@astram/identity 0.13.0 → 0.14.0

package/dist/features/authz/grant-admin.service.d.ts

@@ -1,6 +1,6 @@
 import type { Pool } from 'mariadb';
 import type { Principal } from '@astram/core';
-import type { AuditPort } from '@astram/engine';
+import { type AuditPort } from '@astram/engine';
 import { PermissionVersionBumper } from './permission-version.bumper.js';
 import { AccessBundleStore } from './access-bundle-store.js';
 import { GrantCeiling } from './grant-ceiling.js';

package/dist/features/authz/grant-admin.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-admin.service.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAa,MAAM,oBAAoB,CAAC;AAI7D,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAiCpF;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;6EAC6E;AAC7E,qBAAa,WAAY,SAAQ,KAAK;gBACxB,GAAG,EAAE,MAAM;CAIxB;AAED,KAAK,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,qBAAa,iBAAiB;IAc1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAlB1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAE5C;;;;;;;;;OASG;gBAEgB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,uBAAuB,EAChD,WAAW,CAAC,EAAE,iBAAiB,EACd,OAAO,CAAC,EAAE,YAAY,YAAA,EACtB,KAAK,CAAC,EAAE,SAAS,YAAA,EACjB,OAAO,GAAE,mBAA+C;IAK3E,+EAA+E;IACzE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAmC5E;;;;OAIG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA0BhC,0FAA0F;YAC5E,cAAc;IAM5B;;;;;;OAMG;YACW,qBAAqB;IAUnC;;;;;OAKG;YACW,WAAW;IA6DzB;;;;;;OAMG;YACW,gBAAgB;IA0D9B;;;;;OAKG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB7E;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5E;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAqDtE;;;;;;OAMG;IACH;;;;;;OAMG;YACW,cAAc;IAS5B,OAAO,CAAC,uBAAuB;IAgB/B,0EAA0E;IACpE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IASvD;;;;;;OAMG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BzF;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBxF,uFAAuF;YACzE,wBAAwB;IAWtC;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,MAAM,EACF;QACE,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;KAC5B,GACD,SAAS,EACb,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAgIrF"}
+{"version":3,"file":"grant-admin.service.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAa,MAAM,oBAAoB,CAAC;AAI7D,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAiCpF;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;6EAC6E;AAC7E,qBAAa,WAAY,SAAQ,KAAK;gBACxB,GAAG,EAAE,MAAM;CAIxB;AAED,KAAK,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,qBAAa,iBAAiB;IAc1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAlB1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAE5C;;;;;;;;;OASG;gBAEgB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,uBAAuB,EAChD,WAAW,CAAC,EAAE,iBAAiB,EACd,OAAO,CAAC,EAAE,YAAY,YAAA,EACtB,KAAK,CAAC,EAAE,SAAS,YAAA,EACjB,OAAO,GAAE,mBAA+C;IAK3E,+EAA+E;IACzE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAmC5E;;;;OAIG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA0BhC,0FAA0F;YAC5E,cAAc;IAM5B;;;;;;OAMG;YACW,qBAAqB;IAUnC;;;;;OAKG;YACW,WAAW;IA6DzB;;;;;;OAMG;YACW,gBAAgB;IAiE9B;;;;;OAKG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB7E;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5E;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAqDtE;;;;;;OAMG;IACH;;;;;;OAMG;YACW,cAAc;IAS5B,OAAO,CAAC,uBAAuB;IAgB/B,0EAA0E;IACpE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IASvD;;;;;;OAMG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BzF;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBxF,uFAAuF;YACzE,wBAAwB;IAWtC;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,MAAM,EACF;QACE,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;KAC5B,GACD,SAAS,EACb,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAgIrF"}

package/dist/features/authz/grant-admin.service.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GrantAdminService = exports.BadKeyError = void 0;
 const core_1 = require("@astram/core");
+const engine_1 = require("@astram/engine");
 const access_bundle_store_js_1 = require("./access-bundle-store.js");
 const db_permission_facts_adapter_js_1 = require("./db-permission-facts.adapter.js");
 const grant_ceiling_js_1 = require("./grant-ceiling.js");
@@ -216,6 +217,12 @@ class GrantAdminService {
                 return [labelOf(rowTenant)];
             return actor.isRoot === true ? tenants.map(labelOf) : [];
         };
+        // G-009 R6: a grantor bound to a declared operation (org bootstrap) is attributed in the row;
+        // an unbound grantor adds nothing, so today's attributes stay byte-identical.
+        const op = (0, engine_1.operationOf)(actor);
+        const operationAttributes = !op
+            ? {}
+            : { operation: op.operationKey, step: op.stepKey, onBehalfOf: op.onBehalfOf };
         const occurredAtMs = Date.now();
         for (const tenantId of new Set([actor.tenantId, ...tenants])) {
             const tenantNames = tenantsFor(tenantId);
@@ -231,6 +238,7 @@ class GrantAdminService {
                     keys: [...keys],
                     tenants: tenantNames,
                     ...extra,
+                    ...operationAttributes,
                 },
             }, query);
         }

package/dist/features/authz/grant-ceiling.d.ts

@@ -20,6 +20,14 @@ import { type IdentitySchemaNames } from '../../schema.js';
 export declare class GrantCeilingError extends Error {
     constructor(key: string, message?: string);
 }
+/**
+ * The org-bootstrap exception (G-009 AC-7): `operationRoleIds` is the allow-set the runner computed
+ * from the file's roles for the company. It relaxes a role check ONLY for a principal bound (engine
+ * WeakMap binding, unforgeable) to `shield:org-bootstrap`, and only when EVERY id of the call is in the set.
+ */
+export interface OperationRoleOptions {
+    readonly operationRoleIds?: readonly string[];
+}
 /** The actor's reachable subtree: the session's cached closure, else the self node (non-widening). */
 export declare function subtreeOf(actor: Principal): readonly string[];
 /**
@@ -89,7 +97,7 @@ export declare class GrantCeiling {
      * A role holding nothing assigns nothing and passes; a role key the registry does not know
      * counts as not held (Phase 8 #4). Root bypasses. Store outage → 503.
      */
-    assertCanAssignRoles(actor: Principal, roleIds: readonly string[]): Promise<void>;
+    assertCanAssignRoles(actor: Principal, roleIds: readonly string[], opts?: OperationRoleOptions): Promise<void>;
     /**
      * The first of a TARGET's raw keys (a role's `role_permission` rows) the actor does not cover,
      * or `undefined` when all are covered. Phase 8 #4: judged per RAW key with `coversKey`, so a key
@@ -166,12 +174,12 @@ export declare class GrantCeiling {
      * role not bound in the subtree is "not found" for the actor (no existence leak); a role also
      * used outside (a shared role) is root-only. Root bypasses.
      */
-    assertRoleAdministrable(actor: Principal, roleUuid: string): Promise<void>;
+    assertRoleAdministrable(actor: Principal, roleUuid: string, opts?: OperationRoleOptions): Promise<void>;
     /**
      * Assert the actor may POST someone to the role (#11): the role is bound within the actor's
      * subtree or not bound at all — never a role also used outside it (a shared role's assignment
      * would widen another tenant's role). Pair with {@link assertCanAssignRoles}. Root bypasses.
      */
-    assertRoleAssignable(actor: Principal, roleUuid: string): Promise<void>;
+    assertRoleAssignable(actor: Principal, roleUuid: string, opts?: OperationRoleOptions): Promise<void>;
 }
 //# sourceMappingURL=grant-ceiling.d.ts.map

package/dist/features/authz/grant-ceiling.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-ceiling.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-ceiling.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAI9D,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAWtE,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,6FAA6F;AAC7F,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAI1C;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,MAAM,EAAE,CAE7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,EAC9B,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,OAAO,EAAE,MAAM,GACd,OAAO,CAST;AAED;;;GAGG;AACH,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAQzB,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,OAAO;IAf1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;gBAGzB,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;;OAKG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IACjC,+FAA+F;IAC9E,GAAG,GAAE,MAAM,MAAiB;IAC7C,mFAAmF;IAClE,OAAO,GAAE,mBAA+C;IAU3E,+FAA+F;IAC/F,MAAM,CAAC,kBAAkB,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAS/C,qFAAqF;IACrF,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAQ5C,oEAAoE;IACpE,OAAO,CAAC,cAAc;IAItB,+FAA+F;YACjF,cAAc;IAU5B,+FAA+F;YACjF,KAAK;IASnB;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAwB7D;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAahF;;;;;;OAMG;IACG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBvF;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAQtB;;;;;;OAMG;IACG,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+D5E;;;;;;;;;;;;OAYG;IACG,0BAA0B,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BnF;;;;;;;;;OASG;IACG,qCAAqC,CACzC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,SAAS,GAAE,QAAQ,GAAG,QAAmB,GACxC,OAAO,CAAC,IAAI,CAAC;IAsBhB;;;;;;;;OAQG;IACG,8BAA8B,CAClC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC;IA6BhB;;;;;;;;OAQG;IACG,uBAAuB,CAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,KAAK,EAAE;QAAE,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC9F,OAAO,CAAC,IAAI,CAAC;IAuChB,+FAA+F;IACzF,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAM3E;;;;;OAKG;IACG,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhF;;;;OAIG;IACG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI9E"}
+{"version":3,"file":"grant-ceiling.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-ceiling.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAM9D,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAWtE,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,6FAA6F;AAC7F,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAI1C;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAcD,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,MAAM,EAAE,CAE7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,EAC9B,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,OAAO,EAAE,MAAM,GACd,OAAO,CAST;AAED;;;GAGG;AACH,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAQzB,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,OAAO;IAf1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;gBAGzB,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;;OAKG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IACjC,+FAA+F;IAC9E,GAAG,GAAE,MAAM,MAAiB;IAC7C,mFAAmF;IAClE,OAAO,GAAE,mBAA+C;IAU3E,+FAA+F;IAC/F,MAAM,CAAC,kBAAkB,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAS/C,qFAAqF;IACrF,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAQ5C,oEAAoE;IACpE,OAAO,CAAC,cAAc;IAItB,+FAA+F;YACjF,cAAc;IAU5B,+FAA+F;YACjF,KAAK;IASnB;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAwB7D;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAahF;;;;;;OAMG;IACG,oBAAoB,CACxB,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAiBhB;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAQtB;;;;;;OAMG;IACG,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+D5E;;;;;;;;;;;;OAYG;IACG,0BAA0B,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BnF;;;;;;;;;OASG;IACG,qCAAqC,CACzC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,SAAS,GAAE,QAAQ,GAAG,QAAmB,GACxC,OAAO,CAAC,IAAI,CAAC;IAsBhB;;;;;;;;OAQG;IACG,8BAA8B,CAClC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC;IA6BhB;;;;;;;;OAQG;IACG,uBAAuB,CAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,KAAK,EAAE;QAAE,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC9F,OAAO,CAAC,IAAI,CAAC;IAuChB,+FAA+F;IACzF,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAM3E;;;;;OAKG;IACG,uBAAuB,CAC3B,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAMhB;;;;OAIG;IACG,oBAAoB,CACxB,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAAC,IAAI,CAAC;CAKjB"}

package/dist/features/authz/grant-ceiling.js

@@ -4,6 +4,8 @@ exports.GrantCeiling = exports.GrantCeilingError = void 0;
 exports.subtreeOf = subtreeOf;
 exports.coversKey = coversKey;
 const core_1 = require("@astram/core");
+const engine_1 = require("@astram/engine");
+const org_bootstrap_manifest_js_1 = require("../org-bootstrap/org-bootstrap.manifest.js");
 const http_js_1 = require("../shared/http.js");
 const db_permission_facts_adapter_js_1 = require("./db-permission-facts.adapter.js");
 const role_binding_js_1 = require("./role-binding.js");
@@ -18,6 +20,15 @@ class GrantCeilingError extends Error {
     }
 }
 exports.GrantCeilingError = GrantCeilingError;
+function operationCovers(actor, roleIds, opts) {
+    const allowed = opts?.operationRoleIds;
+    if (allowed === undefined || allowed.length === 0 || roleIds.length === 0)
+        return false;
+    if ((0, engine_1.operationOf)(actor)?.operationKey !== org_bootstrap_manifest_js_1.ORG_BOOTSTRAP_OPERATION)
+        return false;
+    const set = new Set(allowed);
+    return roleIds.every((id) => set.has(id));
+}
 /** The actor's reachable subtree: the session's cached closure, else the self node (non-widening). */
 function subtreeOf(actor) {
     return actor.scopeSubtreeNodeIds?.length ? actor.scopeSubtreeNodeIds : [actor.tenantId];
@@ -160,9 +171,11 @@ class GrantCeiling {
      * A role holding nothing assigns nothing and passes; a role key the registry does not know
      * counts as not held (Phase 8 #4). Root bypasses. Store outage → 503.
      */
-    async assertCanAssignRoles(actor, roleIds) {
+    async assertCanAssignRoles(actor, roleIds, opts) {
         if (actor.isRoot === true)
             return;
+        if (operationCovers(actor, roleIds, opts))
+            return;
         const ids = [...new Set(roleIds)];
         if (ids.length === 0)
             return;
@@ -372,9 +385,11 @@ class GrantCeiling {
      * role not bound in the subtree is "not found" for the actor (no existence leak); a role also
      * used outside (a shared role) is root-only. Root bypasses.
      */
-    async assertRoleAdministrable(actor, roleUuid) {
+    async assertRoleAdministrable(actor, roleUuid, opts) {
         if (actor.isRoot === true)
             return;
+        if (operationCovers(actor, [roleUuid], opts))
+            return;
         GrantCeiling.checkAdministrable(await this.roleBinding(actor, roleUuid));
     }
     /**
@@ -382,9 +397,11 @@ class GrantCeiling {
      * subtree or not bound at all — never a role also used outside it (a shared role's assignment
      * would widen another tenant's role). Pair with {@link assertCanAssignRoles}. Root bypasses.
      */
-    async assertRoleAssignable(actor, roleUuid) {
+    async assertRoleAssignable(actor, roleUuid, opts) {
         if (actor.isRoot === true)
             return;
+        if (operationCovers(actor, [roleUuid], opts))
+            return;
         GrantCeiling.checkAssignable(await this.roleBinding(actor, roleUuid));
     }
 }

package/dist/features/authz/record-authorization.d.ts

@@ -41,7 +41,7 @@ export declare function createIdentityAuthzPool(schemas?: FrameworkSchemas): Poo
  *   - `registry` — bridged from `identityObjects` PLUS the consumer's `extraObjects` (their
  *     `<module>:<type>:<action>` keys project into a principal's grants at gate 5; without them a
  *     consumer type is `resource_not_registered`),
- *   - `operationManifest` — empty (identity declares no trusted delegated operations).
+ *   - `operationManifest` — the `shield:org-bootstrap` steps (G-009); no other delegated operation.
  */
 export declare function buildRecordAuthorizationInputs(pool: Pool, extraObjects?: readonly ObjectTypeInput[], 
 /** Resolved framework names for the facts adapter (absent ⇒ from the namespace, once). */

package/dist/features/authz/record-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record-authorization.d.ts","sourceRoot":"","sources":["../../../src/features/authz/record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAItD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMxF;AAED,iEAAiE;AACjE,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE3E;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAaxE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,IAAI,EACV,YAAY,GAAE,SAAS,eAAe,EAAO;AAC7C,0FAA0F;AAC1F,OAAO,CAAC,EAAE,mBAAmB,GAC5B,yBAAyB,CAS3B"}
+{"version":3,"file":"record-authorization.d.ts","sourceRoot":"","sources":["../../../src/features/authz/record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAKtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMxF;AAED,iEAAiE;AACjE,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE3E;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAaxE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,IAAI,EACV,YAAY,GAAE,SAAS,eAAe,EAAO;AAC7C,0FAA0F;AAC1F,OAAO,CAAC,EAAE,mBAAmB,GAC5B,yBAAyB,CAS3B"}

package/dist/features/authz/record-authorization.js

@@ -22,6 +22,7 @@ exports.buildRecordAuthorizationInputs = buildRecordAuthorizationInputs;
  */
 const mariadb_1 = __importDefault(require("mariadb"));
 const guard_1 = require("@astram/guard");
+const org_bootstrap_manifest_js_1 = require("../org-bootstrap/org-bootstrap.manifest.js");
 const objects_js_1 = require("../../objects.js");
 const db_permission_facts_adapter_js_1 = require("./db-permission-facts.adapter.js");
 const session_facts_reader_js_1 = require("./session-facts.reader.js");
@@ -73,7 +74,7 @@ function createIdentityAuthzPool(schemas) {
  *   - `registry` — bridged from `identityObjects` PLUS the consumer's `extraObjects` (their
  *     `<module>:<type>:<action>` keys project into a principal's grants at gate 5; without them a
  *     consumer type is `resource_not_registered`),
- *   - `operationManifest` — empty (identity declares no trusted delegated operations).
+ *   - `operationManifest` — the `shield:org-bootstrap` steps (G-009); no other delegated operation.
  */
 function buildRecordAuthorizationInputs(pool, extraObjects = [], 
 /** Resolved framework names for the facts adapter (absent ⇒ from the namespace, once). */
@@ -84,6 +85,6 @@ schemas) {
         permissionFacts: new db_permission_facts_adapter_js_1.DbPermissionFactsAdapter(pool, registry, undefined, schemas),
         sessionFacts: new session_facts_reader_js_1.AlsSessionFactsReader(),
         registry,
-        operationManifest: [],
+        operationManifest: org_bootstrap_manifest_js_1.ORG_BOOTSTRAP_MANIFEST,
     };
 }

package/dist/features/company/company-hierarchy.service.d.ts

@@ -115,6 +115,12 @@ export declare class CompanyHierarchyService {
      * Every change is audited on this transaction (names; ids only in structured attributes).
      */
     private retireDependents;
+    /**
+     * Step 5 of {@link retireDependents} (G-009 T14, SPEC §5 v4): the roles the company owns become
+     * shared. Each owner is cleared through the audited `transitionRoleOwner` seam on the delete's
+     * connection (the FK's SET NULL would do it silently, without an audit row).
+     */
+    private clearRoleOwners;
     /** Step 4 of {@link retireDependents}: revoke and audit the grants naming the company. */
     private revokeGrantsNaming;
     /** Lock the company, then require dominance over each of its members (see `remove`). */

package/dist/features/company/company-hierarchy.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company-hierarchy.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company-hierarchy.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,mBAAmB,EAAkB,MAAM,mCAAmC,CAAC;AAQxF,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,8BAA8B,CAC5B,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAqCD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAElD;AAED,qBAAa,uBAAuB;IAEhC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAPP,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,mBAAmB;IAC7C,2FAA2F;IAC1E,OAAO,EAAE,eAAe,EACxB,KAAK,CAAC,EAAE,SAAS,YAAA,EACjB,GAAG,GAAE,MAAM,MAAiB;IAC7C,mFAAmF;IAClE,OAAO,GAAE,mBAA+C;IAG3E,yDAAyD;IACzD,OAAO,CAAC,OAAO;IAIf;;;;;OAKG;YACW,UAAU;IAQxB,uDAAuD;YACzC,KAAK;YAUL,WAAW;IAqBzB,iGAAiG;IAC3F,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAoD3F;;;;;;;;;;;;;;;;;OAiBG;IACG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB/D;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,gBAAgB;IAkF9B,0FAA0F;YAC5E,kBAAkB;IAmDhC,wFAAwF;YAC1E,sBAAsB;IAgCpC,wFAAwF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD"}
+{"version":3,"file":"company-hierarchy.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company-hierarchy.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,mBAAmB,EAAkB,MAAM,mCAAmC,CAAC;AASxF,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,8BAA8B,CAC5B,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAqCD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAElD;AAED,qBAAa,uBAAuB;IAEhC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAPP,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,mBAAmB;IAC7C,2FAA2F;IAC1E,OAAO,EAAE,eAAe,EACxB,KAAK,CAAC,EAAE,SAAS,YAAA,EACjB,GAAG,GAAE,MAAM,MAAiB;IAC7C,mFAAmF;IAClE,OAAO,GAAE,mBAA+C;IAG3E,yDAAyD;IACzD,OAAO,CAAC,OAAO;IAIf;;;;;OAKG;YACW,UAAU;IAQxB,uDAAuD;YACzC,KAAK;YAUL,WAAW;IAqBzB,iGAAiG;IAC3F,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAoD3F;;;;;;;;;;;;;;;;;OAiBG;IACG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB/D;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,gBAAgB;IAmF9B;;;;OAIG;YACW,eAAe;IA6B7B,0FAA0F;YAC5E,kBAAkB;IAmDhC,wFAAwF;YAC1E,sBAAsB;IAgCpC,wFAAwF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD"}

package/dist/features/company/company-hierarchy.service.js

@@ -6,6 +6,7 @@ const http_js_1 = require("../shared/http.js");
 const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
 const lock_service_accounts_js_1 = require("../service-account/lock-service-accounts.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
+const role_owner_transition_js_1 = require("../role/role-owner-transition.js");
 const schema_js_1 = require("../../schema.js");
 /** A JSON-array column (the driver returns an array OR a string) → its string items; else []. */
 function jsonIdArray(v) {
@@ -233,8 +234,26 @@ class CompanyHierarchyService {
             });
         }
         await this.revokeGrantsNaming(conn, actor, nodeUuid, companyName);
+        await this.clearRoleOwners(conn, actor, nodeUuid, companyName);
         return [...touched];
     }
+    /**
+     * Step 5 of {@link retireDependents} (G-009 T14, SPEC §5 v4): the roles the company owns become
+     * shared. Each owner is cleared through the audited `transitionRoleOwner` seam on the delete's
+     * connection (the FK's SET NULL would do it silently, without an audit row).
+     */
+    async clearRoleOwners(conn, actor, nodeUuid, companyName) {
+        const owned = (await conn.query(`SELECT r_uuid, r_name FROM \`${this.schemas.app}\`.\`roles\` WHERE r_owner_company_uuid = ? ORDER BY r_uuid FOR UPDATE`, [nodeUuid]));
+        for (const role of owned) {
+            await (0, role_owner_transition_js_1.transitionRoleOwner)((sql, params) => conn.query(sql, params), role.r_uuid, nodeUuid, null, (action, attributes, query) => this.recordAudit({ query }, actor, action, {
+                eventType: 'role',
+                ...attributes,
+                role: role.r_name,
+                company: companyName,
+                reason: 'company_deleted',
+            }), this.schemas);
+        }
+    }
     /** Step 4 of {@link retireDependents}: revoke and audit the grants naming the company. */
     async revokeGrantsNaming(conn, actor, nodeUuid, companyName) {
         const grants = (await conn.query(`SELECT ctg_uuid, ctg_owning_tenant_uuid, ctg_grantee_tenant_uuid, ctg_grantee_kind,

package/dist/features/identity-feature.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAYL,KAAK,cAAc,EAGnB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AA2GxB;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAUnF;AAKD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GACzC,IAAI,CAwBN;AAKD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC/E,IAAI,CAQN;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,gBAAgB,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,cAAc,CAqBhB;AAED;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,EACjB,OAAO,EAAE,YAAY,GACtB,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QAC1C,OAAO,CAAC,EAAE,gBAAgB,CAAC;KACvB,GAAG,aAAa;CA2jBvB"}
+{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAYL,KAAK,cAAc,EAGnB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AA+GxB;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAUnF;AAKD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GACzC,IAAI,CAwBN;AAKD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC/E,IAAI,CAQN;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,gBAAgB,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,cAAc,CAqBhB;AAED;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,EACjB,OAAO,EAAE,YAAY,GACtB,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QAC1C,OAAO,CAAC,EAAE,gBAAgB,CAAC;KACvB,GAAG,aAAa;CAqkBvB"}

package/dist/features/identity-feature.module.js

@@ -17,6 +17,7 @@ const core_1 = require("@nestjs/core");
 const core_2 = require("@astram/core");
 const engine_1 = require("@astram/engine");
 const guard_1 = require("@astram/guard");
+const internal_1 = require("@astram/guard/internal");
 const objects_js_1 = require("../objects.js");
 const index_js_1 = require("./access/index.js");
 const company_service_js_1 = require("./company/company.service.js");
@@ -26,7 +27,9 @@ const role_service_js_1 = require("./role/role.service.js");
 const role_controller_js_1 = require("./role/role.controller.js");
 const user_service_js_1 = require("./user/user.service.js");
 const email_address_changer_token_js_1 = require("./user/email-address-changer.token.js");
+const credential_provisioner_token_js_1 = require("./user/credential-provisioner.token.js");
 const framework_schemas_token_js_1 = require("./framework-schemas.token.js");
+const org_bootstrap_tokens_js_1 = require("./org-bootstrap/org-bootstrap.tokens.js");
 const user_controller_js_1 = require("./user/user.controller.js");
 const membership_controller_js_1 = require("./membership/membership.controller.js");
 const membership_service_js_1 = require("./membership/membership.service.js");
@@ -203,6 +206,8 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
      *   differ from guard's `FRAMEWORK_SCHEMAS`. Never read per request.
      */
     static forRoot({ rootIds, extraObjects = [], schemas: givenSchemas, } = {}) {
+        // G-009 N4: a reserved operation principal is never a root, whatever variable `rootIds` came from.
+        (0, guard_1.assertNoReservedRootId)(rootIds);
         // The framework database names, resolved ONCE (boot) for every SQL path built below.
         // Caller-supplied names are checked before any SQL is built (fail closed, Shield #1).
         const schemas = givenSchemas !== undefined
@@ -585,9 +590,17 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                     provide: email_address_changer_token_js_1.IDENTITY_EMAIL_ADDRESS_CHANGER,
                     useValue: new guard_1.MariaDbEmailAddressChanger(authzPool, Date.now, schemas),
                 },
+                // G-009 T7 (OD-6): the locked-credential writer UserService runs on the create transaction.
+                {
+                    provide: credential_provisioner_token_js_1.IDENTITY_CREDENTIAL_PROVISIONER,
+                    useValue: new internal_1.MariaDbCredentialProvisioner(authzPool, Date.now, schemas),
+                },
                 // The same resolved names for identity services Nest constructs (UserService's
                 // email-change audit sink), never a second env read.
                 { provide: framework_schemas_token_js_1.IDENTITY_FRAMEWORK_SCHEMAS, useValue: schemas },
+                // G-009 T10: the ONE shared authz pool, for the org bootstrap runner (named lock, state reads,
+                // claim and root-flag writes). Not exported; the runner reads it with `app.get({ strict: false })`.
+                { provide: org_bootstrap_tokens_js_1.IDENTITY_AUTHZ_POOL, useValue: authzPool },
                 // ADR-0035 (GAPS #6): attach the guard's Redis permission-version cache to the ONE shared
                 // bumper, so every committed bump (postings, grants, hierarchy) is published to Redis,
                 // where gate 5 reads it. Provided by the auth surface under `auth: true` (through the

package/dist/features/membership/membership.service.d.ts

@@ -41,6 +41,15 @@ export declare class MembershipService {
      * swallowed here). `createdBy` is stamped server-side (actorId-trusted).
      */
     addMembership(actor: Principal, userUuid: string, companyUuid: string): Promise<RecordId>;
+    /**
+     * Add an ACTIVE membership for `(userUuid, companyUuid)` in one create (G-009 R4): a brand-new
+     * membership has no other active card to displace, so no create-then-activate pair. A
+     * membership for that pair already existing is an `IdentityConflictError`, from the pre-check
+     * and from the `(cm_user_uuid, cm_company_uuid)` unique index (the pre-check read is SQL-scoped
+     * and can miss a row for an operation-bound principal); the driver message is never echoed.
+     * Bumps the company's tenant. The reach checks of `addMembership` apply unchanged.
+     */
+    addActiveMembership(actor: Principal, userUuid: string, companyUuid: string): Promise<RecordId>;
     /** List a user's membership cards (tenant-scoped by the pipe). */
     listMemberships(userUuid: string): Promise<readonly RecordView[]>;
     /**

package/dist/features/membership/membership.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membership.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE1F,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,qBACa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAQxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAXZ,OAAO,EAAE,cAAc,EAGvB,OAAO,EAAE,YAAY,EAQrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D;;;;OAIG;YACW,WAAW;IAQzB;;;;;;OAMG;YACW,WAAW;IAYzB;;;;;;OAMG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAkB/F,kEAAkE;IAC5D,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAKvE;;;;;;;;;;;;;;;;;OAiBG;IACG,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsC1F;;;;OAIG;IACG,gBAAgB,CACpB,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACzB,OAAO,CAAC,IAAI,CAAC;IAchB;;;OAGG;IACG,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAYhF"}
+{"version":3,"file":"membership.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE1F,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AASzD,qBACa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAQxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAXZ,OAAO,EAAE,cAAc,EAGvB,OAAO,EAAE,YAAY,EAQrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D;;;;OAIG;YACW,WAAW;IAQzB;;;;;;OAMG;YACW,WAAW;IAYzB;;;;;;OAMG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAkB/F;;;;;;;OAOG;IACG,mBAAmB,CACvB,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC;IAwBpB,kEAAkE;IAC5D,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAKvE;;;;;;;;;;;;;;;;;OAiBG;IACG,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsC1F;;;;OAIG;IACG,gBAAgB,CACpB,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACzB,OAAO,CAAC,IAAI,CAAC;IAchB;;;OAGG;IACG,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAYhF"}

package/dist/features/membership/membership.service.js

@@ -30,6 +30,13 @@ const engine_1 = require("@astram/engine");
 const posting_version_bump_js_1 = require("./posting-version-bump.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
 const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
+/** A driver duplicate-key error (errno 1062), recognised by errno/code only, never its message. */
+function isDuplicateKey(err) {
+    if (typeof err !== 'object' || err === null)
+        return false;
+    const e = err;
+    return e.errno === 1062 || e.code === 'ER_DUP_ENTRY';
+}
 let MembershipService = class MembershipService {
     records;
     ceiling;
@@ -101,6 +108,39 @@ let MembershipService = class MembershipService {
             fields: { userUuid, companyUuid, isActive: false, status: 'active' },
         });
     }
+    /**
+     * Add an ACTIVE membership for `(userUuid, companyUuid)` in one create (G-009 R4): a brand-new
+     * membership has no other active card to displace, so no create-then-activate pair. A
+     * membership for that pair already existing is an `IdentityConflictError`, from the pre-check
+     * and from the `(cm_user_uuid, cm_company_uuid)` unique index (the pre-check read is SQL-scoped
+     * and can miss a row for an operation-bound principal); the driver message is never echoed.
+     * Bumps the company's tenant. The reach checks of `addMembership` apply unchanged.
+     */
+    async addActiveMembership(actor, userUuid, companyUuid) {
+        if (actor.isRoot !== true) {
+            const user = await this.records.get('user', userUuid);
+            if (user === null)
+                throw new identity_errors_js_1.IdentityNotFoundError('User not found.');
+        }
+        const existing = await this.records.list('company_membership', { where: { userUuid } });
+        if (existing.rows.some((m) => m.fields?.companyUuid === companyUuid)) {
+            throw new identity_errors_js_1.IdentityConflictError('That user already has a membership in this company.');
+        }
+        let id;
+        try {
+            id = await this.records.create('company_membership', {
+                fields: { userUuid, companyUuid, isActive: true, status: 'active' },
+            });
+        }
+        catch (err) {
+            if (isDuplicateKey(err)) {
+                throw new identity_errors_js_1.IdentityConflictError('That user already has a membership in this company.');
+            }
+            throw err;
+        }
+        await this.bumpTenants([companyUuid]);
+        return id;
+    }
     /** List a user's membership cards (tenant-scoped by the pipe). */
     async listMemberships(userUuid) {
         const page = await this.records.list('company_membership', { where: { userUuid } });

package/dist/features/membership/posting.service.d.ts

@@ -53,5 +53,23 @@ export declare class PostingService {
      * runs BEFORE any write; the writes run in one transaction (see the file header).
      */
     replacePostings(actor: Principal, membershipUuid: string, desired: readonly PostingInput[]): Promise<void>;
+    /**
+     * Add postings to a membership WITHOUT touching the rest of its set (G-009 R4/R5): only tuples
+     * (role|department|branch) not already present are created; nothing is updated or deleted. The
+     * pre-checks, the in-transaction lock + re-check, the atomicity and the version bump are those
+     * of `replacePostings` (shared helpers). `opts.operationRoleIds` is forwarded to the ceiling
+     * calls (the org-bootstrap operation's declared roles). An inactive membership is refused.
+     */
+    addPostings(actor: Principal, membershipUuid: string, toAdd: readonly PostingInput[], opts?: {
+        operationRoleIds?: ReadonlySet<string> | readonly string[];
+    }): Promise<void>;
+    private assertEveryRole;
+    /** The membership through the subtree read wall (404 when out of reach) and its company. */
+    private reachMembership;
+    /** Authority for ADDED postings (binding rule, ceiling, org units); returns the distinct roles. */
+    private assertMayAdd;
+    /** Lock each added role row on the transaction, then re-run the binding rule (review F2). */
+    private lockAndRecheck;
+    private bumpTenant;
 }
 //# sourceMappingURL=posting.service.d.ts.map

package/dist/features/membership/posting.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"posting.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/posting.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGzD;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACzC;AA0ED,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBARZ,OAAO,EAAE,cAAc,EAGvB,OAAO,EAAE,YAAY,EAKrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D,gEAAgE;IAC1D,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAK1E;;;;;OAKG;IACG,eAAe,CACnB,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,OAAO,CAAC,IAAI,CAAC;CA8GjB"}
+{"version":3,"file":"posting.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/posting.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,YAAY,EAA6B,MAAM,2BAA2B,CAAC;AAOpF;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACzC;AA0ED,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBARZ,OAAO,EAAE,cAAc,EAGvB,OAAO,EAAE,YAAY,EAKrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D,gEAAgE;IAC1D,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAK1E;;;;;OAKG;IACG,eAAe,CACnB,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,OAAO,CAAC,IAAI,CAAC;IAyEhB;;;;;;OAMG;IACG,WAAW,CACf,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,IAAI,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,CAAA;KAAE,GACpE,OAAO,CAAC,IAAI,CAAC;IA2ChB,OAAO,CAAC,eAAe;IAQvB,4FAA4F;YAC9E,eAAe;IAY7B,mGAAmG;YACrF,YAAY;IAqB1B,6FAA6F;YAC/E,cAAc;YAYd,UAAU;CAkBzB"}

package/dist/features/membership/posting.service.js

@@ -134,18 +134,9 @@ let PostingService = class PostingService {
      * runs BEFORE any write; the writes run in one transaction (see the file header).
      */
     async replacePostings(actor, membershipUuid, desired) {
-        for (const d of desired) {
-            if (typeof d?.roleUuid !== 'string' || d.roleUuid.length === 0) {
-                throw new identity_errors_js_1.IdentityBadRequestError('Every assignment needs a role.');
-            }
-        }
+        this.assertEveryRole(desired);
         // 1) Reach: the membership must be visible through the subtree read wall (else 404).
-        const membership = await this.records.get('company_membership', membershipUuid);
-        if (membership === null)
-            throw new identity_errors_js_1.IdentityNotFoundError('Membership not found.');
-        const tenantUuid = typeof membership.fields?.companyUuid === 'string' && membership.fields.companyUuid.length > 0
-            ? membership.fields.companyUuid
-            : null;
+        const { membership, tenantUuid } = await this.reachMembership(membershipUuid);
         const current = (await this.records.list('membership_posting', { where: { membershipUuid } }))
             .rows;
         const desiredKeys = new Set(desired.map(naturalKey));
@@ -160,18 +151,7 @@ let PostingService = class PostingService {
             return true;
         });
         // 2) Authority for every ADDED role, before any write: binding rule, then the ceiling.
-        const addedRoles = [...new Set(added.map((d) => d.roleUuid))];
-        for (const roleUuid of addedRoles) {
-            await this.ceiling.assertRoleAssignable(actor, roleUuid);
-        }
-        await this.ceiling.assertCanAssignRoles(actor, addedRoles);
-        // Phase 9 #13b (review F4): an added posting's department/branch must be the membership
-        // company's own (junction rows), never another tenant's (400).
-        const present = (v) => typeof v === 'string' && v.length > 0;
-        await this.ceiling.assertOrgUnitsInCompany(tenantUuid, {
-            departmentUuids: added.map((d) => d.departmentUuid).filter(present),
-            branchUuids: added.map((d) => d.branchUuid).filter(present),
-        });
+        const addedRoles = await this.assertMayAdd(actor, tenantUuid, added, undefined);
         // Removing a PEER's postings strips their authority: the actor must dominate the member
         // (security review). Removing your OWN postings (self-demotion) stays allowed.
         const memberUuid = typeof membership.fields?.userUuid === 'string' ? membership.fields.userUuid : '';
@@ -187,10 +167,7 @@ let PostingService = class PostingService {
             // added role row on THIS transaction (grant administration locks the same row), then
             // re-run the binding rule: a binding another tenant committed while we waited is now
             // visible, and a role that became shared is refused before the INSERT (rolled back).
-            for (const roleUuid of addedRoles) {
-                await tx.lockForUpdate('role', roleUuid);
-                await this.ceiling.assertRoleAssignable(actor, roleUuid);
-            }
+            await this.lockAndRecheck(tx, actor, addedRoles, undefined);
             for (const d of added) {
                 await tx.create('membership_posting', { fields: { ...stripEmpty(d), membershipUuid } });
             }
@@ -198,6 +175,87 @@ let PostingService = class PostingService {
                 await tx.delete('membership_posting', r.id);
             }
         });
+        await this.bumpTenant(tenantUuid);
+    }
+    /**
+     * Add postings to a membership WITHOUT touching the rest of its set (G-009 R4/R5): only tuples
+     * (role|department|branch) not already present are created; nothing is updated or deleted. The
+     * pre-checks, the in-transaction lock + re-check, the atomicity and the version bump are those
+     * of `replacePostings` (shared helpers). `opts.operationRoleIds` is forwarded to the ceiling
+     * calls (the org-bootstrap operation's declared roles). An inactive membership is refused.
+     */
+    async addPostings(actor, membershipUuid, toAdd, opts) {
+        this.assertEveryRole(toAdd);
+        const { membership, tenantUuid } = await this.reachMembership(membershipUuid);
+        // TINYINT(1): the engine returns 1/0, not true/false (like `membership.controller.ts`).
+        if (!membership.fields?.isActive) {
+            throw new identity_errors_js_1.IdentityConflictError('That membership is not active.');
+        }
+        const ceilingOpts = opts?.operationRoleIds === undefined
+            ? undefined
+            : { operationRoleIds: [...opts.operationRoleIds] };
+        const current = (await this.records.list('membership_posting', { where: { membershipUuid } }))
+            .rows;
+        const seen = new Set(current.map((r) => naturalKey(r.fields)));
+        const added = toAdd.filter((d) => {
+            const k = naturalKey(d);
+            if (seen.has(k))
+                return false;
+            seen.add(k);
+            return true;
+        });
+        if (added.length === 0)
+            return; // nothing missing: no write, no bump
+        const addedRoles = await this.assertMayAdd(actor, tenantUuid, added, ceilingOpts);
+        await this.records.transaction(async (tx) => {
+            await this.lockAndRecheck(tx, actor, addedRoles, ceilingOpts);
+            for (const d of added) {
+                await tx.create('membership_posting', { fields: { ...stripEmpty(d), membershipUuid } });
+            }
+        });
+        await this.bumpTenant(tenantUuid);
+    }
+    assertEveryRole(postings) {
+        for (const d of postings) {
+            if (typeof d?.roleUuid !== 'string' || d.roleUuid.length === 0) {
+                throw new identity_errors_js_1.IdentityBadRequestError('Every assignment needs a role.');
+            }
+        }
+    }
+    /** The membership through the subtree read wall (404 when out of reach) and its company. */
+    async reachMembership(membershipUuid) {
+        const membership = await this.records.get('company_membership', membershipUuid);
+        if (membership === null)
+            throw new identity_errors_js_1.IdentityNotFoundError('Membership not found.');
+        const tenantUuid = typeof membership.fields?.companyUuid === 'string' && membership.fields.companyUuid.length > 0
+            ? membership.fields.companyUuid
+            : null;
+        return { membership, tenantUuid };
+    }
+    /** Authority for ADDED postings (binding rule, ceiling, org units); returns the distinct roles. */
+    async assertMayAdd(actor, tenantUuid, added, opts) {
+        const addedRoles = [...new Set(added.map((d) => d.roleUuid))];
+        for (const roleUuid of addedRoles) {
+            await this.ceiling.assertRoleAssignable(actor, roleUuid, opts);
+        }
+        await this.ceiling.assertCanAssignRoles(actor, addedRoles, opts);
+        // Phase 9 #13b (review F4): an added posting's department/branch must be the membership
+        // company's own (junction rows), never another tenant's (400).
+        const present = (v) => typeof v === 'string' && v.length > 0;
+        await this.ceiling.assertOrgUnitsInCompany(tenantUuid, {
+            departmentUuids: added.map((d) => d.departmentUuid).filter(present),
+            branchUuids: added.map((d) => d.branchUuid).filter(present),
+        });
+        return addedRoles;
+    }
+    /** Lock each added role row on the transaction, then re-run the binding rule (review F2). */
+    async lockAndRecheck(tx, actor, addedRoles, opts) {
+        for (const roleUuid of addedRoles) {
+            await tx.lockForUpdate('role', roleUuid);
+            await this.ceiling.assertRoleAssignable(actor, roleUuid, opts);
+        }
+    }
+    async bumpTenant(tenantUuid) {
         // ADR-0011 STALENESS FIX: a posting add/remove changes the effective roles (→ coarse
         // grants) of the membership's user in that company, so bump the tenant's permission
         // version — every live session in that tenant then reloads its cached facts on the next

package/dist/features/org-bootstrap/org-bootstrap-error.d.ts

@@ -0,0 +1,20 @@
+import type { PlanKind } from './org-bootstrap-plan.js';
+export type OrgBootstrapErrorCode = 'operator_required' | 'plan_conflict' | 'root_password_missing' | 'root_password_literal' | 'root_password_weak' | 'root_password_collision' | 'link_base_url' | 'links_need_terminal' | 'invalid_link_ttl' | 'not_wired' | 'lock_not_acquired' | 'step_failed';
+/** What a run wrote, counted per plan kind. */
+export type OrgBootstrapWritten = Partial<Record<PlanKind, number>>;
+/**
+ * A refusal or failure of the org bootstrap run. The message is fixed text plus names from the
+ * operator's own file; it never carries a password, a link or token, or a driver message.
+ */
+export declare class OrgBootstrapError extends Error {
+    readonly code: OrgBootstrapErrorCode;
+    /** `step_failed` only: the manifest step key that failed. */
+    readonly step?: string;
+    /** `step_failed` only: what the run had written before it stopped. */
+    readonly written?: OrgBootstrapWritten;
+    constructor(code: OrgBootstrapErrorCode, message: string, extra?: {
+        step?: string;
+        written?: OrgBootstrapWritten;
+    });
+}
+//# sourceMappingURL=org-bootstrap-error.d.ts.map

package/dist/features/org-bootstrap/org-bootstrap-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-bootstrap-error.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/org-bootstrap-error.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAExD,MAAM,MAAM,qBAAqB,GAC7B,mBAAmB,GACnB,eAAe,GACf,uBAAuB,GACvB,uBAAuB,GACvB,oBAAoB,GACpB,yBAAyB,GACzB,eAAe,GACf,qBAAqB,GACrB,kBAAkB,GAClB,WAAW,GACX,mBAAmB,GACnB,aAAa,CAAC;AAElB,+CAA+C;AAC/C,MAAM,MAAM,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAEpE;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;gBAGrC,IAAI,EAAE,qBAAqB,EAC3B,OAAO,EAAE,MAAM,EACf,KAAK,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,mBAAmB,CAAA;KAAO;CAQ/D"}