@astram/identity 0.13.0 → 0.15.0

package/dist/features/user/user.service.js

@@ -16,12 +16,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.UserService = void 0;
 const common_1 = require("@nestjs/common");
 const engine_1 = require("@astram/engine");
+const internal_1 = require("@astram/engine/internal");
 const guard_1 = require("@astram/guard");
 const posting_version_bump_js_1 = require("../membership/posting-version-bump.js");
 const list_query_js_1 = require("../shared/list-query.js");
 const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
 const email_address_changer_token_js_1 = require("./email-address-changer.token.js");
+const credential_provisioner_token_js_1 = require("./credential-provisioner.token.js");
 const framework_schemas_token_js_1 = require("../framework-schemas.token.js");
 /**
  * KI #87: `users` has two unique keys besides the PK, `IDX_users_username` (migration 001) and
@@ -43,11 +45,19 @@ async function mappingDuplicates(write) {
         return await write();
     }
     catch (err) {
-        if (isDuplicateKey(err))
+        // R1-4: an orphan credential already holds this login hint (deleteUser leaves it): same fixed
+        // 409 as a duplicate email, never the hint.
+        if (isDuplicateKey(err) || err instanceof guard_1.CredentialExistsError) {
             throw new identity_errors_js_1.IdentityConflictError(USERNAME_OR_EMAIL_TAKEN);
+        }
         throw err;
     }
 }
+const SIGN_IN_STATUS = {
+    locked: 'pending',
+    usable: 'active',
+    none: 'none',
+};
 const USER_SEARCH_FIELDS = ['username', 'email'];
 const USER_SORT_FIELDS = ['username', 'email', 'status', 'createdAt'];
 /**
@@ -77,6 +87,8 @@ let UserService = UserService_1 = class UserService {
     sessions;
     versionBump;
     emailAddresses;
+    provisioner;
+    dispatcher;
     logger = new common_1.Logger(UserService_1.name);
     /**
      * The engine's audit sink, used on the email helper's transaction (no pool of its own), on the
@@ -84,7 +96,7 @@ let UserService = UserService_1 = class UserService {
      * service) ⇒ the sink resolves `SHIELD_DB_NAMESPACE` itself.
      */
     emailAudit;
-    constructor(records, ceiling, resetTokens, emailSender, sessions, versionBump, emailAddresses, schemas) {
+    constructor(records, ceiling, resetTokens, emailSender, sessions, versionBump, emailAddresses, schemas, provisioner, dispatcher) {
         this.records = records;
         this.ceiling = ceiling;
         this.resetTokens = resetTokens;
@@ -92,8 +104,17 @@ let UserService = UserService_1 = class UserService {
         this.sessions = sessions;
         this.versionBump = versionBump;
         this.emailAddresses = emailAddresses;
+        this.provisioner = provisioner;
+        this.dispatcher = dispatcher;
         this.emailAudit = new engine_1.MariaDbAuditSink(schemas ? { schema: schemas.audit } : {});
     }
+    /**
+     * Create a user; returns its id. Delegates to {@link createUserWithCredential} (same behaviour;
+     * the detailed credential outcome is dropped to keep this public signature stable).
+     */
+    async createUser(actor, input) {
+        return (await this.createUserWithCredential(actor, input)).id;
+    }
     /**
      * Create a user. With `companyUuid`, the user is created AND attached (one active membership) in
      * ONE transaction — the onboarding path for a non-root admin, whose membership create is checked
@@ -103,9 +124,13 @@ let UserService = UserService_1 = class UserService {
      *
      * KI #94: an `email` is stored canonical (the ONE address rule, as the email-change flow); a
      * malformed one ⇒ {@link IdentityBadRequestError} (400) before any write; a blank one is no email.
-     * A new user has no credential yet, so no login hint moves.
+     *
+     * G-009 T7 (OD-6): with an email AND a company, a LOCKED credential (no password verifies; set
+     * later by reset) is created in that same transaction through the provisioner on the engine
+     * transaction's own connection; a provisioner failure rolls everything back. Otherwise no
+     * credential is created and the result says why (no email takes precedence).
      */
-    async createUser(actor, input) {
+    async createUserWithCredential(actor, input) {
         const fields = { username: input.username };
         const email = typeof input.email === 'string' ? (0, guard_1.canonicalEmail)(input.email) : '';
         if (email !== '') {
@@ -113,25 +138,56 @@ let UserService = UserService_1 = class UserService {
                 throw new identity_errors_js_1.IdentityBadRequestError('Enter a valid email address.');
             fields.email = email;
         }
-        if (!input.companyUuid) {
-            return mappingDuplicates(() => this.records.create('user', { fields }));
-        }
         const companyUuid = input.companyUuid;
-        return mappingDuplicates(() => this.records.transaction(async (tx) => {
-            const id = await tx.create('user', { fields });
+        if (!companyUuid) {
+            const id = await mappingDuplicates(() => this.records.create('user', { fields }));
+            return { id, credential: 'none', reason: email === '' ? 'no_email' : 'no_company' };
+        }
+        const provisioner = this.provisioner;
+        const provision = email !== '' && provisioner != null;
+        const id = await mappingDuplicates(() => this.records.transaction(async (tx) => {
+            const created = await tx.create('user', { fields });
             await tx.create('company_membership', {
-                fields: { userUuid: id, companyUuid, isActive: true, status: 'active' },
+                fields: { userUuid: created, companyUuid, isActive: true, status: 'active' },
             });
-            return id;
+            if (provision) {
+                await provisioner.provisionLocked({ principalId: created, hint: email, tenantId: companyUuid }, (0, internal_1.transactionQueryOf)(tx));
+            }
+            return created;
         }));
+        if (provision)
+            return { id, credential: 'locked' };
+        return {
+            id,
+            credential: 'none',
+            reason: email === '' ? 'no_email' : 'no_provisioner',
+        };
+    }
+    /**
+     * List users (tenant-scoped by the pipe), with paging/search/sort. Each row gains a top-level
+     * `signInStatus` (T10), from ONE batched credential read for the page.
+     */
+    async listUsers(params) {
+        const page = await this.records.list('user', (0, list_query_js_1.buildListQuery)(params, USER_SEARCH_FIELDS, USER_SORT_FIELDS));
+        return { ...page, rows: await this.withSignInStatus(page.rows) };
     }
-    /** List users (tenant-scoped by the pipe), with paging/search/sort. */
-    listUsers(params) {
-        return this.records.list('user', (0, list_query_js_1.buildListQuery)(params, USER_SEARCH_FIELDS, USER_SORT_FIELDS));
+    /** Read a single user, with its top-level `signInStatus` (T10). */
+    async getUser(uuid) {
+        const record = await this.records.get('user', uuid);
+        if (record === null)
+            return null;
+        return (await this.withSignInStatus([record]))[0];
     }
-    /** Read a single user. */
-    getUser(uuid) {
-        return this.records.get('user', uuid);
+    /** One `statesOf` call for the given rows; no provisioner (hand-built service) ⇒ rows unchanged. */
+    async withSignInStatus(rows) {
+        const provisioner = this.provisioner;
+        if (rows.length === 0 || provisioner == null)
+            return [...rows];
+        const states = await provisioner.statesOf(rows.map((r) => String(r.id)));
+        return rows.map((r) => ({
+            ...r,
+            signInStatus: SIGN_IN_STATUS[states.get(String(r.id)) ?? 'none'],
+        }));
     }
     /** Update a user (whitelisted patch; username/email/status changes need dominance — class doc). */
     async updateUser(actor, uuid, patch) {
@@ -170,7 +226,7 @@ let UserService = UserService_1 = class UserService {
         if (statusChanged || wantsInactive)
             await this.applyStatusChange(uuid, String(patch.status));
         if (emailChanged && oldEmail)
-            await this.notifyEmailChanged(oldEmail);
+            await this.notifyEmailChanged(actor, oldEmail);
     }
     /**
      * Phase 12 (KI #14): write a dominated user's new (canonical) email through guard's
@@ -261,19 +317,28 @@ let UserService = UserService_1 = class UserService {
         await this.records.delete('user', uuid);
     }
     /** Tell the OLD address its account email changed (best-effort; never names the new one). */
-    async notifyEmailChanged(oldEmail) {
-        if (!this.emailSender)
+    async notifyEmailChanged(actor, oldEmail) {
+        if (!this.dispatcher && !this.emailSender)
             return;
         const text = 'The email address on your account was changed by an administrator. ' +
             'Password-reset links sent before this change no longer work. ' +
             'If you did not expect this, contact your administrator.';
+        const message = {
+            to: oldEmail,
+            subject: 'Your account email address was changed',
+            text,
+            html: `<p>${text}</p>`,
+        };
         try {
-            await this.emailSender.send({
-                to: oldEmail,
-                subject: 'Your account email address was changed',
-                text,
-                html: `<p>${text}</p>`,
-            });
+            if (this.dispatcher) {
+                // G-010: bounded and audited (`message.sent` / `message.failed`); never throws.
+                await this.dispatcher.sendEmail('security_notice', message, {
+                    actorId: actor.id,
+                    tenantId: actor.tenantId,
+                });
+                return;
+            }
+            await this.emailSender.send(message);
         }
         catch {
             // Best-effort: the change is committed; a delivery failure must not fail it.
@@ -296,6 +361,10 @@ exports.UserService = UserService = UserService_1 = __decorate([
     __param(6, (0, common_1.Inject)(email_address_changer_token_js_1.IDENTITY_EMAIL_ADDRESS_CHANGER)),
     __param(7, (0, common_1.Optional)()),
     __param(7, (0, common_1.Inject)(framework_schemas_token_js_1.IDENTITY_FRAMEWORK_SCHEMAS)),
+    __param(8, (0, common_1.Optional)()),
+    __param(8, (0, common_1.Inject)(credential_provisioner_token_js_1.IDENTITY_CREDENTIAL_PROVISIONER)),
+    __param(9, (0, common_1.Optional)()),
+    __param(9, (0, common_1.Inject)(guard_1.SHIELD_MESSAGE_DISPATCHER)),
     __metadata("design:paramtypes", [engine_1.RecordsService,
-        grant_ceiling_js_1.GrantCeiling, Object, Object, Object, Object, Object, Object])
+        grant_ceiling_js_1.GrantCeiling, Object, Object, Object, Object, Object, Object, Object, Object])
 ], UserService);

package/dist/index.d.ts

@@ -40,6 +40,19 @@ export { buildIdentityAuthKeys, type IdentityAuthKeys } from './auth-facts-keys.
  * `identityObjects`, and mounts the CRUD controllers — no separate engine setup needed.
  */
 export { IdentityFeatureModule } from './features/identity-feature.module.js';
+/**
+ * G-010: the administrator invite (`POST /identity/users/:uuid/invite`, option
+ * `forRoot({ invite })`) and the computed `signInStatus` on user reads (types only).
+ */
+export type { InviteOptions } from './features/user/invite.config.js';
+export type { InviteResult } from './features/user/invite.service.js';
+export type { SignInStatus, UserRecord } from './features/user/user.service.js';
+/**
+ * The org bootstrap (G-009): `runOrgBootstrap(app, { file, apply })` applies a declarative org file
+ * (roots, company tree, roles, users, postings) through the framework's own services, as the declared
+ * operation `shield:org-bootstrap`. Run at deploy time against the app's own `AppModule` context.
+ */
+export { runOrgBootstrap, OrgBootstrapError, type OrgBootstrapReport, type RunOrgBootstrapOptions, } from './features/org-bootstrap/run-org-bootstrap.js';
 /**
  * Stored files (file-storage SPEC §5 I-K): `store` / `open` / `remove` on the engine pipe, provided
  * and exported by `IdentityFeatureModule`. Apps call it from their own `@Classified` routes.

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACxF;0DAC0D;AAC1D,OAAO,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEpF;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;GAGG;AACH,OAAO,EACL,YAAY,EACZ,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,UAAU,GAChB,MAAM,mCAAmC,CAAC;AAU3C;;;GAGG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF;;;;;;;GAOG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACxF;0DAC0D;AAC1D,OAAO,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEpF;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;GAGG;AACH,YAAY,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACtE,YAAY,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACtE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAEhF;;;;GAIG;AACH,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,+CAA+C,CAAC;AAEvD;;;GAGG;AACH,OAAO,EACL,YAAY,EACZ,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,UAAU,GAChB,MAAM,mCAAmC,CAAC;AAU3C;;;GAGG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF;;;;;;;GAOG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DbMembershipChecker = exports.DbScopeSubtreeResolver = exports.AlsSessionFactsReader = exports.FilesService = exports.IdentityFeatureModule = exports.buildIdentityAuthKeys = exports.identityControlPlaneKeys = exports.identityAuthActionKeys = exports.identityObjects = exports.identityMigrationsDir = exports.StoredFile = exports.ServiceAccount = exports.CompanyBranch = exports.CompanyDepartment = exports.MembershipPosting = exports.CompanyMembership = exports.Branch = exports.Department = exports.Role = exports.User = exports.Company = void 0;
+exports.DbMembershipChecker = exports.DbScopeSubtreeResolver = exports.AlsSessionFactsReader = exports.FilesService = exports.OrgBootstrapError = exports.runOrgBootstrap = exports.IdentityFeatureModule = exports.buildIdentityAuthKeys = exports.identityControlPlaneKeys = exports.identityAuthActionKeys = exports.identityObjects = exports.identityMigrationsDir = exports.StoredFile = exports.ServiceAccount = exports.CompanyBranch = exports.CompanyDepartment = exports.MembershipPosting = exports.CompanyMembership = exports.Branch = exports.Department = exports.Role = exports.User = exports.Company = void 0;
 /**
  * @astram/identity — the framework-owned identity + tenancy model.
  * The 9 identity object classes (relocated from the consumer app in Sub-plan B) +
@@ -60,6 +60,14 @@ Object.defineProperty(exports, "buildIdentityAuthKeys", { enumerable: true, get:
  */
 var identity_feature_module_js_1 = require("./features/identity-feature.module.js");
 Object.defineProperty(exports, "IdentityFeatureModule", { enumerable: true, get: function () { return identity_feature_module_js_1.IdentityFeatureModule; } });
+/**
+ * The org bootstrap (G-009): `runOrgBootstrap(app, { file, apply })` applies a declarative org file
+ * (roots, company tree, roles, users, postings) through the framework's own services, as the declared
+ * operation `shield:org-bootstrap`. Run at deploy time against the app's own `AppModule` context.
+ */
+var run_org_bootstrap_js_1 = require("./features/org-bootstrap/run-org-bootstrap.js");
+Object.defineProperty(exports, "runOrgBootstrap", { enumerable: true, get: function () { return run_org_bootstrap_js_1.runOrgBootstrap; } });
+Object.defineProperty(exports, "OrgBootstrapError", { enumerable: true, get: function () { return run_org_bootstrap_js_1.OrgBootstrapError; } });
 /**
  * Stored files (file-storage SPEC §5 I-K): `store` / `open` / `remove` on the engine pipe, provided
  * and exported by `IdentityFeatureModule`. Apps call it from their own `@Classified` routes.

package/dist/internal.d.ts

@@ -8,4 +8,6 @@
  * subpath everywhere else. Feature code never holds a pool: it uses the RecordEngine.
  */
 export { createIdentityAuthzPool } from './features/authz/record-authorization.js';
+export { transitionRoleOwner } from './features/role/role-owner-transition.js';
+export type { RoleOwnerAudit, RoleOwnerQuery } from './features/role/role-owner-transition.js';
 //# sourceMappingURL=internal.d.ts.map

package/dist/internal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC"}
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAC/E,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC"}

package/dist/internal.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createIdentityAuthzPool = void 0;
+exports.transitionRoleOwner = exports.createIdentityAuthzPool = void 0;
 /**
  * @astram/identity/internal — composition-root surface (Phase 8 #5).
  *
@@ -12,3 +12,5 @@ exports.createIdentityAuthzPool = void 0;
  */
 var record_authorization_js_1 = require("./features/authz/record-authorization.js");
 Object.defineProperty(exports, "createIdentityAuthzPool", { enumerable: true, get: function () { return record_authorization_js_1.createIdentityAuthzPool; } });
+var role_owner_transition_js_1 = require("./features/role/role-owner-transition.js");
+Object.defineProperty(exports, "transitionRoleOwner", { enumerable: true, get: function () { return role_owner_transition_js_1.transitionRoleOwner; } });

package/dist/role.object.d.ts

@@ -2,6 +2,7 @@
 export declare class Role {
     uuid: string;
     name: string;
+    ownerCompanyUuid?: string | null;
     createdAt: string;
 }
 //# sourceMappingURL=role.object.d.ts.map

package/dist/role.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.object.d.ts","sourceRoot":"","sources":["../src/role.object.ts"],"names":[],"mappings":"AAGA,8BAA8B;AAC9B,qBAoBa,IAAI;IAEf,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;IAGd,SAAS,EAAG,MAAM,CAAC;CACpB"}
+{"version":3,"file":"role.object.d.ts","sourceRoot":"","sources":["../src/role.object.ts"],"names":[],"mappings":"AAGA,8BAA8B;AAC9B,qBAoBa,IAAI;IAEf,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;IAMd,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAGjC,SAAS,EAAG,MAAM,CAAC;CACpB"}

package/dist/role.object.js

@@ -16,6 +16,10 @@ const schema_1 = require("./schema");
 let Role = class Role {
     uuid;
     name;
+    // The company a role was created for (G-009 T14, SPEC R13); NULL = shared (root-created). Create-only
+    // and server-set (RoleService stamps it from the actor); NOT `trusted`, so the engine never
+    // derives it and root's UI-created roles stay unowned. Changed later only by `transitionRoleOwner`.
+    ownerCompanyUuid;
     createdAt;
 };
 exports.Role = Role;
@@ -27,6 +31,10 @@ __decorate([
     (0, engine_1.Field)({ column: 'r_name', type: 'string', required: true }),
     __metadata("design:type", String)
 ], Role.prototype, "name", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'r_owner_company_uuid', type: 'uuid', immutable: true }),
+    __metadata("design:type", Object)
+], Role.prototype, "ownerCompanyUuid", void 0);
 __decorate([
     (0, engine_1.Field)({ column: 'r_created_at', type: 'timestamp' }),
     __metadata("design:type", String)

package/dist/user.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.object.d.ts","sourceRoot":"","sources":["../src/user.object.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,qBAuBa,IAAI;IAEf,IAAI,EAAG,MAAM,CAAC;IAGd,QAAQ,EAAG,MAAM,CAAC;IAGlB,KAAK,EAAG,MAAM,CAAC;IAGf,MAAM,EAAG,MAAM,CAAC;IAGhB,SAAS,EAAG,MAAM,CAAC;CACpB"}
+{"version":3,"file":"user.object.d.ts","sourceRoot":"","sources":["../src/user.object.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,qBA0Ba,IAAI;IAEf,IAAI,EAAG,MAAM,CAAC;IAGd,QAAQ,EAAG,MAAM,CAAC;IAGlB,KAAK,EAAG,MAAM,CAAC;IAGf,MAAM,EAAG,MAAM,CAAC;IAGhB,SAAS,EAAG,MAAM,CAAC;CACpB"}

package/dist/user.object.js

@@ -54,6 +54,9 @@ exports.User = User = __decorate([
         // capped root, the identity administrator, may list/read AND create/update/delete users). Uniform
         // across all actions (read reclassified control 2026-07-16), so plane is per-type.
         access: { plane: 'control', system: true },
+        // G-010 R11 (ADR-0038): `invite` (`identity:user:invite`, POST /identity/users/:uuid/invite) next
+        // to CRUD. Roles holding `identity:*` or `identity:user:*` gain it on upgrade; exact keys do not.
+        actions: ['invite'],
         // Read-scope wall (ADR-0027, Task 4.1): a user has no company column (they belong to many
         // companies via `company_membership`) — a user is in-scope iff they have a membership in
         // the caller's reachable subtree. A multi-tenant user correctly appears for each subtree

package/migrations/1710000000101-AddRoleOwnerCompany.cjs

@@ -0,0 +1,98 @@
+/**
+ * Framework identity migration — `roles.r_owner_company_uuid` (G-009 T14, AC-19; SPEC R13).
+ *
+ * WHY: `roles` was a global catalog with no owner, so a company delete could not say which roles
+ * were its own. The owner is the company (tenant node) a role was created for; NULL = shared
+ * (root-created, or unowned). It is create-only at the engine (immutable); the only later change
+ * is the audited `transitionRoleOwner` seam (company -> NULL on a company delete, NULL -> company
+ * for an owner claim).
+ *
+ * Steps (idempotent; a half-applied state is completed, nothing is dropped or overwritten):
+ *   1. ADD the nullable column when absent.
+ *   2. ADD `idx_roles_owner_company` when absent (the FK needs it; the delete's owned-roles read).
+ *   3. ADD `FK_roles_owner_company` -> `companies (c_uuid)` ON DELETE SET NULL when absent. The
+ *      app clears owners itself on a company delete (audited); SET NULL is only the backstop.
+ *   4. BACK-FILL unowned roles bound ONLY inside ONE top-level tenant's subtree (postings ->
+ *      memberships -> companies -> `scope_closure` ancestors with no parent) to that tenant. A role
+ *      bound across several tenants, or bound nowhere, stays NULL. Only `IS NULL` rows are
+ *      touched, so a re-run never overwrites an owner. No ids are hardcoded.
+ *
+ * `down` drops the FK, then the index, then the column, each with IF EXISTS (a second run, or a
+ * database that never had the column, does nothing).
+ */
+
+const { frameworkSchemasForMigration } = require('@astram/core');
+
+const COLUMN = 'r_owner_company_uuid';
+const INDEX = 'idx_roles_owner_company';
+const FK = 'FK_roles_owner_company';
+
+const present = async (query, sql, params) => {
+  const rows = await query(sql, params);
+  return Array.isArray(rows) && rows.length > 0;
+};
+
+async function up(ctx) {
+  const { query } = ctx;
+  const schemas = frameworkSchemasForMigration(ctx, process.env);
+  const APP = schemas.app;
+  const AUTHZ = schemas.authz;
+
+  const hasColumn = await present(
+    query,
+    `SELECT 1 AS n FROM information_schema.COLUMNS
+      WHERE TABLE_SCHEMA = ? AND TABLE_NAME = 'roles' AND COLUMN_NAME = ? LIMIT 1`,
+    [APP, COLUMN],
+  );
+  if (!hasColumn) {
+    await query(`ALTER TABLE \`${APP}\`.\`roles\` ADD COLUMN ${COLUMN} VARCHAR(36) NULL`);
+  }
+
+  const hasIndex = await present(
+    query,
+    `SELECT 1 AS n FROM information_schema.STATISTICS
+      WHERE TABLE_SCHEMA = ? AND TABLE_NAME = 'roles' AND INDEX_NAME = ? LIMIT 1`,
+    [APP, INDEX],
+  );
+  if (!hasIndex) {
+    await query(`CREATE INDEX ${INDEX} ON \`${APP}\`.\`roles\` (${COLUMN})`);
+  }
+
+  const hasFk = await present(
+    query,
+    `SELECT 1 AS n FROM information_schema.REFERENTIAL_CONSTRAINTS
+      WHERE CONSTRAINT_SCHEMA = ? AND TABLE_NAME = 'roles' AND CONSTRAINT_NAME = ? LIMIT 1`,
+    [APP, FK],
+  );
+  if (!hasFk) {
+    await query(`ALTER TABLE \`${APP}\`.\`roles\`
+      ADD CONSTRAINT ${FK} FOREIGN KEY (${COLUMN})
+      REFERENCES \`${APP}\`.\`companies\` (c_uuid) ON DELETE SET NULL`);
+  }
+
+  // Back-fill: exactly one top-level tenant over every posting of the role, else leave NULL.
+  const tenantsOfRole = `SELECT COUNT(DISTINCT sc.ancestor_uuid)
+        FROM \`${APP}\`.\`membership_posting\` mp
+        JOIN \`${APP}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
+        JOIN \`${AUTHZ}\`.\`scope_closure\` sc ON sc.descendant_uuid = cm.cm_company_uuid
+        JOIN \`${APP}\`.\`companies\` top ON top.c_uuid = sc.ancestor_uuid AND top.c_parent_uuid IS NULL
+       WHERE mp.mp_role_uuid = r.r_uuid`;
+  await query(`UPDATE \`${APP}\`.\`roles\` r
+      SET r.${COLUMN} = (SELECT MIN(sc.ancestor_uuid)
+        FROM \`${APP}\`.\`membership_posting\` mp
+        JOIN \`${APP}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
+        JOIN \`${AUTHZ}\`.\`scope_closure\` sc ON sc.descendant_uuid = cm.cm_company_uuid
+        JOIN \`${APP}\`.\`companies\` top ON top.c_uuid = sc.ancestor_uuid AND top.c_parent_uuid IS NULL
+       WHERE mp.mp_role_uuid = r.r_uuid)
+    WHERE r.${COLUMN} IS NULL AND (${tenantsOfRole}) = 1`);
+}
+
+async function down(ctx) {
+  const { query } = ctx;
+  const APP = frameworkSchemasForMigration(ctx, process.env).app;
+  await query(`ALTER TABLE \`${APP}\`.\`roles\` DROP FOREIGN KEY IF EXISTS ${FK}`);
+  await query(`DROP INDEX IF EXISTS ${INDEX} ON \`${APP}\`.\`roles\``);
+  await query(`ALTER TABLE \`${APP}\`.\`roles\` DROP COLUMN IF EXISTS ${COLUMN}`);
+}
+
+module.exports = { up, down };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/identity",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "license": "MIT",
   "description": "Astram framework — the framework-owned identity + tenancy model. Hosts the identity @ObjectType classes (user, company, membership, posting), framework-authored identity migrations, and the identity resolver. Top of the dependency graph: depends on @astram/engine (for @ObjectType/@Field decorators) + @astram/guard / @astram/core (for the auth ports).",
   "type": "commonjs",
@@ -36,9 +36,9 @@
   },
   "dependencies": {
     "mariadb": "^3.5.4",
-    "@astram/core": "1.8.0",
-    "@astram/guard": "0.16.0",
-    "@astram/engine": "0.9.0"
+    "@astram/core": "1.9.0",
+    "@astram/guard": "0.18.0",
+    "@astram/engine": "0.10.1"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",