@astram/identity 0.16.0 → 0.17.0

package/dist/branch.object.d.ts

@@ -1,6 +1,14 @@
-/** branches — global catalog. */
+/**
+ * branches — a company's own branches (G-012, spec §4/§5.B). Each row belongs to exactly one
+ * company (`b_company_uuid`, migration `1710000000105-OwnDepartmentsAndBranches`), names are unique
+ * per company, and no row is shared between companies. The owner is stamped server-side from the
+ * reached route company and never changes (`immutable`). Read wall (ADR-0027): a non-root
+ * list/get sees only rows owned by a company in its reachable subtree; a non-root create is
+ * walled the same way (ADR-0034). A legacy row with no owner (NULL) is visible to root only.
+ */
 export declare class Branch {
     uuid: string;
     name: string;
+    companyUuid: string;
 }
 //# sourceMappingURL=branch.object.d.ts.map

package/dist/branch.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"branch.object.d.ts","sourceRoot":"","sources":["../src/branch.object.ts"],"names":[],"mappings":"AAGA,iCAAiC;AACjC,qBAOa,MAAM;IAEjB,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;CACf"}
+{"version":3,"file":"branch.object.d.ts","sourceRoot":"","sources":["../src/branch.object.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,qBAQa,MAAM;IAEjB,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;IAGd,WAAW,EAAG,MAAM,CAAC;CACtB"}

package/dist/branch.object.js

@@ -12,10 +12,18 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Branch = void 0;
 const engine_1 = require("@astram/engine");
 const schema_1 = require("./schema");
-/** branches — global catalog. */
+/**
+ * branches — a company's own branches (G-012, spec §4/§5.B). Each row belongs to exactly one
+ * company (`b_company_uuid`, migration `1710000000105-OwnDepartmentsAndBranches`), names are unique
+ * per company, and no row is shared between companies. The owner is stamped server-side from the
+ * reached route company and never changes (`immutable`). Read wall (ADR-0027): a non-root
+ * list/get sees only rows owned by a company in its reachable subtree; a non-root create is
+ * walled the same way (ADR-0034). A legacy row with no owner (NULL) is visible to root only.
+ */
 let Branch = class Branch {
     uuid;
     name;
+    companyUuid;
 };
 exports.Branch = Branch;
 __decorate([
@@ -26,12 +34,17 @@ __decorate([
     (0, engine_1.Field)({ column: 'b_name', type: 'string', required: true }),
     __metadata("design:type", String)
 ], Branch.prototype, "name", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'b_company_uuid', type: 'uuid', immutable: true }),
+    __metadata("design:type", String)
+], Branch.prototype, "companyUuid", void 0);
 exports.Branch = Branch = __decorate([
     (0, engine_1.ObjectType)({
         typeKey: 'branch',
         table: 'branches',
         schema: schema_1.SCHEMA,
         access: { plane: 'control', system: true },
+        readScope: { kind: 'nodeColumn', column: 'b_company_uuid' },
     }),
     (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'b_uuid' })
 ], Branch);

package/dist/company-branch.object.d.ts

@@ -1,8 +1,9 @@
 /**
- * company_branches — the per-company branch catalog junction (the branch dropdown's
- * option source). Same shape/role as `company_department`: listed by `companyUuid`, each
- * `branchUuid` resolved to a name server-side for the editor's company-scoped Branch
- * dropdown.
+ * company_branches — the company → branch junction. Same shape and role as
+ * `company_department`: since G-012 (migration `1710000000105-OwnDepartmentsAndBranches`) every
+ * branch is owned by one company and has exactly one junction row, to its owner. Read wall
+ * (ADR-0027) on `cb_company_uuid`, so a non-root junction read or write is bounded to the caller's
+ * reachable subtree (create walled too, ADR-0034).
  */
 export declare class CompanyBranch {
     companyUuid: string;

package/dist/company-branch.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company-branch.object.d.ts","sourceRoot":"","sources":["../src/company-branch.object.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,qBAOa,aAAa;IAExB,WAAW,EAAG,MAAM,CAAC;IAGrB,UAAU,EAAG,MAAM,CAAC;CACrB"}
+{"version":3,"file":"company-branch.object.d.ts","sourceRoot":"","sources":["../src/company-branch.object.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,qBAQa,aAAa;IAExB,WAAW,EAAG,MAAM,CAAC;IAGrB,UAAU,EAAG,MAAM,CAAC;CACrB"}

package/dist/company-branch.object.js

@@ -13,10 +13,11 @@ exports.CompanyBranch = void 0;
 const engine_1 = require("@astram/engine");
 const schema_1 = require("./schema");
 /**
- * company_branches — the per-company branch catalog junction (the branch dropdown's
- * option source). Same shape/role as `company_department`: listed by `companyUuid`, each
- * `branchUuid` resolved to a name server-side for the editor's company-scoped Branch
- * dropdown.
+ * company_branches — the company → branch junction. Same shape and role as
+ * `company_department`: since G-012 (migration `1710000000105-OwnDepartmentsAndBranches`) every
+ * branch is owned by one company and has exactly one junction row, to its owner. Read wall
+ * (ADR-0027) on `cb_company_uuid`, so a non-root junction read or write is bounded to the caller's
+ * reachable subtree (create walled too, ADR-0034).
  */
 let CompanyBranch = class CompanyBranch {
     companyUuid;
@@ -37,6 +38,7 @@ exports.CompanyBranch = CompanyBranch = __decorate([
         table: 'company_branches',
         schema: schema_1.SCHEMA,
         access: { plane: 'control', system: true },
+        readScope: { kind: 'nodeColumn', column: 'cb_company_uuid' },
     }),
     (0, engine_1.PrimaryKey)({ kind: 'composite', columns: ['cb_company_uuid', 'cb_branch_uuid'] })
 ], CompanyBranch);

package/dist/company-department.object.d.ts

@@ -1,10 +1,10 @@
 /**
- * company_departments — the per-company department catalog junction (which departments a
- * company offers). Registered (Phase 5, Task 14 seam) so the Assignments editor's
- * company-scoped Department dropdown can be read THROUGH THE PIPE: list this junction by
- * `companyUuid`, then resolve each `departmentUuid` → a display name via `engine.get`
- * (never a raw uuid label). A composite-PK, read-only-through-the-engine catalog; the
- * service only lists it — no create/update from this feature.
+ * company_departments — the company → department junction. Since G-012 (migration
+ * `1710000000105-OwnDepartmentsAndBranches`) every department is owned by one company and has
+ * exactly one junction row, to its owner; the junction stays so existing readers
+ * (`GrantCeiling.assertOrgUnitsInCompany`, the org bootstrap) keep working. A composite-PK type;
+ * read wall (ADR-0027) on `cd_company_uuid`, so a non-root junction read or write is bounded to
+ * the caller's reachable subtree (create walled too, ADR-0034).
  */
 export declare class CompanyDepartment {
     companyUuid: string;

package/dist/company-department.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company-department.object.d.ts","sourceRoot":"","sources":["../src/company-department.object.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,qBAOa,iBAAiB;IAE5B,WAAW,EAAG,MAAM,CAAC;IAGrB,cAAc,EAAG,MAAM,CAAC;CACzB"}
+{"version":3,"file":"company-department.object.d.ts","sourceRoot":"","sources":["../src/company-department.object.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,qBAQa,iBAAiB;IAE5B,WAAW,EAAG,MAAM,CAAC;IAGrB,cAAc,EAAG,MAAM,CAAC;CACzB"}

package/dist/company-department.object.js

@@ -13,12 +13,12 @@ exports.CompanyDepartment = void 0;
 const engine_1 = require("@astram/engine");
 const schema_1 = require("./schema");
 /**
- * company_departments — the per-company department catalog junction (which departments a
- * company offers). Registered (Phase 5, Task 14 seam) so the Assignments editor's
- * company-scoped Department dropdown can be read THROUGH THE PIPE: list this junction by
- * `companyUuid`, then resolve each `departmentUuid` → a display name via `engine.get`
- * (never a raw uuid label). A composite-PK, read-only-through-the-engine catalog; the
- * service only lists it — no create/update from this feature.
+ * company_departments — the company → department junction. Since G-012 (migration
+ * `1710000000105-OwnDepartmentsAndBranches`) every department is owned by one company and has
+ * exactly one junction row, to its owner; the junction stays so existing readers
+ * (`GrantCeiling.assertOrgUnitsInCompany`, the org bootstrap) keep working. A composite-PK type;
+ * read wall (ADR-0027) on `cd_company_uuid`, so a non-root junction read or write is bounded to
+ * the caller's reachable subtree (create walled too, ADR-0034).
  */
 let CompanyDepartment = class CompanyDepartment {
     companyUuid;
@@ -39,6 +39,7 @@ exports.CompanyDepartment = CompanyDepartment = __decorate([
         table: 'company_departments',
         schema: schema_1.SCHEMA,
         access: { plane: 'control', system: true },
+        readScope: { kind: 'nodeColumn', column: 'cd_company_uuid' },
     }),
     (0, engine_1.PrimaryKey)({ kind: 'composite', columns: ['cd_company_uuid', 'cd_department_uuid'] })
 ], CompanyDepartment);

package/dist/department.object.d.ts

@@ -1,6 +1,14 @@
-/** departments — global catalog. */
+/**
+ * departments — a company's own departments (G-012, spec §4/§5.B). Each row belongs to exactly one
+ * company (`d_company_uuid`, migration `1710000000105-OwnDepartmentsAndBranches`), names are unique
+ * per company, and no row is shared between companies. The owner is stamped server-side from the
+ * reached route company and never changes (`immutable`). Read wall (ADR-0027): a non-root
+ * list/get sees only rows owned by a company in its reachable subtree; a non-root create is
+ * walled the same way (ADR-0034). A legacy row with no owner (NULL) is visible to root only.
+ */
 export declare class Department {
     uuid: string;
     name: string;
+    companyUuid: string;
 }
 //# sourceMappingURL=department.object.d.ts.map

package/dist/department.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"department.object.d.ts","sourceRoot":"","sources":["../src/department.object.ts"],"names":[],"mappings":"AAGA,oCAAoC;AACpC,qBAOa,UAAU;IAErB,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;CACf"}
+{"version":3,"file":"department.object.d.ts","sourceRoot":"","sources":["../src/department.object.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,qBAQa,UAAU;IAErB,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;IAGd,WAAW,EAAG,MAAM,CAAC;CACtB"}

package/dist/department.object.js

@@ -12,10 +12,18 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Department = void 0;
 const engine_1 = require("@astram/engine");
 const schema_1 = require("./schema");
-/** departments — global catalog. */
+/**
+ * departments — a company's own departments (G-012, spec §4/§5.B). Each row belongs to exactly one
+ * company (`d_company_uuid`, migration `1710000000105-OwnDepartmentsAndBranches`), names are unique
+ * per company, and no row is shared between companies. The owner is stamped server-side from the
+ * reached route company and never changes (`immutable`). Read wall (ADR-0027): a non-root
+ * list/get sees only rows owned by a company in its reachable subtree; a non-root create is
+ * walled the same way (ADR-0034). A legacy row with no owner (NULL) is visible to root only.
+ */
 let Department = class Department {
     uuid;
     name;
+    companyUuid;
 };
 exports.Department = Department;
 __decorate([
@@ -26,12 +34,17 @@ __decorate([
     (0, engine_1.Field)({ column: 'd_name', type: 'string', required: true }),
     __metadata("design:type", String)
 ], Department.prototype, "name", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'd_company_uuid', type: 'uuid', immutable: true }),
+    __metadata("design:type", String)
+], Department.prototype, "companyUuid", void 0);
 exports.Department = Department = __decorate([
     (0, engine_1.ObjectType)({
         typeKey: 'department',
         table: 'departments',
         schema: schema_1.SCHEMA,
         access: { plane: 'control', system: true },
+        readScope: { kind: 'nodeColumn', column: 'd_company_uuid' },
     }),
     (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'd_uuid' })
 ], Department);

package/dist/features/access/access-admin.access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-admin.access.d.ts","sourceRoot":"","sources":["../../../src/features/access/access-admin.access.ts"],"names":[],"mappings":"AAOA,qBAOa,iBAAiB;CAAG"}
+{"version":3,"file":"access-admin.access.d.ts","sourceRoot":"","sources":["../../../src/features/access/access-admin.access.ts"],"names":[],"mappings":"AAWA,qBAUa,iBAAiB;CAAG"}

package/dist/features/access/access-admin.access.js

@@ -11,6 +11,10 @@ exports.AccessAdminAccess = void 0;
  * `access-admin` — the role-administration seed bundle from design §6. Full role
  * lifecycle (managing roles + the access granted to them). Every key resolves to a
  * REAL registered `identity:<type>:<action>`.
+ *
+ * G-013 (spec §6): roles are owned per company, so every company role route reaches the company
+ * through the walled `company` read first, and the Roles page's company picker lists companies:
+ * the bundle carries `company: read` (the G-012 KI #13 lesson).
  */
 const engine_1 = require("@astram/engine");
 let AccessAdminAccess = class AccessAdminAccess {
@@ -22,6 +26,9 @@ exports.AccessAdminAccess = AccessAdminAccess = __decorate([
         module: 'identity',
         label: 'Access Administration',
         description: 'Manage roles and the access granted to them.',
-        permissions: [{ typeKey: 'role', actions: ['read', 'create', 'update', 'delete'] }],
+        permissions: [
+            { typeKey: 'role', actions: ['read', 'create', 'update', 'delete'] },
+            { typeKey: 'company', actions: ['read'] },
+        ],
     })
 ], AccessAdminAccess);

package/dist/features/access/index.d.ts

@@ -10,6 +10,7 @@ import { UserManagementAccess } from './user-management.access';
 export { UserManagementAccess } from './user-management.access';
 export { CompanyAdminAccess } from './company-admin.access';
 export { AccessAdminAccess } from './access-admin.access';
+export { OrgStructureAccess } from './org-structure.access';
 /** All identity access bundles, collected into the engine at boot. */
 export declare const identityAccessBundles: (typeof UserManagementAccess)[];
 //# sourceMappingURL=index.d.ts.map

package/dist/features/access/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/features/access/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAIhE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,iCAAgE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/features/access/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAKhE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,iCAKjC,CAAC"}

package/dist/features/access/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.identityAccessBundles = exports.AccessAdminAccess = exports.CompanyAdminAccess = exports.UserManagementAccess = void 0;
+exports.identityAccessBundles = exports.OrgStructureAccess = exports.AccessAdminAccess = exports.CompanyAdminAccess = exports.UserManagementAccess = void 0;
 /**
  * Identity access-bundles barrel. Each `@AccessBundle` class is declared in its own
  * `<bundle>.access.ts` (co-located with the feature it grants, per the design's
@@ -12,11 +12,19 @@ exports.identityAccessBundles = exports.AccessAdminAccess = exports.CompanyAdmin
 const user_management_access_1 = require("./user-management.access");
 const company_admin_access_1 = require("./company-admin.access");
 const access_admin_access_1 = require("./access-admin.access");
+const org_structure_access_1 = require("./org-structure.access");
 var user_management_access_2 = require("./user-management.access");
 Object.defineProperty(exports, "UserManagementAccess", { enumerable: true, get: function () { return user_management_access_2.UserManagementAccess; } });
 var company_admin_access_2 = require("./company-admin.access");
 Object.defineProperty(exports, "CompanyAdminAccess", { enumerable: true, get: function () { return company_admin_access_2.CompanyAdminAccess; } });
 var access_admin_access_2 = require("./access-admin.access");
 Object.defineProperty(exports, "AccessAdminAccess", { enumerable: true, get: function () { return access_admin_access_2.AccessAdminAccess; } });
+var org_structure_access_2 = require("./org-structure.access");
+Object.defineProperty(exports, "OrgStructureAccess", { enumerable: true, get: function () { return org_structure_access_2.OrgStructureAccess; } });
 /** All identity access bundles, collected into the engine at boot. */
-exports.identityAccessBundles = [user_management_access_1.UserManagementAccess, company_admin_access_1.CompanyAdminAccess, access_admin_access_1.AccessAdminAccess];
+exports.identityAccessBundles = [
+    user_management_access_1.UserManagementAccess,
+    company_admin_access_1.CompanyAdminAccess,
+    access_admin_access_1.AccessAdminAccess,
+    org_structure_access_1.OrgStructureAccess,
+];

package/dist/features/access/org-structure.access.d.ts

@@ -0,0 +1,3 @@
+export declare class OrgStructureAccess {
+}
+//# sourceMappingURL=org-structure.access.d.ts.map

package/dist/features/access/org-structure.access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-structure.access.d.ts","sourceRoot":"","sources":["../../../src/features/access/org-structure.access.ts"],"names":[],"mappings":"AASA,qBAmBa,kBAAkB;CAAG"}

package/dist/features/access/org-structure.access.js

@@ -0,0 +1,41 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgStructureAccess = void 0;
+/**
+ * `org-structure` (G-012, spec §5.C) — create, rename and delete a company's own departments and
+ * branches, as ONE named unit. `company:read` lets every route reach the company and the page pick
+ * one; the junction reads gate the two list routes, the junction creates the create routes; the posting read lets
+ * the list show `usedBy` (without it the list still answers, with `usedBy` omitted). The delete's
+ * in-use check needs no posting key: it is a complete count inside the service (spec §5.A).
+ */
+const engine_1 = require("@astram/engine");
+let OrgStructureAccess = class OrgStructureAccess {
+};
+exports.OrgStructureAccess = OrgStructureAccess;
+exports.OrgStructureAccess = OrgStructureAccess = __decorate([
+    (0, engine_1.AccessBundle)({
+        key: 'org-structure',
+        module: 'identity',
+        label: 'Org Structure',
+        description: 'Create, rename and delete departments and branches.',
+        permissions: [
+            // `company:read`: every route reaches the company through the walled read first, and the Org
+            // structure page's company picker lists the companies the caller can reach (G-012 live proof).
+            { typeKey: 'company', actions: ['read'] },
+            { typeKey: 'department', actions: ['read', 'create', 'update', 'delete'] },
+            { typeKey: 'branch', actions: ['read', 'create', 'update', 'delete'] },
+            // `create` on the junctions: creating a department or branch also writes its one junction row
+            // through the engine pipe, which gates `identity:company_department|company_branch:create`
+            // (security review P1). Deletes need no junction key: the junction row cascades.
+            { typeKey: 'company_department', actions: ['read', 'create'] },
+            { typeKey: 'company_branch', actions: ['read', 'create'] },
+            { typeKey: 'membership_posting', actions: ['read'] },
+        ],
+    })
+], OrgStructureAccess);

package/dist/features/access/user-management.access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-management.access.d.ts","sourceRoot":"","sources":["../../../src/features/access/user-management.access.ts"],"names":[],"mappings":"AAQA,qBAca,oBAAoB;CAAG"}
+{"version":3,"file":"user-management.access.d.ts","sourceRoot":"","sources":["../../../src/features/access/user-management.access.ts"],"names":[],"mappings":"AAQA,qBAmBa,oBAAoB;CAAG"}

package/dist/features/access/user-management.access.js

@@ -25,9 +25,14 @@ exports.UserManagementAccess = UserManagementAccess = __decorate([
         description: 'Create, edit and assign users to companies.',
         permissions: [
             { typeKey: 'user', actions: ['read', 'create', 'update', 'delete'] },
+            // G-012: the department/branch lists reach the company through the walled company read first.
+            { typeKey: 'company', actions: ['read'] },
             { typeKey: 'role', actions: ['read'] },
             { typeKey: 'department', actions: ['read'] },
             { typeKey: 'branch', actions: ['read'] },
+            // G-012: the posting editor lists a company's departments and branches through these.
+            { typeKey: 'company_department', actions: ['read'] },
+            { typeKey: 'company_branch', actions: ['read'] },
             { typeKey: 'company_membership', actions: ['read', 'create', 'update', 'delete'] },
             { typeKey: 'membership_posting', actions: ['read', 'update'] },
         ],

package/dist/features/audit/audit-read.service.d.ts

@@ -1,7 +1,24 @@
 import type { AuditEvent, LabelResolver } from '@astram/core';
+/**
+ * What kind of actor wrote an audit row (KI #140): a user, a service account (API key), a framework
+ * operation (org bootstrap, audit retention prune), or an id found nowhere (`'unknown'`, shown as
+ * "Deleted user").
+ */
+export type AuditActorKind = 'user' | 'service_account' | 'operation' | 'unknown';
+/** A directory lookup of an actor id: never an operation (those are labelled without a lookup). */
+export interface ResolvedActor {
+    readonly kind: Exclude<AuditActorKind, 'operation'>;
+    readonly label: string;
+}
+/** The actor directory port (`DirectoryLabelResolver` implements it). A throw propagates. */
+export interface ActorLabelResolver {
+    resolveActor(actorId: string): Promise<ResolvedActor>;
+}
 export interface AuditRow {
     readonly occurredAt: number;
     readonly actorLabel: string;
+    /** Additive (KI #140): lets the viewer badge non-user actors. */
+    readonly actorKind: AuditActorKind;
     readonly action: string;
     readonly tenantLabel: string;
     readonly detail: Record<string, unknown>;
@@ -63,7 +80,11 @@ export declare class AuditReadService {
     private readonly reader;
     private readonly labels;
     private readonly actorNameResolver;
-    constructor(reader: PagedAuditReader, labels: LabelResolver, actorNameResolver: ActorNameResolver);
+    /** Absent ⇒ every non-operation actor resolves as a user via `labels` (the pre-KI #140 shape). */
+    private readonly actors?;
+    constructor(reader: PagedAuditReader, labels: LabelResolver, actorNameResolver: ActorNameResolver, 
+    /** Absent ⇒ every non-operation actor resolves as a user via `labels` (the pre-KI #140 shape). */
+    actors?: ActorLabelResolver | undefined);
     /**
      * A numbered (offset + total) audit page. Scope is derived from the PRINCIPAL ALONE — a
      * non-root is pinned to its own tenant (tenantFilter ignored); a root gets the all-tenants
@@ -83,6 +104,16 @@ export declare class AuditReadService {
         page: number;
         limit: number;
     }>;
+    /**
+     * The actor of one row (KI #140). A reserved operation principal (guard's registry) and an
+     * audit-prune row are labelled without any lookup, naming the human operator from the row's own
+     * free text (`onBehalfOf` / the prune actor), never an id; everything else goes to the directory.
+     */
+    private resolveActor;
+    /** A prune row: one of the prune's own types on the platform tenant (`'*'`). */
+    private isAuditPrune;
+    /** Free-text operator name, verbatim; absent, blank or uuid-shaped ⇒ "unknown operator". */
+    private operatorName;
     /**
      * Remove obvious raw-uuid-bearing keys from the attributes detail so no raw id leaks.
      * Keeps non-id fields; drops keys ending in `Uuid`/`Id`/`_uuid`/`_id` and any uuid-shaped value.

package/dist/features/audit/audit-read.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-read.service.d.ts","sourceRoot":"","sources":["../../../src/features/audit/audit-read.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE9D,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,wFAAwF;AACxF,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;IAC5D,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C;AAMD;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,aAAa,EACrB,iBAAiB,EAAE,iBAAiB;IAGvD;;;;;;OAMG;IACG,QAAQ,CACZ,SAAS,EAAE,cAAc,EACzB,OAAO,EAAE;QACP,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GACA,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAkE5E;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAUjB"}
+{"version":3,"file":"audit-read.service.d.ts","sourceRoot":"","sources":["../../../src/features/audit/audit-read.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG9D;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,iBAAiB,GAAG,WAAW,GAAG,SAAS,CAAC;AAElF,mGAAmG;AACnG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,wFAAwF;AACxF,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;IAC5D,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C;AAcD;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,kGAAkG;IAClG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAJP,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,aAAa,EACrB,iBAAiB,EAAE,iBAAiB;IACrD,kGAAkG;IACjF,MAAM,CAAC,EAAE,kBAAkB,YAAA;IAG9C;;;;;;OAMG;IACG,QAAQ,CACZ,SAAS,EAAE,cAAc,EACzB,OAAO,EAAE;QACP,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GACA,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IA2E5E;;;;OAIG;YACW,YAAY;IAmB1B,gFAAgF;IAChF,OAAO,CAAC,YAAY;IAIpB,4FAA4F;IAC5F,OAAO,CAAC,YAAY;IAMpB;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAUjB"}

package/dist/features/audit/audit-read.service.js

@@ -1,8 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuditReadService = void 0;
+const guard_1 = require("@astram/guard");
 const ALL_TENANTS = '*';
 const DEFAULT_LIMIT = 50;
+const UUID_SHAPED = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** `al_type` of the rows `astram-migrate audit:prune` writes (tenant `'*'`, actor = operator). */
+const AUDIT_PRUNE_TYPES = new Set([
+    'audit.retention_prune_started',
+    'audit.retention_pruned',
+]);
+const PLATFORM_TENANT_LABEL = 'Platform';
+const UNKNOWN_OPERATOR = 'unknown operator';
 const MAX_LIMIT = 200;
 /**
  * The audit viewer read-model wrapper (design §2, §3): derives scope from the PRINCIPAL
@@ -15,10 +24,14 @@ class AuditReadService {
     reader;
     labels;
     actorNameResolver;
-    constructor(reader, labels, actorNameResolver) {
+    actors;
+    constructor(reader, labels, actorNameResolver, 
+    /** Absent ⇒ every non-operation actor resolves as a user via `labels` (the pre-KI #140 shape). */
+    actors) {
         this.reader = reader;
         this.labels = labels;
         this.actorNameResolver = actorNameResolver;
+        this.actors = actors;
     }
     /**
      * A numbered (offset + total) audit page. Scope is derived from the PRINCIPAL ALONE — a
@@ -70,26 +83,66 @@ class AuditReadService {
             this.reader.count(scopeQuery),
             this.reader.read({ ...scopeQuery, limit, offset }),
         ]);
-        // Resolve labels DIRECTLY (the core `auditView` engine is no longer in this path): actorLabel
-        // via labels.resolve('principal', ...) and tenantLabel via labels.resolve('tenant', ...) —
-        // same resolver, same no-raw-id guarantee. A resolver throw propagates (fail-closed).
-        const rows = await Promise.all(events.map(async (event) => ({
-            occurredAt: event.occurredAtMs,
-            actorLabel: await this.labels.resolve('principal', event.actorId),
-            action: event.action?.key ??
-                event.action ??
-                '(event)',
-            tenantLabel: await this.labels.resolve('tenant', event.tenantId),
-            detail: this.stripIds(event.attributes ?? {}),
-        })));
+        // Resolve labels DIRECTLY (the core `auditView` engine is no longer in this path): the actor by
+        // kind (operation registry, then the actor directory) and tenantLabel via
+        // labels.resolve('tenant', ...) — no raw id is ever a label. A resolver throw propagates
+        // (fail-closed).
+        const rows = await Promise.all(events.map(async (event) => {
+            const prune = this.isAuditPrune(event);
+            const actor = await this.resolveActor(event, prune);
+            const actionKey = event.action?.key ??
+                event.action;
+            return {
+                occurredAt: event.occurredAtMs,
+                actorLabel: actor.label,
+                actorKind: actor.kind,
+                action: actionKey ?? (prune ? String(event.type) : '(event)'),
+                tenantLabel: event.tenantId === ALL_TENANTS
+                    ? PLATFORM_TENANT_LABEL
+                    : await this.labels.resolve('tenant', event.tenantId),
+                detail: this.stripIds(event.attributes ?? {}),
+            };
+        }));
         return { rows, total, page, limit };
     }
+    /**
+     * The actor of one row (KI #140). A reserved operation principal (guard's registry) and an
+     * audit-prune row are labelled without any lookup, naming the human operator from the row's own
+     * free text (`onBehalfOf` / the prune actor), never an id; everything else goes to the directory.
+     */
+    async resolveActor(event, prune) {
+        const reserved = (0, guard_1.reservedOperationPrincipal)(event.actorId);
+        if (reserved) {
+            const operator = this.operatorName(event.attributes?.['onBehalfOf']);
+            return { kind: 'operation', label: `${reserved.label} (on behalf of ${operator})` };
+        }
+        if (prune) {
+            return {
+                kind: 'operation',
+                label: `Audit retention prune (${this.operatorName(event.actorId)})`,
+            };
+        }
+        if (this.actors)
+            return this.actors.resolveActor(event.actorId);
+        return { kind: 'user', label: await this.labels.resolve('principal', event.actorId) };
+    }
+    /** A prune row: one of the prune's own types on the platform tenant (`'*'`). */
+    isAuditPrune(event) {
+        return event.tenantId === ALL_TENANTS && AUDIT_PRUNE_TYPES.has(String(event.type));
+    }
+    /** Free-text operator name, verbatim; absent, blank or uuid-shaped ⇒ "unknown operator". */
+    operatorName(value) {
+        if (typeof value !== 'string')
+            return UNKNOWN_OPERATOR;
+        const name = value.trim();
+        return name.length === 0 || UUID_SHAPED.test(name) ? UNKNOWN_OPERATOR : name;
+    }
     /**
      * Remove obvious raw-uuid-bearing keys from the attributes detail so no raw id leaks.
      * Keeps non-id fields; drops keys ending in `Uuid`/`Id`/`_uuid`/`_id` and any uuid-shaped value.
      */
     stripIds(attrs) {
-        const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+        const UUID = UUID_SHAPED;
         const out = {};
         for (const [k, val] of Object.entries(attrs)) {
             if (/uuid$|Id$|_id$/i.test(k))

package/dist/features/audit/auth-audit-sink.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The framework default for guard's auth `AuditSink` (R12.1, B-3).
+ *
+ * `IdentityFeatureModule.forRoot` binds it on guard's `SHIELD_DEFAULT_AUTH_AUDIT_SINK`; guard's
+ * `SHIELD_AUDIT_SINK` uses it when the app supplied no `auditSink`. It maps guard's
+ * `AuthAuditEvent` onto the engine `MariaDbAuditSink` row (`<ns>_audit.audit_log`, the table the
+ * G3 sealer chains per tenant, ADR-0044), written with its own autocommit query, outside any
+ * business transaction.
+ *
+ *  - An event without an actor or a tenant is skipped: `audit_log` requires both, and a row must
+ *    be attributable to a tenant chain. (Guard's per-IP lockout and the pre-auth forgot-password
+ *    throttles carry neither; they stay counters.)
+ *  - Best-effort: an error is swallowed. Guard's emit is fire-and-forget, so sign-in never waits
+ *    on, or fails because of, this write.
+ */
+import type { AuditSink } from '@astram/guard';
+import type { MariaDbAuditSink, QueryFn } from '@astram/engine';
+export declare function createDefaultAuthAuditSink(engineSink: Pick<MariaDbAuditSink, 'record'>, query: QueryFn): AuditSink;
+//# sourceMappingURL=auth-audit-sink.d.ts.map

package/dist/features/audit/auth-audit-sink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-audit-sink.d.ts","sourceRoot":"","sources":["../../../src/features/audit/auth-audit-sink.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,SAAS,EAAkB,MAAM,eAAe,CAAC;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhE,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,EAC5C,KAAK,EAAE,OAAO,GACb,SAAS,CAqBX"}

package/dist/features/audit/auth-audit-sink.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDefaultAuthAuditSink = createDefaultAuthAuditSink;
+function createDefaultAuthAuditSink(engineSink, query) {
+    return {
+        async record(event) {
+            if (!event.actorId || !event.tenantId)
+                return;
+            try {
+                await engineSink.record({
+                    type: event.type,
+                    occurredAtMs: event.occurredAtMs,
+                    actorId: event.actorId,
+                    tenantId: event.tenantId,
+                    action: { key: event.action },
+                    ...(event.attributes !== undefined ? { attributes: event.attributes } : {}),
+                }, query);
+            }
+            catch {
+                // Best-effort: an audit write failure never reaches the auth flow.
+            }
+        },
+    };
+}