@astram/identity 0.16.0 → 0.17.0

package/dist/features/user/user.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.controller.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.controller.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAOvD,qBAEa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACV,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;gBADpB,KAAK,EAAE,WAAW,EACN,OAAO,CAAC,EAAE,aAAa,YAAA;IAGtD;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C;;;OAGG;IAGG,UAAU,CACP,GAAG,EAAE,aAAa,EACjB,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;IAY3E;0CACsC;IAGtC,OAAO,CAA0B,IAAI,EAAE,MAAM;IAI7C,iGAAiG;IAG3F,UAAU,CACP,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAUtE;;;;;OAKG;IAIH,UAAU,CACD,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,GACpC,OAAO,CAAC,YAAY,CAAC;IAKxB,0FAA0F;IAGpF,UAAU,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;CAIlF"}
+{"version":3,"file":"user.controller.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.controller.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAC9F,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAOvD,qBAEa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACV,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAFxB,KAAK,EAAE,WAAW,EACN,OAAO,CAAC,EAAE,aAAa,YAAA,EACvB,WAAW,CAAC,EAAE,sBAAsB,YAAA;IAGnE;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C;;;OAGG;IAGG,UAAU,CACP,GAAG,EAAE,aAAa,EAEzB,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IAc9F;0CACsC;IAGtC,OAAO,CAA0B,IAAI,EAAE,MAAM;IAI7C;;;OAGG;IAGG,UAAU,CACP,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAErC,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;;;IAWzF;;;;;OAKG;IAIH,UAAU,CACD,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,GACpC,OAAO,CAAC,YAAY,CAAC;IAKxB;;;;;;;OAOG;IAIH,YAAY,CACH,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE,eAAe,GAC5B,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAI7B,2FAA2F;IAI3F,UAAU,CACD,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE,eAAe,GAC5B,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAI7B,qFAAqF;IAIrF,eAAe,CACN,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE,eAAe,GAC5B,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAI7B,OAAO,CAAC,kBAAkB;IAK1B,0FAA0F;IAGpF,UAAU,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;CAIlF"}

package/dist/features/user/user.controller.js

@@ -17,6 +17,7 @@ const common_1 = require("@nestjs/common");
 const guard_1 = require("@astram/guard");
 const user_service_js_1 = require("./user.service.js");
 const invite_service_js_1 = require("./invite.service.js");
+const user_signin_admin_service_js_1 = require("./user-signin-admin.service.js");
 const list_query_js_1 = require("../shared/list-query.js");
 const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
 // User management is gated on `identity:user:<action>` grants. `user` is CONTROL-plane
@@ -26,9 +27,11 @@ const identity_error_interceptor_js_1 = require("../shared/identity-error.interc
 let UserController = class UserController {
     users;
     invites;
-    constructor(users, invites) {
+    signInAdmin;
+    constructor(users, invites, signInAdmin) {
         this.users = users;
         this.invites = invites;
+        this.signInAdmin = signInAdmin;
     }
     /**
      * List users — gated on `identity:user:read` (see class doc). Server-side DataTable:
@@ -51,6 +54,8 @@ let UserController = class UserController {
             // KI #94: the template form sends it; the service canonicalises and validates it.
             ...(typeof body?.email === 'string' ? { email: body.email } : {}),
             ...(companyUuid !== undefined ? { companyUuid } : {}),
+            // R1.7: optional login name (validated by the service; admin-only route).
+            ...(body?.loginName !== undefined ? { loginName: body.loginName } : {}),
         });
         return result;
     }
@@ -59,12 +64,16 @@ let UserController = class UserController {
     getUser(uuid) {
         return this.users.getUser(uuid);
     }
-    /** Update a user — gated on `identity:user:update`. Only `username`, `email`, `status` apply. */
+    /**
+     * Update a user — gated on `identity:user:update`. Only `username`, `email`, `status` and
+     * `loginName` (R1.7; `null` clears; needs dominance) apply.
+     */
     async updateUser(req, uuid, body) {
         await this.users.updateUser(req.principal, uuid, {
             username: body?.username,
             email: body?.email,
             status: body?.status,
+            loginName: body?.loginName,
         });
         return { success: true };
     }
@@ -79,6 +88,30 @@ let UserController = class UserController {
             throw new Error('UserController: InviteService is not wired');
         return this.invites.invite(req.principal, uuid);
     }
+    /**
+     * Auth capabilities R11 (task 18): admin sign-in controls, each a custom action on `user`
+     * (ADR-0038) with the admin's own TOTP in the body `{ code }`, record-level check and dominance in
+     * the service. 200 `{ success: true }`; 400 `{error:'mfa_required'}` no code, 400
+     * `{error:'invalid_request'}` wrong code, 409 `{error:'mfa_required'}` admin has no 2FA, 403 not
+     * allowed (yourself, no grant, other tenant, not dominated), 429 step-up budget, 503 unavailable
+     * (`{error:'partially_applied', message}` when the action was applied but a later step failed).
+     */
+    resetUserMfa(req, uuid, body) {
+        return this.signInAdminService().resetMfa(req.principal, uuid, body);
+    }
+    /** R11: clear the user's sign-in lockout counters — `identity:user:unlock` (see above). */
+    unlockUser(req, uuid, body) {
+        return this.signInAdminService().unlock(req.principal, uuid, body);
+    }
+    /** R11: end every session of the user — `identity:user:end_sessions` (see above). */
+    endUserSessions(req, uuid, body) {
+        return this.signInAdminService().endSessions(req.principal, uuid, body);
+    }
+    signInAdminService() {
+        if (!this.signInAdmin)
+            throw new Error('UserController: UserSignInAdminService is not wired');
+        return this.signInAdmin;
+    }
     /** Delete a user — gated on `identity:user:delete`; the caller must dominate the user. */
     async deleteUser(req, uuid) {
         await this.users.deleteUser(req.principal, uuid);
@@ -131,6 +164,39 @@ __decorate([
     __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)
 ], UserController.prototype, "inviteUser", null);
+__decorate([
+    (0, common_1.Post)('users/:uuid/reset-mfa'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, guard_1.Classified)({ typeKey: 'user', action: 'reset_mfa' }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, Object]),
+    __metadata("design:returntype", Promise)
+], UserController.prototype, "resetUserMfa", null);
+__decorate([
+    (0, common_1.Post)('users/:uuid/unlock'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, guard_1.Classified)({ typeKey: 'user', action: 'unlock' }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, Object]),
+    __metadata("design:returntype", Promise)
+], UserController.prototype, "unlockUser", null);
+__decorate([
+    (0, common_1.Post)('users/:uuid/end-sessions'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, guard_1.Classified)({ typeKey: 'user', action: 'end_sessions' }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, Object]),
+    __metadata("design:returntype", Promise)
+], UserController.prototype, "endUserSessions", null);
 __decorate([
     (0, common_1.Delete)('users/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'user', action: 'delete' }),
@@ -144,6 +210,8 @@ exports.UserController = UserController = __decorate([
     (0, common_1.Controller)('identity'),
     (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
     __param(1, (0, common_1.Optional)()),
+    __param(2, (0, common_1.Optional)()),
     __metadata("design:paramtypes", [user_service_js_1.UserService,
-        invite_service_js_1.InviteService])
+        invite_service_js_1.InviteService,
+        user_signin_admin_service_js_1.UserSignInAdminService])
 ], UserController);

package/dist/features/user/user.service.d.ts

@@ -1,9 +1,10 @@
 import { RecordsService, type RecordId, type RecordView } from '@astram/engine';
-import type { FrameworkSchemas, Principal } from '@astram/core';
+import { type FrameworkSchemas, type Principal } from '@astram/core';
 import { type EmailAddressChanger, type CredentialProvisioner, type EmailSender, type MessageDispatcher, type ResetTokenStore, type SessionSweeper } from '@astram/guard';
 import { type PostingVersionBump } from '../membership/posting-version-bump.js';
 import { type ListParams } from '../shared/list-query.js';
 import { GrantCeiling } from '../authz/grant-ceiling.js';
+import type { UserMfaStatus, UserMfaStatusReader } from './user-mfa-status.js';
 /** The outcome of {@link UserService.createUserWithCredential}. */
 export type CreateUserResult = {
     id: RecordId;
@@ -18,15 +19,29 @@ export type CreateUserResult = {
  * locked → `pending` (invite-able), usable → `active`, none → `none`. Never any credential data.
  */
 export type SignInStatus = 'pending' | 'active' | 'none';
-/** A user record as `GET /identity/users[/:uuid]` returns it: the engine row plus `signInStatus`. */
+/**
+ * A user record as `GET /identity/users[/:uuid]` returns it: the engine row plus `signInStatus` and
+ * (auth capabilities R11.3) `mfaStatus` — never device names, secrets or counts.
+ */
 export type UserRecord = RecordView & {
     readonly signInStatus?: SignInStatus;
+    readonly mfaStatus?: UserMfaStatus;
 };
 /** The patch keys a generic user update accepts (security hardening #3). */
 export interface UserPatch {
     username?: unknown;
     email?: unknown;
     status?: unknown;
+    /** R1.7: the login name (`null` clears); admin-only, needs dominance. */
+    loginName?: unknown;
+}
+/** The input of {@link UserService.createUserWithCredential}. */
+export interface CreateUserInput {
+    username: string;
+    email?: string | undefined;
+    companyUuid?: string | undefined;
+    /** R1.7: optional login name (normalized and validated; blank ⇒ none). */
+    loginName?: string | null | undefined;
 }
 /**
  * UserService — user (principal) CRUD on the paved road, via the framework's RecordsService facade
@@ -57,6 +72,7 @@ export declare class UserService {
     private readonly emailAddresses?;
     private readonly provisioner?;
     private readonly dispatcher?;
+    private readonly mfaStatus?;
     private readonly logger;
     /**
      * The engine's audit sink, used on the email helper's transaction (no pool of its own), on the
@@ -64,16 +80,12 @@ export declare class UserService {
      * service) ⇒ the sink resolves `SHIELD_DB_NAMESPACE` itself.
      */
     private readonly emailAudit;
-    constructor(records: RecordsService, ceiling: GrantCeiling, resetTokens?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, sessions?: (SessionSweeper | null) | undefined, versionBump?: (PostingVersionBump | null) | undefined, emailAddresses?: (EmailAddressChanger | null) | undefined, schemas?: FrameworkSchemas | null, provisioner?: (CredentialProvisioner | null) | undefined, dispatcher?: (MessageDispatcher | null) | undefined);
+    constructor(records: RecordsService, ceiling: GrantCeiling, resetTokens?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, sessions?: (SessionSweeper | null) | undefined, versionBump?: (PostingVersionBump | null) | undefined, emailAddresses?: (EmailAddressChanger | null) | undefined, schemas?: FrameworkSchemas | null, provisioner?: (CredentialProvisioner | null) | undefined, dispatcher?: (MessageDispatcher | null) | undefined, mfaStatus?: (UserMfaStatusReader | null) | undefined);
     /**
      * Create a user; returns its id. Delegates to {@link createUserWithCredential} (same behaviour;
      * the detailed credential outcome is dropped to keep this public signature stable).
      */
-    createUser(actor: Principal, input: {
-        username: string;
-        email?: string | undefined;
-        companyUuid?: string | undefined;
-    }): Promise<RecordId>;
+    createUser(actor: Principal, input: CreateUserInput): Promise<RecordId>;
     /**
      * Create a user. With `companyUuid`, the user is created AND attached (one active membership) in
      * ONE transaction — the onboarding path for a non-root admin, whose membership create is checked
@@ -89,11 +101,7 @@ export declare class UserService {
      * transaction's own connection; a provisioner failure rolls everything back. Otherwise no
      * credential is created and the result says why (no email takes precedence).
      */
-    createUserWithCredential(actor: Principal, input: {
-        username: string;
-        email?: string | undefined;
-        companyUuid?: string | undefined;
-    }): Promise<CreateUserResult>;
+    createUserWithCredential(actor: Principal, input: CreateUserInput): Promise<CreateUserResult>;
     /**
      * List users (tenant-scoped by the pipe), with paging/search/sort. Each row gains a top-level
      * `signInStatus` (T10), from ONE batched credential read for the page.
@@ -104,10 +112,23 @@ export declare class UserService {
     }>;
     /** Read a single user, with its top-level `signInStatus` (T10). */
     getUser(uuid: string): Promise<UserRecord | null>;
-    /** One `statesOf` call for the given rows; no provisioner (hand-built service) ⇒ rows unchanged. */
+    /**
+     * One `statesOf` call for the given rows (no provisioner, a hand-built service ⇒ no
+     * `signInStatus`), and one batched `mfaStatus` read (R11.3; no reader ⇒ no `mfaStatus`).
+     */
     private withSignInStatus;
+    /** R11.3: the page's `mfaStatus`; a store error is a fixed 503, never a guessed value. */
+    private mfaStatusesOf;
     /** Update a user (whitelisted patch; username/email/status changes need dominance — class doc). */
     updateUser(actor: Principal, uuid: string, patch: UserPatch): Promise<void>;
+    /**
+     * Review round 1, item F: a login name must not equal another principal's legacy sign-in hint
+     * (`identity_credential.ic_identity_hint`, compared under the column's case-insensitive
+     * collation); the sign-in lookup would then match two accounts. Same fixed 409 as a login-name
+     * clash (no new oracle). Read on the write's transaction through guard's credential provisioner;
+     * a hand-built service without one (or a custom provisioner without `hintHolderOf`) skips it.
+     */
+    private assertLoginNameNotAHint;
     /**
      * Phase 12 (KI #14): write a dominated user's new (canonical) email through guard's
      * email-change helper — ONE transaction that locks the user and credential rows, refuses a
@@ -116,6 +137,11 @@ export declare class UserService {
      * (engine shape, fail closed). Reset links are burned BEFORE (a failure aborts the change).
      */
     private changeEmail;
+    /**
+     * R1.7 / R12.2: the `auth.handle.changed` row (type `authentication`) on the write's own
+     * transaction. Actor and target only: no login name (old or new) is written.
+     */
+    private auditHandleChanged;
     /** The helper call with the audit row on its transaction (see {@link changeEmail}). */
     private applyEmailChange;
     /**

package/dist/features/user/user.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAElG,OAAO,KAAK,EAAc,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EASL,KAAK,mBAAmB,EAExB,KAAK,qBAAqB,EAE1B,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAwCzD,mEAAmE;AACnE,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,QAAQ,CAAA;CAAE,GACtC;IACE,EAAE,EAAE,QAAQ,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,gBAAgB,CAAC;CACtD,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEzD,qGAAqG;AACrG,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG;IAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAA;CAAE,CAAC;AAW/E,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,WAAW;IAUpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IACY,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAMtE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAK1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAQhC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAK7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IA1C9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;gBAG3B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAGrB,WAAW,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EACK,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAMzE,QAAQ,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKhC,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAIvC,cAAc,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA,EAI5D,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,EAIhB,WAAW,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAK1C,UAAU,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA;IAKxD;;;OAGG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GACxF,OAAO,CAAC,QAAQ,CAAC;IAIpB;;;;;;;;;;;;;;OAcG;IACG,wBAAwB,CAC5B,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GACxF,OAAO,CAAC,gBAAgB,CAAC;IAqC5B;;;OAGG;IACG,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,UAAU,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAQ7F,mEAAmE;IAC7D,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAMvD,oGAAoG;YACtF,gBAAgB;IAU9B,mGAAmG;IAC7F,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAsCjF;;;;;;OAMG;YACW,WAAW;IAyBzB,uFAAuF;IACvF,OAAO,CAAC,gBAAgB;IA8BxB;;;;;;;;;OASG;YACW,iBAAiB;IAY/B,uDAAuD;IACjD,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/D,6FAA6F;YAC/E,kBAAkB;CA2BjC"}
+{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAElG,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AACtB,OAAO,EASL,KAAK,mBAAmB,EAExB,KAAK,qBAAqB,EAE1B,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAYzD,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAqE/E,mEAAmE;AACnE,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,QAAQ,CAAA;CAAE,GACtC;IACE,EAAE,EAAE,QAAQ,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,gBAAgB,CAAC;CACtD,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEzD;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG;IACpC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;CACpC,CAAC;AAWF,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,iEAAiE;AACjE,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,WAAW;IAUpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IACY,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAMtE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAK1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAQhC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAK7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAI5B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IA9C7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;gBAG3B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAGrB,WAAW,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EACK,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAMzE,QAAQ,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKhC,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAIvC,cAAc,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA,EAI5D,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,EAIhB,WAAW,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAK1C,UAAU,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAIrC,SAAS,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA;IAKzD;;;OAGG;IACG,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC;IAI7E;;;;;;;;;;;;;;OAcG;IACG,wBAAwB,CAC5B,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,gBAAgB,CAAC;IAqD5B;;;OAGG;IACG,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,UAAU,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAQ7F,mEAAmE;IAC7D,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAMvD;;;OAGG;YACW,gBAAgB;IAe9B,0FAA0F;YAC5E,aAAa;IAa3B,mGAAmG;IAC7F,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAwDjF;;;;;;OAMG;YACW,uBAAuB;IAgBrC;;;;;;OAMG;YACW,WAAW;IAyBzB;;;OAGG;YACW,kBAAkB;IAmBhC,uFAAuF;IACvF,OAAO,CAAC,gBAAgB;IA8BxB;;;;;;;;;OASG;YACW,iBAAiB;IAY/B,uDAAuD;IACjD,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/D,6FAA6F;YAC/E,kBAAkB;CA2BjC"}

package/dist/features/user/user.service.js

@@ -17,14 +17,17 @@ exports.UserService = void 0;
 const common_1 = require("@nestjs/common");
 const engine_1 = require("@astram/engine");
 const internal_1 = require("@astram/engine/internal");
+const core_1 = require("@astram/core");
 const guard_1 = require("@astram/guard");
 const posting_version_bump_js_1 = require("../membership/posting-version-bump.js");
 const list_query_js_1 = require("../shared/list-query.js");
 const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
+const http_js_1 = require("../shared/http.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
 const email_address_changer_token_js_1 = require("./email-address-changer.token.js");
 const credential_provisioner_token_js_1 = require("./credential-provisioner.token.js");
 const framework_schemas_token_js_1 = require("../framework-schemas.token.js");
+const signin_admin_tokens_js_1 = require("./signin-admin.tokens.js");
 /**
  * KI #87: `users` has two unique keys besides the PK, `IDX_users_username` (migration 001) and
  * `uq_users_email` (021, `utf8mb4_unicode_ci`: folds case, accents, width, trailing spaces). The
@@ -39,12 +42,32 @@ function isDuplicateKey(err) {
     return e.errno === 1062 || e.code === 'ER_DUP_ENTRY';
 }
 const USERNAME_OR_EMAIL_TAKEN = 'That username or email is already in use.';
+/** Auth capabilities R1.10: the fixed 409 for a login-name clash (never the value, no tenant). */
+const LOGIN_NAME_TAKEN = 'That sign-in name is already in use.';
+/** R1.3: the fixed 400 for a login name outside the rule (never echoes the value). */
+const LOGIN_NAME_INVALID = 'Enter a valid sign-in name: 3–64 characters, letters a–z, digits, dot, underscore or hyphen.';
+/** Migration 103's unique index on `users.u_login_name`. */
+const LOGIN_NAME_INDEX = 'uq_users_login_name';
+/** The audit action for a login-name set / change / clear (R1.7, R12.2). */
+const HANDLE_CHANGED = 'auth.handle.changed';
+/**
+ * The duplicate key is the login-name index. The driver names the key in its message; only that
+ * name is matched (the message itself, which carries the value, is never echoed or logged).
+ */
+function isLoginNameDuplicate(err) {
+    if (!isDuplicateKey(err))
+        return false;
+    const e = err;
+    return [e.sqlMessage, e.message].some((m) => typeof m === 'string' && m.includes(LOGIN_NAME_INDEX));
+}
 /** Run a user write; a duplicate key becomes {@link IdentityConflictError}, all else rethrows. */
 async function mappingDuplicates(write) {
     try {
         return await write();
     }
     catch (err) {
+        if (isLoginNameDuplicate(err))
+            throw new identity_errors_js_1.IdentityConflictError(LOGIN_NAME_TAKEN);
         // R1-4: an orphan credential already holds this login hint (deleteUser leaves it): same fixed
         // 409 as a duplicate email, never the hint.
         if (isDuplicateKey(err) || err instanceof guard_1.CredentialExistsError) {
@@ -53,6 +76,25 @@ async function mappingDuplicates(write) {
         throw err;
     }
 }
+/**
+ * R1.3 / R1.10: the requested login name. `undefined` ⇒ not part of the request; `null` (or a
+ * blank string) ⇒ clear; otherwise the normalized (trim + lower-case) value, which must pass core
+ * `isValidLoginName` (else a fixed 400, before any write).
+ */
+function requestedLoginName(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === null)
+        return null;
+    if (typeof value !== 'string')
+        throw new identity_errors_js_1.IdentityBadRequestError(LOGIN_NAME_INVALID);
+    const name = (0, core_1.normalizeLoginName)(value);
+    if (name === '')
+        return null;
+    if (!(0, core_1.isValidLoginName)(name))
+        throw new identity_errors_js_1.IdentityBadRequestError(LOGIN_NAME_INVALID);
+    return name;
+}
 const SIGN_IN_STATUS = {
     locked: 'pending',
     usable: 'active',
@@ -89,6 +131,7 @@ let UserService = UserService_1 = class UserService {
     emailAddresses;
     provisioner;
     dispatcher;
+    mfaStatus;
     logger = new common_1.Logger(UserService_1.name);
     /**
      * The engine's audit sink, used on the email helper's transaction (no pool of its own), on the
@@ -96,7 +139,7 @@ let UserService = UserService_1 = class UserService {
      * service) ⇒ the sink resolves `SHIELD_DB_NAMESPACE` itself.
      */
     emailAudit;
-    constructor(records, ceiling, resetTokens, emailSender, sessions, versionBump, emailAddresses, schemas, provisioner, dispatcher) {
+    constructor(records, ceiling, resetTokens, emailSender, sessions, versionBump, emailAddresses, schemas, provisioner, dispatcher, mfaStatus) {
         this.records = records;
         this.ceiling = ceiling;
         this.resetTokens = resetTokens;
@@ -106,6 +149,7 @@ let UserService = UserService_1 = class UserService {
         this.emailAddresses = emailAddresses;
         this.provisioner = provisioner;
         this.dispatcher = dispatcher;
+        this.mfaStatus = mfaStatus;
         this.emailAudit = new engine_1.MariaDbAuditSink(schemas ? { schema: schemas.audit } : {});
     }
     /**
@@ -138,9 +182,20 @@ let UserService = UserService_1 = class UserService {
                 throw new identity_errors_js_1.IdentityBadRequestError('Enter a valid email address.');
             fields.email = email;
         }
+        // R1.7: an optional login name, written with the user and audited on the same transaction.
+        const loginName = requestedLoginName(input.loginName) ?? null;
+        if (loginName !== null)
+            fields.loginName = loginName;
         const companyUuid = input.companyUuid;
         if (!companyUuid) {
-            const id = await mappingDuplicates(() => this.records.create('user', { fields }));
+            const id = await mappingDuplicates(() => loginName === null
+                ? this.records.create('user', { fields })
+                : this.records.transaction(async (tx) => {
+                    const created = await tx.create('user', { fields });
+                    await this.assertLoginNameNotAHint(tx, loginName, String(created));
+                    await this.auditHandleChanged(tx, actor, String(created), false);
+                    return created;
+                }));
             return { id, credential: 'none', reason: email === '' ? 'no_email' : 'no_company' };
         }
         const provisioner = this.provisioner;
@@ -150,6 +205,10 @@ let UserService = UserService_1 = class UserService {
             await tx.create('company_membership', {
                 fields: { userUuid: created, companyUuid, isActive: true, status: 'active' },
             });
+            if (loginName !== null) {
+                await this.assertLoginNameNotAHint(tx, loginName, String(created));
+                await this.auditHandleChanged(tx, actor, String(created), false);
+            }
             if (provision) {
                 await provisioner.provisionLocked({ principalId: created, hint: email, tenantId: companyUuid }, (0, internal_1.transactionQueryOf)(tx));
             }
@@ -178,17 +237,38 @@ let UserService = UserService_1 = class UserService {
             return null;
         return (await this.withSignInStatus([record]))[0];
     }
-    /** One `statesOf` call for the given rows; no provisioner (hand-built service) ⇒ rows unchanged. */
+    /**
+     * One `statesOf` call for the given rows (no provisioner, a hand-built service ⇒ no
+     * `signInStatus`), and one batched `mfaStatus` read (R11.3; no reader ⇒ no `mfaStatus`).
+     */
     async withSignInStatus(rows) {
-        const provisioner = this.provisioner;
-        if (rows.length === 0 || provisioner == null)
+        if (rows.length === 0)
             return [...rows];
-        const states = await provisioner.statesOf(rows.map((r) => String(r.id)));
+        const ids = rows.map((r) => String(r.id));
+        const provisioner = this.provisioner;
+        const states = provisioner != null ? await provisioner.statesOf(ids) : null;
+        const mfa = await this.mfaStatusesOf(ids);
         return rows.map((r) => ({
             ...r,
-            signInStatus: SIGN_IN_STATUS[states.get(String(r.id)) ?? 'none'],
+            ...(states !== null
+                ? { signInStatus: SIGN_IN_STATUS[states.get(String(r.id)) ?? 'none'] }
+                : {}),
+            ...(mfa !== null ? { mfaStatus: mfa.get(String(r.id)) ?? 'not_required' } : {}),
         }));
     }
+    /** R11.3: the page's `mfaStatus`; a store error is a fixed 503, never a guessed value. */
+    async mfaStatusesOf(ids) {
+        const reader = this.mfaStatus;
+        if (reader == null)
+            return null;
+        try {
+            return await reader.statusesOf(ids);
+        }
+        catch {
+            this.logger.warn('user mfaStatus could not be read (store error)');
+            throw new identity_errors_js_1.IdentityUnavailableError('Sign-in status is temporarily unavailable. Try again.');
+        }
+    }
     /** Update a user (whitelisted patch; username/email/status changes need dominance — class doc). */
     async updateUser(actor, uuid, patch) {
         const current = await this.records.get('user', uuid);
@@ -214,13 +294,31 @@ let UserService = UserService_1 = class UserService {
         const wantsInactive = typeof patch?.status === 'string' && patch.status !== 'active';
         if (statusChanged)
             fields.status = patch.status;
-        if (usernameChanged || emailChanged || statusChanged || wantsInactive) {
+        // R1.7: the login name is a sign-in identifier like the email: admin-only, under dominance,
+        // audited (`auth.handle.changed`, no names), sessions untouched. Validated before any write.
+        const newLoginName = requestedLoginName(patch?.loginName);
+        const oldLoginName = typeof current.fields.loginName === 'string' && current.fields.loginName !== ''
+            ? (0, core_1.normalizeLoginName)(current.fields.loginName)
+            : null;
+        const loginNameChanged = newLoginName !== undefined && newLoginName !== oldLoginName;
+        if (loginNameChanged)
+            fields.loginName = newLoginName;
+        if (usernameChanged || emailChanged || statusChanged || wantsInactive || loginNameChanged) {
             await this.ceiling.assertDominates(actor, uuid);
         }
         // The email first (the step most likely to be refused, 409), through the ONE helper.
         if (emailChanged)
             await this.changeEmail(actor, uuid, newEmail);
-        if (Object.keys(fields).length > 0) {
+        if (loginNameChanged) {
+            // The field write and its audit row commit together (fail closed).
+            await mappingDuplicates(() => this.records.transaction(async (tx) => {
+                if (newLoginName !== null)
+                    await this.assertLoginNameNotAHint(tx, newLoginName, uuid);
+                await tx.update('user', uuid, { fields });
+                await this.auditHandleChanged(tx, actor, uuid, newLoginName === null);
+            }));
+        }
+        else if (Object.keys(fields).length > 0) {
             await mappingDuplicates(() => this.records.update('user', uuid, { fields }));
         }
         if (statusChanged || wantsInactive)
@@ -228,6 +326,22 @@ let UserService = UserService_1 = class UserService {
         if (emailChanged && oldEmail)
             await this.notifyEmailChanged(actor, oldEmail);
     }
+    /**
+     * Review round 1, item F: a login name must not equal another principal's legacy sign-in hint
+     * (`identity_credential.ic_identity_hint`, compared under the column's case-insensitive
+     * collation); the sign-in lookup would then match two accounts. Same fixed 409 as a login-name
+     * clash (no new oracle). Read on the write's transaction through guard's credential provisioner;
+     * a hand-built service without one (or a custom provisioner without `hintHolderOf`) skips it.
+     */
+    async assertLoginNameNotAHint(tx, loginName, principalId) {
+        const provisioner = this.provisioner;
+        if (provisioner == null || typeof provisioner.hintHolderOf !== 'function')
+            return;
+        const holder = await provisioner.hintHolderOf(loginName, (0, internal_1.transactionQueryOf)(tx));
+        if (holder !== null && !(0, http_js_1.sameUuid)(holder, principalId)) {
+            throw new identity_errors_js_1.IdentityConflictError(LOGIN_NAME_TAKEN);
+        }
+    }
     /**
      * Phase 12 (KI #14): write a dominated user's new (canonical) email through guard's
      * email-change helper — ONE transaction that locks the user and credential rows, refuses a
@@ -260,6 +374,23 @@ let UserService = UserService_1 = class UserService {
         if (outcome.status !== 'changed')
             throw new identity_errors_js_1.IdentityNotFoundError('User not found.');
     }
+    /**
+     * R1.7 / R12.2: the `auth.handle.changed` row (type `authentication`) on the write's own
+     * transaction. Actor and target only: no login name (old or new) is written.
+     */
+    async auditHandleChanged(tx, actor, targetId, cleared) {
+        const query = (0, internal_1.transactionQueryOf)(tx);
+        const event = {
+            type: 'authentication',
+            occurredAtMs: Date.now(),
+            actorId: actor.id,
+            tenantId: actor.tenantId,
+            action: { key: HANDLE_CHANGED },
+            resource: { level: 'record', typeKey: 'user', tenantId: actor.tenantId, recordId: targetId },
+            attributes: { changed: true, cleared },
+        };
+        await this.emailAudit.record(event, (sql, params) => query(sql, params));
+    }
     /** The helper call with the audit row on its transaction (see {@link changeEmail}). */
     applyEmailChange(changer, actor, uuid, newEmail) {
         return changer.change({
@@ -365,6 +496,8 @@ exports.UserService = UserService = UserService_1 = __decorate([
     __param(8, (0, common_1.Inject)(credential_provisioner_token_js_1.IDENTITY_CREDENTIAL_PROVISIONER)),
     __param(9, (0, common_1.Optional)()),
     __param(9, (0, common_1.Inject)(guard_1.SHIELD_MESSAGE_DISPATCHER)),
+    __param(10, (0, common_1.Optional)()),
+    __param(10, (0, common_1.Inject)(signin_admin_tokens_js_1.IDENTITY_MFA_STATUS_READER)),
     __metadata("design:paramtypes", [engine_1.RecordsService,
-        grant_ceiling_js_1.GrantCeiling, Object, Object, Object, Object, Object, Object, Object, Object])
+        grant_ceiling_js_1.GrantCeiling, Object, Object, Object, Object, Object, Object, Object, Object, Object])
 ], UserService);

package/dist/index.d.ts

@@ -15,6 +15,7 @@ export { CompanyDepartment } from './company-department.object.js';
 export { CompanyBranch } from './company-branch.object.js';
 export { ServiceAccount } from './service-account.object.js';
 export { StoredFile } from './stored-file.object.js';
+export { SecurityPolicy } from './security-policy.object.js';
 export { identityMigrationsDir } from './migrations-dir.js';
 /**
  * All identity objects, registered with the engine at boot (same set + order as before).

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACxF;0DAC0D;AAC1D,OAAO,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEpF;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;GAGG;AACH,YAAY,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACtE,YAAY,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACtE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAEhF;;;;GAIG;AACH,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,+CAA+C,CAAC;AAEvD;;;GAGG;AACH,OAAO,EACL,YAAY,EACZ,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,UAAU,GAChB,MAAM,mCAAmC,CAAC;AAU3C;;;GAGG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF;;;;;;;GAOG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACxF;0DAC0D;AAC1D,OAAO,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEpF;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;GAGG;AACH,YAAY,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACtE,YAAY,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACtE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAEhF;;;;GAIG;AACH,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,+CAA+C,CAAC;AAEvD;;;GAGG;AACH,OAAO,EACL,YAAY,EACZ,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,UAAU,GAChB,MAAM,mCAAmC,CAAC;AAU3C;;;GAGG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF;;;;;;;GAOG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DbMembershipChecker = exports.DbScopeSubtreeResolver = exports.AlsSessionFactsReader = exports.FilesService = exports.OrgBootstrapError = exports.runOrgBootstrap = exports.IdentityFeatureModule = exports.buildIdentityAuthKeys = exports.identityControlPlaneKeys = exports.identityAuthActionKeys = exports.identityObjects = exports.identityMigrationsDir = exports.StoredFile = exports.ServiceAccount = exports.CompanyBranch = exports.CompanyDepartment = exports.MembershipPosting = exports.CompanyMembership = exports.Branch = exports.Department = exports.Role = exports.User = exports.Company = void 0;
+exports.DbMembershipChecker = exports.DbScopeSubtreeResolver = exports.AlsSessionFactsReader = exports.FilesService = exports.OrgBootstrapError = exports.runOrgBootstrap = exports.IdentityFeatureModule = exports.buildIdentityAuthKeys = exports.identityControlPlaneKeys = exports.identityAuthActionKeys = exports.identityObjects = exports.identityMigrationsDir = exports.SecurityPolicy = exports.StoredFile = exports.ServiceAccount = exports.CompanyBranch = exports.CompanyDepartment = exports.MembershipPosting = exports.CompanyMembership = exports.Branch = exports.Department = exports.Role = exports.User = exports.Company = void 0;
 /**
  * @astram/identity — the framework-owned identity + tenancy model.
  * The 9 identity object classes (relocated from the consumer app in Sub-plan B) +
@@ -29,6 +29,8 @@ var service_account_object_js_1 = require("./service-account.object.js");
 Object.defineProperty(exports, "ServiceAccount", { enumerable: true, get: function () { return service_account_object_js_1.ServiceAccount; } });
 var stored_file_object_js_1 = require("./stored-file.object.js");
 Object.defineProperty(exports, "StoredFile", { enumerable: true, get: function () { return stored_file_object_js_1.StoredFile; } });
+var security_policy_object_js_1 = require("./security-policy.object.js");
+Object.defineProperty(exports, "SecurityPolicy", { enumerable: true, get: function () { return security_policy_object_js_1.SecurityPolicy; } });
 var migrations_dir_js_1 = require("./migrations-dir.js");
 Object.defineProperty(exports, "identityMigrationsDir", { enumerable: true, get: function () { return migrations_dir_js_1.identityMigrationsDir; } });
 /**

package/dist/objects.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"objects.d.ts","sourceRoot":"","sources":["../src/objects.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAgBtD,6FAA6F;AAC7F,eAAO,MAAM,eAAe,EAAE,SAAS,eAAe,EAerD,CAAC"}
+{"version":3,"file":"objects.d.ts","sourceRoot":"","sources":["../src/objects.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAiBtD,6FAA6F;AAC7F,eAAO,MAAM,eAAe,EAAE,SAAS,eAAe,EAgBrD,CAAC"}

package/dist/objects.js

@@ -15,6 +15,7 @@ const record_share_object_js_1 = require("./record-share.object.js");
 const shared_resource_object_js_1 = require("./shared-resource.object.js");
 const service_account_object_js_1 = require("./service-account.object.js");
 const stored_file_object_js_1 = require("./stored-file.object.js");
+const security_policy_object_js_1 = require("./security-policy.object.js");
 /** All identity objects, registered with the engine at boot (same set + order as before). */
 exports.identityObjects = [
     company_object_js_1.Company,
@@ -31,4 +32,5 @@ exports.identityObjects = [
     shared_resource_object_js_1.SharedResource,
     service_account_object_js_1.ServiceAccount,
     stored_file_object_js_1.StoredFile,
+    security_policy_object_js_1.SecurityPolicy,
 ];

package/dist/role.object.d.ts

@@ -1,4 +1,4 @@
-/** roles — global catalog. */
+/** roles — each role is owned by one company (G-013); names are unique per company. */
 export declare class Role {
     uuid: string;
     name: string;

package/dist/role.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.object.d.ts","sourceRoot":"","sources":["../src/role.object.ts"],"names":[],"mappings":"AAGA,8BAA8B;AAC9B,qBAoBa,IAAI;IAEf,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;IAMd,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAGjC,SAAS,EAAG,MAAM,CAAC;CACpB"}
+{"version":3,"file":"role.object.d.ts","sourceRoot":"","sources":["../src/role.object.ts"],"names":[],"mappings":"AAGA,uFAAuF;AACvF,qBAWa,IAAI;IAEf,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;IAMd,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAGjC,SAAS,EAAG,MAAM,CAAC;CACpB"}