@astram/identity 0.14.0 → 0.15.0

package/dist/features/user/invite.service.js

@@ -0,0 +1,254 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var InviteService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InviteService = exports.INVITE_WINDOW_MS = exports.INVITES_PER_USER = void 0;
+/**
+ * G-010 T9 (SPEC R11, P-4, P-5; AC-8, AC-9, AC-15): administrator invite.
+ *
+ * `invite(actor, uuid)` sends a one-time set-password link to a user whose credential is still
+ * LOCKED (created by an admin, never signed in). Order:
+ *   a. no delivery channel (mail off and `returnLinkToAdmin` off, or no usable link base) → 501,
+ *      before anything else; the auth surface or the limiter missing → 503 (fail closed);
+ *   b. record-level `authorize('user', uuid, 'invite')` (ADR-0038) — missing ≡ foreign, same 403;
+ *   c. `GrantCeiling.assertDominates` — an admin cannot invite a user who outranks them;
+ *   d. the user record is read (`records.get`): invite ALSO requires `identity:user:read`, and a
+ *      caller who cannot read the user gets the same 403 before any budget is spent;
+ *   e. rate limits: 3 per user and `INVITE_RATE_PER_ADMIN` per admin, per 60 minutes, counted
+ *      only after b–d pass (no oracle, no burning another admin's budget). The slot is RESERVED
+ *      first with guard's atomic `consume` (one Lua step: INCR, and the window TTL armed on the
+ *      first hit or re-armed when missing, so a counter can never stay without an expiry), so
+ *      concurrent invites cannot all pass a check; over → 429 and `user.invite_throttled`. A
+ *      Redis error (consume rejects) lets the invite proceed (fail open, P-5);
+ *   f. under the user row lock (`transaction` + `lockForUpdate`): the credential state (usable or
+ *      none, or no email → 409 with the reason), earlier links killed, one token (sha256 stored,
+ *      per-row expiry), `&purpose=invite`. The lock serialises invites of one user, so two can
+ *      never leave two live tokens. After the commit the state is read again: a user who finished
+ *      a reset in between gets their tokens killed and a 409;
+ *   g. emailed through guard's dispatcher (purpose `invite`); a failed send with no link return
+ *      burns THIS invite's token (single-use consume of its own hash, never every token of the
+ *      user: a newer invite issued after our lock was released stays live) and answers 503;
+ *   h. `user.invited` audited (emailed / linkReturned), never the link or token. Best-effort when
+ *      only emailed; MANDATORY when the link goes back to the admin (no unaudited link: a failed
+ *      write burns this invite's token, as in g, and answers 503).
+ */
+const node_crypto_1 = require("node:crypto");
+const common_1 = require("@nestjs/common");
+const engine_1 = require("@astram/engine");
+const guard_1 = require("@astram/guard");
+const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
+const identity_errors_js_1 = require("../shared/identity-errors.js");
+const credential_provisioner_token_js_1 = require("./credential-provisioner.token.js");
+const invite_message_js_1 = require("./invite-message.js");
+const invite_tokens_js_1 = require("./invite.tokens.js");
+/** Invites per invited user per window (matches forgot-password's per-account limit). */
+exports.INVITES_PER_USER = 3;
+exports.INVITE_WINDOW_MS = 3_600_000;
+const HOUR_MS = 3_600_000;
+const MSG_NO_CHANNEL = 'No delivery channel is configured for invites.';
+const MSG_UNAVAILABLE = 'Invites are temporarily unavailable. Try again.';
+const MSG_THROTTLED = 'Too many invites. Try again later.';
+const MSG_USABLE = 'This user has already set a password. Use forgot-password instead.';
+const MSG_NO_CREDENTIAL = 'This user has no sign-in credential yet (needs an email and a company).';
+const MSG_SEND_FAILED = 'The invite email could not be sent. Try again.';
+const MSG_DENIED = 'You do not have access to perform this action.';
+let InviteService = InviteService_1 = class InviteService {
+    records;
+    ceiling;
+    config;
+    limiters;
+    audit;
+    resetTokens;
+    provisioner;
+    dispatcher;
+    logger = new common_1.Logger(InviteService_1.name);
+    constructor(records, ceiling, config, limiters, audit, resetTokens, provisioner, dispatcher) {
+        this.records = records;
+        this.ceiling = ceiling;
+        this.config = config;
+        this.limiters = limiters;
+        this.audit = audit;
+        this.resetTokens = resetTokens;
+        this.provisioner = provisioner;
+        this.dispatcher = dispatcher;
+    }
+    async invite(actor, uuid) {
+        const { returnLinkToAdmin, linkBase, ttlHours } = this.config;
+        const emailEnabled = this.dispatcher?.emailEnabled === true;
+        const store = this.resetTokens;
+        const provisioner = this.provisioner;
+        // a. P-4: nothing could carry the link (or no auth surface to redeem it) → 501, before any check.
+        if ((!emailEnabled && !returnLinkToAdmin) || linkBase === null || !store || !provisioner) {
+            throw new common_1.NotImplementedException(MSG_NO_CHANNEL);
+        }
+        const limiters = this.limiters;
+        if (!limiters) {
+            // Fail closed: an unthrottled invite route is never served.
+            this.logger.warn('invite refused: no rate limiter is wired (guard Redis not visible)');
+            throw new identity_errors_js_1.IdentityUnavailableError(MSG_UNAVAILABLE);
+        }
+        // b. record-level decision for the declared action; c. dominance (same as update).
+        await this.records.authorize('user', uuid, 'invite');
+        await this.ceiling.assertDominates(actor, uuid);
+        // d. read the user BEFORE any count: invite also requires identity:user:read (the engine's
+        // read gate), so a caller who cannot read the user gets 403 without burning anyone's budget.
+        if ((await this.records.get('user', uuid)) === null) {
+            throw new identity_errors_js_1.IdentityForbiddenError(MSG_DENIED);
+        }
+        // e. rate limits: reserve the slot first (atomic consume), then decide on its verdict.
+        const userKey = `invite:user:${uuid.toLowerCase()}`;
+        const adminKey = `invite:admin:${actor.id}`;
+        if (!(await this.reserve(limiters.user, userKey))) {
+            await this.throttled(actor, uuid, 'user');
+        }
+        if (!(await this.reserve(limiters.admin, adminKey))) {
+            await this.throttled(actor, uuid, 'admin');
+        }
+        // f. under the user row lock: re-check the state, kill earlier links, issue one token. The
+        // reset-token store writes on its own pool (no FK to users, so no self-block); holding the
+        // row lock across those writes serialises every invite of this user.
+        const raw = (0, node_crypto_1.randomBytes)(32).toString('hex');
+        // THIS invite's token hash: a compensation burns exactly it (never every token of the user).
+        const tokenHash = (0, node_crypto_1.createHash)('sha256').update(raw).digest('hex');
+        const email = await this.records.transaction(async (tx) => {
+            await tx.lockForUpdate('user', uuid);
+            const user = await tx.get('user', uuid);
+            if (user === null)
+                throw new identity_errors_js_1.IdentityForbiddenError(MSG_DENIED);
+            const address = typeof user.fields.email === 'string' ? user.fields.email.trim() : '';
+            this.assertInvitable(await provisioner.stateOf(uuid), address);
+            await store.invalidateAllForPrincipal(uuid);
+            await store.issue(uuid, tokenHash, Date.now() + ttlHours * HOUR_MS);
+            return address;
+        });
+        // A reset finished between the check and the issue (the credential is not under the row
+        // lock): kill the token we just issued and answer as if it had been usable at the check.
+        const after = await provisioner.stateOf(uuid);
+        if (after !== 'locked') {
+            await store.invalidateAllForPrincipal(uuid);
+            this.assertInvitable(after, email);
+        }
+        const link = `${linkBase}?token=${raw}&purpose=invite`;
+        // g. deliver.
+        let emailed = false;
+        let delivery = {};
+        if (emailEnabled) {
+            const outcome = await this.dispatcher.sendEmail('invite', (0, invite_message_js_1.inviteMessage)(email, link, ttlHours), { actorId: actor.id, tenantId: actor.tenantId });
+            emailed = outcome.status === 'sent';
+            // AC-9: what the delivery row says, beside the invite (masked recipient, never the link).
+            delivery = { channel: 'email', purpose: 'invite', recipient: (0, guard_1.maskEmail)(email) };
+            if (outcome.status === 'sent') {
+                delivery.provider = outcome.provider;
+                if (outcome.messageId)
+                    delivery.messageId = outcome.messageId;
+            }
+            else if (outcome.status === 'failed') {
+                delivery.provider = outcome.provider;
+                delivery.failureClass = outcome.failureClass;
+            }
+            if (!emailed && !returnLinkToAdmin) {
+                // Nobody holds the link: burn it. Only OUR token: a concurrent invite may have issued a
+                // newer one after our transaction released the row lock.
+                await this.burn(store, tokenHash);
+                throw new identity_errors_js_1.IdentityUnavailableError(MSG_SEND_FAILED);
+            }
+        }
+        // h. audit; never the link or the token. A link handed back to the admin is never unaudited.
+        const audited = await this.record(actor, uuid, 'user.invited', {
+            emailed,
+            linkReturned: returnLinkToAdmin,
+            ...delivery,
+        });
+        if (returnLinkToAdmin && !audited) {
+            await this.burn(store, tokenHash);
+            throw new identity_errors_js_1.IdentityUnavailableError(MSG_UNAVAILABLE);
+        }
+        return returnLinkToAdmin ? { emailed, link } : { emailed };
+    }
+    /** Only a locked credential with an email can be invited; otherwise 409 with the reason. */
+    assertInvitable(state, email) {
+        if (state === 'usable')
+            throw new identity_errors_js_1.IdentityConflictError(MSG_USABLE);
+        if (state !== 'locked' || email === '')
+            throw new identity_errors_js_1.IdentityConflictError(MSG_NO_CREDENTIAL);
+    }
+    /** Reserve one slot; `false` = over the budget. A limiter that cannot answer fails open (P-5). */
+    async reserve(limiter, key) {
+        try {
+            return (await limiter.consume(key)).allowed;
+        }
+        catch {
+            this.logger.warn('invite rate limiter unavailable; the invite proceeds unthrottled (P-5)');
+            return true;
+        }
+    }
+    /**
+     * Burn this invite's own token (the store's single-use consume of exactly that hash). A token a
+     * newer invite already invalidated is simply not found. A store error is logged, not thrown: the
+     * caller still answers 503 and nobody holds the link.
+     */
+    async burn(store, tokenHash) {
+        try {
+            await store.consume(tokenHash);
+        }
+        catch {
+            this.logger.warn('invite token could not be burned after a failed delivery or audit');
+        }
+    }
+    async throttled(actor, uuid, limit) {
+        await this.record(actor, uuid, 'user.invite_throttled', { limit });
+        throw new common_1.HttpException(MSG_THROTTLED, common_1.HttpStatus.TOO_MANY_REQUESTS);
+    }
+    /**
+     * Writes one audit row; never throws. Returns whether the row was written (`false` when no
+     * writer is wired or the sink failed), so the link-return path can fail closed on it.
+     */
+    async record(actor, uuid, key, attributes) {
+        if (!this.audit)
+            return false;
+        try {
+            await this.audit.record({
+                type: 'admin_action',
+                occurredAtMs: Date.now(),
+                actorId: actor.id,
+                tenantId: actor.tenantId,
+                action: { key },
+                resource: { level: 'record', typeKey: 'user', tenantId: actor.tenantId, recordId: uuid },
+                attributes: { userUuid: uuid, ...attributes },
+            });
+            return true;
+        }
+        catch {
+            this.logger.warn(`${key} audit row could not be written`);
+            return false;
+        }
+    }
+};
+exports.InviteService = InviteService;
+exports.InviteService = InviteService = InviteService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(2, (0, common_1.Inject)(invite_tokens_js_1.IDENTITY_INVITE_CONFIG)),
+    __param(3, (0, common_1.Optional)()),
+    __param(3, (0, common_1.Inject)(invite_tokens_js_1.IDENTITY_INVITE_LIMITERS)),
+    __param(4, (0, common_1.Optional)()),
+    __param(4, (0, common_1.Inject)(invite_tokens_js_1.IDENTITY_INVITE_AUDIT)),
+    __param(5, (0, common_1.Optional)()),
+    __param(5, (0, common_1.Inject)(guard_1.SHIELD_RESET_TOKEN_STORE)),
+    __param(6, (0, common_1.Optional)()),
+    __param(6, (0, common_1.Inject)(credential_provisioner_token_js_1.IDENTITY_CREDENTIAL_PROVISIONER)),
+    __param(7, (0, common_1.Optional)()),
+    __param(7, (0, common_1.Inject)(guard_1.SHIELD_MESSAGE_DISPATCHER)),
+    __metadata("design:paramtypes", [engine_1.RecordsService,
+        grant_ceiling_js_1.GrantCeiling, Object, Object, Object, Object, Object, Object])
+], InviteService);

package/dist/features/user/invite.tokens.d.ts

@@ -0,0 +1,11 @@
+/**
+ * G-010 T9: module-internal DI tokens for the invite (built in `IdentityFeatureModule.forRoot`).
+ * Not exported from the package.
+ */
+/** The {@link InviteConfig} read once at boot. */
+export declare const IDENTITY_INVITE_CONFIG: unique symbol;
+/** The per-user and per-admin limiters over guard's Redis (`null` when Redis is not visible). */
+export declare const IDENTITY_INVITE_LIMITERS: unique symbol;
+/** The audit writer for `user.invited` / `user.invite_throttled` (shared authz pool). */
+export declare const IDENTITY_INVITE_AUDIT: unique symbol;
+//# sourceMappingURL=invite.tokens.d.ts.map

package/dist/features/user/invite.tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite.tokens.d.ts","sourceRoot":"","sources":["../../../src/features/user/invite.tokens.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,kDAAkD;AAClD,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AACvE,iGAAiG;AACjG,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAC3E,yFAAyF;AACzF,eAAO,MAAM,qBAAqB,eAAkC,CAAC"}

package/dist/features/user/invite.tokens.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_INVITE_AUDIT = exports.IDENTITY_INVITE_LIMITERS = exports.IDENTITY_INVITE_CONFIG = void 0;
+/**
+ * G-010 T9: module-internal DI tokens for the invite (built in `IdentityFeatureModule.forRoot`).
+ * Not exported from the package.
+ */
+/** The {@link InviteConfig} read once at boot. */
+exports.IDENTITY_INVITE_CONFIG = Symbol('IDENTITY_INVITE_CONFIG');
+/** The per-user and per-admin limiters over guard's Redis (`null` when Redis is not visible). */
+exports.IDENTITY_INVITE_LIMITERS = Symbol('IDENTITY_INVITE_LIMITERS');
+/** The audit writer for `user.invited` / `user.invite_throttled` (shared authz pool). */
+exports.IDENTITY_INVITE_AUDIT = Symbol('IDENTITY_INVITE_AUDIT');

package/dist/features/user/user.controller.d.ts

@@ -1,9 +1,11 @@
 import { UserService } from './user.service.js';
+import { InviteService, type InviteResult } from './invite.service.js';
 import { type ListQueryDto } from '../shared/list-query.js';
 import type { AuthedRequest } from '../shared/http.js';
 export declare class UserController {
     private readonly users;
-    constructor(users: UserService);
+    private readonly invites?;
+    constructor(users: UserService, invites?: InviteService | undefined);
     /**
      * List users — gated on `identity:user:read` (see class doc). Server-side DataTable:
      * `?page&limit&search&sortBy&sortOrder`. Returns `{ total, rows, page, limit }` —
@@ -11,7 +13,7 @@ export declare class UserController {
      */
     listUsers(query: ListQueryDto): Promise<{
         total: number;
-        rows: readonly import("packages/engine/dist/types.js").RecordView[];
+        rows: readonly import("./user.service.js").UserRecord[];
         page: number;
         limit: number;
     }>;
@@ -26,7 +28,7 @@ export declare class UserController {
     }): Promise<import("./user.service.js").CreateUserResult>;
     /** Read one user — gated on `identity:user:read` (CONTROL-plane; root, the identity
      *  administrator, may read users). */
-    getUser(uuid: string): Promise<import("packages/engine/dist/types.js").RecordView | null>;
+    getUser(uuid: string): Promise<import("./user.service.js").UserRecord | null>;
     /** Update a user — gated on `identity:user:update`. Only `username`, `email`, `status` apply. */
     updateUser(req: AuthedRequest, uuid: string, body: {
         username?: string;
@@ -35,6 +37,13 @@ export declare class UserController {
     }): Promise<{
         success: boolean;
     }>;
+    /**
+     * G-010 R11: invite a user whose credential is still locked — gated on the custom action
+     * `identity:user:invite` (ADR-0038; record-level check, dominance, rate limits in the service).
+     * No body. 200 `{ emailed, link? }`; `link` only with `forRoot({ invite: { returnLinkToAdmin } })`.
+     * 409 not locked, 429 throttled, 501 no delivery channel, 503 send failed.
+     */
+    inviteUser(req: AuthedRequest, uuid: string): Promise<InviteResult>;
     /** Delete a user — gated on `identity:user:delete`; the caller must dominate the user. */
     deleteUser(req: AuthedRequest, uuid: string): Promise<{
         success: boolean;

package/dist/features/user/user.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.controller.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAOvD,qBAEa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAE/C;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C;;;OAGG;IAGG,UAAU,CACP,GAAG,EAAE,aAAa,EACjB,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;IAY3E;0CACsC;IAGtC,OAAO,CAA0B,IAAI,EAAE,MAAM;IAI7C,iGAAiG;IAG3F,UAAU,CACP,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAUtE,0FAA0F;IAGpF,UAAU,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;CAIlF"}
+{"version":3,"file":"user.controller.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.controller.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAOvD,qBAEa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACV,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;gBADpB,KAAK,EAAE,WAAW,EACN,OAAO,CAAC,EAAE,aAAa,YAAA;IAGtD;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C;;;OAGG;IAGG,UAAU,CACP,GAAG,EAAE,aAAa,EACjB,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;IAY3E;0CACsC;IAGtC,OAAO,CAA0B,IAAI,EAAE,MAAM;IAI7C,iGAAiG;IAG3F,UAAU,CACP,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAUtE;;;;;OAKG;IAIH,UAAU,CACD,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,GACpC,OAAO,CAAC,YAAY,CAAC;IAKxB,0FAA0F;IAGpF,UAAU,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;CAIlF"}

package/dist/features/user/user.controller.js

@@ -16,6 +16,7 @@ exports.UserController = void 0;
 const common_1 = require("@nestjs/common");
 const guard_1 = require("@astram/guard");
 const user_service_js_1 = require("./user.service.js");
+const invite_service_js_1 = require("./invite.service.js");
 const list_query_js_1 = require("../shared/list-query.js");
 const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
 // User management is gated on `identity:user:<action>` grants. `user` is CONTROL-plane
@@ -24,8 +25,10 @@ const identity_error_interceptor_js_1 = require("../shared/identity-error.interc
 // email or status, or deleting them, also needs the caller to dominate that user (D2).
 let UserController = class UserController {
     users;
-    constructor(users) {
+    invites;
+    constructor(users, invites) {
         this.users = users;
+        this.invites = invites;
     }
     /**
      * List users — gated on `identity:user:read` (see class doc). Server-side DataTable:
@@ -65,6 +68,17 @@ let UserController = class UserController {
         });
         return { success: true };
     }
+    /**
+     * G-010 R11: invite a user whose credential is still locked — gated on the custom action
+     * `identity:user:invite` (ADR-0038; record-level check, dominance, rate limits in the service).
+     * No body. 200 `{ emailed, link? }`; `link` only with `forRoot({ invite: { returnLinkToAdmin } })`.
+     * 409 not locked, 429 throttled, 501 no delivery channel, 503 send failed.
+     */
+    inviteUser(req, uuid) {
+        if (!this.invites)
+            throw new Error('UserController: InviteService is not wired');
+        return this.invites.invite(req.principal, uuid);
+    }
     /** Delete a user — gated on `identity:user:delete`; the caller must dominate the user. */
     async deleteUser(req, uuid) {
         await this.users.deleteUser(req.principal, uuid);
@@ -107,6 +121,16 @@ __decorate([
     __metadata("design:paramtypes", [Object, String, Object]),
     __metadata("design:returntype", Promise)
 ], UserController.prototype, "updateUser", null);
+__decorate([
+    (0, common_1.Post)('users/:uuid/invite'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, guard_1.Classified)({ typeKey: 'user', action: 'invite' }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], UserController.prototype, "inviteUser", null);
 __decorate([
     (0, common_1.Delete)('users/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'user', action: 'delete' }),
@@ -119,5 +143,7 @@ __decorate([
 exports.UserController = UserController = __decorate([
     (0, common_1.Controller)('identity'),
     (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
-    __metadata("design:paramtypes", [user_service_js_1.UserService])
+    __param(1, (0, common_1.Optional)()),
+    __metadata("design:paramtypes", [user_service_js_1.UserService,
+        invite_service_js_1.InviteService])
 ], UserController);

package/dist/features/user/user.service.d.ts

@@ -1,6 +1,6 @@
-import { RecordsService, type RecordId } from '@astram/engine';
+import { RecordsService, type RecordId, type RecordView } from '@astram/engine';
 import type { FrameworkSchemas, Principal } from '@astram/core';
-import { type EmailAddressChanger, type CredentialProvisioner, type EmailSender, type ResetTokenStore, type SessionSweeper } from '@astram/guard';
+import { type EmailAddressChanger, type CredentialProvisioner, type EmailSender, type MessageDispatcher, type ResetTokenStore, type SessionSweeper } from '@astram/guard';
 import { type PostingVersionBump } from '../membership/posting-version-bump.js';
 import { type ListParams } from '../shared/list-query.js';
 import { GrantCeiling } from '../authz/grant-ceiling.js';
@@ -13,6 +13,15 @@ export type CreateUserResult = {
     credential: 'none';
     reason: 'no_email' | 'no_company' | 'no_provisioner';
 };
+/**
+ * G-010 R13 (P-6): the computed, read-only sign-in state on user reads, from the credential:
+ * locked → `pending` (invite-able), usable → `active`, none → `none`. Never any credential data.
+ */
+export type SignInStatus = 'pending' | 'active' | 'none';
+/** A user record as `GET /identity/users[/:uuid]` returns it: the engine row plus `signInStatus`. */
+export type UserRecord = RecordView & {
+    readonly signInStatus?: SignInStatus;
+};
 /** The patch keys a generic user update accepts (security hardening #3). */
 export interface UserPatch {
     username?: unknown;
@@ -47,6 +56,7 @@ export declare class UserService {
     private readonly versionBump?;
     private readonly emailAddresses?;
     private readonly provisioner?;
+    private readonly dispatcher?;
     private readonly logger;
     /**
      * The engine's audit sink, used on the email helper's transaction (no pool of its own), on the
@@ -54,7 +64,7 @@ export declare class UserService {
      * service) ⇒ the sink resolves `SHIELD_DB_NAMESPACE` itself.
      */
     private readonly emailAudit;
-    constructor(records: RecordsService, ceiling: GrantCeiling, resetTokens?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, sessions?: (SessionSweeper | null) | undefined, versionBump?: (PostingVersionBump | null) | undefined, emailAddresses?: (EmailAddressChanger | null) | undefined, schemas?: FrameworkSchemas | null, provisioner?: (CredentialProvisioner | null) | undefined);
+    constructor(records: RecordsService, ceiling: GrantCeiling, resetTokens?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, sessions?: (SessionSweeper | null) | undefined, versionBump?: (PostingVersionBump | null) | undefined, emailAddresses?: (EmailAddressChanger | null) | undefined, schemas?: FrameworkSchemas | null, provisioner?: (CredentialProvisioner | null) | undefined, dispatcher?: (MessageDispatcher | null) | undefined);
     /**
      * Create a user; returns its id. Delegates to {@link createUserWithCredential} (same behaviour;
      * the detailed credential outcome is dropped to keep this public signature stable).
@@ -84,10 +94,18 @@ export declare class UserService {
         email?: string | undefined;
         companyUuid?: string | undefined;
     }): Promise<CreateUserResult>;
-    /** List users (tenant-scoped by the pipe), with paging/search/sort. */
-    listUsers(params?: ListParams): Promise<import("@astram/engine").RecordPage>;
-    /** Read a single user. */
-    getUser(uuid: string): Promise<import("@astram/engine").RecordView | null>;
+    /**
+     * List users (tenant-scoped by the pipe), with paging/search/sort. Each row gains a top-level
+     * `signInStatus` (T10), from ONE batched credential read for the page.
+     */
+    listUsers(params?: ListParams): Promise<{
+        rows: readonly UserRecord[];
+        total: number;
+    }>;
+    /** Read a single user, with its top-level `signInStatus` (T10). */
+    getUser(uuid: string): Promise<UserRecord | null>;
+    /** One `statesOf` call for the given rows; no provisioner (hand-built service) ⇒ rows unchanged. */
+    private withSignInStatus;
     /** Update a user (whitelisted patch; username/email/status changes need dominance — class doc). */
     updateUser(actor: Principal, uuid: string, patch: UserPatch): Promise<void>;
     /**

package/dist/features/user/user.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEjF,OAAO,KAAK,EAAc,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAQL,KAAK,mBAAmB,EAExB,KAAK,qBAAqB,EAC1B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAwCzD,mEAAmE;AACnE,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,QAAQ,CAAA;CAAE,GACtC;IACE,EAAE,EAAE,QAAQ,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,gBAAgB,CAAC;CACtD,CAAC;AAKN,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,WAAW;IAUpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IACY,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAMtE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAK1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAQhC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IArC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;gBAG3B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAGrB,WAAW,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EACK,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAMzE,QAAQ,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKhC,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAIvC,cAAc,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA,EAI5D,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,EAIhB,WAAW,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA;IAK7D;;;OAGG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GACxF,OAAO,CAAC,QAAQ,CAAC;IAIpB;;;;;;;;;;;;;;OAcG;IACG,wBAAwB,CAC5B,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GACxF,OAAO,CAAC,gBAAgB,CAAC;IAqC5B,uEAAuE;IACvE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,0BAA0B;IAC1B,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB,mGAAmG;IAC7F,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAsCjF;;;;;;OAMG;YACW,WAAW;IAyBzB,uFAAuF;IACvF,OAAO,CAAC,gBAAgB;IA8BxB;;;;;;;;;OASG;YACW,iBAAiB;IAY/B,uDAAuD;IACjD,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/D,6FAA6F;YAC/E,kBAAkB;CAkBjC"}
+{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAElG,OAAO,KAAK,EAAc,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EASL,KAAK,mBAAmB,EAExB,KAAK,qBAAqB,EAE1B,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAwCzD,mEAAmE;AACnE,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,QAAQ,CAAA;CAAE,GACtC;IACE,EAAE,EAAE,QAAQ,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,gBAAgB,CAAC;CACtD,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEzD,qGAAqG;AACrG,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG;IAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAA;CAAE,CAAC;AAW/E,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,WAAW;IAUpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IACY,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAMtE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAK1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAQhC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAK7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IA1C9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;gBAG3B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAGrB,WAAW,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EACK,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAMzE,QAAQ,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKhC,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAIvC,cAAc,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA,EAI5D,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,EAIhB,WAAW,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAK1C,UAAU,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA;IAKxD;;;OAGG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GACxF,OAAO,CAAC,QAAQ,CAAC;IAIpB;;;;;;;;;;;;;;OAcG;IACG,wBAAwB,CAC5B,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GACxF,OAAO,CAAC,gBAAgB,CAAC;IAqC5B;;;OAGG;IACG,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,UAAU,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAQ7F,mEAAmE;IAC7D,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAMvD,oGAAoG;YACtF,gBAAgB;IAU9B,mGAAmG;IAC7F,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAsCjF;;;;;;OAMG;YACW,WAAW;IAyBzB,uFAAuF;IACvF,OAAO,CAAC,gBAAgB;IA8BxB;;;;;;;;;OASG;YACW,iBAAiB;IAY/B,uDAAuD;IACjD,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/D,6FAA6F;YAC/E,kBAAkB;CA2BjC"}

package/dist/features/user/user.service.js

@@ -53,6 +53,11 @@ async function mappingDuplicates(write) {
         throw err;
     }
 }
+const SIGN_IN_STATUS = {
+    locked: 'pending',
+    usable: 'active',
+    none: 'none',
+};
 const USER_SEARCH_FIELDS = ['username', 'email'];
 const USER_SORT_FIELDS = ['username', 'email', 'status', 'createdAt'];
 /**
@@ -83,6 +88,7 @@ let UserService = UserService_1 = class UserService {
     versionBump;
     emailAddresses;
     provisioner;
+    dispatcher;
     logger = new common_1.Logger(UserService_1.name);
     /**
      * The engine's audit sink, used on the email helper's transaction (no pool of its own), on the
@@ -90,7 +96,7 @@ let UserService = UserService_1 = class UserService {
      * service) ⇒ the sink resolves `SHIELD_DB_NAMESPACE` itself.
      */
     emailAudit;
-    constructor(records, ceiling, resetTokens, emailSender, sessions, versionBump, emailAddresses, schemas, provisioner) {
+    constructor(records, ceiling, resetTokens, emailSender, sessions, versionBump, emailAddresses, schemas, provisioner, dispatcher) {
         this.records = records;
         this.ceiling = ceiling;
         this.resetTokens = resetTokens;
@@ -99,6 +105,7 @@ let UserService = UserService_1 = class UserService {
         this.versionBump = versionBump;
         this.emailAddresses = emailAddresses;
         this.provisioner = provisioner;
+        this.dispatcher = dispatcher;
         this.emailAudit = new engine_1.MariaDbAuditSink(schemas ? { schema: schemas.audit } : {});
     }
     /**
@@ -156,13 +163,31 @@ let UserService = UserService_1 = class UserService {
             reason: email === '' ? 'no_email' : 'no_provisioner',
         };
     }
-    /** List users (tenant-scoped by the pipe), with paging/search/sort. */
-    listUsers(params) {
-        return this.records.list('user', (0, list_query_js_1.buildListQuery)(params, USER_SEARCH_FIELDS, USER_SORT_FIELDS));
+    /**
+     * List users (tenant-scoped by the pipe), with paging/search/sort. Each row gains a top-level
+     * `signInStatus` (T10), from ONE batched credential read for the page.
+     */
+    async listUsers(params) {
+        const page = await this.records.list('user', (0, list_query_js_1.buildListQuery)(params, USER_SEARCH_FIELDS, USER_SORT_FIELDS));
+        return { ...page, rows: await this.withSignInStatus(page.rows) };
+    }
+    /** Read a single user, with its top-level `signInStatus` (T10). */
+    async getUser(uuid) {
+        const record = await this.records.get('user', uuid);
+        if (record === null)
+            return null;
+        return (await this.withSignInStatus([record]))[0];
     }
-    /** Read a single user. */
-    getUser(uuid) {
-        return this.records.get('user', uuid);
+    /** One `statesOf` call for the given rows; no provisioner (hand-built service) ⇒ rows unchanged. */
+    async withSignInStatus(rows) {
+        const provisioner = this.provisioner;
+        if (rows.length === 0 || provisioner == null)
+            return [...rows];
+        const states = await provisioner.statesOf(rows.map((r) => String(r.id)));
+        return rows.map((r) => ({
+            ...r,
+            signInStatus: SIGN_IN_STATUS[states.get(String(r.id)) ?? 'none'],
+        }));
     }
     /** Update a user (whitelisted patch; username/email/status changes need dominance — class doc). */
     async updateUser(actor, uuid, patch) {
@@ -201,7 +226,7 @@ let UserService = UserService_1 = class UserService {
         if (statusChanged || wantsInactive)
             await this.applyStatusChange(uuid, String(patch.status));
         if (emailChanged && oldEmail)
-            await this.notifyEmailChanged(oldEmail);
+            await this.notifyEmailChanged(actor, oldEmail);
     }
     /**
      * Phase 12 (KI #14): write a dominated user's new (canonical) email through guard's
@@ -292,19 +317,28 @@ let UserService = UserService_1 = class UserService {
         await this.records.delete('user', uuid);
     }
     /** Tell the OLD address its account email changed (best-effort; never names the new one). */
-    async notifyEmailChanged(oldEmail) {
-        if (!this.emailSender)
+    async notifyEmailChanged(actor, oldEmail) {
+        if (!this.dispatcher && !this.emailSender)
             return;
         const text = 'The email address on your account was changed by an administrator. ' +
             'Password-reset links sent before this change no longer work. ' +
             'If you did not expect this, contact your administrator.';
+        const message = {
+            to: oldEmail,
+            subject: 'Your account email address was changed',
+            text,
+            html: `<p>${text}</p>`,
+        };
         try {
-            await this.emailSender.send({
-                to: oldEmail,
-                subject: 'Your account email address was changed',
-                text,
-                html: `<p>${text}</p>`,
-            });
+            if (this.dispatcher) {
+                // G-010: bounded and audited (`message.sent` / `message.failed`); never throws.
+                await this.dispatcher.sendEmail('security_notice', message, {
+                    actorId: actor.id,
+                    tenantId: actor.tenantId,
+                });
+                return;
+            }
+            await this.emailSender.send(message);
         }
         catch {
             // Best-effort: the change is committed; a delivery failure must not fail it.
@@ -329,6 +363,8 @@ exports.UserService = UserService = UserService_1 = __decorate([
     __param(7, (0, common_1.Inject)(framework_schemas_token_js_1.IDENTITY_FRAMEWORK_SCHEMAS)),
     __param(8, (0, common_1.Optional)()),
     __param(8, (0, common_1.Inject)(credential_provisioner_token_js_1.IDENTITY_CREDENTIAL_PROVISIONER)),
+    __param(9, (0, common_1.Optional)()),
+    __param(9, (0, common_1.Inject)(guard_1.SHIELD_MESSAGE_DISPATCHER)),
     __metadata("design:paramtypes", [engine_1.RecordsService,
-        grant_ceiling_js_1.GrantCeiling, Object, Object, Object, Object, Object, Object, Object])
+        grant_ceiling_js_1.GrantCeiling, Object, Object, Object, Object, Object, Object, Object, Object])
 ], UserService);

package/dist/index.d.ts

@@ -40,6 +40,13 @@ export { buildIdentityAuthKeys, type IdentityAuthKeys } from './auth-facts-keys.
  * `identityObjects`, and mounts the CRUD controllers — no separate engine setup needed.
  */
 export { IdentityFeatureModule } from './features/identity-feature.module.js';
+/**
+ * G-010: the administrator invite (`POST /identity/users/:uuid/invite`, option
+ * `forRoot({ invite })`) and the computed `signInStatus` on user reads (types only).
+ */
+export type { InviteOptions } from './features/user/invite.config.js';
+export type { InviteResult } from './features/user/invite.service.js';
+export type { SignInStatus, UserRecord } from './features/user/user.service.js';
 /**
  * The org bootstrap (G-009): `runOrgBootstrap(app, { file, apply })` applies a declarative org file
  * (roots, company tree, roles, users, postings) through the framework's own services, as the declared

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACxF;0DAC0D;AAC1D,OAAO,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEpF;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;;GAIG;AACH,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,+CAA+C,CAAC;AAEvD;;;GAGG;AACH,OAAO,EACL,YAAY,EACZ,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,UAAU,GAChB,MAAM,mCAAmC,CAAC;AAU3C;;;GAGG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF;;;;;;;GAOG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACxF;0DAC0D;AAC1D,OAAO,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEpF;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;GAGG;AACH,YAAY,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACtE,YAAY,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACtE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAEhF;;;;GAIG;AACH,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,+CAA+C,CAAC;AAEvD;;;GAGG;AACH,OAAO,EACL,YAAY,EACZ,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,UAAU,GAChB,MAAM,mCAAmC,CAAC;AAU3C;;;GAGG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF;;;;;;;GAOG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC"}

package/dist/user.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.object.d.ts","sourceRoot":"","sources":["../src/user.object.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,qBAuBa,IAAI;IAEf,IAAI,EAAG,MAAM,CAAC;IAGd,QAAQ,EAAG,MAAM,CAAC;IAGlB,KAAK,EAAG,MAAM,CAAC;IAGf,MAAM,EAAG,MAAM,CAAC;IAGhB,SAAS,EAAG,MAAM,CAAC;CACpB"}
+{"version":3,"file":"user.object.d.ts","sourceRoot":"","sources":["../src/user.object.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,qBA0Ba,IAAI;IAEf,IAAI,EAAG,MAAM,CAAC;IAGd,QAAQ,EAAG,MAAM,CAAC;IAGlB,KAAK,EAAG,MAAM,CAAC;IAGf,MAAM,EAAG,MAAM,CAAC;IAGhB,SAAS,EAAG,MAAM,CAAC;CACpB"}