owner-transition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-owner-transition.d.ts","sourceRoot":"","sources":["../../../src/features/role/role-owner-transition.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE5F,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG,CAC3B,MAAM,EAAE,oBAAoB,GAAG,oBAAoB,EACnD,UAAU,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACxE,KAAK,EAAE,cAAc,KAClB,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,cAAc,EACrB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GAAG,IAAI,EACnB,EAAE,EAAE,MAAM,GAAG,IAAI,EACjB,KAAK,EAAE,cAAc,EACrB,OAAO,GAAE,mBAA+C,GACvD,OAAO,CAAC,IAAI,CAAC,CAoBf"}

package/dist/features/role/role-owner-transition.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.transitionRoleOwner = transitionRoleOwner;
+/**
+ * The ONLY writer of `roles.r_owner_company_uuid` after create (G-009 T14, SPEC R13 v5). The column
+ * is immutable at the engine, so an owner change is this audited compare-and-set on the caller's
+ * connection (inside its transaction): company -> NULL (company delete) or NULL -> company (owner
+ * claim). Any other shape (company -> company, NULL -> NULL, same -> same) is refused with no write.
+ * Exactly one row must change; a stale `from` or a failing audit throws, rolling the caller back.
+ */
+const schema_js_1 = require("../../schema.js");
+async function transitionRoleOwner(query, roleUuid, from, to, audit, schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
+    const clearing = from !== null && to === null;
+    const claiming = from === null && to !== null;
+    if (!clearing && !claiming) {
+        throw new Error('A role owner may only change from a company to none, or from none to a company.');
+    }
+    const res = (await query(`UPDATE \`${schemas.app}\`.\`roles\` SET r_owner_company_uuid = ? WHERE r_uuid = ? AND r_owner_company_uuid <=> ?`, [to, roleUuid, from]));
+    if (Number(res?.affectedRows ?? 0) !== 1) {
+        throw new Error('The role owner changed concurrently; the transition was not applied.');
+    }
+    await audit(clearing ? 'role.owner_cleared' : 'role.owner_claimed', { roleUuid, from, to }, query);
+}

package/dist/features/role/role.controller.d.ts

@@ -16,7 +16,7 @@ export declare class RoleController {
         limit: number;
     }>;
     /** Create a role — gated on `identity:role:create`. */
-    createRole(body: {
+    createRole(req: AuthedRequest, body: {
         name?: string;
     }): Promise<{
         id: import("packages/engine/dist/types.js").RecordId;

package/dist/features/role/role.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.controller.d.ts","sourceRoot":"","sources":["../../../src/features/role/role.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAOvD,qBAEa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAE/C;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C,uDAAuD;IAGjD,UAAU,CAAS,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAKhD;0CACsC;IAGtC,OAAO,CAA0B,IAAI,EAAE,MAAM;IAI7C,uDAAuD;IAGjD,UAAU,CACP,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAMjC,uDAAuD;IAGjD,UAAU,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;CAIlF"}
+{"version":3,"file":"role.controller.d.ts","sourceRoot":"","sources":["../../../src/features/role/role.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAOvD,qBAEa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAE/C;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C,uDAAuD;IAGjD,UAAU,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAM3E;0CACsC;IAGtC,OAAO,CAA0B,IAAI,EAAE,MAAM;IAI7C,uDAAuD;IAGjD,UAAU,CACP,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAMjC,uDAAuD;IAGjD,UAAU,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;CAIlF"}

package/dist/features/role/role.controller.js

@@ -38,8 +38,9 @@ let RoleController = class RoleController {
         return { total: result.total, rows: result.rows, page, limit };
     }
     /** Create a role — gated on `identity:role:create`. */
-    async createRole(body) {
-        const id = await this.roles.createRole(body?.name ?? 'Untitled');
+    async createRole(req, body) {
+        // The owner is derived from the principal in the service; any owner in the body is ignored.
+        const id = await this.roles.createRole(body?.name ?? 'Untitled', req.principal);
         return { id };
     }
     /** Read one role — gated on `identity:role:read` (CONTROL-plane; root, the identity
@@ -70,9 +71,10 @@ __decorate([
 __decorate([
     (0, common_1.Post)('roles'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'create' }),
-    __param(0, (0, common_1.Body)()),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", Promise)
 ], RoleController.prototype, "createRole", null);
 __decorate([

package/dist/features/role/role.service.d.ts

@@ -20,8 +20,14 @@ export declare class RoleService {
     private readonly versionBump?;
     private readonly grants?;
     constructor(records: RecordsService, ceiling: GrantCeiling, versionBump?: (PostingVersionBump | null) | undefined, grants?: (GrantAdminService | null) | undefined);
-    /** Create a role. */
-    createRole(name: string): Promise<RecordId>;
+    /**
+     * Create a role. The owner is derived here from the actor, never from a client value: a non-root
+     * actor's role is owned by its active company (else its tenant); root's role is shared (no owner).
+     * A root-flagged actor bound to a declared operation (the org bootstrap's `roles` step, Shield #9)
+     * is anchored at the tenant it creates roles for, so its role is owned by that tenant.
+     * No actor (internal callers) ⇒ no owner field.
+     */
+    createRole(name: string, actor?: Principal): Promise<RecordId>;
     /** List roles (tenant-scoped by the pipe), with paging/search/sort. */
     listRoles(params?: ListParams): Promise<import("@astram/engine").RecordPage>;
     /** Read a single role. */

package/dist/features/role/role.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.service.d.ts","sourceRoot":"","sources":["../../../src/features/role/role.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAK/C;;;;;;;;;GASG;AACH,qBACa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAK7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAXP,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAKrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAKvC,MAAM,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA;IAGpD,qBAAqB;IACrB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAI3C,uEAAuE;IACvE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,0BAA0B;IAC1B,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB,8FAA8F;IACxF,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAO1F;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAoBhE"}
+{"version":3,"file":"role.service.d.ts","sourceRoot":"","sources":["../../../src/features/role/role.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAe,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAK/C;;;;;;;;;GASG;AACH,qBACa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAK7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAXP,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAKrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAKvC,MAAM,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA;IAGpD;;;;;;OAMG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAQ9D,uEAAuE;IACvE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,0BAA0B;IAC1B,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB,8FAA8F;IACxF,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAO1F;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAoBhE"}

package/dist/features/role/role.service.js

@@ -43,9 +43,19 @@ let RoleService = class RoleService {
         this.versionBump = versionBump;
         this.grants = grants;
     }
-    /** Create a role. */
-    createRole(name) {
-        return this.records.create('role', { fields: { name } });
+    /**
+     * Create a role. The owner is derived here from the actor, never from a client value: a non-root
+     * actor's role is owned by its active company (else its tenant); root's role is shared (no owner).
+     * A root-flagged actor bound to a declared operation (the org bootstrap's `roles` step, Shield #9)
+     * is anchored at the tenant it creates roles for, so its role is owned by that tenant.
+     * No actor (internal callers) ⇒ no owner field.
+     */
+    createRole(name, actor) {
+        const fields = { name };
+        if (actor && (actor.isRoot !== true || (0, engine_1.operationOf)(actor) !== undefined)) {
+            fields.ownerCompanyUuid = actor.activeScopeNodeId ?? actor.tenantId;
+        }
+        return this.records.create('role', { fields });
     }
     /** List roles (tenant-scoped by the pipe), with paging/search/sort. */
     listRoles(params) {

package/dist/features/user/credential-provisioner.token.d.ts

@@ -0,0 +1,8 @@
+/**
+ * DI token for the credential provisioner `UserService.createUserWithCredential` uses (G-009 T7,
+ * OD-6): guard's `MariaDbCredentialProvisioner` (`@astram/guard/internal`), built by `IdentityFeatureModule.forRoot()` over
+ * the ONE shared authz pool. It writes the locked credential on the engine transaction's own
+ * connection, so an API-created user and its credential commit or fail together.
+ */
+export declare const IDENTITY_CREDENTIAL_PROVISIONER: unique symbol;
+//# sourceMappingURL=credential-provisioner.token.d.ts.map

package/dist/features/user/credential-provisioner.token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-provisioner.token.d.ts","sourceRoot":"","sources":["../../../src/features/user/credential-provisioner.token.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,eAA4C,CAAC"}

package/dist/features/user/credential-provisioner.token.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_CREDENTIAL_PROVISIONER = void 0;
+/**
+ * DI token for the credential provisioner `UserService.createUserWithCredential` uses (G-009 T7,
+ * OD-6): guard's `MariaDbCredentialProvisioner` (`@astram/guard/internal`), built by `IdentityFeatureModule.forRoot()` over
+ * the ONE shared authz pool. It writes the locked credential on the engine transaction's own
+ * connection, so an API-created user and its credential commit or fail together.
+ */
+exports.IDENTITY_CREDENTIAL_PROVISIONER = Symbol('IDENTITY_CREDENTIAL_PROVISIONER');

package/dist/features/user/user.controller.d.ts

@@ -23,9 +23,7 @@ export declare class UserController {
         username?: string;
         email?: string;
         companyUuid?: string;
-    }): Promise<{
-        id: import("packages/engine/dist/types.js").RecordId;
-    }>;
+    }): Promise<import("./user.service.js").CreateUserResult>;
     /** Read one user — gated on `identity:user:read` (CONTROL-plane; root, the identity
      *  administrator, may read users). */
     getUser(uuid: string): Promise<import("packages/engine/dist/types.js").RecordView | null>;

package/dist/features/user/user.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.controller.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAOvD,qBAEa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAE/C;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C;;;OAGG;IAGG,UAAU,CACP,GAAG,EAAE,aAAa,EACjB,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAY3E;0CACsC;IAGtC,OAAO,CAA0B,IAAI,EAAE,MAAM;IAI7C,iGAAiG;IAG3F,UAAU,CACP,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAUtE,0FAA0F;IAGpF,UAAU,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;CAIlF"}
+{"version":3,"file":"user.controller.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAOvD,qBAEa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAE/C;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C;;;OAGG;IAGG,UAAU,CACP,GAAG,EAAE,aAAa,EACjB,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;IAY3E;0CACsC;IAGtC,OAAO,CAA0B,IAAI,EAAE,MAAM;IAI7C,iGAAiG;IAG3F,UAAU,CACP,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAUtE,0FAA0F;IAGpF,UAAU,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;CAIlF"}

package/dist/features/user/user.controller.js

@@ -43,13 +43,13 @@ let UserController = class UserController {
      */
     async createUser(req, body) {
         const companyUuid = (0, guard_1.optionalUuidField)(body?.companyUuid, 'companyUuid');
-        const id = await this.users.createUser(req.principal, {
+        const result = await this.users.createUserWithCredential(req.principal, {
             username: body?.username ?? 'Untitled',
             // KI #94: the template form sends it; the service canonicalises and validates it.
             ...(typeof body?.email === 'string' ? { email: body.email } : {}),
             ...(companyUuid !== undefined ? { companyUuid } : {}),
         });
-        return { id };
+        return result;
     }
     /** Read one user — gated on `identity:user:read` (CONTROL-plane; root, the identity
      *  administrator, may read users). */

package/dist/features/user/user.service.d.ts

@@ -1,9 +1,18 @@
 import { RecordsService, type RecordId } from '@astram/engine';
 import type { FrameworkSchemas, Principal } from '@astram/core';
-import { type EmailAddressChanger, type EmailSender, type ResetTokenStore, type SessionSweeper } from '@astram/guard';
+import { type EmailAddressChanger, type CredentialProvisioner, type EmailSender, type ResetTokenStore, type SessionSweeper } from '@astram/guard';
 import { type PostingVersionBump } from '../membership/posting-version-bump.js';
 import { type ListParams } from '../shared/list-query.js';
 import { GrantCeiling } from '../authz/grant-ceiling.js';
+/** The outcome of {@link UserService.createUserWithCredential}. */
+export type CreateUserResult = {
+    id: RecordId;
+    credential: 'locked';
+} | {
+    id: RecordId;
+    credential: 'none';
+    reason: 'no_email' | 'no_company' | 'no_provisioner';
+};
 /** The patch keys a generic user update accepts (security hardening #3). */
 export interface UserPatch {
     username?: unknown;
@@ -37,6 +46,7 @@ export declare class UserService {
     private readonly sessions?;
     private readonly versionBump?;
     private readonly emailAddresses?;
+    private readonly provisioner?;
     private readonly logger;
     /**
      * The engine's audit sink, used on the email helper's transaction (no pool of its own), on the
@@ -44,7 +54,16 @@ export declare class UserService {
      * service) ⇒ the sink resolves `SHIELD_DB_NAMESPACE` itself.
      */
     private readonly emailAudit;
-    constructor(records: RecordsService, ceiling: GrantCeiling, resetTokens?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, sessions?: (SessionSweeper | null) | undefined, versionBump?: (PostingVersionBump | null) | undefined, emailAddresses?: (EmailAddressChanger | null) | undefined, schemas?: FrameworkSchemas | null);
+    constructor(records: RecordsService, ceiling: GrantCeiling, resetTokens?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, sessions?: (SessionSweeper | null) | undefined, versionBump?: (PostingVersionBump | null) | undefined, emailAddresses?: (EmailAddressChanger | null) | undefined, schemas?: FrameworkSchemas | null, provisioner?: (CredentialProvisioner | null) | undefined);
+    /**
+     * Create a user; returns its id. Delegates to {@link createUserWithCredential} (same behaviour;
+     * the detailed credential outcome is dropped to keep this public signature stable).
+     */
+    createUser(actor: Principal, input: {
+        username: string;
+        email?: string | undefined;
+        companyUuid?: string | undefined;
+    }): Promise<RecordId>;
     /**
      * Create a user. With `companyUuid`, the user is created AND attached (one active membership) in
      * ONE transaction — the onboarding path for a non-root admin, whose membership create is checked
@@ -54,13 +73,17 @@ export declare class UserService {
      *
      * KI #94: an `email` is stored canonical (the ONE address rule, as the email-change flow); a
      * malformed one ⇒ {@link IdentityBadRequestError} (400) before any write; a blank one is no email.
-     * A new user has no credential yet, so no login hint moves.
+     *
+     * G-009 T7 (OD-6): with an email AND a company, a LOCKED credential (no password verifies; set
+     * later by reset) is created in that same transaction through the provisioner on the engine
+     * transaction's own connection; a provisioner failure rolls everything back. Otherwise no
+     * credential is created and the result says why (no email takes precedence).
      */
-    createUser(actor: Principal, input: {
+    createUserWithCredential(actor: Principal, input: {
         username: string;
         email?: string | undefined;
         companyUuid?: string | undefined;
-    }): Promise<RecordId>;
+    }): Promise<CreateUserResult>;
     /** List users (tenant-scoped by the pipe), with paging/search/sort. */
     listUsers(params?: ListParams): Promise<import("@astram/engine").RecordPage>;
     /** Read a single user. */

package/dist/features/user/user.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACjF,OAAO,KAAK,EAAc,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAOL,KAAK,mBAAmB,EAExB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAsCzD,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,WAAW;IAUpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IACY,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAMtE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAK1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IA7BlC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;gBAG3B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAGrB,WAAW,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EACK,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAMzE,QAAQ,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKhC,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAIvC,cAAc,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA,EAI5D,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI;IAKnC;;;;;;;;;;OAUG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GACxF,OAAO,CAAC,QAAQ,CAAC;IAsBpB,uEAAuE;IACvE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,0BAA0B;IAC1B,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB,mGAAmG;IAC7F,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAsCjF;;;;;;OAMG;YACW,WAAW;IAyBzB,uFAAuF;IACvF,OAAO,CAAC,gBAAgB;IA8BxB;;;;;;;;;OASG;YACW,iBAAiB;IAY/B,uDAAuD;IACjD,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/D,6FAA6F;YAC/E,kBAAkB;CAkBjC"}
+{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEjF,OAAO,KAAK,EAAc,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAQL,KAAK,mBAAmB,EAExB,KAAK,qBAAqB,EAC1B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAwCzD,mEAAmE;AACnE,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,QAAQ,CAAA;CAAE,GACtC;IACE,EAAE,EAAE,QAAQ,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,gBAAgB,CAAC;CACtD,CAAC;AAKN,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,WAAW;IAUpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IACY,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAMtE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAK1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAQhC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IArC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;gBAG3B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAGrB,WAAW,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EACK,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAMzE,QAAQ,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKhC,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAIvC,cAAc,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA,EAI5D,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,EAIhB,WAAW,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA;IAK7D;;;OAGG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GACxF,OAAO,CAAC,QAAQ,CAAC;IAIpB;;;;;;;;;;;;;;OAcG;IACG,wBAAwB,CAC5B,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GACxF,OAAO,CAAC,gBAAgB,CAAC;IAqC5B,uEAAuE;IACvE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,0BAA0B;IAC1B,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB,mGAAmG;IAC7F,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAsCjF;;;;;;OAMG;YACW,WAAW;IAyBzB,uFAAuF;IACvF,OAAO,CAAC,gBAAgB;IA8BxB;;;;;;;;;OASG;YACW,iBAAiB;IAY/B,uDAAuD;IACjD,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/D,6FAA6F;YAC/E,kBAAkB;CAkBjC"}

package/dist/features/user/user.service.js

@@ -16,12 +16,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.UserService = void 0;
 const common_1 = require("@nestjs/common");
 const engine_1 = require("@astram/engine");
+const internal_1 = require("@astram/engine/internal");
 const guard_1 = require("@astram/guard");
 const posting_version_bump_js_1 = require("../membership/posting-version-bump.js");
 const list_query_js_1 = require("../shared/list-query.js");
 const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
 const email_address_changer_token_js_1 = require("./email-address-changer.token.js");
+const credential_provisioner_token_js_1 = require("./credential-provisioner.token.js");
 const framework_schemas_token_js_1 = require("../framework-schemas.token.js");
 /**
  * KI #87: `users` has two unique keys besides the PK, `IDX_users_username` (migration 001) and
@@ -43,8 +45,11 @@ async function mappingDuplicates(write) {
         return await write();
     }
     catch (err) {
-        if (isDuplicateKey(err))
+        // R1-4: an orphan credential already holds this login hint (deleteUser leaves it): same fixed
+        // 409 as a duplicate email, never the hint.
+        if (isDuplicateKey(err) || err instanceof guard_1.CredentialExistsError) {
             throw new identity_errors_js_1.IdentityConflictError(USERNAME_OR_EMAIL_TAKEN);
+        }
         throw err;
     }
 }
@@ -77,6 +82,7 @@ let UserService = UserService_1 = class UserService {
     sessions;
     versionBump;
     emailAddresses;
+    provisioner;
     logger = new common_1.Logger(UserService_1.name);
     /**
      * The engine's audit sink, used on the email helper's transaction (no pool of its own), on the
@@ -84,7 +90,7 @@ let UserService = UserService_1 = class UserService {
      * service) ⇒ the sink resolves `SHIELD_DB_NAMESPACE` itself.
      */
     emailAudit;
-    constructor(records, ceiling, resetTokens, emailSender, sessions, versionBump, emailAddresses, schemas) {
+    constructor(records, ceiling, resetTokens, emailSender, sessions, versionBump, emailAddresses, schemas, provisioner) {
         this.records = records;
         this.ceiling = ceiling;
         this.resetTokens = resetTokens;
@@ -92,8 +98,16 @@ let UserService = UserService_1 = class UserService {
         this.sessions = sessions;
         this.versionBump = versionBump;
         this.emailAddresses = emailAddresses;
+        this.provisioner = provisioner;
         this.emailAudit = new engine_1.MariaDbAuditSink(schemas ? { schema: schemas.audit } : {});
     }
+    /**
+     * Create a user; returns its id. Delegates to {@link createUserWithCredential} (same behaviour;
+     * the detailed credential outcome is dropped to keep this public signature stable).
+     */
+    async createUser(actor, input) {
+        return (await this.createUserWithCredential(actor, input)).id;
+    }
     /**
      * Create a user. With `companyUuid`, the user is created AND attached (one active membership) in
      * ONE transaction — the onboarding path for a non-root admin, whose membership create is checked
@@ -103,9 +117,13 @@ let UserService = UserService_1 = class UserService {
      *
      * KI #94: an `email` is stored canonical (the ONE address rule, as the email-change flow); a
      * malformed one ⇒ {@link IdentityBadRequestError} (400) before any write; a blank one is no email.
-     * A new user has no credential yet, so no login hint moves.
+     *
+     * G-009 T7 (OD-6): with an email AND a company, a LOCKED credential (no password verifies; set
+     * later by reset) is created in that same transaction through the provisioner on the engine
+     * transaction's own connection; a provisioner failure rolls everything back. Otherwise no
+     * credential is created and the result says why (no email takes precedence).
      */
-    async createUser(actor, input) {
+    async createUserWithCredential(actor, input) {
         const fields = { username: input.username };
         const email = typeof input.email === 'string' ? (0, guard_1.canonicalEmail)(input.email) : '';
         if (email !== '') {
@@ -113,17 +131,30 @@ let UserService = UserService_1 = class UserService {
                 throw new identity_errors_js_1.IdentityBadRequestError('Enter a valid email address.');
             fields.email = email;
         }
-        if (!input.companyUuid) {
-            return mappingDuplicates(() => this.records.create('user', { fields }));
-        }
         const companyUuid = input.companyUuid;
-        return mappingDuplicates(() => this.records.transaction(async (tx) => {
-            const id = await tx.create('user', { fields });
+        if (!companyUuid) {
+            const id = await mappingDuplicates(() => this.records.create('user', { fields }));
+            return { id, credential: 'none', reason: email === '' ? 'no_email' : 'no_company' };
+        }
+        const provisioner = this.provisioner;
+        const provision = email !== '' && provisioner != null;
+        const id = await mappingDuplicates(() => this.records.transaction(async (tx) => {
+            const created = await tx.create('user', { fields });
             await tx.create('company_membership', {
-                fields: { userUuid: id, companyUuid, isActive: true, status: 'active' },
+                fields: { userUuid: created, companyUuid, isActive: true, status: 'active' },
             });
-            return id;
+            if (provision) {
+                await provisioner.provisionLocked({ principalId: created, hint: email, tenantId: companyUuid }, (0, internal_1.transactionQueryOf)(tx));
+            }
+            return created;
         }));
+        if (provision)
+            return { id, credential: 'locked' };
+        return {
+            id,
+            credential: 'none',
+            reason: email === '' ? 'no_email' : 'no_provisioner',
+        };
     }
     /** List users (tenant-scoped by the pipe), with paging/search/sort. */
     listUsers(params) {
@@ -296,6 +327,8 @@ exports.UserService = UserService = UserService_1 = __decorate([
     __param(6, (0, common_1.Inject)(email_address_changer_token_js_1.IDENTITY_EMAIL_ADDRESS_CHANGER)),
     __param(7, (0, common_1.Optional)()),
     __param(7, (0, common_1.Inject)(framework_schemas_token_js_1.IDENTITY_FRAMEWORK_SCHEMAS)),
+    __param(8, (0, common_1.Optional)()),
+    __param(8, (0, common_1.Inject)(credential_provisioner_token_js_1.IDENTITY_CREDENTIAL_PROVISIONER)),
     __metadata("design:paramtypes", [engine_1.RecordsService,
-        grant_ceiling_js_1.GrantCeiling, Object, Object, Object, Object, Object, Object])
+        grant_ceiling_js_1.GrantCeiling, Object, Object, Object, Object, Object, Object, Object])
 ], UserService);

package/dist/index.d.ts

@@ -40,6 +40,12 @@ export { buildIdentityAuthKeys, type IdentityAuthKeys } from './auth-facts-keys.
  * `identityObjects`, and mounts the CRUD controllers — no separate engine setup needed.
  */
 export { IdentityFeatureModule } from './features/identity-feature.module.js';
+/**
+ * The org bootstrap (G-009): `runOrgBootstrap(app, { file, apply })` applies a declarative org file
+ * (roots, company tree, roles, users, postings) through the framework's own services, as the declared
+ * operation `shield:org-bootstrap`. Run at deploy time against the app's own `AppModule` context.
+ */
+export { runOrgBootstrap, OrgBootstrapError, type OrgBootstrapReport, type RunOrgBootstrapOptions, } from './features/org-bootstrap/run-org-bootstrap.js';
 /**
  * Stored files (file-storage SPEC §5 I-K): `store` / `open` / `remove` on the engine pipe, provided
  * and exported by `IdentityFeatureModule`. Apps call it from their own `@Classified` routes.

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACxF;0DAC0D;AAC1D,OAAO,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEpF;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;GAGG;AACH,OAAO,EACL,YAAY,EACZ,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,UAAU,GAChB,MAAM,mCAAmC,CAAC;AAU3C;;;GAGG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF;;;;;;;GAOG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACxF;0DAC0D;AAC1D,OAAO,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEpF;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;;GAIG;AACH,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,+CAA+C,CAAC;AAEvD;;;GAGG;AACH,OAAO,EACL,YAAY,EACZ,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,UAAU,GAChB,MAAM,mCAAmC,CAAC;AAU3C;;;GAGG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF;;;;;;;GAOG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC"}