@astram/identity 0.15.0 → 0.17.0

package/dist/features/org-bootstrap/run-org-bootstrap.js

@@ -1,13 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OrgBootstrapError = void 0;
+exports.CLAIM_UNOWNED_NOTICE = exports.OrgBootstrapError = void 0;
 exports.runOrgBootstrap = runOrgBootstrap;
 /**
  * G-009 T10: the org bootstrap runner (SPEC R2, R3, R5-R11, R13; ADR-0042).
  *
  * `runOrgBootstrap(app, opts)` applies a declarative org file against the consumer's own application
- * context, through the framework's existing services, never raw SQL (the exceptions are the role-owner
- * claim and the root flag, both under the run lock and audited). Each step runs as its own principal,
+ * context, through the framework's existing services, never raw SQL (the exception is the root flag,
+ * under the run lock and audited). Each step runs as its own principal,
  * bound to the declared operation `shield:org-bootstrap` (Shield #9): control-plane steps root-flagged,
  * people steps non-root and anchored at one company. The principal reaches the request-scoped services
  * through `registerRequestByContextId`, so no service signature changes.
@@ -27,7 +27,6 @@ const framework_schemas_token_js_1 = require("../framework-schemas.token.js");
 const membership_service_js_1 = require("../membership/membership.service.js");
 const posting_service_js_1 = require("../membership/posting.service.js");
 const org_catalog_service_js_1 = require("../org-structure/org-catalog.service.js");
-const role_owner_transition_js_1 = require("../role/role-owner-transition.js");
 const role_service_js_1 = require("../role/role.service.js");
 const credential_provisioner_token_js_1 = require("../user/credential-provisioner.token.js");
 const user_service_js_1 = require("../user/user.service.js");
@@ -35,6 +34,7 @@ const invite_message_js_1 = require("../user/invite-message.js");
 const org_bootstrap_file_js_1 = require("./org-bootstrap-file.js");
 const org_bootstrap_error_js_1 = require("./org-bootstrap-error.js");
 const org_bootstrap_plan_js_1 = require("./org-bootstrap-plan.js");
+const org_unit_name_js_1 = require("../org-structure/org-unit-name.js");
 const org_bootstrap_manifest_js_1 = require("./org-bootstrap.manifest.js");
 const org_bootstrap_tokens_js_1 = require("./org-bootstrap.tokens.js");
 const org_names_js_1 = require("./org-names.js");
@@ -51,6 +51,8 @@ const STEP = {
     users: 'users',
     postings: 'postings',
 };
+/** Printed when `claimUnownedRoles` is passed (G-013, spec §5.E): the flag now does nothing. */
+exports.CLAIM_UNOWNED_NOTICE = '--claim-unowned-roles is no longer needed: roles belong to the company that declares them.';
 // ---------------------------------------------------------------------------------------------
 function loadFile(file) {
     if (typeof file !== 'string')
@@ -84,11 +86,20 @@ function flatten(file) {
                 company: u.company === undefined ? c.path : `${c.tenant}/${u.company}`,
                 tenant: c.tenant,
                 postings: u.postings ?? [],
+                ...(u.loginName !== undefined ? { loginName: u.loginName } : {}),
             });
         }
     }
     return { companies, users };
 }
+/**
+ * A department/branch name as stored (the shared rule, spec §10). The planner already refused a
+ * name the rule refuses, so the fallback is never written.
+ */
+function orgUnitName(raw) {
+    const n = (0, org_unit_name_js_1.normaliseOrgUnitName)(raw);
+    return n.ok ? n.value : raw;
+}
 const postingPath = (user, company, p) => `user:${user}@${company} role:${p.role}${p.department ? ` dept:${p.department}` : ''}${p.branch ? ` branch:${p.branch}` : ''}`;
 function printPlan(plan, out) {
     for (const e of plan.entries) {
@@ -140,7 +151,9 @@ async function runOrgBootstrap(app, opts) {
         query: async (sql, params) => (await pool.query(sql, params)),
         schemas,
     }).read(file);
-    const planFor = (state) => (0, org_bootstrap_plan_js_1.planOrgBootstrap)(file, state, { claimUnownedRoles: opts.claimUnownedRoles === true });
+    const planFor = (state) => (0, org_bootstrap_plan_js_1.planOrgBootstrap)(file, state);
+    if (opts.claimUnownedRoles === true)
+        out(exports.CLAIM_UNOWNED_NOTICE);
     // ---- dry run: plan only, no lock, no write ----
     if (!apply) {
         const state = await readState();
@@ -348,81 +361,53 @@ async function runOrgBootstrap(app, opts) {
                 count('company');
             }
         });
-        // 2. org units: catalog rows, then the company junctions
+        // 2. org units (G-012): each company's OWN departments and branches. `ensure*` creates the row
+        //    with its owner and its one junction row in one transaction, so both are counted.
         await step(STEP.orgUnits, async () => {
-            const seenDept = new Set();
-            const seenBranch = new Set();
             for (const c of flat.companies) {
                 const actor = await rootAt(STEP.orgUnits, c.tenant);
                 const catalogSvc = await service(org_catalog_service_js_1.OrgCatalogService, actor);
                 for (const d of c.node.departments ?? []) {
-                    if (seenDept.has((0, org_names_js_1.nameKey)(d)))
+                    if (st('department', `${c.path}#dept:${d}`) !== 'create')
                         continue;
-                    seenDept.add((0, org_names_js_1.nameKey)(d));
-                    if (st('department', `dept:${d}`) !== 'create')
-                        continue;
-                    ids.set('department', d, String(await catalogSvc.ensureDepartment(d)));
+                    const companyUuid = await ids.company(c.path);
+                    const id = await catalogSvc.ensureDepartment(companyUuid, orgUnitName(d));
+                    ids.setUnit('department', companyUuid, d, String(id));
                     count('department');
-                }
-                for (const b of c.node.branches ?? []) {
-                    if (seenBranch.has((0, org_names_js_1.nameKey)(b)))
-                        continue;
-                    seenBranch.add((0, org_names_js_1.nameKey)(b));
-                    if (st('branch', `branch:${b}`) !== 'create')
-                        continue;
-                    ids.set('branch', b, String(await catalogSvc.ensureBranch(b)));
-                    count('branch');
-                }
-            }
-            for (const c of flat.companies) {
-                const actor = await rootAt(STEP.orgUnits, c.tenant);
-                const catalogSvc = await service(org_catalog_service_js_1.OrgCatalogService, actor);
-                for (const d of c.node.departments ?? []) {
-                    if (st('company_department', `${c.path}#dept:${d}`) !== 'create')
-                        continue;
-                    await catalogSvc.attachDepartment(await ids.company(c.path), await ids.department(d));
                     count('company_department');
                 }
                 for (const b of c.node.branches ?? []) {
-                    if (st('company_branch', `${c.path}#branch:${b}`) !== 'create')
+                    if (st('branch', `${c.path}#branch:${b}`) !== 'create')
                         continue;
-                    await catalogSvc.attachBranch(await ids.company(c.path), await ids.branch(b));
+                    const companyUuid = await ids.company(c.path);
+                    const id = await catalogSvc.ensureBranch(companyUuid, orgUnitName(b));
+                    ids.setUnit('branch', companyUuid, b, String(id));
+                    count('branch');
                     count('company_branch');
                 }
             }
         });
-        // 3. roles (owner stamped by RoleService), owner claims, then grants through GrantAdminService
+        // 3. roles, then grants through GrantAdminService. G-013 (spec §5.E): each role is created OWNED
+        //    by the company that declares it (passed explicitly: the `roles` step holds no company key).
         await step(STEP.roles, async () => {
-            for (const tenant of file.tenants) {
-                const actor = await rootAt(STEP.roles, tenant.name);
+            for (const c of flat.companies) {
+                const declared = c.node.roles ?? [];
+                if (declared.length === 0)
+                    continue;
+                const actor = await rootAt(STEP.roles, c.tenant);
                 const roles = await service(role_service_js_1.RoleService, actor);
-                const declared = [];
-                const seen = new Set();
-                for (const c of flat.companies.filter((x) => x.tenant === tenant.name)) {
-                    for (const r of c.node.roles ?? []) {
-                        if (seen.has((0, org_names_js_1.nameKey)(r.name)))
-                            continue;
-                        seen.add((0, org_names_js_1.nameKey)(r.name));
-                        declared.push(r);
-                    }
-                }
+                const companyUuid = await ids.company(c.path);
                 for (const r of declared) {
-                    if (st('role', `role:${r.name}`) !== 'create')
+                    if (st('role', (0, org_bootstrap_plan_js_1.rolePath)(c.path, r.name)) !== 'create')
                         continue;
-                    ids.set('role', r.name, String(await roles.createRole(r.name, actor)));
+                    ids.setRole(companyUuid, r.name, String(await roles.createRole(orgUnitName(r.name), actor, companyUuid)));
                     count('role');
                 }
-                for (const r of declared) {
-                    if (st('role_claim', `role:${r.name}`) !== 'create')
-                        continue;
-                    await claimRole(await ids.role(r.name), await ids.company(tenant.name));
-                    count('role_claim');
-                }
                 for (const r of declared) {
                     for (const key of r.permissions) {
-                        if (st('grant', `role:${r.name}#${key}`) !== 'create')
+                        if (st('grant', `${(0, org_bootstrap_plan_js_1.rolePath)(c.path, r.name)}#${key}`) !== 'create')
                             continue;
-                        await grantAdmin.grant(await ids.role(r.name), key, actor);
+                        await grantAdmin.grant(await ids.role(companyUuid, r.name), key, actor);
                         count('grant');
                     }
                 }
@@ -440,6 +425,8 @@ async function runOrgBootstrap(app, opts) {
                 const created = await users.createUserWithCredential(actor, {
                     username: r.username,
                     email: r.email,
+                    // Auth capabilities R1.7: the service validates it again and audits it.
+                    ...(r.loginName !== undefined ? { loginName: r.loginName } : {}),
                 });
                 ids.set('user', r.username, String(created.id));
                 count('user');
@@ -454,6 +441,7 @@ async function runOrgBootstrap(app, opts) {
                     username: u.username,
                     email: u.email,
                     companyUuid,
+                    ...(u.loginName !== undefined ? { loginName: u.loginName } : {}),
                 });
                 ids.set('user', u.username, String(created.id));
                 count('user');
@@ -480,7 +468,7 @@ async function runOrgBootstrap(app, opts) {
             }
         });
         // 5. postings: add-only, as the anchored non-root principal, with the roles the file declares
-        //    for this tenant (and no other tenant's) as `operationRoleIds`.
+        //    on the posting's own company (G-013: the only roles assignable there) as `operationRoleIds`.
         await step(STEP.postings, async () => {
             for (const u of flat.users) {
                 const toAdd = u.postings.filter((p) => st('posting', postingPath(u.username, u.company, p)) === 'create');
@@ -492,23 +480,26 @@ async function runOrgBootstrap(app, opts) {
                 // A read-only lookup, not `listMemberships`: list SQL scoping does not consult gate 7, so an
                 // operation-bound non-root principal could see no rows there (spec P1 "Matching").
                 const membershipUuid = await ids.membership(userUuid, companyUuid);
-                // R1-7: the roles declared on THIS company and its ancestors in the file (the resolution the
-                // file parser uses for postings), not every role of the tenant.
+                // R1-7, G-013: the roles declared on THIS company in the file (the resolution the file
+                // parser uses for postings), never an ancestor's or another company's.
                 const operationRoleIds = new Set();
                 const here = (0, org_names_js_1.pathKey)(u.company);
                 for (const c of flat.companies) {
-                    const there = (0, org_names_js_1.pathKey)(c.path);
-                    if (here !== there && !here.startsWith(`${there}/`))
+                    if ((0, org_names_js_1.pathKey)(c.path) !== here)
                         continue;
-                    for (const r of c.node.roles ?? [])
-                        operationRoleIds.add(await ids.role(r.name));
+                    for (const r of c.node.roles ?? []) {
+                        operationRoleIds.add(await ids.role(companyUuid, r.name));
+                    }
                 }
                 const inputs = [];
                 for (const p of toAdd) {
                     inputs.push({
-                        roleUuid: await ids.role(p.role),
-                        ...(p.department ? { departmentUuid: await ids.department(p.department) } : {}),
-                        ...(p.branch ? { branchUuid: await ids.branch(p.branch) } : {}),
+                        roleUuid: await ids.role(companyUuid, p.role),
+                        // G-012: resolved within the posting's OWN company (the planner refused any other).
+                        ...(p.department
+                            ? { departmentUuid: await ids.department(companyUuid, p.department) }
+                            : {}),
+                        ...(p.branch ? { branchUuid: await ids.branch(companyUuid, p.branch) } : {}),
                     });
                 }
                 const postings = await service(posting_service_js_1.PostingService, actor);
@@ -666,7 +657,7 @@ async function runOrgBootstrap(app, opts) {
             linksPrintedRoots,
             rootIds,
         };
-        // ----- raw writes allowed by the spec (R5, R13), both under the run lock and audited -----
+        // ----- the raw write allowed by the spec (R5), under the run lock and audited -----
         async function inTransaction(work) {
             const conn = await pool.getConnection();
             try {
@@ -684,24 +675,6 @@ async function runOrgBootstrap(app, opts) {
                 await conn.release();
             }
         }
-        async function claimRole(roleUuid, tenantUuid) {
-            const tenantUuids = await Promise.all(file.tenants.map((t) => ids.company(t.name)));
-            await inTransaction(async (conn) => {
-                // R1-8: serialise on the role row, then re-check inside the transaction that nobody outside the
-                // file's tenants holds it (the plan-time read is not enough: it ran before other writers).
-                await conn.query(`SELECT r_uuid FROM \`${schemas.app}\`.\`roles\` WHERE r_uuid = ? FOR UPDATE`, [roleUuid]);
-                const held = (await conn.query(`SELECT 1 AS held FROM \`${schemas.app}\`.\`membership_posting\` mp ` +
-                    `JOIN \`${schemas.app}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid ` +
-                    `WHERE mp.mp_role_uuid = ? AND cm.cm_company_uuid NOT IN (` +
-                    `SELECT sc.descendant_uuid FROM \`${schemas.authz}\`.\`scope_closure\` sc WHERE sc.ancestor_uuid IN (${tenantUuids.map(() => '?').join(', ')})) LIMIT 1`, [roleUuid, ...tenantUuids]));
-                if (held.length > 0) {
-                    const refusal = new Error('role is held outside the file tenants');
-                    refusal.name = 'RoleHeldOutsideError';
-                    throw refusal;
-                }
-                await (0, role_owner_transition_js_1.transitionRoleOwner)((sql, params) => conn.query(sql, params), roleUuid, null, tenantUuid, (action, attributes, query) => auditOn(query, tenantUuid, action, 'roles-claim', { ...attributes }), schemas);
-            });
-        }
         async function setPlatformSuperuser(userUuid, tenantUuid) {
             await inTransaction(async (conn) => {
                 await conn.query(`UPDATE \`${schemas.app}\`.\`users\` SET u_is_platform_superuser = 1 WHERE u_uuid = ?`, [userUuid]);
@@ -725,7 +698,9 @@ class Ids {
         this.schemas = schemas;
     }
     key(kind, name) {
-        return `${kind}\u0000${kind === 'company' ? (0, org_names_js_1.pathKey)(name) : kind === 'membership' ? name : (0, org_names_js_1.nameKey)(name)}`;
+        // membership, department, branch and role names are already composite keys (see `unitName`)
+        const raw = kind === 'membership' || kind === 'department' || kind === 'branch' || kind === 'role';
+        return `${kind}\u0000${kind === 'company' ? (0, org_names_js_1.pathKey)(name) : raw ? name : (0, org_names_js_1.nameKey)(name)}`;
     }
     set(kind, name, id) {
         this.known.set(this.key(kind, name), id);
@@ -756,14 +731,28 @@ class Ids {
         const parent = segments.length > 1 ? await this.company(segments.slice(0, -1).join('/')) : null;
         return this.lookup('company', path, `SELECT c_uuid FROM \`${this.schemas.app}\`.\`companies\` WHERE c_name = ? AND c_parent_uuid <=> ? LIMIT 2`, [name, parent], 'c_uuid');
     }
-    department(name) {
-        return this.lookup('department', name, `SELECT d_uuid FROM \`${this.schemas.app}\`.\`departments\` WHERE d_name = ? LIMIT 2`, [name], 'd_uuid');
+    /** G-012: the cache name of a company's own department/branch (owner + normalised name key). */
+    unitName(companyUuid, name) {
+        return `${companyUuid}\u0000${(0, org_bootstrap_plan_js_1.orgUnitKey)(name)}`;
+    }
+    setUnit(kind, companyUuid, name, id) {
+        this.set(kind, this.unitName(companyUuid, name), id);
+    }
+    /** `companyUuid`'s own department named `name` (normalised; the column collation matches). */
+    department(companyUuid, name) {
+        return this.lookup('department', this.unitName(companyUuid, name), `SELECT d_uuid FROM \`${this.schemas.app}\`.\`departments\` WHERE d_company_uuid = ? AND d_name = ? LIMIT 2`, [companyUuid, orgUnitName(name)], 'd_uuid');
+    }
+    /** `companyUuid`'s own branch named `name`. */
+    branch(companyUuid, name) {
+        return this.lookup('branch', this.unitName(companyUuid, name), `SELECT b_uuid FROM \`${this.schemas.app}\`.\`branches\` WHERE b_company_uuid = ? AND b_name = ? LIMIT 2`, [companyUuid, orgUnitName(name)], 'b_uuid');
     }
-    branch(name) {
-        return this.lookup('branch', name, `SELECT b_uuid FROM \`${this.schemas.app}\`.\`branches\` WHERE b_name = ? LIMIT 2`, [name], 'b_uuid');
+    /** G-013: cache a created role of `companyUuid` (owner + normalised name key). */
+    setRole(companyUuid, name, id) {
+        this.set('role', this.unitName(companyUuid, name), id);
     }
-    role(name) {
-        return this.lookup('role', name, `SELECT r_uuid FROM \`${this.schemas.app}\`.\`roles\` WHERE r_name = ? LIMIT 2`, [name], 'r_uuid');
+    /** `companyUuid`'s own role named `name` (normalised; the column collation matches). */
+    role(companyUuid, name) {
+        return this.lookup('role', this.unitName(companyUuid, name), `SELECT r_uuid FROM \`${this.schemas.app}\`.\`roles\` WHERE r_owner_company_uuid = ? AND r_name = ? LIMIT 2`, [companyUuid, orgUnitName(name)], 'r_uuid');
     }
     user(username) {
         return this.lookup('user', username, `SELECT u_uuid FROM \`${this.schemas.app}\`.\`users\` WHERE u_username = ? LIMIT 2`, [username], 'u_uuid');

package/dist/features/org-structure/org-catalog.controller.d.ts

@@ -1,14 +1,37 @@
+import type { ListQueryDto } from '../shared/list-query.js';
 import { OrgCatalogService } from './org-catalog.service.js';
 export declare class OrgCatalogController {
     private readonly catalog;
     constructor(catalog: OrgCatalogService);
-    /** A company's departments as `{ uuid, name }` options for the posting editor. */
-    listCompanyDepartments(companyUuid: string): Promise<{
-        rows: import("../shared/named-option.js").NamedOption[];
+    /** A company's departments — gated on `identity:company_department:read`. */
+    listCompanyDepartments(companyUuid: string, query: ListQueryDto): Promise<import("./org-catalog.service.js").OrgUnitList>;
+    /** A company's branches — gated on `identity:company_branch:read`. */
+    listCompanyBranches(companyUuid: string, query: ListQueryDto): Promise<import("./org-catalog.service.js").OrgUnitList>;
+    /** Create a department in a company — `identity:department:create` ⇒ 201 `{ uuid, name }`. */
+    createDepartment(companyUuid: string, body: unknown): Promise<{
+        uuid: string;
+        name: string;
     }>;
-    /** A company's branches as `{ uuid, name }` options for the posting editor. */
-    listCompanyBranches(companyUuid: string): Promise<{
-        rows: import("../shared/named-option.js").NamedOption[];
+    /** Create a branch in a company — `identity:branch:create` ⇒ 201 `{ uuid, name }`. */
+    createBranch(companyUuid: string, body: unknown): Promise<{
+        uuid: string;
+        name: string;
+    }>;
+    /** Rename a department — `identity:department:update`. */
+    renameDepartment(uuid: string, body: unknown): Promise<{
+        success: boolean;
+    }>;
+    /** Rename a branch — `identity:branch:update`. */
+    renameBranch(uuid: string, body: unknown): Promise<{
+        success: boolean;
+    }>;
+    /** Delete a department (409 while any posting references it) — `identity:department:delete`. */
+    deleteDepartment(uuid: string): Promise<{
+        success: boolean;
+    }>;
+    /** Delete a branch (409 while any posting references it) — `identity:branch:delete`. */
+    deleteBranch(uuid: string): Promise<{
+        success: boolean;
     }>;
 }
 //# sourceMappingURL=org-catalog.controller.d.ts.map

package/dist/features/org-structure/org-catalog.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"org-catalog.controller.d.ts","sourceRoot":"","sources":["../../../src/features/org-structure/org-catalog.controller.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAU7D,qBAEa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,iBAAiB;IAEvD,kFAAkF;IAG5E,sBAAsB,CAAiC,WAAW,EAAE,MAAM;;;IAKhF,+EAA+E;IAGzE,mBAAmB,CAAiC,WAAW,EAAE,MAAM;;;CAI9E"}
+{"version":3,"file":"org-catalog.controller.d.ts","sourceRoot":"","sources":["../../../src/features/org-structure/org-catalog.controller.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAiB7D,qBAEa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,iBAAiB;IAEvD,6EAA6E;IAG7E,sBAAsB,CACY,WAAW,EAAE,MAAM,EAC1C,KAAK,EAAE,YAAY;IAK9B,sEAAsE;IAGtE,mBAAmB,CACe,WAAW,EAAE,MAAM,EAC1C,KAAK,EAAE,YAAY;IAK9B,8FAA8F;IAGxF,gBAAgB,CACY,WAAW,EAAE,MAAM,EAC3C,IAAI,EAAE,OAAO;;;;IAKvB,sFAAsF;IAGhF,YAAY,CAAiC,WAAW,EAAE,MAAM,EAAU,IAAI,EAAE,OAAO;;;;IAI7F,0DAA0D;IAGpD,gBAAgB,CAA0B,IAAI,EAAE,MAAM,EAAU,IAAI,EAAE,OAAO;;;IAKnF,kDAAkD;IAG5C,YAAY,CAA0B,IAAI,EAAE,MAAM,EAAU,IAAI,EAAE,OAAO;;;IAK/E,gGAAgG;IAG1F,gBAAgB,CAA0B,IAAI,EAAE,MAAM;;;IAK5D,wFAAwF;IAGlF,YAAY,CAA0B,IAAI,EAAE,MAAM;;;CAIzD"}

package/dist/features/org-structure/org-catalog.controller.js

@@ -15,29 +15,63 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.OrgCatalogController = void 0;
 const common_1 = require("@nestjs/common");
 const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
+const identity_errors_js_1 = require("../shared/identity-errors.js");
 const guard_1 = require("@astram/guard");
 const org_catalog_service_js_1 = require("./org-catalog.service.js");
-// ── Company-scoped catalogs (dept/branch option lists for the posting editor) ──
+// ── A company's own departments and branches (G-012, spec §3) ──
 //
-// These back the Assignments editor's company-scoped Department/Branch dropdowns.
-// Each returns `{ rows: [{ uuid, name }] }` — the uuid is the option VALUE the client
-// stores, the name is the display LABEL. Read through the pipe (list the
-// company_department/company_branch junction → resolve each catalog uuid to a name in
-// the service), so no raw uuid is ever a label.
+// The two GETs back the posting editor's dropdowns and the template's Org structure page:
+// `{ rows: [{ uuid, name, usedBy? }], total, page, limit }` — every row (up to the per-company cap)
+// without `?page&limit&search`, one page with them. The writes create, rename and delete a
+// company's own rows. The service reaches the company or row through the subtree wall first (404
+// out of reach) and stamps the owner from the reached company, never from the body.
+/** The body's `name`, as a string only (the service normalises and validates it). */
+function nameFrom(body, kind) {
+    const name = body?.name;
+    if (typeof name !== 'string')
+        throw new identity_errors_js_1.IdentityBadRequestError(`Enter a ${kind} name.`);
+    return name;
+}
 let OrgCatalogController = class OrgCatalogController {
     catalog;
     constructor(catalog) {
         this.catalog = catalog;
     }
-    /** A company's departments as `{ uuid, name }` options for the posting editor. */
-    async listCompanyDepartments(companyUuid) {
-        const rows = await this.catalog.listCompanyDepartments(companyUuid);
-        return { rows };
+    /** A company's departments — gated on `identity:company_department:read`. */
+    listCompanyDepartments(companyUuid, query) {
+        return this.catalog.listCompanyDepartments(companyUuid, query);
     }
-    /** A company's branches as `{ uuid, name }` options for the posting editor. */
-    async listCompanyBranches(companyUuid) {
-        const rows = await this.catalog.listCompanyBranches(companyUuid);
-        return { rows };
+    /** A company's branches — gated on `identity:company_branch:read`. */
+    listCompanyBranches(companyUuid, query) {
+        return this.catalog.listCompanyBranches(companyUuid, query);
+    }
+    /** Create a department in a company — `identity:department:create` ⇒ 201 `{ uuid, name }`. */
+    async createDepartment(companyUuid, body) {
+        return this.catalog.createDepartment(companyUuid, nameFrom(body, 'department'));
+    }
+    /** Create a branch in a company — `identity:branch:create` ⇒ 201 `{ uuid, name }`. */
+    async createBranch(companyUuid, body) {
+        return this.catalog.createBranch(companyUuid, nameFrom(body, 'branch'));
+    }
+    /** Rename a department — `identity:department:update`. */
+    async renameDepartment(uuid, body) {
+        await this.catalog.renameDepartment(uuid, nameFrom(body, 'department'));
+        return { success: true };
+    }
+    /** Rename a branch — `identity:branch:update`. */
+    async renameBranch(uuid, body) {
+        await this.catalog.renameBranch(uuid, nameFrom(body, 'branch'));
+        return { success: true };
+    }
+    /** Delete a department (409 while any posting references it) — `identity:department:delete`. */
+    async deleteDepartment(uuid) {
+        await this.catalog.deleteDepartment(uuid);
+        return { success: true };
+    }
+    /** Delete a branch (409 while any posting references it) — `identity:branch:delete`. */
+    async deleteBranch(uuid) {
+        await this.catalog.deleteBranch(uuid);
+        return { success: true };
     }
 };
 exports.OrgCatalogController = OrgCatalogController;
@@ -45,18 +79,72 @@ __decorate([
     (0, common_1.Get)('companies/:companyUuid/departments'),
     (0, guard_1.Classified)({ typeKey: 'company_department', action: 'read' }),
     __param(0, (0, common_1.Param)('companyUuid', guard_1.UuidPipe)),
+    __param(1, (0, common_1.Query)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String]),
-    __metadata("design:returntype", Promise)
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", void 0)
 ], OrgCatalogController.prototype, "listCompanyDepartments", null);
 __decorate([
     (0, common_1.Get)('companies/:companyUuid/branches'),
     (0, guard_1.Classified)({ typeKey: 'company_branch', action: 'read' }),
     __param(0, (0, common_1.Param)('companyUuid', guard_1.UuidPipe)),
+    __param(1, (0, common_1.Query)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", void 0)
+], OrgCatalogController.prototype, "listCompanyBranches", null);
+__decorate([
+    (0, common_1.Post)('companies/:companyUuid/departments'),
+    (0, guard_1.Classified)({ typeKey: 'department', action: 'create' }),
+    __param(0, (0, common_1.Param)('companyUuid', guard_1.UuidPipe)),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], OrgCatalogController.prototype, "createDepartment", null);
+__decorate([
+    (0, common_1.Post)('companies/:companyUuid/branches'),
+    (0, guard_1.Classified)({ typeKey: 'branch', action: 'create' }),
+    __param(0, (0, common_1.Param)('companyUuid', guard_1.UuidPipe)),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], OrgCatalogController.prototype, "createBranch", null);
+__decorate([
+    (0, common_1.Put)('departments/:uuid'),
+    (0, guard_1.Classified)({ typeKey: 'department', action: 'update' }),
+    __param(0, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], OrgCatalogController.prototype, "renameDepartment", null);
+__decorate([
+    (0, common_1.Put)('branches/:uuid'),
+    (0, guard_1.Classified)({ typeKey: 'branch', action: 'update' }),
+    __param(0, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], OrgCatalogController.prototype, "renameBranch", null);
+__decorate([
+    (0, common_1.Delete)('departments/:uuid'),
+    (0, guard_1.Classified)({ typeKey: 'department', action: 'delete' }),
+    __param(0, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", Promise)
-], OrgCatalogController.prototype, "listCompanyBranches", null);
+], OrgCatalogController.prototype, "deleteDepartment", null);
+__decorate([
+    (0, common_1.Delete)('branches/:uuid'),
+    (0, guard_1.Classified)({ typeKey: 'branch', action: 'delete' }),
+    __param(0, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], OrgCatalogController.prototype, "deleteBranch", null);
 exports.OrgCatalogController = OrgCatalogController = __decorate([
     (0, common_1.Controller)('identity'),
     (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),